k8s/services: add ingress networking portainer llm and project guides

- Nginx ingress + TLS termination (homelab-ca) - Portainer container UI - CoreDNS internal DNS rewrites - DuckDNS DDNS updater - Ollama LLM inference - 8 project-usage guides (team reference)
2026-07-11 19:17:54 -07:00
parent 1c02e2b831
commit 6d5a0ba205
26 changed files with 3280 additions and 0 deletions
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: ollama
+description: CPU-only Ollama LLM server with MinIO model registry
+type: application
+version: 0.1.0
+appVersion: "latest"
@@ -0,0 +1,126 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ollama
+  namespace: llm
+  labels:
+    app.kubernetes.io/name: ollama
+    app.kubernetes.io/part-of: llm
+spec:
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ollama
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ollama
+        app.kubernetes.io/part-of: llm
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/zone
+                    operator: In
+                    values:
+                      - {{ .Values.nodeAffinity.zone }}
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Equal
+          value: ""
+          effect: NoSchedule
+
+      initContainers:
+        - name: preload-model
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              echo "Starting Ollama server for model preload..."
+              ollama serve &
+              OLLAMA_PID=$!
+              sleep 10
+              {{- range .Values.preloadJob.hotModels }}
+              echo "Preloading {{ . }}..."
+              if ollama ls | grep -q "{{ . }}"; then
+                echo "✓ {{ . }} already cached"
+              else
+                ollama pull {{ . }}
+              fi
+              {{- end }}
+              echo "Model preload complete"
+              kill $OLLAMA_PID || true
+              wait $OLLAMA_PID 2>/dev/null || true
+          volumeMounts:
+            - name: models-cache
+              mountPath: /root/.ollama/models
+          env:
+            - name: OLLAMA_HOST
+              value: "127.0.0.1:11434"
+
+      containers:
+        - name: ollama
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: 11434
+              name: http
+          env:
+            {{- range $key, $value := .Values.env }}
+            - name: {{ $key }}
+              value: "{{ $value }}"
+            {{- end }}
+            - name: OLLAMA_MODELS_MINIO_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: ollama-minio
+                  key: endpoint
+            - name: OLLAMA_MODELS_MINIO_BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: ollama-minio
+                  key: bucket
+            - name: OLLAMA_MODELS_MINIO_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ollama-minio
+                  key: access_key
+            - name: OLLAMA_MODELS_MINIO_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ollama-minio
+                  key: secret_key
+          resources:
+            requests:
+              cpu: {{ .Values.resources.requests.cpu }}
+              memory: {{ .Values.resources.requests.memory }}
+            limits:
+              cpu: {{ .Values.resources.limits.cpu }}
+              memory: {{ .Values.resources.limits.memory }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 11434
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 11434
+            initialDelaySeconds: 10
+            periodSeconds: 5
+          volumeMounts:
+            - name: models-cache
+              mountPath: /root/.ollama/models
+
+      volumes:
+        - name: models-cache
+          persistentVolumeClaim:
+            claimName: ollama-models-cache
@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ollama-access
+  namespace: llm
+  labels:
+    app.kubernetes.io/name: ollama
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: ollama
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: llm-worker
+      ports:
+        - protocol: TCP
+          port: 11434
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/role: llm-debug
+      ports:
+        - protocol: TCP
+          port: 11434
@@ -0,0 +1,92 @@
+{{- if .Values.preloadJob.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ollama-preload
+  namespace: llm
+  labels:
+    app.kubernetes.io/name: ollama-preload
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: default
+      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/zone
+                    operator: In
+                    values:
+                      - az-a
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Equal
+          effect: NoSchedule
+      initContainers:
+        - name: model-cache-init
+          image: ollama/ollama:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              echo "Starting Ollama server to cache models..."
+              ollama serve &
+              OLLAMA_PID=$!
+              sleep 10
+              echo "Caching hot-tier models..."
+              {{- range .Values.preloadJob.hotModels }}
+              echo "Checking if {{ . }} is cached..."
+              if ollama ls | grep -q "{{ . }}"; then
+                echo "✓ {{ . }} already cached, skipping"
+              else
+                echo "Pulling {{ . }}..."
+                ollama pull {{ . }}
+              fi
+              {{- end }}
+              echo "Model cache initialization complete"
+              kill $OLLAMA_PID || true
+              wait $OLLAMA_PID 2>/dev/null || true
+          volumeMounts:
+            - name: models
+              mountPath: /root/.ollama
+          env:
+            - name: OLLAMA_HOST
+              value: "127.0.0.1:11434"
+
+      containers:
+        - name: cache-populate
+          image: curlimages/curl:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              echo "Waiting for Ollama pod to be ready..."
+              until curl -f http://ollama.llm.svc.cluster.local:11434/api/tags 2>/dev/null; do
+                echo "Ollama not ready, waiting..."
+                sleep 5
+              done
+              echo "Ollama is ready, populating local cache..."
+              {{- range .Values.preloadJob.hotModels }}
+              echo "Checking if {{ . }} is already cached..."
+              if curl -s http://ollama.llm.svc.cluster.local:11434/api/tags | grep -q "{{ . }}"; then
+                echo "✓ {{ . }} already cached, skipping"
+              else
+                echo "Caching {{ . }} locally..."
+                curl -X POST http://ollama.llm.svc.cluster.local:11434/api/pull \
+                  -H "Content-Type: application/json" \
+                  -d '{"name":"{{ . }}","stream":false}'
+              fi
+              {{- end }}
+              echo "Local cache population complete"
+
+      volumes:
+        - name: models
+          emptyDir: {}
+{{- end }}
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ollama-models-cache
+  namespace: llm
+  labels:
+    app.kubernetes.io/name: ollama
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: {{ .Values.pvc.storageClassName }}
+  resources:
+    requests:
+      storage: {{ .Values.pvc.size }}
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ollama
+  namespace: llm
+  labels:
+    app.kubernetes.io/name: ollama
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: ollama
@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-llm
+  labels:
+    app.kubernetes.io/name: ollama
+provisioner: driver.longhorn.io
+parameters:
+  numberOfReplicas: "1"
+  staleReplicaTimeout: "2880"
+reclaimPolicy: Retain
+allowVolumeExpansion: true
@@ -0,0 +1,40 @@
+replicaCount: 1
+
+image:
+  repository: ollama/ollama
+  pullPolicy: IfNotPresent
+  tag: "latest"
+
+service:
+  type: ClusterIP
+  port: 11434
+
+resources:
+  requests:
+    cpu: 8
+    memory: 60Gi
+  limits:
+    cpu: 16
+    memory: 100Gi
+
+pvc:
+  enabled: true
+  size: 115Gi
+  storageClassName: longhorn-llm
+
+nodeAffinity:
+  zone: az-a
+
+env:
+  OLLAMA_MODELS: /root/.ollama/models
+  OLLAMA_MAX_LOADED_MODELS: "2"
+  OLLAMA_NUM_PARALLEL: "2"
+  OLLAMA_MAX_QUEUE: "64"
+  OLLAMA_KEEP_ALIVE: "-1"
+  OLLAMA_HOST: "0.0.0.0:11434"
+
+preloadJob:
+  enabled: false
+  hotModels:
+    - ornith:35b
+    - deepseek-r1:70b