Looking for the RagLeap platform? This page documents the open-source pip install ragleap-app-chart package. For the hosted business platform (AI Office, WhatsApp/Voice bots, billing), see docs.ragleap.com instead.

Not RagLeap-specific — proven against a non-RagLeap toy app, per the design proposal's own requirement

ragleap-app-chart

A generic, reusable Helm chart for deploying arbitrary services to Kubernetes — built by RagLeap, but doesn't know or care what RagLeap is. Point it at your own app via an arbitrary services: list.

0.1.0

PyPI version

Real bugs found & fixed live

1/1

postgres example Running, 0 restarts

Install

The Python package itself ships no functional code — it exists so this content can be versioned and released through the same PyPI pipeline as the other RagLeap packages. The real deliverable is the helm/ chart.

pip install ragleap-app-chart
# or, with uv
uv add ragleap-app-chart

What's inside

Each entry under a services: list in values.yaml renders its own Deployment, Service, and — conditionally — PVC, NetworkPolicy, and Ingress, via Helm range loops. Nothing is hardcoded to a specific app.

deployment.yaml

Per-service Deployment. Optional initChown flag renders a one-time root fix-permissions init container using the service's own declared securityContext.runAsUser.

service.yaml

Per-service Service, always rendered.

pvc.yaml

Rendered only if persistent: true. Mount path is currently fixed at /data — see Known limitations.

networkpolicy.yaml

Deny-by-default per service. Ingress rules are derived automatically from other services' dependsOn entries.

ingress.yaml

Rendered only if expose: true, with cert-manager TLS via a configurable ClusterIssuer.

Secure by default

Per-service resources and securityContext overrides, falling back to chart-level defaultResources/defaultSecurityContext when a service omits its own.

defaultSecurityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: false   # many images need write access; override per-service to true where possible

Live verification — 2 real bugs found and fixed

First helm install against a real kind cluster, using the chart's own default example (web + postgres) — the genericity proof the design proposal explicitly requires: "proven against a non-RagLeap toy app." Neither bug was caught by helm lint/helm template alone.

runAsNonRoot without runAsUser rejected postgres:16 outright. The default image runs as root before its entrypoint drops privileges internally — same bug class found in ragleap-ops the same day. Fixed generically: the opt-in initChown flag uses each service's own declared UID, not a hardcoded one.
Hardcoded /data mount path vs. postgres's real data directory. The official postgres image defaults to /var/lib/postgresql/data, not /data — without an explicit PGDATA override, data would have silently NOT persisted to the actual PVC.

After both fixes: postgres reached 1/1 Running, 0 restarts sustained. Data persistence independently confirmed via SHOW data_directory; → /data/pgdata, not just pod status.

Known limitations

Drawn from the real live-cluster test — including a real risk the chart doesn't yet guard against automatically.

The hardcoded /data mount path is a real generic risk, not just a postgres-specific quirk. Any persistent service whose image doesn't default its data directory to /data needs an explicit env override — the chart does not currently warn or validate this.
initChown requires the service to also declare its own securityContext.runAsUser. If a service sets initChown: true without runAsUser, the rendered chown command would be malformed. Not currently validated — would fail at apply-time, not before.
Not part of RagLeap Core's numbered ecosystem sequence. This is a deliberately separate track from packages like ragleap-ops — see GENERIC-K8S-CHART-PROPOSAL.md in the repo root for the design rationale.