Keep sync-wave examples inline with each service

Remove the separate overlay and make render checks supply per-service overrides directly. Leave optional defaults and Deployment template support unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.144.0
+version: 0.145.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -31,6 +31,43 @@ Uninstall the Kerberos Hub chart
 
     helm uninstall hub -n kerberos-hub
 
+### Optional Argo CD pipeline ordering
+
+Each listed pipeline service accepts `deploymentAnnotations` in its existing
+values section. The default is `{}`, so installing or upgrading the chart alone
+does not enable ordering. Commented examples appear beside the service settings
+in `values.yaml`; replace the empty map rather than adding duplicate YAML keys.
+Annotations render on Deployment `metadata`, not on pod templates or Services.
+
+The inline examples use the following order, leaving gaps of ten:
+
+| Wave | `kerberospipeline` keys |
+| --- | --- |
+| 10 | `event` |
+| 20 | `notify` |
+| 30 | `throttler` |
+| 40 | `analysis` |
+| 50 | `thumbnail`, `sprite`, `dominantColor`, `counting` |
+| 60 | `sequence` |
+| 70 | `monitor` |
+
+Enable the annotation in each service's existing environment values section.
+No separate example values file is required. These annotations do not change
+image tags or enable disabled services such as sprite.
+Deploy the compatible analysis bridge before replying workers, and select the
+fixed counting release; waves do not enforce minimum compatible image versions.
+The chart's default image tags are not a compatibility-tested rollout bundle.
+
+Argo CD applies lower waves first and waits for sync/health before proceeding
+within the same Application. Unannotated resources remain at wave zero. A
+single-service image update does not restart earlier services, but an unhealthy
+earlier wave can block it. Separate Applications and external classifier/workflow
+workers require their own coordination. Helm itself does not enforce these waves.
+
+Waves are not a substitute for message compatibility, readiness checks, or
+stopping old RabbitMQ consumers. This example does not add health probes or
+change the Deployment rolling-update strategy.
+
 ### Parameters
 
 Below all configuration options and parameters are listed.

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-analysis
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.analysis.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-counting.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-counting
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.counting.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-dominantcolor.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-dominantcolor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-event
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.event.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.event.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-monitor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.monitor.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-notify
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.notify.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-sequence
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sequence.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-sprite.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-sprite
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sprite.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-throttler
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.throttler.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-thumbnail.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-thumbnail
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
   selector:

charts/hub/values.yaml

@@ -996,6 +996,10 @@ kerberoshub:
 # The pipeline is a critical component of Kerberos Hub, and should be monitored closely.
 kerberospipeline:
   event:
+    deploymentAnnotations: {}
+    # Example (opt-in Argo CD ordering):
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "10"
     repository: ghcr.io/uug-ai/hub-pipeline-event
     pullPolicy: IfNotPresent
     tag: "v1.3.1"
@@ -1015,6 +1019,9 @@ kerberospipeline:
         cpu: 10m
   monitor:
     repository: ghcr.io/uug-ai/hub-pipeline-monitor
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "70"
     pullPolicy: IfNotPresent
     tag: "v1.3.13"
     replicas: 1 # Number of pods for the service.
@@ -1033,6 +1040,9 @@ kerberospipeline:
         cpu: 10m
   sequence:
     repository: ghcr.io/uug-ai/hub-pipeline-sequence
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "60"
     pullPolicy: IfNotPresent
     tag: "v1.6.26"
     replicas: 1 # Number of pods for the service.
@@ -1050,6 +1060,9 @@ kerberospipeline:
         cpu: 10m
   throttler:
     repository: uugai/hub-pipeline-throttler
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "30"
     pullPolicy: IfNotPresent
     tag: "v1.2.1"
     replicas: 1 # Number of pods for the service.
@@ -1068,6 +1081,9 @@ kerberospipeline:
         cpu: 10m
   notify:
     repository: ghcr.io/uug-ai/hub-pipeline-notification
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "20"
     pullPolicy: IfNotPresent
     tag: "v1.3.18"
     replicas: 1 # Number of pods for the service.
@@ -1108,6 +1124,9 @@ kerberospipeline:
         #      claimName: custom-layout-claim
   analysis:
     repository: ghcr.io/uug-ai/hub-pipeline-analysis
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "40"
     pullPolicy: IfNotPresent
     tag: "v1.8.5"
     replicas: 1 # Number of pods for the service.
@@ -1126,6 +1145,9 @@ kerberospipeline:
         cpu: 10m
   dominantColor:
     repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
     tag: "v2.0.3"
     replicas: 3 # Number of pods for the service.
@@ -1147,6 +1169,9 @@ kerberospipeline:
         cpu: 1000m
   thumbnail:
     repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
     tag: "v1.3.10"
     replicas: 2 # Number of pods for the service.
@@ -1173,6 +1198,9 @@ kerberospipeline:
         cpu: 1000m
   counting:
     repository: uugai/hub-pipeline-counting
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
     tag: "v2.0.0"
     replicas: 1 # Number of pods for the service.
@@ -1191,6 +1219,9 @@ kerberospipeline:
         cpu: 10m
   sprite:
     enabled: false # Enable or disable the sprite generation 'true' or 'false
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     repository: ghcr.io/uug-ai/hub-pipeline-sprite
     pullPolicy: IfNotPresent
     tag: "v1.1.16"

scripts/check-pipeline-deployment-annotations.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+# Supply per-service test overrides without requiring a separate values file.
+WAVE_FLAGS=()
+for setting in event:10 notify:20 throttler:30 analysis:40 thumbnail:50 sprite:50 dominantColor:50 counting:50 sequence:60 monitor:70; do
+  service="${setting%%:*}"
+  wave="${setting#*:}"
+  WAVE_FLAGS+=(--set-string "kerberospipeline.${service}.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=${wave}")
+done
+
+# Only read Deployment metadata, never pod-template or Service annotations.
+extract_waves() {
+  awk '
+    /^---/ { deployment=0; metadata=0; name="" }
+    /^kind: Deployment$/ { deployment=1 }
+    /^metadata:$/ { metadata=1; next }
+    /^[^ #]/ { metadata=0 }
+    deployment && metadata && /^  name:/ { name=$2 }
+    deployment && metadata && /^    argocd.argoproj.io\/sync-wave:/ {
+      value=$2
+      gsub(/"/, "", value)
+      print name, value
+    }
+  ' | sort
+}
+
+assert_waves() {
+  local rendered="$1"
+  local expected="$2"
+  local actual
+  actual="$(printf '%s\n' "$rendered" | extract_waves)"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Unexpected Deployment waves:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
+    return 1
+  fi
+  local all_count expected_count
+  all_count="$(printf '%s\n' "$rendered" | grep -c 'argocd.argoproj.io/sync-wave:' || true)"
+  expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
+  if [[ "$all_count" != "$expected_count" ]]; then
+    echo "Sync-wave annotation leaked outside expected Deployment metadata" >&2
+    return 1
+  fi
+}
+
+expected="$(printf '%s\n' \
+  'pipe-event 10' 'pipe-notify 20' 'pipe-throttler 30' 'pipe-analysis 40' \
+  'pipe-thumbnail 50' 'pipe-sprite 50' 'pipe-dominantcolor 50' \
+  'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"
+
+for mode in all pipeline; do
+  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$default_render" ""
+  if printf '%s\n' "$default_render" | grep -q '^  annotations: null'; then
+    echo "Empty annotations must be omitted" >&2
+    exit 1
+  fi
+  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$configured_render" "$expected"
+  echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
+done
+
+disabled_sprite="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
+assert_waves "$disabled_sprite" "$(printf '%s\n' "$expected" | grep -v '^pipe-sprite ')"
+
+ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true)"
+assert_waves "$ui_render" ""
+
+# Exercise zero/negative strings and an unrelated annotation on the same map.
+for wave in 0 -10; do
+  override="$(helm template hub "$CHART_DIR" --set mode=pipeline \
+    --set-string "kerberospipeline.event.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=$wave" \
+    --set-string 'kerberospipeline.event.deploymentAnnotations.example\.com/owner=queue-team')"
+  assert_waves "$override" "pipe-event $wave"
+  printf '%s\n' "$override" | grep -q "^    argocd.argoproj.io/sync-wave: \"$wave\"$"
+  printf '%s\n' "$override" | grep -q '^    example.com/owner: queue-team$'
+done
+
+echo "All pipeline Deployment annotation checks passed."