feat: add Helm chart for hub/broker Kubernetes deployment

.github/workflows/publish-chart.yml

@@ -0,0 +1,56 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Publish Helm Chart
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    name: Package and Push Helm Chart
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Log in to GHCR
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
+
+      - name: Update chart version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          sed -i "s/^version:.*/version: ${TAG}/" charts/scion/Chart.yaml
+          sed -i "s/^appVersion:.*/appVersion: \"${TAG}\"/" charts/scion/Chart.yaml
+
+      - name: Lint chart
+        run: helm lint charts/scion
+
+      - name: Package chart
+        run: helm package charts/scion
+
+      - name: Push chart to GHCR
+        run: |
+          CHART_PKG=$(ls scion-*.tgz)
+          helm push "${CHART_PKG}" oci://ghcr.io/googlecloudplatform/scion/charts

charts/scion/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: scion
+description: Scion AI agent orchestration platform - hub and runtime broker
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
+home: https://github.com/GoogleCloudPlatform/scion
+sources:
+  - https://github.com/GoogleCloudPlatform/scion
+maintainers:
+  - name: GoogleCloudPlatform
+    url: https://github.com/GoogleCloudPlatform
+keywords:
+  - scion
+  - ai
+  - agents
+  - kubernetes

charts/scion/templates/NOTES.txt

@@ -0,0 +1,47 @@
+{{- if eq .Values.mode "hub" }}
+Scion Hub deployed successfully!
+
+1. Access the hub:
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+   https://{{ .host }}
+{{- end }}
+{{- else }}
+   kubectl port-forward svc/{{ include "scion.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
+   Then open: http://localhost:{{ .Values.service.port }}
+{{- end }}
+
+2. Check health:
+   kubectl get pods -l {{ include "scion.selectorLabels" . | replace ": " "=" | replace "\n" "," }}
+
+{{- if not .Values.auth.existingSecret }}
+
+WARNING: No session secret configured (auth.existingSecret is empty).
+Create a secret with a random session key:
+
+  kubectl create secret generic scion-session \
+    --from-literal=session-secret=$(openssl rand -hex 32)
+
+Then set auth.existingSecret=scion-session in your values.
+{{- end }}
+
+{{- if .Values.ingress.enabled }}
+
+NOTE: If using SSE (Server-Sent Events) or WebSocket connections, ensure
+your Ingress controller supports long-lived connections and has appropriate
+timeout settings (e.g., proxy-read-timeout >= 300s for nginx).
+{{- end }}
+{{- else }}
+Scion Broker deployed successfully!
+
+The broker is running on port {{ .Values.broker.port }}.
+{{- if .Values.broker.hubEndpoint }}
+Hub endpoint: {{ .Values.broker.hubEndpoint }}
+{{- else }}
+
+WARNING: No hub endpoint configured (broker.hubEndpoint is empty).
+Set broker.hubEndpoint to the hub's URL.
+{{- end }}
+{{- end }}
+
+Documentation: https://github.com/GoogleCloudPlatform/scion

charts/scion/templates/_helpers.tpl

@@ -0,0 +1,80 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "scion.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "scion.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "scion.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "scion.labels" -}}
+helm.sh/chart: {{ include "scion.chart" . }}
+{{ include "scion.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "scion.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "scion.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "scion.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "scion.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return the image reference
+*/}}
+{{- define "scion.image" -}}
+{{- $tag := default .Chart.AppVersion .Values.image.tag }}
+{{- printf "%s:%s" .Values.image.repository $tag }}
+{{- end }}
+
+{{/*
+Return the agent namespace for RBAC (defaults to release namespace)
+*/}}
+{{- define "scion.agentNamespace" -}}
+{{- default .Release.Namespace .Values.rbac.agentNamespace }}
+{{- end }}

charts/scion/templates/configmap.yaml

@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "scion.fullname" . }}
+  labels:
+    {{- include "scion.labels" . | nindent 4 }}
+  {{- with .Values.commonAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  {{- if eq .Values.mode "hub" }}
+  SCION_SERVER_HUB_HOST: "0.0.0.0"
+  SCION_SERVER_LOGFORMAT: "json"
+  {{- with .Values.server.logLevel }}
+  SCION_SERVER_LOGLEVEL: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.database.path }}
+  SCION_SERVER_DATABASE_URL: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.storage.provider }}
+  SCION_SERVER_STORAGE_PROVIDER: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.storage.bucket }}
+  SCION_HUB_STORAGE_BUCKET: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.secrets.backend }}
+  SCION_SERVER_SECRETS_BACKEND: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.secrets.gcpProjectId }}
+  SCION_SERVER_SECRETS_GCPPROJECTID: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.server.publicUrl }}
+  SCION_SERVER_BASE_URL: {{ . | quote }}
+  {{- end }}
+  {{- if .Values.server.adminEmails }}
+  SCION_SERVER_HUB_ADMINEMAILS: {{ join "," .Values.server.adminEmails | quote }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.imageRegistry }}
+  SCION_IMAGE_REGISTRY: {{ . | quote }}
+  {{- end }}
+  {{- if .Values.telemetry.cloudLogging.enabled }}
+  SCION_LOG_GCP: "true"
+  {{- with .Values.telemetry.cloudLogging.gcpProjectId }}
+  SCION_CLOUD_LOGGING_PROJECT_ID: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.telemetry.cloudLogging.logId }}
+  SCION_CLOUD_LOGGING_LOG_ID: {{ . | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.telemetry.otelLogBridge.enabled }}
+  SCION_OTEL_LOG_BRIDGE: "true"
+  {{- end }}