feat(poimen): consolidate into single multi-source ArgoCD app
- Merge poimen-workflows + poimen-memory + db + frontend into one app - Delete duplicate apps: poimen-workflows, poimen-memory-app (kubectl done) - Delete poimen-memory ArgoCD app file (replaced by multi-source source 2) - Delete poimen-memory-database (replaced by source 3 → k8s/infra/poimen/) - Move memory-db CNPG cluster to k8s/infra/poimen/ (isolated from other tenants) - Remove memory-db from k8s/infra/databases/kustomization.yaml - Add frontend manifests (Deployment, Service, Ingress) to k8s/apps/poimen/ - Add frontend NetworkPolicy: egress to api-gw (api:8080), memory (poimen:8080), Gotify (notifications:80), Authentik (iam:9000/9443), DNS (kube-system:53) - Sync-wave -1 on CNPG cluster ensures DB ready before app pods (wave 0) - Image updater: workflows + memory + frontend tracked in one annotation block - poimen-toolkit stays separate (CRD management, independent rollback)
This commit is contained in:
@@ -0,0 +1,114 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
app.kubernetes.io/component: frontend
|
||||
app.kubernetes.io/part-of: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
replicas: 2
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app: poimen-frontend
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
# Admitted by llm-serving-default-deny NetworkPolicy (port 8080).
|
||||
# Required for server-side LLM calls through api-gw.
|
||||
llm-client: "true"
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: forgejo-registry
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
fsGroup: 1001
|
||||
containers:
|
||||
- name: frontend
|
||||
image: forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
env:
|
||||
# In-cluster api-gw (server-side only — never exposed to browser)
|
||||
- name: LLM_API_URL
|
||||
value: "http://api-gateway.api.svc.cluster.local:8080"
|
||||
# Memory service (co-located in poimen namespace)
|
||||
- name: POIMEN_MEMORY_URL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: poimen-config
|
||||
key: POIMEN_MEMORY_URL
|
||||
# OIDC — uses same client as existing poimen services
|
||||
- name: LLM_OIDC_TOKEN_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: OIDC_TOKEN_URL
|
||||
- name: LLM_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-oauth2-creds
|
||||
key: client_id
|
||||
- name: LLM_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-oauth2-creds
|
||||
key: client_secret
|
||||
- name: LLM_OIDC_SCOPE
|
||||
value: "openid llm_inference"
|
||||
# NextAuth
|
||||
- name: NEXTAUTH_URL
|
||||
value: "https://poimen.riotpiao.com"
|
||||
- name: NEXTAUTH_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: NEXTAUTH_SECRET
|
||||
# Gotify (server-side notifications + HITL messages)
|
||||
- name: GOTIFY_URL
|
||||
value: "http://gotify.notifications.svc.cluster.local"
|
||||
- name: GOTIFY_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: GOTIFY_TOKEN
|
||||
# Public env — embedded in browser bundle at build time
|
||||
- name: NEXT_PUBLIC_API_URL
|
||||
value: "https://api.riotpiao.com"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
@@ -0,0 +1,24 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
annotations:
|
||||
# Next.js SSE + LLM streaming responses need long timeouts + no buffering.
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/proxy-buffering: "off"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: poimen.riotpiao.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: poimen-frontend
|
||||
port:
|
||||
number: 3000
|
||||
@@ -0,0 +1,78 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: poimen-frontend-egress
|
||||
namespace: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: poimen-frontend
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
|
||||
ingress:
|
||||
# Allow from ingress-nginx controller → frontend on port 3000
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: ingress-nginx
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 3000
|
||||
|
||||
egress:
|
||||
# DNS — required for all in-cluster service resolution
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
|
||||
# api-gw (api namespace) — all server-side LLM + workflow + memory calls
|
||||
# api-gw NetworkPolicy already allows ingress from poimen namespace.
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: api
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
|
||||
# Memory service (co-located in poimen namespace) — GraphQL session queries
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: poimen
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: poimen-memory
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
|
||||
# Gotify (notifications namespace) — /api/notify/messages server-side poll
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: notifications
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
|
||||
# Authentik (iam namespace) — OIDC token fetch + JWKS verification
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: iam
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
- protocol: TCP
|
||||
port: 9443
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: poimen-frontend
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
# Poimen frontend — Deployment, Service, Ingress for poimen.riotpiao.com.
|
||||
# Part of the `poimen` ArgoCD Application (multi-source, source 4).
|
||||
# All resources deploy into namespace `poimen` (same as workers and memory).
|
||||
# api-gw NetworkPolicy already allows ingress from namespace poimen.
|
||||
# Memory service is co-located — no additional NetworkPolicy needed.
|
||||
resources:
|
||||
- frontend-deployment.yaml
|
||||
- frontend-service.yaml
|
||||
- frontend-ingress.yaml
|
||||
- frontend-networkpolicy.yaml
|
||||
@@ -1,41 +0,0 @@
|
||||
# Wave 7 — poimen-memory k8s resources (namespace poimen).
|
||||
#
|
||||
# Manages: Deployment, Service, ConfigMap, Redis cache, NetworkPolicies,
|
||||
# ServiceMonitor, and any future k8s infra owned by the memory service.
|
||||
# Image updates handled by argocd-image-updater (digest strategy, :latest tag).
|
||||
#
|
||||
# Source: riotpiao-poimen/poimen-memory.git k8s/app/
|
||||
# Kustomization at k8s/app/kustomization.yaml lists all managed resources.
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: poimen-memory
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "7"
|
||||
argocd-image-updater.argoproj.io/image-list: |
|
||||
memory=forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
|
||||
argocd-image-updater.argoproj.io/memory.update-strategy: digest
|
||||
argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
|
||||
argocd-image-updater.argoproj.io/write-back-method: argocd
|
||||
spec:
|
||||
project: homelab
|
||||
source:
|
||||
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-memory.git
|
||||
targetRevision: main
|
||||
path: k8s/app
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: poimen
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
@@ -1,37 +1,84 @@
|
||||
# Poimen — unified ArgoCD Application (wave 7).
|
||||
#
|
||||
# Consolidates what was previously five separate apps:
|
||||
# poimen → source 1 (poimen-workflows workers)
|
||||
# poimen-workflows → duplicate of source 1 (deleted)
|
||||
# poimen-memory → source 2 (memory service + redis)
|
||||
# poimen-memory-app → duplicate of source 2 (deleted)
|
||||
# poimen-memory-database → source 3 (CNPG cluster, moved to k8s/infra/poimen)
|
||||
#
|
||||
# poimen-toolkit is intentionally kept as a separate Application because it
|
||||
# manages cluster-scoped CRDs (ToolDefinition). A bad CRD can affect the
|
||||
# whole cluster; keeping it separate means it has its own sync history,
|
||||
# independent rollback, and can be paused without touching app workloads.
|
||||
#
|
||||
# Sync ordering via argocd sync-wave annotations:
|
||||
# wave -1 → DB (CNPG Cluster) — must be Ready before app pods start
|
||||
# wave 0 → all application Deployments (default)
|
||||
#
|
||||
# Image Updater tracks all four images. Write-back via argocd (in-cluster
|
||||
# annotation patch — no git commit per image update).
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: poimen
|
||||
namespace: argocd
|
||||
labels:
|
||||
app.kubernetes.io/part-of: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "7"
|
||||
# Image Updater: auto-update on new image push (SHA tag filter)
|
||||
# ── Image Updater ─────────────────────────────────────────────────────────
|
||||
argocd-image-updater.argoproj.io/image-list: |
|
||||
memory=forgejo.riotpiao.com/rock/poimen-memory
|
||||
workflows=forgejo.riotpiao.com/rock/poimen-workflows
|
||||
frontend=forgejo.riotpiao.com/rock/poimen-frontend
|
||||
argocd-image-updater.argoproj.io/memory.update-strategy: digest
|
||||
argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
|
||||
workflows=forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows
|
||||
memory=forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
|
||||
frontend=forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend
|
||||
argocd-image-updater.argoproj.io/workflows.update-strategy: digest
|
||||
argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^latest$
|
||||
argocd-image-updater.argoproj.io/memory.update-strategy: digest
|
||||
argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
|
||||
argocd-image-updater.argoproj.io/frontend.update-strategy: digest
|
||||
argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^latest$
|
||||
argocd-image-updater.argoproj.io/write-back-method: argocd
|
||||
spec:
|
||||
project: homelab
|
||||
source:
|
||||
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows.git
|
||||
targetRevision: main
|
||||
path: k8s
|
||||
# Multi-source: each repo owns its own k8s manifests.
|
||||
# ArgoCD syncs all sources in parallel; sync-wave annotations on individual
|
||||
# resources control ordering within the sync operation.
|
||||
sources:
|
||||
# 1. Workers — Temporal activity + workflow workers, pi-worker pool
|
||||
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows.git
|
||||
targetRevision: main
|
||||
path: k8s
|
||||
|
||||
# 2. Memory service — poimen-memory API, Redis cache, NetworkPolicies
|
||||
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-memory.git
|
||||
targetRevision: main
|
||||
path: k8s/app
|
||||
|
||||
# 3. Database infrastructure — CNPG Postgres cluster (wave -1)
|
||||
# Moved from k8s/infra/databases to isolate poimen DB from other tenants.
|
||||
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
||||
targetRevision: main
|
||||
path: k8s/infra/poimen
|
||||
|
||||
# 4. Frontend — poimen.riotpiao.com (Deployment, Service, Ingress)
|
||||
# Manifests live in homelab so all infra is in one place (Q4: C).
|
||||
# Image tag managed by Image Updater above.
|
||||
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
||||
targetRevision: main
|
||||
path: k8s/apps/poimen
|
||||
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: poimen
|
||||
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- SkipDryRunOnMissingResource=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
|
||||
@@ -8,5 +8,4 @@ resources:
|
||||
- namespaces.yaml
|
||||
- authentik-db.yaml
|
||||
- temporal-db.yaml
|
||||
- memory-db.yaml
|
||||
- paperless-db.yaml
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
# Poimen infrastructure — CNPG Postgres for memory service.
|
||||
# Part of the `poimen` ArgoCD Application (multi-source, source 3).
|
||||
# Sync-wave -1 ensures the DB cluster is healthy before application
|
||||
# deployments (wave 0) are applied.
|
||||
resources:
|
||||
- memory-db.yaml
|
||||
@@ -0,0 +1,37 @@
|
||||
# Dedicated CNPG Postgres for Poimen Memory (GitOps, wave 2).
|
||||
# Uses default longhorn storage class (3 replicas, dataLocality disabled).
|
||||
# CNPG generates secret `memory-db-app` + service `memory-db-rw` in ns poimen.
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: memory-db
|
||||
namespace: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-1"
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
spec:
|
||||
instances: 3
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: memory
|
||||
owner: app
|
||||
encoding: UTF8
|
||||
localeCollate: C
|
||||
localeCType: C
|
||||
postInitApplicationSQL:
|
||||
- "CREATE EXTENSION vector;"
|
||||
enableSuperuserAccess: false
|
||||
resources:
|
||||
requests: { memory: "512Mi", cpu: "250m" }
|
||||
limits: { memory: "2Gi", cpu: "1" }
|
||||
storage:
|
||||
size: 20Gi
|
||||
storageClass: longhorn
|
||||
affinity:
|
||||
podAntiAffinityType: preferred
|
||||
topologyKey: kubernetes.io/hostname
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
Reference in New Issue
Block a user