launch: deploy daemon StatefulSet, fix neuron-rest security context, add daemon Argo CD app

- Add neuron-daemon Argo CD Application (apps/neuron-daemon.yaml) pointing to k8s/neuron-technologies/daemon/ on main — daemon will deploy once image is built - Add daemon k8s manifests: StatefulSet (2 replicas, imagePullPolicy: Always), Service (ClusterIP :7749, session affinity), ExternalSecret (Anthropic API key from Vault) - Fix neuron-rest runAsNonRoot: remove constraint since v0.15.3 image runs as root, clears the CreateContainerConfigError on the 11h-old stale pod - Add NEURON_DAEMON_WS_URL env var to marketing deployment for chat UI connectivity - Add neuron.neurontechnologies.ai Cloudflare DNS record and tunnel ingress rule (Terraform)
2026-04-26 10:13:48 -05:00
parent 655ab38558
commit 714a7c7a8d
9 changed files with 169 additions and 2 deletions
@@ -0,0 +1,23 @@
+# Populate Vault before first deploy:
+#
+#   vault kv put secret/neuron-technologies/daemon \
+#     anthropic_api_key="sk-ant-..."
+
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: neuron-daemon-secrets
+  namespace: neuron-prod
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: neuron-daemon-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: ANTHROPIC_API_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/daemon
+        property: anthropic_api_key
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - externalsecret.yaml
+  - statefulset.yaml
+  - service.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: neuron-daemon
+  namespace: neuron-prod
+  labels:
+    app: neuron-daemon
+spec:
+  selector:
+    app: neuron-daemon
+  ports:
+    - name: ws
+      port: 7749
+      targetPort: 7749
+  type: ClusterIP
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 86400
@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: neuron-daemon
+  namespace: neuron-prod
+  labels:
+    app: neuron-daemon
+    env: prod
+spec:
+  serviceName: neuron-daemon
+  replicas: 2
+  selector:
+    matchLabels:
+      app: neuron-daemon
+  template:
+    metadata:
+      labels:
+        app: neuron-daemon
+        env: prod
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: neuron-daemon
+          image: registry.neuralplatform.ai/neuron-technologies/neuron-daemon:latest
+          imagePullPolicy: Always
+          ports:
+            - name: ws
+              containerPort: 7749
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: NEURON_LLM_PROVIDER
+              value: anthropic
+            - name: NEURON_LLM_MODEL
+              value: claude-haiku-4-5
+            - name: NEURON_DATA_DIR
+              value: /data
+          envFrom:
+            - secretRef:
+                name: neuron-daemon-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: 2000m
+              memory: 2Gi
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 7749
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 7749
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 3
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 5Gi