rock
985bb7ff46
CI / CI (pull_request) Successful in 32m52s
- config.yaml: prod config with cluster-internal DNS (LLM, OpenSearch, Authentik, Temporal, API-GW) - config.local.yaml: dev config with external URLs via ingress - deployment.yaml: remove hardcoded URIs, read all from ConfigMap envFrom - All downstream service URIs now configurable per environment - Production config encrypted with SOPS (Age-based) - Application code reads LLM_ENDPOINT, OPENSEARCH_HOST, AUTHENTIK_ISSUER, etc. from ENV - Simplifies prod/dev switching: just swap ConfigMap, no code changes
50 lines
1.6 KiB
YAML
50 lines
1.6 KiB
YAML
# Production environment configuration for poimen-memory
|
|
# All services use cluster-internal DNS names
|
|
# This file is encrypted with SOPS in production
|
|
# For local dev, use plaintext version with external URLs
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: poimen-memory-config
|
|
namespace: poimen
|
|
labels:
|
|
app.kubernetes.io/name: poimen-memory
|
|
app.kubernetes.io/component: config
|
|
data:
|
|
# Auth mode: jwt | apikey | none
|
|
MEM_AUTH_MODE: "jwt"
|
|
|
|
# Rate limiting
|
|
MEM_RATE_LIMIT_INGEST: "100"
|
|
MEM_RATE_LIMIT_QUERY: "1000"
|
|
MEM_IDEMPOTENCY_TTL_SECS: "86400"
|
|
|
|
# Embeddings
|
|
MEM_EMBEDDING_BATCH_SIZE: "32"
|
|
|
|
# Downstream services - read by application from ENV
|
|
# Internal cluster DNS (prod) / external URLs (local)
|
|
|
|
# LLM Service (entity extraction, fact extraction)
|
|
LLM_ENDPOINT: "http://reasoning-predictor.llm-serving.svc.cluster.local:8000/v1/chat/completions"
|
|
LLM_API_BASE: "http://reasoning-predictor.llm-serving.svc.cluster.local:8000/v1"
|
|
LLM_MODEL: "ornith:35b"
|
|
LLM_TIMEOUT_SECS: "30"
|
|
ENABLE_LLM_EXTRACTION: "true"
|
|
|
|
# OpenSearch (vector store, BM25 retrieval)
|
|
OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
|
|
OPENSEARCH_SCHEME: "http"
|
|
OPENSEARCH_VERIFY_CERTS: "false"
|
|
|
|
# Authentik (OIDC provider)
|
|
AUTHENTIK_ISSUER: "https://authentik.auth.svc.cluster.local:9443/application/o/poimen/"
|
|
AUTHENTIK_VERIFY_SSL: "false"
|
|
|
|
# Temporal (workflow orchestration - future)
|
|
TEMPORAL_ENDPOINT: "temporal-frontend.temporal.svc.cluster.local:7233"
|
|
TEMPORAL_NAMESPACE: "poimen"
|
|
|
|
# API Gateway (external queue, route optimization - future)
|
|
GATEWAY_URL: "http://api-gw.poimen.svc.cluster.local:8080"
|