Install FASTDB with helm charts

.gitignore

@@ -33,6 +33,7 @@ tests/load_snana_fits_reconstruct_indexes_constraints.sql
 
 # Env file
 /.env
+/helm/fastdb/*secrets*.yaml
 
 # Emacs backup files
 **~

HOWTO_LOGIN.md

@@ -0,0 +1,95 @@
+# How to Create a User and Log In
+
+FASTDB uses challenge-response authentication (RKAuth). A user record must
+contain an RSA public key and an encrypted private key before that user can log
+in. The Helm deployment provides two ways to create those credentials:
+
+1. Use a password-reset email captured by MailHog. This is the intended local
+   Kind workflow.
+2. Generate the credentials locally and insert them directly into PostgreSQL.
+   This is the intended single-node VM workflow.
+
+## Local Kind: create a user through MailHog
+
+The local workflow exercises the same browser-based password-reset process a
+normal web user would use. MailHog captures the email locally instead of
+sending it to a real address.
+
+First install FASTDB using the local Kind helpers:
+
+```bash
+./helm/scripts/create-local-cluster.sh
+./helm/scripts/install-local-fastdb.sh
+```
+
+Then run:
+
+```bash
+./helm/scripts/create-user-local.sh
+```
+
+The script:
+
+1. Creates the fixed development account `test_user` in PostgreSQL.
+2. Requests a password-reset email from FASTDB.
+3. Reads the reset link from MailHog.
+4. Opens FASTDB, the reset page, and MailHog in the browser.
+
+Enter the desired password on the reset page. The browser generates the RSA
+key pair, encrypts the private key with the password, and stores the resulting
+credentials in FASTDB.
+
+The local services are available at:
+
+| Service | URL |
+|---|---|
+| FASTDB | `http://localhost:8080` |
+| MailHog | `http://localhost:8025` |
+
+If `test_user` already exists, use the **Request Password Reset** option on the
+FASTDB login page rather than trying to create the account again.
+
+## Single-node VM: insert a user directly
+
+A VM may not have browser access or a public route to its FASTDB and MailHog
+services. In that case, create a complete user record directly from the VM:
+
+```bash
+./helm/scripts/create-user-singlenode.sh
+```
+
+By default, the script operates in the `fastdb-arbutus-dev` namespace. Set a
+different namespace when necessary:
+
+```bash
+FASTDB_NAMESPACE=<namespace> ./helm/scripts/create-user-singlenode.sh
+```
+
+The script prompts for the username, display name, email, and password. It
+then:
+
+1. Uses the FASTDB shell image to generate the RKAuth keys and SQL.
+2. Sends the generated SQL directly to PostgreSQL through `kubectl exec`.
+3. Removes the password and generated SQL from its shell variables.
+
+The password is read without displaying it and is not included in the SQL or
+passed as a command-line argument. This workflow does not require MailHog or a
+browser-accessible password-reset link.
+
+After either workflow completes, log in with the username and password that
+were created. Applications using the FASTDB Python client will also need those
+credentials in their own `.fastdb.ini` configuration or secret-management
+system; neither user-creation script creates client configuration.
+
+## Manual MailHog reset
+
+To reset an existing user's password manually:
+
+1. Open the FASTDB login page.
+2. Select **Request Password Reset**.
+3. Enter the username or email address.
+4. Open MailHog and follow the link in the captured message.
+5. Enter and confirm the new password.
+
+This requires `mailhog.enabled: true` and network access to both FASTDB and the
+MailHog web interface.

admin/local/kind-config.yaml

@@ -0,0 +1,28 @@
+# Kind cluster config for local FASTDB Helm deployment.
+#
+# Used by helm/scripts/create-local-cluster.sh. The script replaces ${PWD} with
+# the repo root path before passing this file to `kind create cluster`.
+#
+# extraMounts expose the host build tree inside the Kind node so pods can
+# mount /fastdb-install and /fastdb-db via hostPath (values-local.yaml:
+# volumes.codeHostPath: true).
+#
+# extraPortMappings map the webap NodePort (30080) to localhost:8080 and the
+# MailHog HTTP NodePort (30025) to localhost:8025.
+
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+  - role: control-plane
+    extraMounts:
+      - hostPath: ${PWD}/install
+        containerPath: /fastdb-install
+      - hostPath: ${PWD}/db
+        containerPath: /fastdb-db
+    extraPortMappings:
+      - containerPort: 30080
+        hostPort: 8080
+        protocol: TCP
+      - containerPort: 30025
+        hostPort: 8025
+        protocol: TCP

docker/webserver/Dockerfile

@@ -105,7 +105,9 @@ RUN source /venv/bin/activate && \
        "confluent_kafka==2.15.0,<3.0.0" \
        "fastavro>=1.10.0,<2.0.0" \
        "fink-client>=10.1,<11.0" \
+       "hats==0.11.0" \
        "healpy>=1.20.0,<2.0.0" \
+       "lsdb==0.11.0" \
        "nested-pandas>=0.7.1,<0.8.0" \
        "numpy>=2.5.1,<3.0.0" \
        "pandas>=3.0.5,<4.0.0" \
@@ -149,12 +151,6 @@ RUN git clone https://github.com/mongodb/mongo-tools.git \
   && cd .. \
   && rm -rf mongo-tools
 
-# lsdb in PyPi requires older versions of pandas and nested_pandas than
-# we want.  This dev branch has updates in pyproject.toml
-RUN source /venv/bin/activate \
-   && pip --no-cache install "hats @ git+https://github.com/astronomy-commons/hats.git@pandas3" \
-                             "lsdb @ git+https://github.com/astronomy-commons/lsdb.git@pandas3"
-
 # ======================================================================
 # This is for interaction.  It runs something that will stay up that you can exec a shell on.
 FROM base AS shell

helm/LOCAL_KIND.md

@@ -0,0 +1,43 @@
+# Local Kind development
+
+This optional workflow runs FASTDB on a laptop using Kind. For a single-VM
+benchmark deployment, follow the [main guide](README.md).
+
+Install Docker, Docker Compose, Kind, Helm and kubectl. From the FASTDB
+repository root, initialize submodules and run:
+
+```bash
+git submodule update --init --recursive
+./helm/scripts/create-local-cluster.sh
+./helm/scripts/install-local-fastdb.sh
+kubectl --context kind-fastdb-local get pods,pvc -n fastdb-local
+```
+
+The first script creates the cluster. The second builds and loads the images,
+generates `install/`, and installs the chart using
+[values-local.yaml](fastdb/values-local.yaml). It uses a different workflow and
+image configuration from the single-VM installer.
+
+Rerun `install-local-fastdb.sh` after changing application code, migrations,
+images or chart settings; it updates the existing installation without
+deliberately deleting database storage. Verify the configured image tags match
+the images actually built by Compose if you change its defaults.
+
+For local account creation, use:
+
+```bash
+./helm/scripts/create-user-local.sh
+```
+
+This is the browser/MailHog password-reset workflow described in
+[HOWTO_LOGIN.md](../HOWTO_LOGIN.md), rather than the direct user-creation helper
+used on a VM.
+
+To delete the Kind cluster and all FASTDB data stored within it:
+
+```bash
+./helm/scripts/stop-local.sh
+```
+
+This is a destructive reset, not a pause. The next cluster creation starts a
+fresh environment.