feat: add Helm chart for hub/broker Kubernetes deployment

[nissessenap]

Summary

• Adds a Helm chart at charts/scion/ for deploying the hub/broker to Kubernetes, supporting two modes: hub (default, co-located hub+broker+web) and broker (standalone broker connecting to an external hub)
• Adds .github/workflows/publish-chart.yml to package and push the chart as an OCI artifact to oci://ghcr.io/googlecloudplatform/scion/charts/scion on tag push
• Includes a settings-configmap + init container workaround for scion server start requiring image_registry even in hub mode (see note below)

Stupid AI created a PR, this is far from done.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request introduces a new Helm chart for the Scion AI agent orchestration platform, supporting both hub and broker deployment modes with templates for deployments, services, ingress, RBAC, and persistence. The review feedback identifies several necessary improvements to ensure functional parity and operational reliability. Key suggestions include correctly setting the hub endpoint environment variable in broker mode, adding a checksum for the settings ConfigMap to the pod annotations to ensure restarts on configuration updates, and making the hardcoded busybox init container image configurable. Additionally, the reviewer recommends enabling health probes for the broker process and implementing the mounting logic for the currently unused credentials secret.

[gemini-code-assist]

In broker mode, the broker needs to know the endpoint of the external hub it should connect to. The SCION_HUB_ENDPOINT environment variable (referenced in pkg/config/settings.go) should be set from .Values.broker.hubEndpoint when the mode is set to broker.

  {{- with .Values.imageRegistry }}
  SCION_IMAGE_REGISTRY: {{ . | quote }}
  {{- end }}
  {{- if eq .Values.mode "broker" }}
  {{- with .Values.broker.hubEndpoint }}
  SCION_HUB_ENDPOINT: {{ . | quote }}
  {{- end }}
  {{- end }}

[gemini-code-assist]

The pod annotations checksum currently only monitors configmap.yaml. It should also include settings-configmap.yaml to ensure that the pod is automatically recreated if the imageRegistry or other settings in that ConfigMap are updated.

        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/settings: {{ include (print $.Template.BasePath "/settings-configmap.yaml") . | sha256sum }}

[gemini-code-assist]

The busybox image used for the init-settings container is hardcoded. It is a best practice in Helm charts to make all images configurable via values.yaml to support air-gapped environments or organizations using internal image mirrors.

          image: {{ .Values.busyboxImage | default "busybox:1.37" }}

[gemini-code-assist]

Health probes are currently restricted to hub mode. However, the broker process also exposes /healthz and /readyz endpoints (as seen in pkg/runtimebroker/server.go). Probes should be enabled for broker mode as well, targeting the broker port (default 9800).

          {{- if or (eq .Values.mode "hub") (eq .Values.mode "broker") }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: {{ if eq .Values.mode "hub" }}http{{ else }}broker{{ end }}
            initialDelaySeconds: 10
            periodSeconds: 15
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /readyz
              port: {{ if eq .Values.mode "hub" }}http{{ else }}broker{{ end }}
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          {{- end }}

[gemini-code-assist]

The credentialsSecret value is defined here but is not used anywhere in the deployment templates. If this is intended to provide the broker-credentials.json file for HMAC authentication when connecting to a hub, it should be mounted as a volume in the scion container at /home/nonroot/.scion/broker-credentials.json.