490db8f9e6
Bumps tag to bring live pod up to FlowerCore.Intranet.Web@a9ede80 (master tip post-fleet-search-resurrect merge). Image imported to all 3 RKE2 nodes via scripts/deploy.sh v20260505-1108. Closes the source-vs-deployed gap that existed since 2026-04-29: the KnowledgeFleetSearchController + Service + TrustedHeader auth handler were running on the deployed pod but never landed on master. Surgical extraction from stale codex/fleet-knowledge-search branch (12-file rebase conflict made full merge non-trivial) brings the source up to match production. +7 tests (280/280 vs 273), 0W/0E build. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
154 lines
3.8 KiB
YAML
154 lines
3.8 KiB
YAML
apiVersion: v1
|
||
kind: Namespace
|
||
metadata:
|
||
name: intranet
|
||
---
|
||
apiVersion: v1
|
||
kind: PersistentVolumeClaim
|
||
metadata:
|
||
name: intranet-vector-store
|
||
namespace: intranet
|
||
spec:
|
||
accessModes:
|
||
- ReadWriteOnce
|
||
storageClassName: longhorn
|
||
resources:
|
||
requests:
|
||
storage: 1Gi
|
||
---
|
||
apiVersion: v1
|
||
kind: ConfigMap
|
||
metadata:
|
||
name: intranet-config
|
||
namespace: intranet
|
||
data:
|
||
KnowledgeApiKey: ""
|
||
TrustedHeaderSharedSecret: ""
|
||
---
|
||
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: intranet-web
|
||
namespace: intranet
|
||
labels:
|
||
app: intranet-web
|
||
spec:
|
||
replicas: 1
|
||
strategy:
|
||
type: Recreate
|
||
selector:
|
||
matchLabels:
|
||
app: intranet-web
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: intranet-web
|
||
spec:
|
||
containers:
|
||
- name: intranet-web
|
||
image: localhost/fc-intranet-web:v20260505-1108
|
||
imagePullPolicy: Never
|
||
ports:
|
||
- containerPort: 5300
|
||
name: http
|
||
env:
|
||
- name: ASPNETCORE_ENVIRONMENT
|
||
value: Production
|
||
- name: ASPNETCORE_URLS
|
||
value: "http://+:5300"
|
||
# Bulk corpus indexing on edge1 Pi 5 takes ~6s/chunk × 5665 chunks
|
||
# ≈ 9 hours. BLUEJAY-WS GPU (R9700, 32GB VRAM) does the same work
|
||
# in minutes. Memory: feedback_pi5_nomic_embed_slow.
|
||
- name: IntranetSearch__OllamaBaseUrl
|
||
value: "http://10.0.56.20:11434"
|
||
# Sprint E Phase 2α — JSON-file-backed PageReadingOverride persistence
|
||
# on the writable PVC at /data. Without this env var the
|
||
# intranet falls back to the in-memory store (loses state on
|
||
# pod restart). Master's PageReadingOverrideOptions binds
|
||
# PageReadingOverrides:FilePath.
|
||
- name: PageReadingOverrides__FilePath
|
||
value: "/data/page-reading-overrides.json"
|
||
- name: KnowledgeFleetSearch__BaseUrl
|
||
value: "https://knowledge.iamworkin.lan"
|
||
- name: KnowledgeFleetSearch__ApiKey
|
||
valueFrom:
|
||
configMapKeyRef:
|
||
name: intranet-config
|
||
key: KnowledgeApiKey
|
||
optional: true
|
||
- name: TrustedHeaderAuthentication__SharedSecret
|
||
valueFrom:
|
||
configMapKeyRef:
|
||
name: intranet-config
|
||
key: TrustedHeaderSharedSecret
|
||
optional: true
|
||
resources:
|
||
requests:
|
||
memory: "256Mi"
|
||
cpu: "100m"
|
||
limits:
|
||
memory: "1Gi"
|
||
cpu: "1000m"
|
||
livenessProbe:
|
||
httpGet:
|
||
path: /health
|
||
port: 5300
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 30
|
||
readinessProbe:
|
||
httpGet:
|
||
path: /health
|
||
port: 5300
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 10
|
||
volumeMounts:
|
||
- name: vector-store
|
||
mountPath: /data
|
||
volumes:
|
||
- name: vector-store
|
||
persistentVolumeClaim:
|
||
claimName: intranet-vector-store
|
||
---
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: intranet-web
|
||
namespace: intranet
|
||
spec:
|
||
selector:
|
||
app: intranet-web
|
||
ports:
|
||
- port: 5300
|
||
targetPort: 5300
|
||
name: http
|
||
---
|
||
apiVersion: cert-manager.io/v1
|
||
kind: Certificate
|
||
metadata:
|
||
name: intranet-tls
|
||
namespace: intranet
|
||
spec:
|
||
secretName: intranet-tls
|
||
issuerRef:
|
||
name: step-ca-acme
|
||
kind: ClusterIssuer
|
||
dnsNames:
|
||
- intranet.iamworkin.lan
|
||
---
|
||
apiVersion: traefik.io/v1alpha1
|
||
kind: IngressRoute
|
||
metadata:
|
||
name: intranet
|
||
namespace: intranet
|
||
spec:
|
||
entryPoints:
|
||
- websecure
|
||
routes:
|
||
- match: Host(`intranet.iamworkin.lan`)
|
||
kind: Rule
|
||
services:
|
||
- name: intranet-web
|
||
port: 5300
|
||
tls:
|
||
secretName: intranet-tls
|