feat(poimen): consolidate into single multi-source ArgoCD app
- Merge poimen-workflows + poimen-memory + db + frontend into one app - Delete duplicate apps: poimen-workflows, poimen-memory-app (kubectl done) - Delete poimen-memory ArgoCD app file (replaced by multi-source source 2) - Delete poimen-memory-database (replaced by source 3 → k8s/infra/poimen/) - Move memory-db CNPG cluster to k8s/infra/poimen/ (isolated from other tenants) - Remove memory-db from k8s/infra/databases/kustomization.yaml - Add frontend manifests (Deployment, Service, Ingress) to k8s/apps/poimen/ - Add frontend NetworkPolicy: egress to api-gw (api:8080), memory (poimen:8080), Gotify (notifications:80), Authentik (iam:9000/9443), DNS (kube-system:53) - Sync-wave -1 on CNPG cluster ensures DB ready before app pods (wave 0) - Image updater: workflows + memory + frontend tracked in one annotation block - poimen-toolkit stays separate (CRD management, independent rollback)
This commit is contained in:
@@ -0,0 +1,114 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
app.kubernetes.io/component: frontend
|
||||
app.kubernetes.io/part-of: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
replicas: 2
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app: poimen-frontend
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
# Admitted by llm-serving-default-deny NetworkPolicy (port 8080).
|
||||
# Required for server-side LLM calls through api-gw.
|
||||
llm-client: "true"
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: forgejo-registry
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
fsGroup: 1001
|
||||
containers:
|
||||
- name: frontend
|
||||
image: forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
env:
|
||||
# In-cluster api-gw (server-side only — never exposed to browser)
|
||||
- name: LLM_API_URL
|
||||
value: "http://api-gateway.api.svc.cluster.local:8080"
|
||||
# Memory service (co-located in poimen namespace)
|
||||
- name: POIMEN_MEMORY_URL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: poimen-config
|
||||
key: POIMEN_MEMORY_URL
|
||||
# OIDC — uses same client as existing poimen services
|
||||
- name: LLM_OIDC_TOKEN_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: OIDC_TOKEN_URL
|
||||
- name: LLM_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-oauth2-creds
|
||||
key: client_id
|
||||
- name: LLM_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-oauth2-creds
|
||||
key: client_secret
|
||||
- name: LLM_OIDC_SCOPE
|
||||
value: "openid llm_inference"
|
||||
# NextAuth
|
||||
- name: NEXTAUTH_URL
|
||||
value: "https://poimen.riotpiao.com"
|
||||
- name: NEXTAUTH_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: NEXTAUTH_SECRET
|
||||
# Gotify (server-side notifications + HITL messages)
|
||||
- name: GOTIFY_URL
|
||||
value: "http://gotify.notifications.svc.cluster.local"
|
||||
- name: GOTIFY_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: GOTIFY_TOKEN
|
||||
# Public env — embedded in browser bundle at build time
|
||||
- name: NEXT_PUBLIC_API_URL
|
||||
value: "https://api.riotpiao.com"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
@@ -0,0 +1,24 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
annotations:
|
||||
# Next.js SSE + LLM streaming responses need long timeouts + no buffering.
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/proxy-buffering: "off"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: poimen.riotpiao.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: poimen-frontend
|
||||
port:
|
||||
number: 3000
|
||||
@@ -0,0 +1,78 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: poimen-frontend-egress
|
||||
namespace: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: poimen-frontend
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
|
||||
ingress:
|
||||
# Allow from ingress-nginx controller → frontend on port 3000
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: ingress-nginx
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 3000
|
||||
|
||||
egress:
|
||||
# DNS — required for all in-cluster service resolution
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
|
||||
# api-gw (api namespace) — all server-side LLM + workflow + memory calls
|
||||
# api-gw NetworkPolicy already allows ingress from poimen namespace.
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: api
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
|
||||
# Memory service (co-located in poimen namespace) — GraphQL session queries
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: poimen
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: poimen-memory
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
|
||||
# Gotify (notifications namespace) — /api/notify/messages server-side poll
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: notifications
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
|
||||
# Authentik (iam namespace) — OIDC token fetch + JWKS verification
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: iam
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
- protocol: TCP
|
||||
port: 9443
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: poimen-frontend
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
# Poimen frontend — Deployment, Service, Ingress for poimen.riotpiao.com.
|
||||
# Part of the `poimen` ArgoCD Application (multi-source, source 4).
|
||||
# All resources deploy into namespace `poimen` (same as workers and memory).
|
||||
# api-gw NetworkPolicy already allows ingress from namespace poimen.
|
||||
# Memory service is co-located — no additional NetworkPolicy needed.
|
||||
resources:
|
||||
- frontend-deployment.yaml
|
||||
- frontend-service.yaml
|
||||
- frontend-ingress.yaml
|
||||
- frontend-networkpolicy.yaml
|
||||
Reference in New Issue
Block a user