fix: crap code fix and knwoledge_base (#9)

Co-authored-by: poimen <[email protected]>

k8s/kustomization.yaml

@@ -4,19 +4,19 @@ kind: Kustomization
 namespace: poimen
 
 resources:
-  - poimen-application.yaml
+  - worker-deployment.yaml
+  - workflow-runner-deployment.yaml
+  - workflows-deployment.yaml
+  - git-commit.yaml
+
+# SOPS-encrypted configmap applied separately via KSOPS plugin:
+#   - configmap.enc.yaml
 
 commonLabels:
   app.kubernetes.io/name: poimen
   app.kubernetes.io/component: worker
 
 images:
-  - name: forgejo.riotpiao.com/rock/poimen-memory
-    newName: forgejo.riotpiao.com/rock/poimen-memory
-    newTag: latest
   - name: forgejo.riotpiao.com/rock/poimen-workflows
-    newName: forgejo.riotpiao.com/rock/poimen-workflows
-    newTag: latest
-  - name: forgejo.riotpiao.com/rock/poimen-frontend
-    newName: forgejo.riotpiao.com/rock/poimen-frontend
+    newName: forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows
     newTag: latest

k8s/workflow-runner-deployment.yaml

@@ -0,0 +1,140 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: poimen-workflow-runner-config
+  namespace: poimen
+data:
+  TEMPORAL_HOSTPORT: "temporal-frontend.temporal.svc.cluster.local:7233"
+  TEMPORAL_NAMESPACE: "default"
+  LOG_LEVEL: "info"
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: poimen-workflow-runner
+  namespace: poimen
+  labels:
+    app: poimen-workflow-runner
+    component: workflow-runner
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: poimen-workflow-runner
+  template:
+    metadata:
+      labels:
+        app: poimen-workflow-runner
+        component: workflow-runner
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8081"
+        prometheus.io/path: "/metrics"
+    spec:
+      serviceAccountName: poimen-workflow-runner
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      containers:
+      - name: workflow-runner
+        image: forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows:latest
+        imagePullPolicy: IfNotPresent
+        command: ["./poimen-workflow-runner"]
+        ports:
+        - name: health
+          containerPort: 8081
+          protocol: TCP
+        env:
+        - name: TEMPORAL_HOSTPORT
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-workflow-runner-config
+              key: TEMPORAL_HOSTPORT
+        - name: TEMPORAL_NAMESPACE
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-workflow-runner-config
+              key: TEMPORAL_NAMESPACE
+        - name: LOG_LEVEL
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-workflow-runner-config
+              key: LOG_LEVEL
+        - name: ANTHROPIC_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: poimen-secrets
+              key: anthropic-api-key
+        - name: MEMORY_SERVICE_URL
+          value: "http://poimen-memory.poimen.svc.cluster.local:8080"
+        - name: MEMORY_SERVICE_JWT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: poimen-secrets
+              key: memory-service-jwt
+        resources:
+          requests:
+            cpu: 250m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        livenessProbe:
+          httpGet:
+            path: /health/live
+            port: 8081
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /health/ready
+            port: 8081
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 2
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+      volumes:
+      - name: tmp
+        emptyDir:
+          sizeLimit: 100Mi
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: poimen-workflow-runner
+  namespace: poimen
+  labels:
+    app: poimen-workflow-runner
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: poimen-workflow-runner
+  namespace: poimen
+  labels:
+    app: poimen-workflow-runner
+spec:
+  type: ClusterIP
+  ports:
+  - port: 8081
+    targetPort: 8081
+    protocol: TCP
+    name: health
+  selector:
+    app: poimen-workflow-runner