Kubernetes

The Kubernetes deployment runs Veckl as two services:

• Backend service on port 8080.
• Frontend service on port 3000.

The manifests live in k8s/.

Build Images

Build both images:

make container-build
make container-build-frontend

Make the images available to your cluster. Push them to a registry or load them into the cluster runtime according to your platform.

Create the Secret

Copy the secret template:

cp k8s/secret-template.yaml k8s/secret.yaml

Fill in the values in k8s/secret.yaml. Do not commit this file.

Apply the namespace and secret:

kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/secret.yaml -n veckl

Deploy Services

Apply the backend, frontend, services, and ingress:

kubectl apply -f k8s/deployment.yaml -n veckl
kubectl apply -f k8s/service.yaml -n veckl
kubectl apply -f k8s/deployment-frontend.yaml -n veckl
kubectl apply -f k8s/service-frontend.yaml -n veckl
kubectl apply -f k8s/ingress.yaml -n veckl

Open Veckl

Use your configured Ingress host. If you are not using Ingress yet, port-forward the frontend:

kubectl port-forward -n veckl service/veckl-frontend 3000:3000

Open:

http://localhost:3000

OAuth Callback

For production, configure the OAuth App callback URL with the public browser origin:

https://<your-veckl-host>/auth/github/callback

The callback must route back to the same origin users open in their browser.

Custom GHES CA Bundle

If GHES uses a private CA:

1. Add the CA bundle to the Kubernetes secret.
2. Mount it into the backend deployment.
3. Set GITHUB_CA_BUNDLE_PATH to the mounted path.

The secret template includes notes for this path.