7cdcc984a5
- application.yaml: single multi-source Application (openviking pattern), wave 8, chart v0.9.1 via path: + $values/values.yaml - values.yaml: postgresql.enabled=false (external), existingSecret, LLM env (astro-orbiter:8001, Qwen3.8-27B-Q4_K_M), native ingress cosmic-rewind.local.mk-labs.cloud (api /health /v1 /mcp /ext, cp /) - externalsecret.yaml: hindsight-credentials from 1Password mk-labs/hindsight - namespace.yaml, postgres-pvc.yaml (10Gi nfs-emporium), deployment-postgres.yaml (ankane/pgvector pinned by digest), service-postgres.yaml (hindsight-postgres:5432)
101 lines
3.6 KiB
YAML
101 lines
3.6 KiB
YAML
# ============================================================================
|
|
# Deployment - Hindsight external PostgreSQL (ankane/pgvector)
|
|
# Peter Parker, Phase C, t_6d47a360
|
|
#
|
|
# External-Postgres mode (plan pre-authorized fallback; Phase A proved the
|
|
# chart's bundled postgresql is not secret-sourceable). The chart is pointed at
|
|
# this instance via values.yaml: postgresql.enabled=false + external.host=
|
|
# hindsight-postgres.
|
|
#
|
|
# IMAGE NOTE (deviation from task body): the task named `ankane/pgvector:15`,
|
|
# but that tag does NOT exist — the upstream repo publishes only `latest` plus
|
|
# `v0.1.3..v0.5.1` (verified against the docker.io registry API). `latest` is
|
|
# postgres:17-bookworm + pgvector v0.8.6. We therefore pin `latest` BY DIGEST
|
|
# (sha256:956744bd...) so the deploy is reproducible. This was empirically
|
|
# validated on fastpass (pgvector 0.5.1 present, `CREATE EXTENSION vector`
|
|
# succeeded, role has rlsuper). Flagged for Ryan in the Phase C report.
|
|
#
|
|
# POSTGRES_PASSWORD comes from the ExternalSecret (hindsight-credentials,
|
|
# key `postgres-password`) — the same value the chart interpolates into
|
|
# HINDSIGHT_API_DATABASE_URL, so the server login and the API DSN agree.
|
|
# ============================================================================
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: hindsight-postgres
|
|
namespace: hindsight
|
|
labels:
|
|
app.kubernetes.io/name: hindsight
|
|
app.kubernetes.io/component: database
|
|
app.kubernetes.io/part-of: platform-buildout
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
# Recreate: RWO PVC + single writer. No rolling overlap (no two pods on one volume).
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: hindsight-postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: hindsight-postgres
|
|
app.kubernetes.io/name: hindsight
|
|
app.kubernetes.io/component: database
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: docker.io/ankane/pgvector@sha256:956744bd14e9cbdf639c61c2a2a7c7c2c48a9c8cdd42f7de4ac034f4e96b90f8
|
|
# Digest-pinned (immutable) => IfNotPresent avoids redundant re-pulls.
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- name: postgres
|
|
containerPort: 5432
|
|
protocol: TCP
|
|
env:
|
|
- name: POSTGRES_USER
|
|
value: hindsight
|
|
- name: POSTGRES_DB
|
|
value: hindsight
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: hindsight-credentials
|
|
key: postgres-password
|
|
volumeMounts:
|
|
- name: postgres-data
|
|
# Stock postgres data path (ankane/pgvector is postgres:17-based,
|
|
# no PGDATA override needed — unlike firecrawl's custom layout).
|
|
mountPath: /var/lib/postgresql/data
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- pg_isready
|
|
- -U
|
|
- hindsight
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- pg_isready
|
|
- -U
|
|
- hindsight
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: postgres-data
|
|
persistentVolumeClaim:
|
|
claimName: hindsight-postgres-data
|