Helm Chart - apowerb by thaink2

The chart deploys the backend, the interface and PostgreSQL, plus the three services the Compose stack runs — each behind a switch — and a volume for what the backend writes to disk.

Component	Default	Switch
backend, interface, PostgreSQL	on	—
`th2etl` + its seed `Job`	on	`th2etl.enabled`
`th2pulse` (log store)	on	`th2pulse.enabled`
OpenTelemetry collector	on	`otelCollector.enabled`
`PersistentVolumeClaim` on `/data`	on	`persistence.enabled`

Install

Three secrets have to exist first. The chart refuses to install without the two th2pulse tokens — that service does not start without them, so failing at install time is the honest moment to say it.

helm upgrade --install apowerb ./helm/apowerb-chart \
  --namespace apowerb --create-namespace \
  --set backend.env.encryptKey="$(openssl rand -base64 32)" \
  --set th2etl.apiKey="$(openssl rand -hex 32)" \
  --set th2pulse.ingestToken="$(openssl rand -hex 32)" \
  --set th2pulse.queryToken="$(openssl rand -hex 32)" \
  --set postgres.password="$(openssl rand -hex 16)"

Keep those values. A later helm upgrade without them rewrites the Secret with empty strings — and ENCRYPT_KEY changing makes every connected integration unreadable. Put them in a values-secrets.yaml kept out of version control and pass it with --values.

From the published chart

helm install apowerb oci://registry-1.docker.io/apowerb/apowerb-chart --version 0.4.12

The chart moved to its own Docker Hub repository. It used to be pushed to apowerb/apowerb, alongside the backend images — a repository cannot be subdivided there, and helm push names it after the chart. Versions 0.2.0 and 0.4.0 stay where they were published; nothing was deleted. Anythingfrom 0.4.1 on lives at apowerb/apowerb-chart.

This chart has been validated by helm lint and kubeconform, and installed on no cluster yet. Treat the first helm install as the real test.

Storage

persistence.enabled claims one volume, mounts it on persistence.mountPath (/data) and points RUNTIME_ROOT at it. Everything the backend writes lives under it: bi_store, uploads, artifacts_store, agents_pool.

Without it, an imported CSV is gone at the next restart of the backend pod, and the dashboard reading it dies with it. agents_pool is the exception — it is regenerated from the database.
The claim is ReadWriteOnce, so the backend stays at one replica unless the storage class offers ReadWriteMany.
It carries helm.sh/resource-policy: keep: helm uninstall leaves the files behind rather than deleting them with the release.

Configuring S3 makes BI files bypass the disk entirely.

The seed is a Job

th2etl-seed posts the default pipelines and exits. It runs as a post-install,post-upgrade hook and retries while th2etl migrates the database. As a Deployment, Kubernetes would restart a container that exited 0 — a crash loop on a success.

kubectl -n apowerb logs job/apowerb-th2etl-seed

A smaller stack

Nothing beyond the product itself is mandatory:

helm upgrade --install apowerb ./helm/apowerb-chart \
  --set th2etl.enabled=false \
  --set th2pulse.enabled=false \
  --set otelCollector.enabled=false \
  --set backend.env.encryptKey="$(openssl rand -base64 32)"

Seven objects instead of sixteen. The interface then reports those features as not configured instead of failing on them — see What needs configuring.

Ingress and TLS

The interface is reached through the Ingress: since 0.4.0 the frontend Service is a ClusterIP, not a LoadBalancer — no provider load balancer, and no public IP billed for it.

helm upgrade --install apowerb oci://registry-1.docker.io/apowerb/apowerb-chart --version 0.4.12 \
  --set ingress.enabled=true \
  --set ingress.className=traefik \
  --set ingress.host=apowerb.example.com \
  --set ingress.tlsEnabled=true \
  --set ingress.annotations."cert-manager\.io/cluster-issuer"=letsencrypt-prod

tlsEnabled writes the Ingress tls section; the secret name is derived (apowerb-tls) unless ingress.tlsSecretName names one, which is what cert-manager fills from the annotation above.

Left at false, the interface is served in clear — and the address verification links it builds would go out over http://.

Without an Ingress, nothing is exposed outside the cluster: set service.frontend.type=LoadBalancer, or reach it with kubectl port-forward. The install notes say which case you are in.

Checks that need no cluster

helm lint helm/apowerb-chart
helm template rel helm/apowerb-chart \
  --set th2pulse.ingestToken=x --set th2pulse.queryToken=y \
  | kubeconform -strict -summary -kubernetes-version 1.30.0

​Install

​From the published chart

​Storage

​The seed is a Job

​A smaller stack

​Ingress and TLS

​Checks that need no cluster

Install

From the published chart

Storage

The seed is a Job

A smaller stack

Ingress and TLS

Checks that need no cluster