Rename unified chart self-contained profile (#1336)

Rename unified chart self-contained profile

Author: ecolternv

.github/workflows/helm-chart-lint.yaml

@@ -25,6 +25,9 @@ on:
       - 'deployments/charts/**'
       - '.github/workflows/helm-chart-lint.yaml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
@@ -132,11 +135,8 @@ jobs:
               --set-string compute.backendName=test-backend
             helm lint deployments/charts/osmo \
               --kube-version 1.30.0 \
-              -f deployments/charts/osmo/profiles/kind-self-contained.yaml \
-              --set-string compute.backendName=test-backend \
-              --set embeddedDependencies.postgresql.enabled=false \
-              --set externalDependencies.postgresql.host=lint-postgresql \
-              --set secrets.postgresql.existingSecret=lint-postgresql
+              -f deployments/charts/osmo/profiles/self-contained.yaml \
+              -f deployments/charts/osmo/tests/self-contained-lint-values.yaml
           else
             helm lint "deployments/charts/$CHART"
           fi
@@ -167,11 +167,11 @@ jobs:
               -f deployments/charts/osmo/profiles/split-plane-compute.yaml \
               --set-string compute.backendName=test-backend \
               >/dev/null
-            helm template test-kind deployments/charts/osmo \
+            helm template test-self-contained deployments/charts/osmo \
               --kube-version 1.30.0 \
               --api-versions postgresql.cnpg.io/v1 \
-              -f deployments/charts/osmo/profiles/kind-self-contained.yaml \
-              --set-string compute.backendName=test-backend \
+              -f deployments/charts/osmo/profiles/self-contained.yaml \
+              -f deployments/charts/osmo/examples/self-contained-environment-values.yaml \
               >/dev/null
           fi
 

deployments/README.md

@@ -38,8 +38,9 @@ cd scripts
 ./deploy-osmo-minimal.sh --provider aws
 ```
 
-For an existing kind cluster with KAI Scheduler already installed, use the
-unified chart. CloudNativePG remains a separate prerequisite release:
+For a development evaluation, use the unified chart's `quickstart.yaml`
+profile. Kind is the recommended local cluster; KAI Scheduler, CloudNativePG,
+and a default dynamic StorageClass must already be available:
 
 ```bash
 helm repo add cnpg https://cloudnative-pg.github.io/charts
@@ -55,15 +56,28 @@ helm dependency build deployments/charts/osmo
 helm --kube-context kind-osmo upgrade --install osmo deployments/charts/osmo \
   --namespace osmo \
   --create-namespace \
-  --values deployments/charts/osmo/profiles/kind-self-contained.yaml \
+  --values deployments/charts/osmo/profiles/quickstart.yaml \
   --set-string compute.backendName=default \
   --wait \
+  --wait-for-jobs \
   --timeout 20m
 ```
 
-This development profile installs the control and compute planes, PostgreSQL,
-Valkey, and RustFS in one OSMO release and creates their required retained
-credentials and buckets automatically. See
+After the first installation creates the retained master-encryption-key Secret,
+remove the one-time bootstrap Job and Secret-creation permission:
+
+```bash
+helm --kube-context kind-osmo upgrade osmo deployments/charts/osmo \
+  --namespace osmo \
+  --reuse-values \
+  --set secrets.masterEncryptionKey.bootstrap.enabled=false \
+  --wait \
+  --timeout 20m
+```
+
+The quick-start profile installs the control and compute planes, PostgreSQL,
+Valkey, and RustFS in one development OSMO release and creates its credentials
+and buckets automatically. See
 [`charts/osmo/README.md`](charts/osmo/README.md) for readiness checks,
 port-forwarding, hello-world validation, recovery, and split-plane deployment.
 The unified chart owns its listener and worker templates directly. The
@@ -128,11 +142,18 @@ For users who already have Kubernetes infrastructure and want to deploy OSMO dir
 
 📖 **[charts/](charts/)** - Helm chart install guide
 
-The unified kind profile creates its namespace, CloudNativePG database Cluster,
-Valkey and RustFS credentials, retained MEK and backend token Secrets, and
-object-storage buckets. Production and multi-cluster installs instead provide
-external endpoints and Kubernetes Secret references through the control-only
-and compute-only profile contracts.
+The unified self-contained profile is the production converged path for
+hosting OSMO outside a cloud environment. It owns a synchronous three-instance
+CloudNativePG Cluster, replicated Valkey, distributed RustFS, retained MEK and
+backend-token Secrets, and object-storage buckets. The Kubernetes cluster must
+provide KAI Scheduler, the CloudNativePG operator, a default dynamic
+StorageClass, a NetworkPolicy-enforcing CNI, IPv4 cluster CIDRs, and a TLS edge
+for the ClusterIP gateway. Separately, register an OIDC client with an identity
+provider reachable by users and OSMO gateway workloads. The provider may run
+inside or outside the cluster; its tokens must emit OSMO role assignments and
+bootstrap an administrator. The release creates and retains the workflow
+namespace and enables OAuth2, authorization, and network isolation; operators
+supply and test backups.
 
 The legacy deployment scripts require existing infrastructure details:
 

deployments/charts/README.md

@@ -38,6 +38,19 @@ helm --kube-context kind-osmo upgrade --install osmo deployments/charts/osmo \
   --values deployments/charts/osmo/profiles/quickstart.yaml \
   --set-string compute.backendName=default \
   --wait \
+  --wait-for-jobs \
+  --timeout 20m
+```
+
+After the first installation bootstraps the retained master-encryption-key
+Secret, disable its one-time bootstrap Job and Secret-creation permission:
+
+```bash
+helm --kube-context kind-osmo upgrade osmo deployments/charts/osmo \
+  --namespace osmo \
+  --reuse-values \
+  --set secrets.masterEncryptionKey.bootstrap.enabled=false \
+  --wait \
   --timeout 20m
 ```
 
@@ -51,7 +64,56 @@ See the [`osmo` quick-start guide](osmo/README.md#quick-start) for prerequisite
 installation, browser and CLI access, a hello-world workflow, capacity,
 troubleshooting, cleanup, and the profile's non-production limitations.
 
-## Production Shape
+## Self-contained production
+
+Use `profiles/self-contained.yaml` to host the control plane, compute plane,
+PostgreSQL, Valkey, and object storage in one production Kubernetes cluster.
+The cluster must provide KAI Scheduler, the CloudNativePG operator, and a
+default dynamic StorageClass. It must also provide a NetworkPolicy-enforcing
+CNI, at least four schedulable nodes, the cluster network CIDRs, and a TLS edge
+in front of the chart's ClusterIP gateway. The current workflow policy requires
+IPv4 pod and Service CIDRs. Separately, register an OIDC client with an identity
+provider reachable by users and OSMO gateway workloads. The provider may run
+inside or outside Kubernetes. Its tokens must contain an array-valued `roles`
+claim and assign `osmo-admin` to an initial operator. The chart creates and
+retains the workflow namespace and runs OAuth2 authentication plus OSMO
+semantic authorization behind the edge.
+
+```bash
+kubectl create namespace osmo
+kubectl --namespace osmo create secret generic osmo-oauth2-proxy \
+  --from-literal=client_secret='<oidc-client-secret>' \
+  --from-literal=cookie_secret='<32-byte-random-cookie-secret>'
+helm dependency build deployments/charts/osmo
+cp deployments/charts/osmo/examples/self-contained-environment-values.yaml \
+  self-contained-environment-values.yaml
+# Edit self-contained-environment-values.yaml for the target environment.
+helm upgrade --install osmo deployments/charts/osmo \
+  --namespace osmo \
+  --values deployments/charts/osmo/profiles/self-contained.yaml \
+  --values self-contained-environment-values.yaml \
+  --wait \
+  --wait-for-jobs \
+  --timeout 30m
+```
+
+After the first installation bootstraps the retained master-encryption-key
+Secret, persist `secrets.masterEncryptionKey.bootstrap.enabled: false` in the
+environment overlay and apply it. The immediate Helm cleanup transaction is:
+
+```bash
+helm upgrade osmo deployments/charts/osmo \
+  --namespace osmo \
+  --reuse-values \
+  --set secrets.masterEncryptionKey.bootstrap.enabled=false \
+  --wait \
+  --timeout 30m
+```
+
+See the [`osmo` self-contained guide](osmo/README.md#self-contained-production)
+for availability, storage, identity, network-isolation, backup, and edge details.
+
+## Other production shapes
 
 For production, use environment-specific unified chart values or the legacy
 chart interfaces required by an existing deployment:
@@ -65,5 +127,5 @@ chart interfaces required by an existing deployment:
   and compute clusters. Configure the unified chart's
   `secrets.backendApiTokens.credentials[].existingSecret.name`
   and `compute.authentication.existingSecret` to consume the matching Secret.
-  Managed backend-token and MEK generation is intended only for single-cluster
-  development where both planes consume namespace-local Secrets.
+  The self-contained profile can generate these namespace-local Secrets when
+  both planes run in one cluster.