103 lines
4.9 KiB
YAML
103 lines
4.9 KiB
YAML
# ============================================================================
|
|
# Hindsight — helm values (Phase C). Consumed by the ArgoCD Application source 1
|
|
# via `helm.valueFiles: ["$values/values.yaml"]` (openviking multi-source pattern).
|
|
#
|
|
# Design decisions (all verified against chart v0.9.1 + rendered output):
|
|
# - Chart is the single source for the app (api, control-plane, services,
|
|
# probes, ingress). We do NOT hand-roll Deployments/Services.
|
|
# - Postgres is EXTERNAL (separate Deployment in this dir, firecrawl pattern)
|
|
# => postgresql.enabled: false, external.* points at hindsight-postgres:5432.
|
|
# - Secrets come from 1Password via ExternalSecret => existingSecret:
|
|
# hindsight-credentials. The chart does envFrom(secretRef) so
|
|
# HINDSIGHT_API_LLM_API_KEY / HINDSIGHT_API_MCP_AUTH_TOKEN are injected
|
|
# automatically; POSTGRES_PASSWORD is a secretKeyRef that K8s expands into
|
|
# HINDSIGHT_API_DATABASE_URL (verified with a live envFrom test pod).
|
|
# - LLM is the Nous free-tier inference endpoint
|
|
# (https://inference-api.nousresearch.com/v1), model
|
|
# `upstage/solar-pro4:free` (tool-calling, verified reflect). Fallback
|
|
# (documented, NOT deployed): `stepfun/step-3.7-flash:free`. API key via existingSecret
|
|
# envFrom (hindsight-credentials / HINDSIGHT_API_LLM_API_KEY), sourced from
|
|
# 1Password `nous` item per decision 4.
|
|
# - Ingress is driven through the chart's NATIVE ingress template (approved
|
|
# plan: "Ingress driven through values.yaml"). api.service.port=8888,
|
|
# controlPlane.service.port=3000.
|
|
# - Image tag defaults to .Values.version (root) when api.image.tag is unset,
|
|
# so version: "0.9.1" pins the API image to 0.9.1.
|
|
# ============================================================================
|
|
|
|
version: "0.9.1"
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# External PostgreSQL (chart's bundled postgresql is disabled).
|
|
# password is the K8s env expansion `$(POSTGRES_PASSWORD)` — the chart defines
|
|
# POSTGRES_PASSWORD as a secretKeyRef (hindsight-credentials / postgres-password)
|
|
# earlier in the same container, so K8s substitutes it at container start.
|
|
# ----------------------------------------------------------------------------
|
|
postgresql:
|
|
enabled: false
|
|
external:
|
|
host: hindsight-postgres
|
|
port: 5432
|
|
username: hindsight
|
|
database: hindsight
|
|
password: $(POSTGRES_PASSWORD)
|
|
|
|
# ExternalSecret (from 1Password) that the chart injects via envFrom(secretRef).
|
|
# Keys it must expose: postgres-password, HINDSIGHT_API_LLM_API_KEY,
|
|
# HINDSIGHT_API_MCP_AUTH_TOKEN. See externalsecret.yaml in this dir.
|
|
existingSecret: hindsight-credentials
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# API container environment (explicit env entries; the chart renders this map
|
|
# to individual env vars). LLM points at the LOCAL astro-orbiter Qwen node
|
|
# (OpenAI-compatible) — moved OFF the Nous free tier (solar-pro4 was 404/dead).
|
|
# HINDSIGHT_API_LLM_API_KEY is NOT set here — it comes from the existingSecret
|
|
# via envFrom (1Password `nous` item); the local node ignores it but the secret
|
|
# still satisfies the chart's envFrom contract.
|
|
# ----------------------------------------------------------------------------
|
|
api:
|
|
env:
|
|
HINDSIGHT_API_LLM_BASE_URL: "https://inference-api.nousresearch.com/v1"
|
|
HINDSIGHT_API_LLM_PROVIDER: "openai"
|
|
# Interim swap (2026-08-28, Ryan directive): local astro-orbiter Qwen is DOWN,
|
|
# so back Hindsight with Nous free stepfun/step-3.7-flash until the local node recovers.
|
|
HINDSIGHT_API_LLM_MODEL: "stepfun/step-3.7-flash:free"
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Ingress via the chart's native template.
|
|
# /health,/v1,/mcp,/ext -> api:8888 (longest-prefix wins in nginx)
|
|
# / -> controlPlane:3000
|
|
# TLS secret hindsight-tls provisioned by the letsencrypt-prod issuer.
|
|
# ----------------------------------------------------------------------------
|
|
ingress:
|
|
enabled: true
|
|
className: "nginx"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
|
# Raised read/send timeout so a slow agentic reflect (~132s on solar-pro4)
|
|
# can complete before nginx cuts the connection (was 60s default -> 504).
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
|
|
hosts:
|
|
- host: cosmic-rewind.local.mk-labs.cloud
|
|
paths:
|
|
- path: /health
|
|
pathType: Prefix
|
|
service: api
|
|
- path: /v1
|
|
pathType: Prefix
|
|
service: api
|
|
- path: /mcp
|
|
pathType: Prefix
|
|
service: api
|
|
- path: /ext
|
|
pathType: Prefix
|
|
service: api
|
|
- path: /
|
|
pathType: Prefix
|
|
service: controlPlane
|
|
tls:
|
|
- hosts:
|
|
- cosmic-rewind.local.mk-labs.cloud
|
|
secretName: hindsight-tls
|