demo: use cdk8s for deployment

.github/workflows/integration-tests.yml

@@ -74,26 +74,28 @@ jobs:
       - uses: azure/setup-helm@v4
         with:
           version: v3.18.3
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: ./integration-tests/.nvmrc
+      - name: Cache .npm
+        uses: actions/cache@v5
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('integration-tests/**/package-lock.json', 'kubernetes/cdk8s/package-lock.json') }}
+      - name: Install CDK8s dependencies
+        run: cd kubernetes/cdk8s && npm ci
       - name: Create k3d cluster
         run: |
           ./deploy.py --verbose cluster --bind-all
-      - name: Deploy with Helm
+      - name: Deploy with CDK8s
         run: |
-          ./deploy.py --verbose helm \
+          ./deploy.py --verbose deploy \
             --branch ${{ github.ref_name }} \
             --sha ${{ env.sha }} \
             --for-e2e \
             --enablePreprocessing \
             --use-localhost-ip
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: ./integration-tests/.nvmrc
-      - name: Cache .npm
-        uses: actions/cache@v5
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('integration-tests/**/package-lock.json') }}
-      - name: Install dependencies
+      - name: Install integration test dependencies
         run: cd integration-tests && npm ci
       - name: Install Python
         uses: actions/setup-python@v6

.github/workflows/website-playwright-dev-test.yml

@@ -3,6 +3,7 @@ on:
   pull_request:
     paths:
       - "website/**"
+      - "kubernetes/cdk8s/**"
       - "deploy.py"
       - generate_local_test_config.sh
       - .github/workflows/website-playwright-dev-test.yml
@@ -26,16 +27,18 @@ jobs:
         exclude:
           - os: ${{ github.ref != 'refs/heads/main' && 'macos-latest' }}
     steps:
-      - uses: azure/setup-helm@v4
-        with:
-          version: v3.18.3
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
       - name: Install uv
         uses: astral-sh/setup-uv@v6
       - name: Checkout repository
         uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+      - name: Install CDK8s dependencies
+        run: cd kubernetes/cdk8s && npm ci
       - name: Install yaml package
         run: uv pip install --system PyYAML requests
       - name: Generate local test config

.pre-commit-config.yaml

@@ -21,16 +21,3 @@ repos:
       entry: npx prettier@3.6.2 --write
       language: system
       files: ^kubernetes/loculus/values\.schema\.json$
-    - id: helm-lint
-      name: helm lint
-      entry: bash
-      args:
-        - -c
-        - |
-          set -euo pipefail
-          helm lint kubernetes/loculus -f kubernetes/loculus/values.yaml
-          helm lint kubernetes/loculus -f kubernetes/loculus/values.yaml -f kubernetes/loculus/values_e2e_and_dev.yaml
-          helm lint kubernetes/loculus -f kubernetes/loculus/values.yaml -f kubernetes/loculus/values_preview_server.yaml
-      language: system
-      pass_filenames: false
-      files: ^kubernetes/loculus/

AGENTS.md

@@ -15,6 +15,40 @@ When adding or modifying interactive components in the website, ensure they are
 
 These wrappers automatically disable components until client-side hydration is complete, preventing Playwright from interacting with them before they're ready.
 
+## Running Integration Tests Locally (k3d)
+
+See `integration-tests/AGENTS.md` for full instructions. Key gotchas:
+
+### Anaconda Python conflict
+If Anaconda is in your PATH, `deploy.py` will fail with "Python 3.9 or higher is required". Use `/usr/bin/python3 ./deploy.py` instead.
+
+### Disk pressure (k3d nodes won't schedule pods)
+k3d nodes inherit the host's disk. If disk usage is above ~85%, kubelet marks nodes with `DiskPressure` taint and pods stay `Pending`. Free up disk space or create the cluster with relaxed eviction thresholds:
+```sh
+k3d cluster create testCluster ... \
+  --k3s-arg '--kubelet-arg=eviction-hard=imagefs.available<1%,nodefs.available<1%@server:*' \
+  --k3s-arg '--kubelet-arg=eviction-hard=imagefs.available<1%,nodefs.available<1%@agent:*'
+```
+
+### Critical: Fix `host.k3d.internal` DNS for pods (S3/MinIO connectivity)
+After deploying with `localHost: host.k3d.internal`, pods **cannot** reach `host.k3d.internal:8084` (MinIO/S3) because that hostname resolves to the Docker gateway IP which doesn't forward host ports. Pre-signed S3 URLs generated by the backend contain `host.k3d.internal:8084` and are used by preprocessing pods, causing `ConnectionError` / `ConnectTimeoutError`.
+
+**Fix**: Override CoreDNS to point `host.k3d.internal` to the MinIO service ClusterIP:
+```sh
+MINIO_IP=$(kubectl get svc loculus-minio-service -o jsonpath='{.spec.clusterIP}')
+kubectl patch configmap coredns -n kube-system --type=json \
+  -p="[{\"op\":\"replace\",\"path\":\"/data/NodeHosts\",\"value\":\"${MINIO_IP} host.k3d.internal\n$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.NodeHosts}' | grep -v host.k3d.internal)\"}]"
+kubectl rollout restart deployment coredns -n kube-system
+# Restart preprocessing pods to pick up DNS change
+kubectl get deployments | grep preprocessing | awk '{print $1}' | xargs -I {} kubectl rollout restart deployment {}
+```
+
+### CLI tests require `keyrings.alt`
+Install it in the CLI venv, not system-wide: `uv pip install --python cli/.venv/bin/python keyrings.alt`
+
+### CLI must be on PATH
+The integration tests invoke `loculus` directly. Symlink it: `ln -sf $(pwd)/cli/.venv/bin/loculus ~/bin/loculus`
+
 ## Updating Conda Environment Dependencies
 
 Conda dependencies in `environment.yml` files are not automatically updated by dependabot.