61 lines
3.5 KiB
Plaintext
61 lines
3.5 KiB
Plaintext
Agentic OS Helm / manifest pins (update together when bumping).
|
|
Last reviewed: 2026-05-19
|
|
|
|
Git remote (Argo CD source):
|
|
http://192.168.8.248:3000/deepkoluguri/agentic-os.git
|
|
Optional Argo repo Secret (HTTP / insecure): platform/bootstrap/argocd-gitea-repo-secret.example.yaml
|
|
|
|
Argo CD bootstrap (one-time kustomize remote resource):
|
|
argoproj/argo-cd v3.4.1 manifests/install.yaml
|
|
File: platform/bootstrap/initial-argocd/kustomization.yaml
|
|
|
|
Argo CD Applications (Helm charts):
|
|
jetstack/cert-manager v1.20.2 app-cert-manager.yaml + ServerSideApply=true
|
|
external-secrets/external-secrets 0.14.4 app-external-secrets.yaml + ServerSideApply=true
|
|
cloudnative-pg/cloudnative-pg 0.24.0 app-cnpg-operator.yaml + ServerSideApply=true
|
|
temporal/temporal 0.55.0 app-temporal.yaml (1.x chart needs values rewrite before bump)
|
|
prometheus-community/kube-prometheus-stack 84.4.0 app-kube-prometheus.yaml
|
|
|
|
Container images (pinned in manifests):
|
|
ollama/ollama 0.7.0 ai-core/ollama/statefulset.yaml
|
|
ghcr.io/berriai/litellm v1.55.10 ai-core/litellm/deployment.yaml (was main-v1.55.10)
|
|
|
|
Architecture review changes (2026-05-19):
|
|
[SECURITY] Removed stub Secrets from agents/k8s/gumbo-job-template.yaml → replaced with ExternalSecrets
|
|
[SECURITY] Removed hardcoded DB password from ai-core/temporal/helm-values.yaml → ExternalSecret + extraEnv
|
|
[SECURITY] Locked down AppProject sourceRepos from wildcard to explicit list
|
|
[SECURITY] Added pod SecurityContext (runAsNonRoot, no privilege escalation) to Gumbo job
|
|
[SECURITY] Created platform/security/network-policies.yaml for namespace-level segmentation
|
|
[HA] Scaled CNPG cluster from 1 → 3 instances (1 primary + 2 replicas)
|
|
[HA] Added MinIO barman backup to CNPG cluster (WAL archiving + PITR)
|
|
[HA] Added PodDisruptionBudgets for LiteLLM and Ollama
|
|
[OPS] Added liveness/readiness probes to Ollama and LiteLLM
|
|
[OPS] Added storageClassName: longhorn to Ollama PVC template
|
|
[OPS] Updated Ollama from 0.4.4 → 0.7.0
|
|
[OPS] Fixed LiteLLM image tag from main-v1.55.10 → v1.55.10
|
|
[OPS] Added revisionHistoryLimit: 3 to LiteLLM deployment
|
|
[OPS] Added Prometheus scrape annotations to LiteLLM pods
|
|
[OPS] Added Temporal serviceMonitor for Prometheus
|
|
[OPS] Added ServerSideApply=true to cert-manager, ESO, CNPG operator apps
|
|
[CI] Scoped mcp-build.yaml trigger to main branch + tools-mcp/ path
|
|
[CI] Added SHA-based image tagging to Kaniko build
|
|
[GITOPS] Fixed static-demo.yaml: added namespace to all resources
|
|
[GITOPS] Renamed agents-runtime ArgoCD app to agent-gumbo + added sync-wave: 1
|
|
[GITOPS] Added CNPG backup ExternalSecret to platform/data kustomization
|
|
[GITOPS] Fixed curio/k8s/app.yaml: replaced hardcoded DATABASE_URL with secretKeyRef
|
|
|
|
Pending (not yet addressed):
|
|
- Enable HTTPS on Gitea + update repoURL to https://
|
|
- Migrate ai-agents/manifests.yaml Open WebUI into interface/k8s/
|
|
- Add agent-bernard ArgoCD app + bernard k8s manifests
|
|
- Add Alembic / migration Job for gumbo_summaries schema (remove DDL from temporal activity)
|
|
- Add ClusterBackupSchedule CRD for automated CNPG scheduled backups
|
|
|
|
Verify locally (no cluster required):
|
|
pwsh -File scripts/verify-kustomize.ps1
|
|
Optional remote bootstrap check (fetches Argo install.yaml):
|
|
pwsh -File scripts/verify-kustomize.ps1 -IncludeRemoteArgoCD
|
|
|
|
Helm chart diff (requires helm + repos):
|
|
helm template ...
|