helm-deploy

Deploy sparq with Helm

[GPT-5.6] Verified against deploy/helm/sparq on 2026-07-15. The chart targets Kubernetes 1.20 or later and does not build images. The sparq-server GHCR image is published; the LWS selector becomes runnable only after sq-lmz40 publishes its image.

Preserve the security boundary

Treat these as invariants:

• Keep SPARQ_AUTH_TOKEN in an existing Kubernetes Secret. Never pass a token through Helm values or commit a Secret manifest.
• Keep the built-in Service as ClusterIP. Use the optional ingress-nginx Ingress for public access; it requires a TLS Secret and forces HTTPS redirects.
• Keep the chart's non-root, read-only-root-filesystem, dropped-capability, and disabled-service-account-token settings.
• Use /health on port 3030 for sparq-server; use /livez and /readyz on port 3000 for lws.
• [GPT-5.6] Run exactly one replica of either server. sparq-server has an unreplicated writable in-memory store. The planned canonical LWS image lacks its opt-in Redis replay backend, and Redis alone would not provide a shared blob store.

The sparq-server image is open by default at the image layer because it bakes SPARQ_ALLOW_REMOTE=1. The chart refuses to render that server without an auth Secret. Do not remove the token wiring. The token always gates writes; set auth.requireTokenForReads=true to gate reads too.

Install sparq-server privately

Create the Secret before installing the chart:

kubectl create namespace sparq
kubectl create secret generic sparq-auth-token \
  --namespace sparq \
  --from-literal=SPARQ_AUTH_TOKEN="$(openssl rand -hex 32)"

helm upgrade --install sparq ./deploy/helm/sparq \
  --namespace sparq \
  --set auth.existingSecret=sparq-auth-token

This creates only a ClusterIP Service. Test it over a local port-forward:

kubectl port-forward --namespace sparq svc/sparq 3030:3030
curl http://127.0.0.1:3030/health

Expose sparq-server over HTTPS

Use the built-in Ingress only with ingress-nginx and a pre-provisioned or cert-manager-managed TLS Secret: