feat: add draw.io kustomize component#34
Merged
Conversation
Add a cluster-internal self-hosted draw.io as an optional Kustomize component (Deployment + ClusterIP Service, image jgraph/drawio:30.0.4) and enable it in the default, managed, and phoenix overlays. - Reject plane-draw-io-wl from each overlay's APP_VERSION image-tag replacement so the pinned third-party tag is not clobbered. - In phoenix, order draw-io after nonroot-security-context and custom-ca (it has no envFrom, like iframely) and reject it from the initContainers image replacement since it has no init container. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Source the draw-io image tag from overlay-vars.DRAWIO_VERSION via a replacement in the component (mirrors how iframely reads overlay-vars), so version bumps are a one-line change in each overlay's vars.yaml instead of editing the component deployment.yaml. The in-file tag is now just a placeholder default. Document the new key in each overlay's vars.yaml.example (the live vars.yaml is gitignored / user-provided). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a Traefik IngressRoute for the draw.io editor under /drawio, wired to the existing plane-draw-io:8080 service. Since jgraph/drawio serves its webapp at "/" and references all assets relatively: - drawio-stripprefix strips the /drawio prefix before forwarding - drawio-redirect-slash redirects bare /drawio -> /drawio/ so relative assets resolve under the subpath The phoenix overlay patches the new route (index 10) with the commercial.loadtest.plane.town host. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a README to the draw-io component covering subpath exposure: why the trailing-slash redirect + prefix strip are needed (relative asset paths), the Traefik setup that's already wired, and a ready-to-apply nginx-ingress recipe for self-hosted users on ingress-nginx. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move the draw.io image from jgraph/drawio:30.0.4 to makeplane/drawio:v2.5.0. Bump DRAWIO_VERSION to v2.5.0 in each overlay's vars.yaml.example (the authoritative tag source via the replacements block) and update the image name in deployment.yaml plus stale references in docs/comments. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Prashant-Surya
approved these changes
Jun 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Folds the standalone self-hosted draw.io setup (previously raw K8s manifests at
draw_io_self_host) into thecommercial-deploymentsKustomize structure as a first-class optional component, so overlays can opt in.What changed
New component —
kustomize/components/draw-io/:kustomization.yaml—kind: Componentdeployment.yaml—plane-draw-io-wl, imagejgraph/drawio:30.0.4(pinned), port 8080,plane-srv-account, tcpSocket readiness probe, modest resourcesservice.yaml—plane-draw-ioClusterIP 8080→8080Cluster-internal only (Deployment + Service) — no ingress/cert-manager carried over from the standalone setup.
Wired into all three overlays (
default,managed,phoenix):../../components/draw-ioto eachcomponents:listplane-draw-io-wlto each overlay'sAPP_VERSION→ image-tagreject:list so the pinned third-party tag is not clobbered (same treatment as iframely)Phoenix-specific handling:
nonroot-security-contextandcustom-ca— draw.io has noenvFrom(like iframely) and its third-party image shouldn't be patched by those all-Deployment componentsplane-draw-io-wlfrom phoenix'sinitContainers.*.imagereplacement, since it has no init containerVerification
kubectl kustomizerenders cleanly for all three overlays; each showsplane-draw-io-wl/plane-draw-iowithimage: jgraph/drawio:30.0.4(not the APP_VERSION tag), and the phoenix draw-io pod is free of injected init containers / security context.Note
In phoenix, draw.io does not receive the custom CA bundle or non-root hardening (by design, to avoid breaking the third-party image). A per-service custom-ca override could be added later if needed.
🤖 Generated with Claude Code