Deployment: Kubernetes Helm chart + admin docs

[Mtze]

✨ What is the change?

Adds a reusable Helm chart (charts/prompt) to deploy PROMPT 2.0 on Kubernetes, plus a comprehensive admin guide under docs/admin/kubernetes/.

Chart structure:

• Umbrella + one subchart per phase, sharing a prompt-common library chart (Deployment/Service/HTTPRoute + helpers) so the ~14 near-identical components stay DRY.
• infrastructure subchart: CloudNativePG Cluster (one logical database per phase, managed roles, PgBouncer pooler, optional WAL + scheduled backups), SeaweedFS object storage, Gateway API + Envoy Gateway with per-listener cert-manager TLS, and optional in-cluster Keycloak (operator + realm import).
• Shared app ConfigMap + Secret (envFrom) and per-phase DB Secrets mirror the existing .env contract, so no application code changes are needed.

Every stateful dependency is pluggable between an in-cluster bundle (self-contained installs) and an external managed service (production): postgresql.mode, objectStorage.mode, keycloak.mode.

📌 Reason for the change

Enables institutions running Kubernetes to deploy PROMPT alongside the existing Docker Compose path. Defaults favour TUM AET but the chart is built to be reusable by other chairs.

Design hardening folded in from review: Helm lookup so DB passwords survive upgrades, roles declared on the CNPG cluster, connection pooling, per-listener TLS (no multi-SAN blast radius), Envoy rate-limit gated behind a toggle, S3 CORS + Host-header preservation for presigned URLs, DB-wait init containers.

🧪 How to Test

1. helm lint charts/prompt (passes).
2. helm template prompt charts/prompt renders cleanly; verify counts (15 Deployments, 6 Databases, 3 SeaweedFS StatefulSets, per-listener Gateway).
3. Render mode combinations: --set global.postgresql.mode=external, --set global.objectStorage.mode=external, --set global.keycloak.mode=in-cluster, and --set <phase>.enabled=false.
4. cd docs && yarn build succeeds with the new admin pages.
5. On-cluster (not yet performed): install the prerequisite operators on kind/minikube, helm install, then verify TLS issuance, login, and a presigned upload (see docs/admin/kubernetes).

✅ PR Checklist

• Tested locally (helm lint / helm template / docs yarn build)
• Code is clean, readable, and documented
• Tests added or updated (if needed)
• Screenshots attached for UI changes (if any) — n/a
• Documentation updated (admin Kubernetes guide)

Draft: validated statically only. A runtime apply against a cluster with the prerequisite operators (CloudNativePG, Envoy Gateway, cert-manager, Keycloak) is still pending.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 999353cb-48ff-4a19-b477-767394d3af5e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/helm-deployment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}