feat: deploy the agent — image, manifests, and the Flux plumbing
Two-stage Dockerfile: the runtime image carries neither uv nor a build toolchain, runs as uid 10001, drops every capability and needs no writable filesystem (verified with --read-only and no tmpfs). k8s/ is what runs, dev/ is the Flux plumbing that applies it, self-managing after three manual applies — the same shape every kong-* repo settled on. Three choices worth naming: - One namespace for the estate. What isolates an agent is its Keycloak client and the audiences it may request, not a namespace boundary. - The GitRepository uses anonymous HTTPS rather than SSH with a Vault-held deploy key. The repo is already anonymously readable on gitea, so a key would guard nothing while adding two objects to create by hand before anything deploys. If the repos ever go private this becomes the kong-* SSH pattern. - The lab CA certificate is committed. It is a certificate, never a key, and checking it in means the deployment has no hidden prerequisite. replicas: 1 is a constraint, not a default — conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Stéphane Tailland
@@ -0,0 +1,36 @@
|
||||
# The lab CA, so the agent can verify keycloak.sttlab.local and every gateway
|
||||
# rather than disabling verification. A CA certificate is public by
|
||||
# construction — this is the certificate, never the key, and it is checked in
|
||||
# deliberately so the deployment has no hidden prerequisite.
|
||||
#
|
||||
# Issued by the sttlab-local-ca ClusterIssuer, valid until 2026-11-24. When it
|
||||
# is rotated this file must be regenerated:
|
||||
# kubectl -n cert-manager get secret sttlab-local-ca \
|
||||
# -o jsonpath='{.data.tls\.crt}' | base64 -d
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: sttlab-ca
|
||||
namespace: agents
|
||||
data:
|
||||
ca.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDPDCCAiSgAwIBAgIUd/utDf+f0yQR3v3qTjZqx+wvTZMwDQYJKoZIhvcNAQEL
|
||||
BQAwGTEXMBUGA1UEAwwOKi5zdHRsYWIubG9jYWwwHhcNMjUxMTI0MTUzODQ1WhcN
|
||||
MjYxMTI0MTUzODQ1WjAZMRcwFQYDVQQDDA4qLnN0dGxhYi5sb2NhbDCCASIwDQYJ
|
||||
KoZIhvcNAQEBBQADggEPADCCAQoCggEBALj0sryq8qXtkShT/B+/EjVJNN/TLHIn
|
||||
QJYc6xuUH/f7q3dYdLm4iH0XnFgrSQLUo4iqd/Mczef5iWCYwT5FFa7P17/TcLVf
|
||||
gso0j41qNLBjGxDQGQ6Z1VCxi6oan8ow98rumjVj0E0Qgs5CX/rN+gcEmZ/TZFWU
|
||||
qudVoztpeiVqJ0dxCIq+KMutzd1BU7BXx4VRO9Y+t1idUc7oY7BPmS2qPAN7TtXP
|
||||
j1KhH2BgLsmF5GRhYHNS578eCltcmS2sbQ3c7GwOV96lpgF9TixEvFXeN4xk43E6
|
||||
1COUD7CRiWAZ0XI8FMlpZGeNZeV4bbV/MqVig1ybWNOz9MDKYj3eoXUCAwEAAaN8
|
||||
MHowHQYDVR0OBBYEFDbzYWOPr4vxa+VONs7xHbcNx70YMB8GA1UdIwQYMBaAFDbz
|
||||
YWOPr4vxa+VONs7xHbcNx70YMA8GA1UdEwEB/wQFMAMBAf8wJwYDVR0RBCAwHoIO
|
||||
Ki5zdHRsYWIubG9jYWyCDHN0dGxhYi5sb2NhbDANBgkqhkiG9w0BAQsFAAOCAQEA
|
||||
tU4p5/ONXm7x4YDzSeL8NdThVLguiFur0jcTxvvPUS4NFNsnQJk4OXxBgjy1YwpL
|
||||
3i56/4mCEd9OCQF/Hl0eFwGZBzNKlMoTA08AC/lBDvPrnVjuUu0qe/b/2KOkhESa
|
||||
x8rQNp0o8pcj0f29nu0JfRqYGkzy0Lh2qgXhPu2iC+t2PfdleRAky1tt68wogdFL
|
||||
TvHDsJbVo/ihsPpONlSyHfxG6bb/0Mkz64PH46TTt9GvJflEKMqDwivNFUA1P5S/
|
||||
U4Ic8Qapnxc7h2+WbRjmYrnuygC2wMBE6rL9OF3gwCr1fkgGGRr5lVRUq2X2HZV5
|
||||
5jqViv6eurq8O61N3vWGCQ==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,26 @@
|
||||
# Everything here is an endpoint or a public identifier. The one secret the
|
||||
# agent holds arrives through catalogue-agent-secrets; nothing in this file is
|
||||
# sensitive, which is the point of keeping the split visible.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: catalogue-agent-config
|
||||
namespace: agents
|
||||
data:
|
||||
CATALOGUE_KEYCLOAK_REALM_URL: https://keycloak.sttlab.local/realms/classic-models
|
||||
CATALOGUE_CLIENT_ID: classic-models-agent-catalogue
|
||||
|
||||
CATALOGUE_MCP_CATALOG_URL: https://catalog-dev.sttlab.local/catalog-mcp
|
||||
CATALOGUE_MCP_SALES_URL: https://sales-dev.sttlab.local/sales-mcp
|
||||
|
||||
CATALOGUE_LLM_BASE_URL: https://llm-dev.sttlab.local/llm/v1
|
||||
CATALOGUE_LLM_MODEL: google/gemini-3.7-flash
|
||||
|
||||
# Trust the lab CA rather than disabling verification. Mounted from the
|
||||
# sttlab-ca ConfigMap.
|
||||
CATALOGUE_CA_BUNDLE: /etc/sttlab-ca/ca.crt
|
||||
|
||||
# What other agents dial, so it is the Service DNS name and not the bind
|
||||
# address. It is advertised in the Agent Card; get it wrong and A2A callers
|
||||
# are pointed at nothing.
|
||||
CATALOGUE_PUBLIC_URL: http://catalogue-agent.agents.svc.cluster.local:8080/
|
||||
@@ -0,0 +1,71 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: catalogue-agent
|
||||
namespace: agents
|
||||
spec:
|
||||
# One replica, and that is a constraint rather than a default. Conversation
|
||||
# history — which the confirm-before-writing flow depends on — lives in the
|
||||
# process, keyed by A2A contextId. A second replica would route the user's
|
||||
# "yes" to a pod that never saw the question. Scaling out needs sticky routing
|
||||
# on contextId or a shared store first.
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: catalogue-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: catalogue-agent
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: agent
|
||||
image: ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: catalogue-agent-config
|
||||
- secretRef:
|
||||
name: catalogue-agent-secrets
|
||||
volumeMounts:
|
||||
- name: sttlab-ca
|
||||
mountPath: /etc/sttlab-ca
|
||||
readOnly: true
|
||||
# The Agent Card needs no auth and is served by the same app, so a 200
|
||||
# means the A2A routes are genuinely mounted — not merely that the
|
||||
# process is alive.
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /.well-known/agent-card.json
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /.well-known/agent-card.json
|
||||
port: http
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 192Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
volumes:
|
||||
- name: sttlab-ca
|
||||
configMap:
|
||||
name: sttlab-ca
|
||||
@@ -0,0 +1,24 @@
|
||||
# The agent's Keycloak client secret, and nothing else. It comes from the same
|
||||
# Vault entry the realm import reads, so there is exactly one copy of this
|
||||
# secret in the estate and rotating it in Vault rotates it everywhere.
|
||||
#
|
||||
# vault-keycloak rather than a store of the agents' own: this value is a
|
||||
# Keycloak client secret, owned by the realm, and inventing a second AppRole to
|
||||
# read the same path would add a credential without adding a boundary.
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: catalogue-agent-secrets
|
||||
namespace: agents
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault-keycloak
|
||||
target:
|
||||
name: catalogue-agent-secrets
|
||||
data:
|
||||
- secretKey: CATALOGUE_CLIENT_SECRET
|
||||
remoteRef:
|
||||
key: keycloak/classic-models-realm
|
||||
property: KC_SECRET_CLASSIC_MODELS_AGENT_CATALOGUE
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- ca-configmap.yaml
|
||||
- externalsecret.yaml
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
@@ -0,0 +1,9 @@
|
||||
# One namespace for the whole agent estate rather than one per agent. The agents
|
||||
# share nothing but a trust boundary — no data, no storage, no service mesh
|
||||
# policy — and splitting them would multiply the CA ConfigMap and the
|
||||
# ExternalSecret without isolating anything that matters. What isolates them is
|
||||
# their Keycloak client and the audiences it may request, not the namespace.
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: agents
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: catalogue-agent
|
||||
namespace: agents
|
||||
spec:
|
||||
selector:
|
||||
app: catalogue-agent
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: http
|
||||
Reference in New Issue
Block a user