Kubernetes

Veckl deploys through the charts/veckl Helm chart, which renders both the backend and frontend workloads:

• Backend service on port 8080.
• Frontend service on port 3000.

The chart lives in charts/veckl/. See charts/veckl/README.md for the full values reference, secret-handling options, NetworkPolicy caveats, and Ingress controller notes.

Build Images

Build both images:

make container-build
make container-build-frontend

Make the images available to your cluster. Push them to a registry or load them into the cluster runtime according to your platform.

Install the Chart

Install with your GitHub App and OAuth configuration:

helm install veckl charts/veckl \
  --namespace veckl --create-namespace \
  --set config.githubOwner=my-org \
  --set config.githubRepo=security-test-cases \
  --set config.githubAppId=123456 \
  --set config.githubAppInstallationId=78901234 \
  --set config.githubOAuthClientId=Iv1.abcdef1234567890 \
  --set secrets.githubOAuthClientSecret=<oauth-client-secret> \
  --set-file secrets.githubAppPrivateKey=./github-app-private-key.pem \
  --set ingress.host=veckl.example.com

--set-file reads the GitHub App private key’s raw file bytes, preserving the PEM’s newlines exactly - prefer this over pasting a PEM into a values file by hand.

Session signing keys (secrets.sessionHashKey / secrets.sessionBlockKey) are generated automatically on first install and preserved across future helm upgrade runs against the same release - do not delete the release’s Secret, or every logged-in user will be signed out.

For a quick local/dev install with auth disabled and no Ingress:

helm install veckl charts/veckl \
  --namespace veckl --create-namespace \
  --set config.disableAuth=true \
  --set ingress.enabled=false

Never set config.disableAuth=true outside of a local/dev/test install.

Open Veckl

Use your configured Ingress host. If you are not using Ingress yet, port-forward the frontend:

kubectl port-forward -n veckl service/veckl-frontend 3000:3000

Open:

http://localhost:3000

OAuth Callback

For production, configure the OAuth App callback URL with the public browser origin:

https://<your-veckl-host>/auth/github/callback

The callback must route back to the same origin users open in their browser.

Ingress Controllers

ingress.className defaults to empty, which resolves to whichever IngressClass the cluster marks as default:

• k3s ships Traefik pre-installed as the default class - this works out of the box.
• Vanilla/kubeadm clusters ship no Ingress controller by default - install one and mark it default, or set ingress.className explicitly (e.g. nginx).

Custom GHES CA Bundle

If GHES uses a private CA, supply the PEM content via secrets.caBundle (or include the matching key in your own secrets.existingSecret). The chart mounts it and sets GITHUB_CA_BUNDLE_PATH for you automatically once secrets.caBundle is set - see charts/veckl/README.md for details.

Secret Management Options

Use either secrets.create=true (default, the chart renders its own Secret) or secrets.existingSecret=<name> to point at a Secret managed by External Secrets Operator, Sealed Secrets, or your own tooling. See charts/veckl/README.md for the full decision tree.