Skip to content

Kubernetes Deployment

Deploy Engine services to Kubernetes using the repository overlays.

Basic Deployment

cd engine/deploy
kubectl apply -k overlays/linux-cluster/

Verify Rollout

kubectl get pods -n meshflows
kubectl get svc -n meshflows
kubectl rollout status deployment/orchestrator -n meshflows

Optional: Sync Flows Data PV

Sync flows data into the shared PVC mounted at /app/flows:

cd engine
./scripts/sync-flows-pv.sh meshflows

Required Inputs

  • Namespace and image pull secret.
  • Runtime secrets (JWT, bootstrap credentials, RabbitMQ credentials).
  • Storage class/PVC availability.

Additional Hostnames: Code and Webmail

This repository deploys two additional public hostnames with TLS via the shared Gateway:

  • code.meshflows.org -> Forgejo (namespace forgejo)
  • webmail.meshflows.org -> Roundcube (namespace webmail)

The deploy workflow creates these namespaces automatically and installs:

  • Forgejo via Kubernetes manifests in engine/deploy/overlays/linux-cluster/infra/
  • Roundcube via Helm chart mlohr/roundcube (Artifact Hub)

Required DNS

Create A-records to the same public IP as the existing gateway hostnames:

  • code.meshflows.org
  • webmail.meshflows.org

Optional GitHub Secrets for Roundcube

Roundcube values are parameterized in deploy workflow and can be configured via secrets:

  • ROUNDCUBE_IMAP_HOST
  • ROUNDCUBE_SMTP_HOST
  • ROUNDCUBE_DB_TYPE
  • ROUNDCUBE_DB_HOST
  • ROUNDCUBE_DB_NAME
  • ROUNDCUBE_DB_USER
  • ROUNDCUBE_DB_PASSWORD

Behavior when secrets are absent:

  • IMAP/SMTP default to mail.meshflows.org
  • External DB settings are applied only when all DB secrets are set

Post-Deploy Checks

  • Gateway status endpoint responds.
  • Orchestrator readyz reports loaded workflows/connections/policies.
  • RabbitMQ and storage components are healthy.
  • Workflow/schedule/config files resolve from /app/flows/*.

Upgrade Pattern

  1. Build and push images.
  2. Update image tags in manifests/overlays.
  3. Apply manifests.
  4. Monitor rollout and traces.

Rollback should use deployment history or previous manifest revision.