Agentic OS Helm / manifest pins (update together when bumping).
Last reviewed: 2026-05-19

Git remote (Argo CD source):
  http://192.168.8.248:3000/deepkoluguri/agentic-os.git
  Optional Argo repo Secret (HTTP / insecure): platform/bootstrap/argocd-gitea-repo-secret.example.yaml

Argo CD bootstrap (one-time kustomize remote resource):
  argoproj/argo-cd v3.4.1  manifests/install.yaml
  File: platform/bootstrap/initial-argocd/kustomization.yaml

Argo CD Applications (Helm charts):
  jetstack/cert-manager              v1.20.2   app-cert-manager.yaml     + ServerSideApply=true
  external-secrets/external-secrets  0.14.4    app-external-secrets.yaml + ServerSideApply=true
  cloudnative-pg/cloudnative-pg      0.24.0    app-cnpg-operator.yaml    + ServerSideApply=true
  temporal/temporal                   0.55.0    app-temporal.yaml  (1.x chart needs values rewrite before bump)
  prometheus-community/kube-prometheus-stack 84.4.0 app-kube-prometheus.yaml

Container images (pinned in manifests):
  ollama/ollama              0.7.0     ai-core/ollama/statefulset.yaml
  ghcr.io/berriai/litellm   v1.55.10  ai-core/litellm/deployment.yaml   (was main-v1.55.10)

Architecture review changes (2026-05-19):
  [SECURITY] Removed stub Secrets from agents/k8s/gumbo-job-template.yaml → replaced with ExternalSecrets
  [SECURITY] Removed hardcoded DB password from ai-core/temporal/helm-values.yaml → ExternalSecret + extraEnv
  [SECURITY] Locked down AppProject sourceRepos from wildcard to explicit list
  [SECURITY] Added pod SecurityContext (runAsNonRoot, no privilege escalation) to Gumbo job
  [SECURITY] Created platform/security/network-policies.yaml for namespace-level segmentation
  [HA]       Scaled CNPG cluster from 1 → 3 instances (1 primary + 2 replicas)
  [HA]       Added MinIO barman backup to CNPG cluster (WAL archiving + PITR)
  [HA]       Added PodDisruptionBudgets for LiteLLM and Ollama
  [OPS]      Added liveness/readiness probes to Ollama and LiteLLM
  [OPS]      Added storageClassName: longhorn to Ollama PVC template
  [OPS]      Updated Ollama from 0.4.4 → 0.7.0
  [OPS]      Fixed LiteLLM image tag from main-v1.55.10 → v1.55.10
  [OPS]      Added revisionHistoryLimit: 3 to LiteLLM deployment
  [OPS]      Added Prometheus scrape annotations to LiteLLM pods
  [OPS]      Added Temporal serviceMonitor for Prometheus
  [OPS]      Added ServerSideApply=true to cert-manager, ESO, CNPG operator apps
  [CI]       Scoped mcp-build.yaml trigger to main branch + tools-mcp/ path
  [CI]       Added SHA-based image tagging to Kaniko build
  [GITOPS]   Fixed static-demo.yaml: added namespace to all resources
  [GITOPS]   Renamed agents-runtime ArgoCD app to agent-gumbo + added sync-wave: 1
  [GITOPS]   Added CNPG backup ExternalSecret to platform/data kustomization
  [GITOPS]   Fixed curio/k8s/app.yaml: replaced hardcoded DATABASE_URL with secretKeyRef

Pending (not yet addressed):
  - Enable HTTPS on Gitea + update repoURL to https://
  - Migrate ai-agents/manifests.yaml Open WebUI into interface/k8s/
  - Add agent-bernard ArgoCD app + bernard k8s manifests
  - Add Alembic / migration Job for gumbo_summaries schema (remove DDL from temporal activity)
  - Add ClusterBackupSchedule CRD for automated CNPG scheduled backups

Verify locally (no cluster required):
  pwsh -File scripts/verify-kustomize.ps1
Optional remote bootstrap check (fetches Argo install.yaml):
  pwsh -File scripts/verify-kustomize.ps1 -IncludeRemoteArgoCD

Helm chart diff (requires helm + repos):
  helm template ...