feat: move app deployment to Helm chart

[benjaminlees]

Summary

• Replaces the kubernetes_deployment Terraform resource with a local Helm chart (charts/platform-code-test-app), making Q3 (secrets injection) much easier to iterate on — candidates can reason about standard Helm values rather than deeply nested TF HCL
• Adds sensitive Terraform outputs for db_host, db_user, and db_password so candidates have a clean way to retrieve DB credentials via terraform output
• The chart exposes db.host, db.user, and db.existingSecret values — the existingSecret pattern naturally guides candidates toward creating a kubernetes_secret resource rather than passing the password as plaintext
• Adds management.tf as a data source lookup for the pre-existing kubernetes-cluster-admin IAM role
• Removes assume_role from the kubernetes_admin provider — it was never exercised for interviewers (who always take the @deliveroo.co.uk bootstrap path) and caused fresh-apply failures

Motivation

Q3 was fiddly to test because:

1. The DB password lived buried in Terraform state with no output
2. Iterating on env var injection required tf apply cycles through the slow Kubernetes provider

With this change candidates use terraform output to get credentials and helm upgrade semantics via tf apply on the helm_release resource.

Test plan

• Fresh make tf-apply completes successfully (66 resources)
• /healthcheck returns 200
• /connect returns an error (no DB env vars — expected starting state for Q3)
• terraform output db_password returns the RDS master password
• Q1 (wrong egress CIDR) still reproduces a 504 as expected
• Q3 solvable by adding kubernetes_secret + wiring db.existingSecret in the helm_release

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Migrates the app workload deployment from a Terraform-managed Kubernetes Deployment to a local Helm chart, to make iterative changes (notably secrets/env injection) faster and more candidate-friendly, while also exposing DB connection details via Terraform outputs.

Changes:

• Replaced kubernetes_deployment with a helm_release pointing at a local chart (charts/platform-code-test-app).
• Added Terraform outputs for DB host/user/password (password marked sensitive).
• Removed assume_role usage from the aws.kubernetes_admin provider alias and added a new IAM role data lookup.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
terraform/providers.tf	Removes assume_role from the k8s-admin AWS provider alias; leaves token-selection logic in place.
terraform/outputs.tf	Adds DB connection outputs (including sensitive password output).
terraform/management.tf	Adds a data lookup for the kubernetes-cluster-admin IAM role.
terraform/app_deployment.tf	Switches app deployment to a Helm release using the local chart and sets name/image values.
charts/platform-code-test-app/Chart.yaml	Introduces Helm chart metadata for the app.
charts/platform-code-test-app/values.yaml	Defines configurable image/resources and DB env/secret values.
charts/platform-code-test-app/templates/deployment.yaml	Creates the Kubernetes Deployment and conditionally injects DB env vars/secret.
charts/platform-code-test-app/templates/_helpers.tpl	Adds a helper for generating the app name.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This data source is currently unused anywhere in the Terraform config, so it adds maintenance overhead without affecting behavior. Either wire it into the places that need the cluster-admin role ARN (e.g., access entry / role assumption logic) or remove it until it’s needed.

Suggested change

	data "aws_iam_role" "kubernetes_cluster_admin" {
	name = "kubernetes-cluster-admin"
	}

[Copilot]

With assume_role removed, the aws.kubernetes_admin provider alias no longer differs from the default aws provider. That makes the extra aws_eks_cluster_auth.admin path / token branching redundant; consider collapsing to a single AWS provider + single aws_eks_cluster_auth to reduce configuration complexity.

[Copilot]

The env: block is only rendered when db.host or db.existingSecret is set, but not when only db.user is set. This makes db.user a no-op unless another DB value is also provided. Consider gating env: on any of db.host, db.user, or db.existingSecret (or always rendering env: and conditionally including individual vars).