Add plural chart to main repo by michaeljguarino · Pull Request #3394 · pluralsh/console

michaeljguarino · 2026-04-09T03:19:04Z

Test Plan

Checklist

If required, I have updated the Plural documentation accordingly.
I have added tests to cover my changes.
I have added a meaningful title and summary to convey the impact of this PR to a user.

Plural Flow: console

greptile-apps · 2026-04-09T03:23:42Z

Greptile Summary

This PR adds the full charts/plural Helm chart to the main console repository, covering API, worker, RTC, WWW, MCP, registry, chartmuseum, and Hydra deployments along with supporting Postgres, RBAC, ingress, cron, and monitoring resources. Several P1 issues were found that would prevent a working deployment:

Five CronJob entries in values.yaml use cronTab (capital T) instead of crontab, producing invalid empty schedules.
SECRET_KEY_BASE falls back to randAlphaNum 24, regenerating on every helm upgrade and invalidating all sessions.
The readinessProbe in both postgres.yaml and hydra-postgres.yaml contains a stray livenessProbe: key (copy-paste artifact), producing invalid sidecar specs that Kubernetes will reject.
The email provider env var in secrets.yaml is misspelled (SENGRID_API_KEY), silently breaking email delivery.
registry.yaml checks .Values.tolerations to guard .Values.registry.tolerations, which can emit a null tolerations block.

Confidence Score: 3/5

Not safe to merge — multiple P1 issues would prevent a working deployment out of the box.

Five distinct P1 defects: invalid cron schedules (half the cron jobs broken), session-destroying secret regeneration, invalid Kubernetes probe specs on both Postgres clusters, a silently broken email integration, and a mismatched toleration guard.

charts/plural/values.yaml, charts/plural/templates/secrets.yaml, charts/plural/templates/postgres.yaml, charts/plural/templates/hydra-postgres.yaml

Vulnerabilities

secrets.yaml: SECRET_KEY_BASE uses randAlphaNum 24 as a fallback — regenerates on every Helm render, causing authentication failures after every upgrade where secrets.key_base is not explicitly set.
rbac.yaml: The plural-shell-role ClusterRole grants wildcard verbs (*) on pods, pods/exec, and pods/status cluster-wide. Intentional for cloud-shell functionality but a significant privilege escalation surface if the plural ServiceAccount is compromised.
networkpolicy.yaml: Egress allows unrestricted outbound traffic to 0.0.0.0/0 (excluding RFC-1918 and link-local), permitting shell pods to reach any public endpoint.

Important Files Changed

Filename	Overview
charts/plural/values.yaml	5 of 10 cron entries use `cronTab` (capital T) instead of `crontab`, causing those CronJobs to render with an empty schedule and fail Kubernetes validation.
charts/plural/templates/secrets.yaml	Two bugs: `SECRET_KEY_BASE` falls back to `randAlphaNum 24` which regenerates on every upgrade invalidating sessions; email provider env var key has a typo (`SENGRID_API_KEY` missing a `D`).
charts/plural/templates/postgres.yaml	Sidecar `readinessProbe` contains a stray `livenessProbe:` key (copy-paste error), making the probe spec invalid and causing Kubernetes to reject the postgresql resource.
charts/plural/templates/hydra-postgres.yaml	Same `readinessProbe` / `livenessProbe` copy-paste error as `postgres.yaml`, producing an invalid sidecar probe spec.
charts/plural/templates/registry.yaml	Toleration guard checks `.Values.tolerations` (top-level) but renders `.Values.registry.tolerations`; mismatched condition can emit a null tolerations block.
charts/plural/templates/deployment.yaml	Adds five Deployments (api, worker, rtc, www, mcp); structure is sound with checksum annotations and topology spread support.
charts/plural/templates/hpa.yaml	Uses deprecated `autoscaling/v2beta2` API which was removed in Kubernetes 1.26+; should be `autoscaling/v2`.
charts/plural/templates/migration.yaml	Defines migration, scan-packages, create-hydra-db, and hydra-migration jobs; logic looks correct with appropriate backoffLimits and restartPolicy.
charts/plural/templates/ingress.yaml	Routes API, RTC, WWW, and registry traffic via nginx ingress with TLS; paths and backends look correct.
charts/plural/templates/rbac.yaml	Creates Role, ClusterRole, ServiceAccount, and bindings; ClusterRole grants wildcard verbs on pods/exec which is intentional for shell access.

_{Reviews (1): Last reviewed commit: "add charts to action" | Re-trigger Greptile}

greptile-apps · 2026-04-09T03:23:45Z

charts/plural/values.yaml

+- cronName: plrl-metering
+  cronModule: Task.Metering
+  cronTab: "30 1 * * *"
+  envVars: []
+- cronName: plrl-digest
+  cronModule: Digest.Pending
+  cronTab: "0 12 * * 1"
+  envVars: []
+- cronName: plrl-prune-cloud-instances
+  cronModule: Prune.Cloud
+  cronTab: "45 1 * * *"
+  envVars: []
+
+hydraSecrets:
+  dsn: memory
+  system: dummy
+  cookie: dummy


cronTab case mismatch breaks 5 cron schedules

The cron template uses .crontab (all lowercase) in schedule: {{ .crontab | quote }}, but five entries here use cronTab (capital T). Helm key lookups are case-sensitive, so .crontab resolves to an empty string for these entries, producing schedule: "" — an invalid cron expression that Kubernetes will reject. Affected crons: plrl-prune-trials, plrl-prune-notifs, plrl-metering, plrl-digest, plrl-prune-cloud-instances.

greptile-apps · 2026-04-09T03:23:46Z

charts/plural/templates/secrets.yaml

+  DKR_DNS: {{ .Values.ingress.dkr_dns | b64enc | quote }}
+  JWT_SECRET: {{ .Values.secrets.jwt | b64enc | quote }}
+  SECRET_KEY_BASE: {{ .Values.secrets.key_base | default (randAlphaNum 24) | b64enc | quote }}
+  ERLANG_COOKIE: {{ .Values.secrets.erlang | b64enc | quote }}


SECRET_KEY_BASE regenerated on every Helm upgrade

randAlphaNum 24 is evaluated fresh on each helm upgrade, so SECRET_KEY_BASE changes whenever .Values.secrets.key_base is not explicitly set. This invalidates all active user sessions on every upgrade. The value must be stable across deployments and should be set explicitly in values or generated once and stored.

greptile-apps · 2026-04-09T03:23:47Z

charts/plural/templates/postgres.yaml

+  labels:
+    spilo-role: master
+    {{ include "plural.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+  - name: http-metrics
+    port: 9187
+    targetPort: http-metrics


Malformed readinessProbe — livenessProbe key is a copy-paste artifact

The readinessProbe block contains a stray livenessProbe: key (null value) as a child field. Kubernetes will reject the sidecar spec because livenessProbe is not a valid field of a probe object. The same issue is present in hydra-postgres.yaml.

greptile-apps · 2026-04-09T03:23:48Z

charts/plural/templates/hydra-postgres.yaml

+        scheme: HTTP
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+      timeoutSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hydra-master
+  labels:


Same readinessProbe / livenessProbe copy-paste error as postgres.yaml

The readinessProbe block contains a stray livenessProbe: key that is not a valid probe field. Kubernetes will reject this sidecar spec.

greptile-apps · 2026-04-09T03:23:49Z

charts/plural/templates/registry.yaml

+{{- end }}
+      {{- with .Values.registry.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}


Toleration guard checks the wrong value

The condition is {{- if .Values.tolerations }} (top-level tolerations), but the rendered value is .Values.registry.tolerations. Because .Values.tolerations is always non-empty in values.yaml, the block is unconditionally emitted. If .Values.registry.tolerations is empty/nil, this renders tolerations: with a null body, producing invalid YAML.

greptile-apps · 2026-04-09T03:23:50Z

charts/plural/templates/secrets.yaml

+{{ end }}
+{{ if .Values.secrets.zoom_client_id }}
+  ZOOM_CLIENT_ID: {{ .Values.secrets.zoom_client_id | b64enc | quote }}


Typo in email provider env var key name

The environment variable is named SENGRID_API_KEY (missing the letter D). If the application reads the correctly-spelled variable name, emails will silently fail even when the corresponding value in .Values.secrets is set.

greptile-apps · 2026-04-09T03:23:51Z

charts/plural/templates/hpa.yaml

+apiVersion: autoscaling/v2beta2
+kind: HorizontalPodAutoscaler
+metadata:


Deprecated autoscaling/v2beta2 API

autoscaling/v2beta2 was removed in Kubernetes 1.26+ (replaced by the stable autoscaling/v2). Using the beta API will fail on modern clusters.

Add plural chart to main repo

d042543

michaeljguarino requested a review from a team April 9, 2026 03:19

michaeljguarino added bug-fix This pull request fixes a bug hotfix labels Apr 9, 2026

add charts to action

babd2e5

michaeljguarino merged commit f9fe71a into master Apr 9, 2026
11 of 12 checks passed

michaeljguarino deleted the vendor-plural-chart branch April 9, 2026 03:20

greptile-apps bot reviewed Apr 9, 2026

View reviewed changes

greptile-apps bot mentioned this pull request Apr 9, 2026

Another chart fix #3396

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add plural chart to main repo#3394

Add plural chart to main repo#3394
michaeljguarino merged 2 commits intomasterfrom
vendor-plural-chart

michaeljguarino commented Apr 9, 2026

Uh oh!

Uh oh!

greptile-apps bot commented Apr 9, 2026

Vulnerabilities

Important Files Changed

Uh oh!

greptile-apps bot Apr 9, 2026

Uh oh!

greptile-apps bot Apr 9, 2026

Uh oh!

greptile-apps bot Apr 9, 2026

Uh oh!

greptile-apps bot Apr 9, 2026

Uh oh!

greptile-apps bot Apr 9, 2026

Uh oh!

greptile-apps bot Apr 9, 2026

Uh oh!

greptile-apps bot Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

michaeljguarino commented Apr 9, 2026

Test Plan

Checklist

Uh oh!

Uh oh!

greptile-apps bot commented Apr 9, 2026

Greptile Summary

Confidence Score: 3/5

Vulnerabilities

Important Files Changed

Uh oh!

greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant