feat(helm-chart): add helm-chart

[yod527]

A production-oriented Helm chart for the self-hosted API:

• Deployment
• Service
• HPA
• PDB
• Ingress
• API-key Secret
• non-root securityContext
• probes on /healthcheck,
• well-tested resource defaults

#583

[cubic-dev-ai]

2 issues found across 14 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="charts/unstructured-api/templates/deployment.yaml">

<violation number="1" location="charts/unstructured-api/templates/deployment.yaml:43">
P1: Rolling updates can still kill in-flight requests instead of using the configured 120-second drain period: the image entrypoint does not forward Kubernetes termination signals from the shell to Uvicorn. Updating the entrypoint to `exec` Uvicorn or using a signal-forwarding init would make this grace period effective.</violation>

<violation number="2" location="charts/unstructured-api/templates/deployment.yaml:71">
P2: When `config.allowedOrigins` and `apiKey.enabled` are used together, browser clients cannot use the documented API-key header because the CORS preflight disallows `unstructured-api-key`. Including that header in the application’s CORS allow-list (or making the chart’s CORS configuration cover it) would keep these features compatible.</violation>
</file>

<sub>Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Rolling updates can still kill in-flight requests instead of using the configured 120-second drain period: the image entrypoint does not forward Kubernetes termination signals from the shell to Uvicorn. Updating the entrypoint to exec Uvicorn or using a signal-forwarding init would make this grace period effective.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At charts/unstructured-api/templates/deployment.yaml, line 43:

<comment>Rolling updates can still kill in-flight requests instead of using the configured 120-second drain period: the image entrypoint does not forward Kubernetes termination signals from the shell to Uvicorn. Updating the entrypoint to `exec` Uvicorn or using a signal-forwarding init would make this grace period effective.</comment>

<file context>
@@ -0,0 +1,160 @@
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      containers:
+        - name: {{ .Chart.Name }}
</file context>

[yod527]

out of helm chart scope, probably there is a need to consider something like tini on Docker-image level

[cubic-dev-ai]

P2: When config.allowedOrigins and apiKey.enabled are used together, browser clients cannot use the documented API-key header because the CORS preflight disallows unstructured-api-key. Including that header in the application’s CORS allow-list (or making the chart’s CORS configuration cover it) would keep these features compatible.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At charts/unstructured-api/templates/deployment.yaml, line 71:

<comment>When `config.allowedOrigins` and `apiKey.enabled` are used together, browser clients cannot use the documented API-key header because the CORS preflight disallows `unstructured-api-key`. Including that header in the application’s CORS allow-list (or making the chart’s CORS configuration cover it) would keep these features compatible.</comment>

<file context>
@@ -0,0 +1,160 @@
+            {{- end }}
+            {{- if .Values.config.allowedOrigins }}
+            - name: ALLOWED_ORIGINS
+              value: {{ .Values.config.allowedOrigins | quote }}
+            {{- end }}
+            {{- if .Values.config.maxLifetimeSeconds }}
</file context>

[yod527]

the cause is prepline_general/api/app.py: allow_headers=["Content-Type"] omits unstructured-api-key, so browser preflight probably rejects it.

[cubic-dev-ai]

All reported issues were addressed across 14 files (changes from recent commits).

<sub>Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Shadow auto-approve: would not auto-approve. Auto-approval blocked by 2 unresolved issues from previous reviews.

Re-trigger cubic</sub>