Skip to content

feat: GCP/GKE migration prep (persistence split, Dockerfiles, CI)#27

Merged
kimo-ice merged 7 commits intomainfrom
chore/wizardly-ptolemy
Apr 16, 2026
Merged

feat: GCP/GKE migration prep (persistence split, Dockerfiles, CI)#27
kimo-ice merged 7 commits intomainfrom
chore/wizardly-ptolemy

Conversation

@kimo-ice
Copy link
Copy Markdown
Contributor

Summary

Prepares the agent-paymaster codebase for migration from Railway to the shared Taiko mainnet GKE cluster:

  • Persistence split: API defaults to api.db, bundler defaults to bundler.db — each service owns its own SQLite file for independent PVCs on GKE
  • Dockerfile non-root: Both images now run as node (UID 1000) via USER node, matching the GKE StatefulSet securityContext
  • CI gating: Railway deploy in release.yml is skipped when DEPLOY_TARGET=gke, so the migration tag doesn't redeploy Railway
  • GKE release workflow: New gke-release.yml builds + pushes images to us-central1-docker.pkg.dev/mainnet-trailblazer/servo/ via Workload Identity Federation
  • Tests: New unit tests for both PersistenceStore and BundlerPersistenceStore (183 total tests passing)

Design spec

docs/superpowers/specs/2026-04-16-gcp-migration-design.md

Companion PR

Helm chart in ecosystem-k8s-configs (separate repo, separate PR)

Test plan

  • pnpm test — 183/183 passing (shared 9, bundler 68, API 106)
  • pnpm lint — 0 errors across all packages
  • New PersistenceStore tests: DB creation, quote CRUD, rate-limit CRUD
  • New BundlerPersistenceStore tests: DB creation, pending operations, sender reputations
  • Docker build smoke test: verify both images run as UID 1000
  • Verify gke-release.yml triggers on tag push (requires GCP Workload Identity setup)
  • Verify release.yml deploy job skips when DEPLOY_TARGET=gke

Change DEFAULT_DB_PATH from './data/servo.db' to './data/api.db' so the
API and bundler use independent SQLite files when deployed to separate
containers. The DB_PATH env var override is preserved for backward
compatibility. Add unit tests for PersistenceStore.
Change DEFAULT_DB_PATH from './data/servo.db' to './data/bundler.db' so
each service owns its own SQLite file. Add unit tests for
BundlerPersistenceStore covering pending operations and sender
reputations.
Add chown node:node /app/data and USER node directive to both
Dockerfiles. The node:22-slim base image includes a node user at
UID/GID 1000, matching the GKE StatefulSet securityContext
(runAsUser: 1000, fsGroup: 1000).
When DEPLOY_TARGET is set to 'gke' in GitHub Actions variables, the
Railway deploy job is skipped. The github-release job now depends on
verify directly so it still runs when deploy is skipped. Default
behavior (no variable set) is unchanged -- Railway deploys as before.
Build and push API and bundler Docker images to
us-central1-docker.pkg.dev/mainnet-trailblazer/servo/ on v* tags.
Uses Workload Identity Federation for keyless auth. The verify job
is identical to the existing release.yml.
Replace 'as any' with 'as unknown as PaymasterQuote' in the test
quote factory to satisfy @typescript-eslint/no-explicit-any rule.
@kimo-ice kimo-ice requested a review from ggonzalez94 April 16, 2026 11:39
@kimo-ice kimo-ice merged commit f246984 into main Apr 16, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant