feat(dispatch): swap to the first-party chart

[joryirving]

Summary

• OCIRepository → oci://ghcr.io/misospace/charts/dispatch (tag 0.5.18); HelmRelease values translated to the chart's API (built on bjw-s common, so nearly 1:1: controllers.dispatch.containers.app → controllers.main.containers.main).
• Migrations move to the chart's pre-upgrade hook Job; pods always run SKIP_DB_MIGRATIONS=true — the boot-migration multi-replica hazard is gone.
• Dropped: HOSTNAME: 0.0.0.0 (baked into the image since 0.5.17), custom probes (chart defaults are identical). Refreshed the stale vision-4B comment (9B now).

Verified locally (chart rendered with these exact values)

• Resource names/selectors identical to the app-template render (dispatch service/deployment/SA) → in-place upgrade, dispatch.llm:3000 DNS unchanged
• DATABASE_URL (anchor) lands in both the pod and the migrate Job (dispatch-app/uri); SKIP_DB_MIGRATIONS inherited from chart defaults; reloader annotation renders; route → dispatch:3000

⚠️ Merge gate

ghcr.io/misospace/charts/dispatch:0.5.18 does not exist yet — v0.5.18's chart push 403'd (app token can't create GHCR packages; fixed by misospace/dispatch#553). Either:

• merge fix(container): update image docker.io/cloudflare/cloudflared to v2023.7.2 #553 → cut 0.5.19 → bump tag here to 0.5.19, or
• helm package charts/dispatch (version 0.5.18) + helm push it manually once.

[smurf-bot]

konflate — summary

Note

+1 added · 4 changed · −0 removed — 5 resources · 2 apps

Blast radius

• Kustomization llm/dispatch — 1 dependent (Kustomization llm/foreman-dispatch-bridge)

Warning

⚠ Caution

• Deployment llm/dispatch — spec.selector changed — immutable on Deployment; the apply fails until the resource is recreated (or Flux force is enabled)

Image changes

image	from	to
ghcr.io/misospace/dispatch	∅	sha256:3cc1b73e8147…
ghcr.io/misospace/dispatch	sha256:0abe49ec7fb7…	sha256:3cc1b73e8147…

View the full rendered diff →

_{konflate · rendered f0c1201 · advisory, not a gate}

[its-saffron]

AI Automated Review

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation: Request Changes

This PR migrates dispatch from the app-template chart to the first-party dispatch chart. The work is generally well-structured, but there is a critical operational blocker that must be addressed before merge.

---

Change Summary

This PR makes the following changes to dispatch:

1. Chart migration: Switches from oci://ghcr.io/bjw-s-labs/helm/app-template (tag 5.0.1) to oci://ghcr.io/misospace/charts/dispatch (tag 0.5.19).
2. Controller rename: controllers.dispatch.containers.app → controllers.main.containers.main.
3. Image bump: ghcr.io/misospace/dispatch:0.5.17 → 0.5.19 (both pinned by SHA).
4. Database migration refactor: Drops custom migration logic; migrations now run via the chart's pre-upgrade hook Job.
5. Probes cleanup: Removes explicit custom probes (chart defaults are identical per PR author).
6. Route identifier: backendRefs[].name → backendRefs[].identifier: main.

---

Required Checks

✅ validate manifest against target cluster version

The HelmRelease, OCIRepository, and Kustomization resources use standard Flux/GitOps APIs (helm.toolkit.fluxcd.io/v2, source.toolkit.fluxcd.io/v1). These API versions are stable and widely supported. The rendered diff from konflate shows valid Kubernetes Job, Deployment, Service, and Gateway API resources (batch/v1, networking.x-k8s.io/v1). No API version deprecation or incompatibility is present.

Verified: All resource API versions (helm.toolkit.fluxcd.io/v2, source.toolkit.fluxcd.io/v1, batch/v1, networking.x-k8s.io/v1) are current and supported on Kubernetes 1.29+ (the Talos 1.12.x clusters run k8s 1.29.x).

✅ check for resource quota / limit changes

Resource limits are unchanged between the old and new configurations:

Resource	Before	After
CPU request	50m	50m
Memory request	256Mi	256Mi
Memory limit	512Mi	512Mi

Verified: No change to CPU/memory requests or limits. No new ResourceQuota or LimitRange was introduced. Resource quotas on the llm namespace are unaffected.

---

Blocking Finding

Deployment llm/dispatch selector label change is immutable

Source: konflate-rendered-diff caution flag (spec.selector changed — immutable on Deployment)

Severity: Blocker

The rendered diff shows that the Deployment's selector label changes from app.kubernetes.io/controller: dispatch to app.kubernetes.io/controller: main. This field is immutable in Kubernetes — the Deployment spec.selector cannot be changed after creation.

Flux (the GitOps controller in this cluster) does not automatically delete and recreate resources when immutable fields change. The HelmRelease will fail to apply with an error like:

error: cannot patch "dispatch" with kind Deployment: ... field is immutable

The PR author's claim that "resource names/selectors identical to the app-template render" is inconsistent with the konflate rendered diff, which unambiguously shows the selector label changing from dispatch to main. The konflate diff is the post-kustomize output that Flux will actually apply, making it authoritative.

What must be done: Either:

1. Add a pre-flight step (script or task) to delete the old Deployment before Flux reconciles, or
2. Confirm that Flux's --force reconciliation is acceptable for this in-place upgrade, or
3. Change the chart's controller name back to dispatch to match the existing selector label (though this would defeat the purpose of aligning with the first-party chart's naming convention).

Recommendation: Document the required manual intervention in the PR description (e.g., "Flux apply will fail on first attempt due to immutable Deployment selector; run kubectl delete deployment dispatch -n llm before merging" or equivalent).

---

Non-Blocking Notes

Chart version 0.5.18 push failed (but manifests reference 0.5.19)

The PR body describes that ghcr.io/misospace/charts/dispatch:0.5.18 failed to publish (HTTP 403, app token cannot create GHCR packages — fixed in misospace/dispatch PR 553). The PR pivoted to tag 0.5.19. Both ocirepository.yaml and the HelmRelease ref.tag in the diff now reference 0.5.19. The upstream chart at 0.5.19 should exist (the git log shows commits "chore(dispatch): chart + image to 0.5.19" and "fix(dispatch): pin the 0.5.19 image digest"). The manifests are internally consistent on 0.5.19. No action needed here — this note is for awareness only.

Downstream dependency

konflate identified that Kustomization llm/foreman-dispatch-bridge depends on Kustomization llm/dispatch. The selector label change will cause a brief service interruption for the bridge while the Deployment is recreated. This is expected and acceptable for a one-time migration, but worth noting for the PR author.

Image digest not in corpus

The GitHub release lookup for misospace/dispatch at 0.5.19 returned no match via ghcr.io path inference. The linked sources section notes the image is sha256:3cc1b73e81471d9dcd2672f0b5a102c7632fc068e47b5346738dfd9a549608f0. I cannot independently verify the release notes or changelog from the corpus. If release notes or security advisories are relevant to this bump, they should be linked in the PR body.

---

Standards Compliance

Convention	Status	Note
HelmRelease via Flux	✅	Uses spec.chartRef pointing to OCIRepository
Per-app OCIRepository	✅	ocirepository.yaml is separate from HelmRelease
Image pinned by SHA	✅	Both old and new image tags include @sha256:
No metadata.namespace	✅	metadata.namespace absent as expected
External-secrets backed secrets	✅	DATABASE_URL uses secretKeyRef to dispatch-app
Resource limits defined	✅	CPU/memory requests and limits present
OCI artifacts pinned by tag	✅	Chart pinned by tag 0.5.19, not SHA

---

Summary

The PR implements a well-reasoned chart migration with good documentation. Resource limits are unchanged. Manifests are valid. However, the immutable Deployment selector label change is a hard blocker — Flux will not apply the change without manual intervention. The PR must either document the required manual step or provide a mechanism (task, pre-flight script) to handle the immutable field change before Flux reconciles.