feat(helm): add Helm chart for Kubernetes deployment

WW
4mo ago
+1259-3

Summary

Adds a Helm chart under charts/vane to deploy Vane on Kubernetes. A single variant value selects the official image, so both published images are covered by one chart:

variantImageSearXNG
full (default)itzcrazykns1337/vane:latestbundled inside the image
slimitzcrazykns1337/vane:slim-latestdeployed by the chart (searxng.deploy=true) or external (searxng.url)

What's included

  • Vane workload: Deployment, Service, ServiceAccount, optional Ingress and HPA
  • Persistence: PVCs for the config/SQLite database (/home/vane/data) and uploads (/home/vane/uploads)
  • Optional in-cluster SearXNG (slim only): Deployment/Service/Secret generated from the repo's searxng/settings.yml (JSON format + Wolfram Alpha engine enabled), with a stable auto-generated secret_key, wired to Vane through SEARXNG_API_URL
  • Probes (liveness/readiness/startup), resource limits and scheduling controls (nodeSelector/tolerations/affinity)
  • values.schema.json for install-time validation of the values
  • Security default: automountServiceAccountToken: false
  • Guardrails (fail) for an invalid variant or a slim install with no search backend

Usage

# Full image (Vane + bundled SearXNG) — recommended default
helm install vane ./charts/vane

# Slim image with a chart-managed SearXNG
helm install vane ./charts/vane --set variant=slim --set searxng.deploy=true

# Slim image with an existing SearXNG instance
helm install vane ./charts/vane \
  --set variant=slim --set searxng.deploy=false \
  --set searxng.url=http://my-searxng:8080

See charts/vane/README.md for the full list of options.

Notes / tradeoffs

  • The image tag defaults to the floating latest / slim-latest tags; override image.tag to pin a release such as 1.12.2 / slim-1.12.2.
  • No enforced non-root securityContext by default: the full image starts SearXNG via sudo and both images run as root, so hardening is left configurable rather than forced.
  • Vane stores its config and history in a local SQLite database on a ReadWriteOnce volume, so the chart defaults to replicaCount: 1 with a Recreate strategy.

Validation

  • helm lint passes for full, slim + in-cluster SearXNG, and slim + external SearXNG
  • helm template renders valid manifests in all three modes; the JSON schema rejects invalid values (unknown keys, wrong types, out-of-range ports, invalid variant)
  • prettier clean — chart templates are excluded from Prettier via .prettierignore because Go templating conflicts with it

Summary by cubic

Add a Helm chart to deploy Vane on Kubernetes, supporting both full and slim images via a single variant switch. This makes K8s installs simple, with optional in-cluster SearXNG, persistence, and basic ops features.

  • New Features
    • Chart added under charts/vane with variant=full|slim; slim supports in-cluster or external SearXNG.
    • Core resources: Deployment, Service, optional Ingress and HPA, ServiceAccount with automountServiceAccountToken=false.
    • Persistence: PVCs for /home/vane/data and /home/vane/uploads.
    • Slim SearXNG: deploys searxng/searxng (JSON format + Wolfram Alpha enabled) with a stable auto-generated secret_key, or use searxng.url.
    • Probes and controls: liveness/readiness/startup probes; nodeSelector/tolerations/affinity.
    • Validation: values.schema.json and guardrails for invalid variant or slim without a search backend.
    • Docs/tooling: README adds Helm install steps; .prettierignore excludes Helm templates.