refactor(poimen): move frontend k8s manifests to poimen-frontend repo
- Remove Deployment/Service/NetworkPolicy from homelab (wrong place)
- Add k8s/apps/poimen-frontend/ with ingress only (edge concern, same as api-gw)
- Update 70-poimen.yaml: source 4 → poimen-frontend.git k8s/
source 5 → homelab k8s/apps/poimen-frontend/ (ingress)
This commit is contained in:
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
# Edge Ingress for poimen.riotpiao.com.
|
||||
# Same pattern as k8s/apps/api/ (api-gw ingress).
|
||||
# App manifests (Deployment, Service, NetworkPolicy) live in
|
||||
# riotpiao-poimen/poimen-frontend.git k8s/ — each repo owns its own k8s.
|
||||
resources:
|
||||
- ingress.yaml
|
||||
@@ -1,108 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
app.kubernetes.io/component: frontend
|
||||
app.kubernetes.io/part-of: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
replicas: 2
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app: poimen-frontend
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
# Admitted by llm-serving-default-deny NetworkPolicy (port 8080).
|
||||
# Required for server-side LLM calls through api-gw.
|
||||
llm-client: "true"
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: forgejo-registry
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
fsGroup: 1001
|
||||
containers:
|
||||
- name: frontend
|
||||
image: forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
env:
|
||||
# In-cluster api-gw (server-side only — never exposed to browser)
|
||||
- name: LLM_API_URL
|
||||
value: "http://api-gateway.api.svc.cluster.local:8080"
|
||||
# Memory service (co-located in poimen namespace)
|
||||
- name: POIMEN_MEMORY_URL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: poimen-config
|
||||
key: POIMEN_MEMORY_URL
|
||||
# OIDC — uses same client as existing poimen services
|
||||
# Use in-cluster Authentik (port 80 → pod 9000) to avoid Cloudflare hairpin.
|
||||
# External URL in poimen-secrets is for out-of-cluster clients only.
|
||||
- name: LLM_OIDC_TOKEN_URL
|
||||
value: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
|
||||
- name: LLM_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: LLM_OIDC_CLIENT_ID
|
||||
- name: LLM_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: LLM_OIDC_CLIENT_SECRET
|
||||
- name: LLM_OIDC_SCOPE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: LLM_OIDC_SCOPE
|
||||
# Gotify (server-side notifications + HITL messages)
|
||||
- name: GOTIFY_URL
|
||||
value: "http://gotify.notifications.svc.cluster.local"
|
||||
- name: GOTIFY_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: poimen-secrets
|
||||
key: GOTIFY_TOKEN
|
||||
# Public env — embedded in browser bundle at build time
|
||||
- name: NEXT_PUBLIC_API_URL
|
||||
value: "https://api.riotpiao.com"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
@@ -1,78 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: poimen-frontend-egress
|
||||
namespace: poimen
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: poimen-frontend
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
|
||||
ingress:
|
||||
# Allow from ingress-nginx controller → frontend on port 3000
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: ingress-nginx
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 3000
|
||||
|
||||
egress:
|
||||
# DNS — required for all in-cluster service resolution
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
|
||||
# api-gw (api namespace) — all server-side LLM + workflow + memory calls
|
||||
# api-gw NetworkPolicy already allows ingress from poimen namespace.
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: api
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
|
||||
# Memory service (co-located in poimen namespace) — GraphQL session queries
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: poimen
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: poimen-memory
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
|
||||
# Gotify (notifications namespace) — /api/notify/messages server-side poll
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: notifications
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
|
||||
# Authentik (iam namespace) — OIDC token fetch + JWKS verification
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: iam
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9000
|
||||
- protocol: TCP
|
||||
port: 9443
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: poimen-frontend
|
||||
namespace: poimen
|
||||
labels:
|
||||
app: poimen-frontend
|
||||
app.kubernetes.io/name: poimen-frontend
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: poimen-frontend
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
# Poimen frontend — Deployment, Service, Ingress for poimen.riotpiao.com.
|
||||
# Part of the `poimen` ArgoCD Application (multi-source, source 4).
|
||||
# All resources deploy into namespace `poimen` (same as workers and memory).
|
||||
# api-gw NetworkPolicy already allows ingress from namespace poimen.
|
||||
# Memory service is co-located — no additional NetworkPolicy needed.
|
||||
resources:
|
||||
- frontend-deployment.yaml
|
||||
- frontend-service.yaml
|
||||
- frontend-ingress.yaml
|
||||
- frontend-networkpolicy.yaml
|
||||
@@ -61,12 +61,17 @@ spec:
|
||||
targetRevision: main
|
||||
path: k8s/infra/poimen
|
||||
|
||||
# 4. Frontend — poimen.riotpiao.com (Deployment, Service, Ingress)
|
||||
# Manifests live in homelab so all infra is in one place (Q4: C).
|
||||
# Image tag managed by Image Updater above.
|
||||
# 4. Frontend app manifests — Deployment, Service, NetworkPolicy.
|
||||
# Each repo owns its own k8s/ (same pattern as homelab-frontend for api-gw).
|
||||
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend.git
|
||||
targetRevision: main
|
||||
path: k8s
|
||||
|
||||
# 5. Frontend ingress — poimen.riotpiao.com edge route.
|
||||
# Lives in homelab (same pattern as k8s/apps/api/ for api-gw).
|
||||
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
||||
targetRevision: main
|
||||
path: k8s/apps/poimen
|
||||
path: k8s/apps/poimen-frontend
|
||||
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
|
||||
Reference in New Issue
Block a user