From c04ed6136b52f412193ff719f36ab16795d204bd Mon Sep 17 00:00:00 2001 From: rock Date: Mon, 28 Sep 2026 09:13:02 +0800 Subject: [PATCH] refactor(poimen): move frontend k8s manifests to poimen-frontend repo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove Deployment/Service/NetworkPolicy from homelab (wrong place) - Add k8s/apps/poimen-frontend/ with ingress only (edge concern, same as api-gw) - Update 70-poimen.yaml: source 4 → poimen-frontend.git k8s/ source 5 → homelab k8s/apps/poimen-frontend/ (ingress) --- .../ingress.yaml} | 0 k8s/apps/poimen-frontend/kustomization.yaml | 8 ++ k8s/apps/poimen/frontend-deployment.yaml | 108 ------------------ k8s/apps/poimen/frontend-networkpolicy.yaml | 78 ------------- k8s/apps/poimen/frontend-service.yaml | 17 --- k8s/apps/poimen/kustomization.yaml | 12 -- k8s/argocd/apps/70-poimen.yaml | 13 ++- 7 files changed, 17 insertions(+), 219 deletions(-) rename k8s/apps/{poimen/frontend-ingress.yaml => poimen-frontend/ingress.yaml} (100%) create mode 100644 k8s/apps/poimen-frontend/kustomization.yaml delete mode 100644 k8s/apps/poimen/frontend-deployment.yaml delete mode 100644 k8s/apps/poimen/frontend-networkpolicy.yaml delete mode 100644 k8s/apps/poimen/frontend-service.yaml delete mode 100644 k8s/apps/poimen/kustomization.yaml diff --git a/k8s/apps/poimen/frontend-ingress.yaml b/k8s/apps/poimen-frontend/ingress.yaml similarity index 100% rename from k8s/apps/poimen/frontend-ingress.yaml rename to k8s/apps/poimen-frontend/ingress.yaml diff --git a/k8s/apps/poimen-frontend/kustomization.yaml b/k8s/apps/poimen-frontend/kustomization.yaml new file mode 100644 index 0000000..d6e5c12 --- /dev/null +++ b/k8s/apps/poimen-frontend/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +# Edge Ingress for poimen.riotpiao.com. +# Same pattern as k8s/apps/api/ (api-gw ingress). +# App manifests (Deployment, Service, NetworkPolicy) live in +# riotpiao-poimen/poimen-frontend.git k8s/ — each repo owns its own k8s. +resources: + - ingress.yaml diff --git a/k8s/apps/poimen/frontend-deployment.yaml b/k8s/apps/poimen/frontend-deployment.yaml deleted file mode 100644 index 985cd18..0000000 --- a/k8s/apps/poimen/frontend-deployment.yaml +++ /dev/null @@ -1,108 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: poimen-frontend - namespace: poimen - labels: - app: poimen-frontend - app.kubernetes.io/name: poimen-frontend - app.kubernetes.io/component: frontend - app.kubernetes.io/part-of: poimen - annotations: - argocd.argoproj.io/sync-wave: "0" - reloader.stakater.com/auto: "true" -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - selector: - matchLabels: - app: poimen-frontend - template: - metadata: - labels: - app: poimen-frontend - app.kubernetes.io/name: poimen-frontend - # Admitted by llm-serving-default-deny NetworkPolicy (port 8080). - # Required for server-side LLM calls through api-gw. - llm-client: "true" - spec: - imagePullSecrets: - - name: forgejo-registry - securityContext: - runAsNonRoot: true - runAsUser: 1001 - fsGroup: 1001 - containers: - - name: frontend - image: forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend:latest - imagePullPolicy: Always - ports: - - name: http - containerPort: 3000 - protocol: TCP - env: - # In-cluster api-gw (server-side only — never exposed to browser) - - name: LLM_API_URL - value: "http://api-gateway.api.svc.cluster.local:8080" - # Memory service (co-located in poimen namespace) - - name: POIMEN_MEMORY_URL - valueFrom: - configMapKeyRef: - name: poimen-config - key: POIMEN_MEMORY_URL - # OIDC — uses same client as existing poimen services - # Use in-cluster Authentik (port 80 → pod 9000) to avoid Cloudflare hairpin. - # External URL in poimen-secrets is for out-of-cluster clients only. - - name: LLM_OIDC_TOKEN_URL - value: "http://authentik-server.iam.svc.cluster.local/application/o/token/" - - name: LLM_OIDC_CLIENT_ID - valueFrom: - secretKeyRef: - name: poimen-secrets - key: LLM_OIDC_CLIENT_ID - - name: LLM_OIDC_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: poimen-secrets - key: LLM_OIDC_CLIENT_SECRET - - name: LLM_OIDC_SCOPE - valueFrom: - secretKeyRef: - name: poimen-secrets - key: LLM_OIDC_SCOPE - # Gotify (server-side notifications + HITL messages) - - name: GOTIFY_URL - value: "http://gotify.notifications.svc.cluster.local" - - name: GOTIFY_TOKEN - valueFrom: - secretKeyRef: - name: poimen-secrets - key: GOTIFY_TOKEN - # Public env — embedded in browser bundle at build time - - name: NEXT_PUBLIC_API_URL - value: "https://api.riotpiao.com" - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 1000m - memory: 512Mi - readinessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 3 - livenessProbe: - httpGet: - path: / - port: http - initialDelaySeconds: 30 - periodSeconds: 30 - failureThreshold: 3 diff --git a/k8s/apps/poimen/frontend-networkpolicy.yaml b/k8s/apps/poimen/frontend-networkpolicy.yaml deleted file mode 100644 index 04b93a6..0000000 --- a/k8s/apps/poimen/frontend-networkpolicy.yaml +++ /dev/null @@ -1,78 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: poimen-frontend-egress - namespace: poimen - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - podSelector: - matchLabels: - app: poimen-frontend - policyTypes: - - Ingress - - Egress - - ingress: - # Allow from ingress-nginx controller → frontend on port 3000 - - from: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: ingress-nginx - ports: - - protocol: TCP - port: 3000 - - egress: - # DNS — required for all in-cluster service resolution - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: kube-system - ports: - - protocol: UDP - port: 53 - - protocol: TCP - port: 53 - - # api-gw (api namespace) — all server-side LLM + workflow + memory calls - # api-gw NetworkPolicy already allows ingress from poimen namespace. - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: api - ports: - - protocol: TCP - port: 8080 - - # Memory service (co-located in poimen namespace) — GraphQL session queries - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: poimen - podSelector: - matchLabels: - app.kubernetes.io/name: poimen-memory - ports: - - protocol: TCP - port: 8080 - - # Gotify (notifications namespace) — /api/notify/messages server-side poll - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: notifications - ports: - - protocol: TCP - port: 80 - - # Authentik (iam namespace) — OIDC token fetch + JWKS verification - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: iam - ports: - - protocol: TCP - port: 9000 - - protocol: TCP - port: 9443 diff --git a/k8s/apps/poimen/frontend-service.yaml b/k8s/apps/poimen/frontend-service.yaml deleted file mode 100644 index 22102d3..0000000 --- a/k8s/apps/poimen/frontend-service.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: poimen-frontend - namespace: poimen - labels: - app: poimen-frontend - app.kubernetes.io/name: poimen-frontend -spec: - type: ClusterIP - selector: - app: poimen-frontend - ports: - - name: http - port: 3000 - targetPort: http - protocol: TCP diff --git a/k8s/apps/poimen/kustomization.yaml b/k8s/apps/poimen/kustomization.yaml deleted file mode 100644 index 59c2980..0000000 --- a/k8s/apps/poimen/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -# Poimen frontend — Deployment, Service, Ingress for poimen.riotpiao.com. -# Part of the `poimen` ArgoCD Application (multi-source, source 4). -# All resources deploy into namespace `poimen` (same as workers and memory). -# api-gw NetworkPolicy already allows ingress from namespace poimen. -# Memory service is co-located — no additional NetworkPolicy needed. -resources: - - frontend-deployment.yaml - - frontend-service.yaml - - frontend-ingress.yaml - - frontend-networkpolicy.yaml diff --git a/k8s/argocd/apps/70-poimen.yaml b/k8s/argocd/apps/70-poimen.yaml index 1a40cfd..0f50c92 100644 --- a/k8s/argocd/apps/70-poimen.yaml +++ b/k8s/argocd/apps/70-poimen.yaml @@ -61,12 +61,17 @@ spec: targetRevision: main path: k8s/infra/poimen - # 4. Frontend — poimen.riotpiao.com (Deployment, Service, Ingress) - # Manifests live in homelab so all infra is in one place (Q4: C). - # Image tag managed by Image Updater above. + # 4. Frontend app manifests — Deployment, Service, NetworkPolicy. + # Each repo owns its own k8s/ (same pattern as homelab-frontend for api-gw). + - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend.git + targetRevision: main + path: k8s + + # 5. Frontend ingress — poimen.riotpiao.com edge route. + # Lives in homelab (same pattern as k8s/apps/api/ for api-gw). - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git targetRevision: main - path: k8s/apps/poimen + path: k8s/apps/poimen-frontend destination: server: https://kubernetes.default.svc