paper-board/infra

paper-board/infra is the Helm chart repository for the entire paper-board platform. It contains:

helm/agent-manager/ — umbrella chart that composes all per-service subcharts, shared infrastructure (Postgres, PgBouncer, cert-manager, Redis), and namespace-level Secrets.
k8s/ — raw Kubernetes manifests for cluster-level objects not suited for Helm.
terraform/ — cloud infrastructure provisioning (Phase 5+).
test/e2e/ — end-to-end smoke test scripts.

Chart layout

helm/agent-manager/
  Chart.yaml          # umbrella metadata + dependency list
  values.yaml         # base defaults (all envs)
  values-dev.yaml     # dev/Kind overlay
  values-prod.yaml    # production overlay
  charts/             # vendored local subcharts (postgres, pgbouncer, cert-manager, redis)
  templates/          # umbrella-owned templates (cross-service Secrets, helpers)

Per-service subcharts (identity, agents, runtime, compute, …) are OCI artifacts pulled from oci://ghcr.io/paper-board/helm during helm dep update. They are not vendored in this repo; each service repo owns and publishes its own chart.

                    ┌─────────────────────────────────────────────┐
                    │          agent-manager (umbrella)            │
                    │                                              │
          ┌─────────┴────────┐            ┌────────────────────┐  │
          │  local subcharts │            │   OCI subcharts     │  │
          │  (charts/)       │            │ ghcr.io/paper-board │  │
          │                  │            │ /helm               │  │
          │  postgres        │            │  identity           │  │
          │  pgbouncer       │            │  agents             │  │
          │  cert-manager    │            │  runtime (Phase 3)  │  │
          │  redis           │            │  compute (Phase 3)  │  │
          └─────────┬────────┘            └────────────────────┘  │
                    └─────────────────────────────────────────────┘

Quickstart

Prerequisites: helm ≥ 3.16, kubectl connected to a cluster, GHCR read access.

# 1. Authenticate to GHCR (needed to pull OCI subcharts)
echo "$GITHUB_TOKEN" | helm registry login ghcr.io \
  --username "$GITHUB_ACTOR" --password-stdin

# 2. Resolve subchart dependencies
helm dep update helm/agent-manager

# 3. Lint (same check run by CI)
helm lint helm/agent-manager

# 4. Dry-run render against the dev overlay
helm template agent-manager helm/agent-manager \
  -f helm/agent-manager/values-dev.yaml

# 5. Install into a Kind / dev cluster
helm upgrade --install agent-manager helm/agent-manager \
  -f helm/agent-manager/values-dev.yaml \
  --namespace paper-board --create-namespace \
  --wait

CI

Every pull request and push to main runs .github/workflows/ci.yaml:

Step	Command
`helm dep update`	pulls OCI subcharts from GHCR; verifies `Chart.lock` is satisfiable
`helm lint`	validates chart structure and required values
`helm template`	full render with `values-dev.yaml`; catches missing keys at render time
`yamllint`	YAML style check on `k8s/` raw manifests

CI requires permissions: packages: read to pull OCI charts with GITHUB_TOKEN.

Adding a new service subchart

The service repo publishes its chart to oci://ghcr.io/paper-board/helm/<svc> via its own release workflow.

Add an entry to helm/agent-manager/Chart.yaml dependencies:

- name: <svc>
  version: <semver>
  repository: oci://ghcr.io/paper-board/helm
  condition: <svc>.enabled

Add a matching stanza in values.yaml (disabled by default until the phase that enables the service).
Run helm dep update helm/agent-manager to regenerate Chart.lock.
Update values-dev.yaml to enable the subchart for local smoke testing.