feat(deploy): add k3s deployment foundation and complete offline images
Introduce a self-contained kustomize stack under deploy/k3s covering namespace, config, placeholder secrets, infra StatefulSets, app Deployments/Services, migration and minio-init Jobs, and Traefik Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the operations frontend can ship as an nginx image, and extend the offline package script to build and bundle ops-api, kol-assist-worker, and ops-web alongside the k3s manifests. Wire the new ops/security knobs through .env.example and the compose stack. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,588 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: tenant-api
|
||||
labels:
|
||||
app.kubernetes.io/name: tenant-api
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: tenant-api
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: http
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tenant-api
|
||||
labels:
|
||||
app.kubernetes.io/name: tenant-api
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: tenant-api
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: tenant-api
|
||||
spec:
|
||||
containers:
|
||||
- name: tenant-api
|
||||
image: geo-rankly/tenant-api:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
env:
|
||||
- name: CONFIG_PATH
|
||||
value: /app/configs/config.yaml
|
||||
- name: TZ
|
||||
value: Asia/Shanghai
|
||||
- name: JWT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: JWT_SECRET
|
||||
- name: LLM_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: LLM_API_KEY
|
||||
- name: SILICONFLOW_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: SILICONFLOW_API_KEY
|
||||
- name: OBJECT_STORAGE_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_USER
|
||||
- name: OBJECT_STORAGE_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_PASSWORD
|
||||
- name: SCHEDULER_INTERNAL_METRICS_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: SCHEDULER_INTERNAL_METRICS_TOKEN
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health/ready
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health/live
|
||||
port: http
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: app-config
|
||||
mountPath: /app/configs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: app-config
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: geo-rankly-app-config
|
||||
items:
|
||||
- key: config.yaml
|
||||
path: config.yaml
|
||||
- key: prompts.yml
|
||||
path: prompts.yml
|
||||
- secret:
|
||||
name: geo-rankly-app-secret
|
||||
items:
|
||||
- key: config.local.yaml
|
||||
path: config.local.yaml
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: worker-generate
|
||||
labels:
|
||||
app.kubernetes.io/name: worker-generate
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: worker-generate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: worker-generate
|
||||
spec:
|
||||
containers:
|
||||
- name: worker-generate
|
||||
image: geo-rankly/worker-generate:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: CONFIG_PATH
|
||||
value: /app/configs/config.yaml
|
||||
- name: TZ
|
||||
value: Asia/Shanghai
|
||||
- name: JWT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: JWT_SECRET
|
||||
- name: LLM_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: LLM_API_KEY
|
||||
- name: SILICONFLOW_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: SILICONFLOW_API_KEY
|
||||
- name: OBJECT_STORAGE_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_USER
|
||||
- name: OBJECT_STORAGE_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_PASSWORD
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: app-config
|
||||
mountPath: /app/configs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: app-config
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: geo-rankly-app-config
|
||||
items:
|
||||
- key: config.yaml
|
||||
path: config.yaml
|
||||
- key: prompts.yml
|
||||
path: prompts.yml
|
||||
- secret:
|
||||
name: geo-rankly-app-secret
|
||||
items:
|
||||
- key: config.local.yaml
|
||||
path: config.local.yaml
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: kol-assist-worker
|
||||
labels:
|
||||
app.kubernetes.io/name: kol-assist-worker
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kol-assist-worker
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: kol-assist-worker
|
||||
spec:
|
||||
containers:
|
||||
- name: kol-assist-worker
|
||||
image: geo-rankly/kol-assist-worker:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: CONFIG_PATH
|
||||
value: /app/configs/config.yaml
|
||||
- name: TZ
|
||||
value: Asia/Shanghai
|
||||
- name: JWT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: JWT_SECRET
|
||||
- name: LLM_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: LLM_API_KEY
|
||||
- name: SILICONFLOW_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: SILICONFLOW_API_KEY
|
||||
- name: OBJECT_STORAGE_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_USER
|
||||
- name: OBJECT_STORAGE_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_PASSWORD
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 192Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 768Mi
|
||||
volumeMounts:
|
||||
- name: app-config
|
||||
mountPath: /app/configs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: app-config
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: geo-rankly-app-config
|
||||
items:
|
||||
- key: config.yaml
|
||||
path: config.yaml
|
||||
- key: prompts.yml
|
||||
path: prompts.yml
|
||||
- secret:
|
||||
name: geo-rankly-app-secret
|
||||
items:
|
||||
- key: config.local.yaml
|
||||
path: config.local.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: scheduler
|
||||
labels:
|
||||
app.kubernetes.io/name: scheduler
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: scheduler
|
||||
ports:
|
||||
- name: metrics
|
||||
port: 8081
|
||||
targetPort: metrics
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: scheduler
|
||||
labels:
|
||||
app.kubernetes.io/name: scheduler
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: scheduler
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: scheduler
|
||||
spec:
|
||||
containers:
|
||||
- name: scheduler
|
||||
image: geo-rankly/scheduler:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 8081
|
||||
env:
|
||||
- name: CONFIG_PATH
|
||||
value: /app/configs/config.yaml
|
||||
- name: TZ
|
||||
value: Asia/Shanghai
|
||||
- name: SCHEDULER_HTTP_HOST
|
||||
value: 0.0.0.0
|
||||
- name: JWT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: JWT_SECRET
|
||||
- name: LLM_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: LLM_API_KEY
|
||||
- name: SILICONFLOW_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: SILICONFLOW_API_KEY
|
||||
- name: SCHEDULER_INTERNAL_METRICS_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: SCHEDULER_INTERNAL_METRICS_TOKEN
|
||||
- name: OBJECT_STORAGE_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_USER
|
||||
- name: OBJECT_STORAGE_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: MINIO_ROOT_PASSWORD
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health/ready
|
||||
port: metrics
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 15
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health/live
|
||||
port: metrics
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: app-config
|
||||
mountPath: /app/configs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: app-config
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: geo-rankly-app-config
|
||||
items:
|
||||
- key: config.yaml
|
||||
path: config.yaml
|
||||
- key: prompts.yml
|
||||
path: prompts.yml
|
||||
- secret:
|
||||
name: geo-rankly-app-secret
|
||||
items:
|
||||
- key: config.local.yaml
|
||||
path: config.local.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ops-api
|
||||
labels:
|
||||
app.kubernetes.io/name: ops-api
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: ops-api
|
||||
ports:
|
||||
- name: http
|
||||
port: 8090
|
||||
targetPort: http
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ops-api
|
||||
labels:
|
||||
app.kubernetes.io/name: ops-api
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ops-api
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ops-api
|
||||
spec:
|
||||
containers:
|
||||
- name: ops-api
|
||||
image: geo-rankly/ops-api:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8090
|
||||
env:
|
||||
- name: CONFIG_PATH
|
||||
value: /app/configs/ops-config.yaml
|
||||
- name: TZ
|
||||
value: Asia/Shanghai
|
||||
- name: OPS_JWT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: OPS_JWT_SECRET
|
||||
- name: OPS_DEFAULT_ADMIN_USERNAME
|
||||
value: admin
|
||||
- name: OPS_DEFAULT_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: geo-rankly-app-secret
|
||||
key: OPS_DEFAULT_ADMIN_PASSWORD
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health/ready
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health/live
|
||||
port: http
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 192Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 768Mi
|
||||
volumeMounts:
|
||||
- name: app-config
|
||||
mountPath: /app/configs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: app-config
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: geo-rankly-app-config
|
||||
items:
|
||||
- key: ops-config.yaml
|
||||
path: ops-config.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: frontend
|
||||
labels:
|
||||
app.kubernetes.io/name: frontend
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: frontend
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: frontend
|
||||
labels:
|
||||
app.kubernetes.io/name: frontend
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: frontend
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: frontend
|
||||
spec:
|
||||
containers:
|
||||
- name: frontend
|
||||
image: geo-rankly/frontend:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 20
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ops-web
|
||||
labels:
|
||||
app.kubernetes.io/name: ops-web
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: ops-web
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ops-web
|
||||
labels:
|
||||
app.kubernetes.io/name: ops-web
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ops-web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ops-web
|
||||
spec:
|
||||
containers:
|
||||
- name: ops-web
|
||||
image: geo-rankly/ops-web:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 20
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
Reference in New Issue
Block a user