[delete-cloud]

Why

This repo is public. o6n-specific infra topology had leaked into HEAD: internal registry host (git.mesh.kinaz.me), the o6n netbird mesh IP, namespace, NodePort, and secret names. No secret values were exposed (the SealedSecret boundary held). This stops the bleeding going forward; git history is intentionally left as-is (topology only, no credentials).

Changes

• helm: delete values-o6n-deepseek.yaml; add placeholder values-example.yaml (same knobs, no real data).
• scripts/deploy-coding-agent-k8s.sh: support VALUES_CONTENT (real values injected from a Woodpecker secret via a 0600 temp file, mirroring KUBECONFIG_CONTENT); genericize defaults; HELM_VALUES kept as fallback.
• .woodpecker/deploy.yml: source K8S_NAMESPACE, IMAGE_REPOSITORY, and values from secrets (k8s_namespace, image_repository, deploy_values); manual + dry-run-default unchanged. Deploy-tools image: (build registry) is structural and retained with a comment.
• docs: genericize phase2-k8s.md + woodpecker.md to <placeholders>; note real values live in the private SRE inventory + Woodpecker repo secrets.

Not in scope / accepted

• .woodpecker/ci.yml kaniko build-registry hostname is structural and retained.
• Git history not rewritten (no credentials, topology only).

Cutover dependency (step ②)

Live deploy now requires Woodpecker repo secrets: deploy_values (real o6n values), k8s_namespace, image_repository (plus existing kubeconfig).

Verification

• uv run pytest tests/deploy/ -q → 38 passed (outside codex sandbox).
• Tree grep confirms no residual mesh IP / namespace / NodePort / langfuse-secret / values-o6n filename outside intentional build-registry refs.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation

  • Deployment guides updated with generic configuration placeholders and security best practices.

• Chores

  • Enhanced deployment pipeline with improved credential handling and validation to prevent incomplete configurations.
  • Deployment script now validates required settings before cluster modifications.

• Tests

  • Updated test cases to align with new generic template-based deployment configuration.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 23fd2276-377d-47ef-9d31-5100ddfcaffd

📥 Commits

Reviewing files that changed from the base of the PR and between a46619f and 584e10c.

📒 Files selected for processing (7)

• .woodpecker/deploy.yml
• coding-agent/docs/deployment/phase2-k8s.md
• coding-agent/docs/deployment/woodpecker.md
• coding-agent/helm/values-example.yaml
• coding-agent/tests/deploy/test_deploy_script.py
• coding-agent/tests/deploy/test_helm_chart.py
• scripts/deploy-coding-agent-k8s.sh

---

📝 Walkthrough

Walkthrough

The deployment pipeline is generalized from hardcoded DeepSeek/Langfuse/namespace-specific values to secrets-sourced, placeholder-driven configuration. The deploy script gains apply-mode guardrails rejecting placeholder inputs, secure temp-file handling for kubeconfig and values content, and an updated Helm invocation. The CI pipeline, Helm example values, tests, and docs are all updated to match.

Changes

Generalize deploy pipeline to placeholder-based configuration

Layer / File(s)	Summary
Deploy script: defaults, guardrails, and secrets handling scripts/deploy-coding-agent-k8s.sh	Default variables switch to coding-agent-scoped placeholders; apply-mode now validates IMAGE_REPOSITORY is not a placeholder and requires real values via VALUES_CONTENT or a non-placeholder HELM_VALUES; both KUBECONFIG_CONTENT and VALUES_CONTENT are written to secure temp files; Helm invocation uses the derived helm_values_file.
Woodpecker CI pipeline: secrets-sourced deploy job .woodpecker/deploy.yml	Deploy job now pulls KUBECONFIG_CONTENT, IMAGE_REPOSITORY, K8S_NAMESPACE, and VALUES_CONTENT from secrets instead of hardcoding the container repository, namespace, and Helm values file.
Helm values-example.yaml: all fields switched to placeholders coding-agent/helm/values-example.yaml	Image repository, nodePort, secret ref names, model provider (openai/gpt-4.1), observability env var names, and egress CIDR are all replaced with generic <…> placeholder values.
Deploy script tests: updated and new apply-mode validation coding-agent/tests/deploy/test_deploy_script.py	Existing dry-run and apply-mode tests updated to generic namespace/placeholder image; three new tests assert apply-mode rejects a placeholder IMAGE_REPOSITORY, rejects example values without VALUES_CONTENT, and uses a correct temp values file when VALUES_CONTENT is supplied.
Helm chart tests: replace deepseek-specific tests with example-values equivalents coding-agent/tests/deploy/test_helm_chart.py	values-example.yaml added to render matrix; deepseek runtime-contract and bootstrap tests replaced with equivalents asserting the generic placeholder values (nodePort 30080, openai/gpt-4.1, placeholder secret refs, observability env keys, CIDR placeholder).
Deployment docs: replace hardcoded provider/namespace details coding-agent/docs/deployment/phase2-k8s.md, coding-agent/docs/deployment/woodpecker.md	Both runbooks drop DeepSeek/Langfuse-specific and fixed-namespace references; describe new secrets (deploy_values, k8s_namespace, image_repository, VALUES_CONTENT); generalize kubectl secret examples and chart values expectations.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related PRs

• delete-cloud/Coding-Agent-Loop#590: Introduced the original o6n DeepSeek Helm deploy path via the same scripts/deploy-coding-agent-k8s.sh and associated test/deploy infrastructure that this PR generalizes into placeholder-based configuration.

Poem

🐇 Hop hop, no more hardcoded names in the hay,
The secrets are secret, the placeholders play!
DeepSeek steps aside, now openai/gpt-4.1,
Temp files for kubeconfig, safely done.
The rabbit deploys without leaving a trace —
Just <registry>/<namespace> and a smile on my face! 🌿

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/scrub-o6n-deploy-config

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}