feat(swarm): add swarm self-improvement loop infrastructure
Adds complete k8s manifests, ArgoCD app, and Terraform namespace resources for the Neuron swarm self-improvement loop system. Each variant (alpha, beta, gamma) gets its own isolated namespace, PVC, MCP/REST deployments, ExternalSecrets from Vault, RBAC for CI, and a SQLite clone Job template for session startup.
This commit is contained in:
Will Anderson
@@ -0,0 +1,52 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: neuron-swarm
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: http://10.43.1.53:3000/will/infrastructure.git
|
||||
targetRevision: main
|
||||
path: servers/legion/k8s/neuron-technologies/swarm
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
# No single namespace — resources span swarm-alpha/beta/gamma.
|
||||
# Each resource declares its own namespace.
|
||||
namespace: swarm-alpha
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
# Don't track Jobs created dynamically by swarm.sh
|
||||
ignoreDifferences:
|
||||
- group: batch
|
||||
kind: Job
|
||||
namespace: swarm-alpha
|
||||
jsonPointers: [""]
|
||||
- group: batch
|
||||
kind: Job
|
||||
namespace: swarm-beta
|
||||
jsonPointers: [""]
|
||||
- group: batch
|
||||
kind: Job
|
||||
namespace: swarm-gamma
|
||||
jsonPointers: [""]
|
||||
# Session ConfigMaps are created/deleted by swarm.sh — ignore drift
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
name: swarm-alpha-session
|
||||
namespace: swarm-alpha
|
||||
jsonPointers: [""]
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
name: swarm-beta-session
|
||||
namespace: swarm-beta
|
||||
jsonPointers: [""]
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
name: swarm-gamma-session
|
||||
namespace: swarm-gamma
|
||||
jsonPointers: [""]
|
||||
@@ -0,0 +1,48 @@
|
||||
# Swarm variant ConfigMaps — base config per variant
|
||||
# The swarm-{variant}-session ConfigMap is created dynamically by swarm.sh
|
||||
# at session start and deleted at session end.
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: swarm-alpha-config
|
||||
namespace: swarm-alpha
|
||||
data:
|
||||
SPRING_PROFILES_ACTIVE: "swarm"
|
||||
NEURON_DATA_DIR: "/data"
|
||||
NEURON_DB_PATH: "/data/neuron.db"
|
||||
NEURON_STORAGE_PATH: "/data"
|
||||
SERVER_TOMCAT_ACCESSLOG_ENABLED: "true"
|
||||
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE: "health,info,metrics"
|
||||
MANAGEMENT_ENDPOINT_HEALTH_SHOW_DETAILS: "always"
|
||||
MANAGEMENT_OTLP_METRICS_EXPORT_ENABLED: "false"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: swarm-beta-config
|
||||
namespace: swarm-beta
|
||||
data:
|
||||
SPRING_PROFILES_ACTIVE: "swarm"
|
||||
NEURON_DATA_DIR: "/data"
|
||||
NEURON_DB_PATH: "/data/neuron.db"
|
||||
NEURON_STORAGE_PATH: "/data"
|
||||
SERVER_TOMCAT_ACCESSLOG_ENABLED: "true"
|
||||
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE: "health,info,metrics"
|
||||
MANAGEMENT_ENDPOINT_HEALTH_SHOW_DETAILS: "always"
|
||||
MANAGEMENT_OTLP_METRICS_EXPORT_ENABLED: "false"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: swarm-gamma-config
|
||||
namespace: swarm-gamma
|
||||
data:
|
||||
SPRING_PROFILES_ACTIVE: "swarm"
|
||||
NEURON_DATA_DIR: "/data"
|
||||
NEURON_DB_PATH: "/data/neuron.db"
|
||||
NEURON_STORAGE_PATH: "/data"
|
||||
SERVER_TOMCAT_ACCESSLOG_ENABLED: "true"
|
||||
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE: "health,info,metrics"
|
||||
MANAGEMENT_ENDPOINT_HEALTH_SHOW_DETAILS: "always"
|
||||
MANAGEMENT_OTLP_METRICS_EXPORT_ENABLED: "false"
|
||||
@@ -0,0 +1,155 @@
|
||||
# Swarm variants share the same secrets as prod.
|
||||
# Each variant gets its own ExternalSecret object pointing at the same Vault paths.
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: swarm-alpha-secrets
|
||||
namespace: swarm-alpha
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: swarm-alpha-secrets
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: NEURON_API_KEY
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/prod
|
||||
property: api_key
|
||||
- secretKey: NEURON_WEBHOOK_SECRET
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/prod
|
||||
property: gitea_webhook_secret
|
||||
- secretKey: NEURON_LICENSE_ADMIN_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/license
|
||||
property: admin_token
|
||||
- secretKey: UNKEY_ROOT_KEY
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/unkey
|
||||
property: root_key
|
||||
- secretKey: UNKEY_API_ID
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/unkey
|
||||
property: api_id
|
||||
- secretKey: NEURON_R2_ENDPOINT
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: endpoint
|
||||
- secretKey: NEURON_R2_ACCESS_KEY
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: access_key_id
|
||||
- secretKey: NEURON_R2_SECRET_KEY
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: secret_access_key
|
||||
- secretKey: NEURON_R2_BUCKET
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: neuron_bucket
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: swarm-beta-secrets
|
||||
namespace: swarm-beta
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: swarm-beta-secrets
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: NEURON_API_KEY
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/prod
|
||||
property: api_key
|
||||
- secretKey: NEURON_WEBHOOK_SECRET
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/prod
|
||||
property: gitea_webhook_secret
|
||||
- secretKey: NEURON_LICENSE_ADMIN_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/license
|
||||
property: admin_token
|
||||
- secretKey: UNKEY_ROOT_KEY
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/unkey
|
||||
property: root_key
|
||||
- secretKey: UNKEY_API_ID
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/unkey
|
||||
property: api_id
|
||||
- secretKey: NEURON_R2_ENDPOINT
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: endpoint
|
||||
- secretKey: NEURON_R2_ACCESS_KEY
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: access_key_id
|
||||
- secretKey: NEURON_R2_SECRET_KEY
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: secret_access_key
|
||||
- secretKey: NEURON_R2_BUCKET
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: neuron_bucket
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: swarm-gamma-secrets
|
||||
namespace: swarm-gamma
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: swarm-gamma-secrets
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: NEURON_API_KEY
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/prod
|
||||
property: api_key
|
||||
- secretKey: NEURON_WEBHOOK_SECRET
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/prod
|
||||
property: gitea_webhook_secret
|
||||
- secretKey: NEURON_LICENSE_ADMIN_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/license
|
||||
property: admin_token
|
||||
- secretKey: UNKEY_ROOT_KEY
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/unkey
|
||||
property: root_key
|
||||
- secretKey: UNKEY_API_ID
|
||||
remoteRef:
|
||||
key: secret/data/neuron-technologies/unkey
|
||||
property: api_id
|
||||
- secretKey: NEURON_R2_ENDPOINT
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: endpoint
|
||||
- secretKey: NEURON_R2_ACCESS_KEY
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: access_key_id
|
||||
- secretKey: NEURON_R2_SECRET_KEY
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: secret_access_key
|
||||
- secretKey: NEURON_R2_BUCKET
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: neuron_bucket
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
# Namespaces
|
||||
- namespace-alpha.yaml
|
||||
- namespace-beta.yaml
|
||||
- namespace-gamma.yaml
|
||||
# Persistent volumes
|
||||
- pvc-alpha.yaml
|
||||
- pvc-beta.yaml
|
||||
- pvc-gamma.yaml
|
||||
# Base config
|
||||
- configmaps.yaml
|
||||
# Shared secrets from Vault
|
||||
- externalsecrets.yaml
|
||||
# MCP deployments
|
||||
- mcp-deployment-alpha.yaml
|
||||
- mcp-deployment-beta.yaml
|
||||
- mcp-deployment-gamma.yaml
|
||||
# REST deployments
|
||||
- rest-deployment-alpha.yaml
|
||||
- rest-deployment-beta.yaml
|
||||
- rest-deployment-gamma.yaml
|
||||
# Services
|
||||
- services.yaml
|
||||
# RBAC for CI runner
|
||||
- rbac.yaml
|
||||
# SQLite clone Jobs (applied by swarm.sh at session start, not auto-synced by ArgoCD)
|
||||
# These are listed here for reference but excluded from ArgoCD automated sync
|
||||
# via the ignoreDifferences config in the ArgoCD app.
|
||||
@@ -0,0 +1,121 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: neuron-mcp
|
||||
namespace: swarm-alpha
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
env: swarm
|
||||
variant: alpha
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: neuron-mcp
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
env: swarm
|
||||
variant: alpha
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 30
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
initContainers:
|
||||
- name: wait-for-sqlite-clone
|
||||
image: busybox:1.36
|
||||
command: ["sh", "-c", "until [ -f /data/neuron.db ]; do echo 'waiting for SQLite clone...'; sleep 2; done; echo 'SQLite ready'"]
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
containers:
|
||||
- name: neuron-mcp
|
||||
# Image is updated by swarm CI on each loop iteration
|
||||
image: registry.neuralplatform.ai/neuron-technologies/neuron-mcp:v0.15.3
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
env:
|
||||
- name: NEURON_SWARM_VARIANT
|
||||
value: "alpha"
|
||||
- name: NEURON_SWARM_SESSION
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-alpha-session
|
||||
key: session_id
|
||||
optional: true
|
||||
- name: NEURON_SWARM_GOAL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-alpha-session
|
||||
key: goal
|
||||
optional: true
|
||||
- name: NEURON_SWARM_LOOP_MAX
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-alpha-session
|
||||
key: loop_max
|
||||
optional: true
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "http://alloy-otlp.monitoring.svc.cluster.local:4318"
|
||||
- name: JAVA_TOOL_OPTIONS
|
||||
value: "-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -XX:+ExitOnOutOfMemoryError"
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: swarm-alpha-config
|
||||
- secretRef:
|
||||
name: swarm-alpha-secrets
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 1536Mi
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["sh", "-c", "sleep 5"]
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
failureThreshold: 30
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/readiness
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-alpha-data
|
||||
@@ -0,0 +1,120 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: neuron-mcp
|
||||
namespace: swarm-beta
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
env: swarm
|
||||
variant: beta
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: neuron-mcp
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
env: swarm
|
||||
variant: beta
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 30
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
initContainers:
|
||||
- name: wait-for-sqlite-clone
|
||||
image: busybox:1.36
|
||||
command: ["sh", "-c", "until [ -f /data/neuron.db ]; do echo 'waiting for SQLite clone...'; sleep 2; done; echo 'SQLite ready'"]
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
containers:
|
||||
- name: neuron-mcp
|
||||
image: registry.neuralplatform.ai/neuron-technologies/neuron-mcp:v0.15.3
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
env:
|
||||
- name: NEURON_SWARM_VARIANT
|
||||
value: "beta"
|
||||
- name: NEURON_SWARM_SESSION
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-beta-session
|
||||
key: session_id
|
||||
optional: true
|
||||
- name: NEURON_SWARM_GOAL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-beta-session
|
||||
key: goal
|
||||
optional: true
|
||||
- name: NEURON_SWARM_LOOP_MAX
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-beta-session
|
||||
key: loop_max
|
||||
optional: true
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "http://alloy-otlp.monitoring.svc.cluster.local:4318"
|
||||
- name: JAVA_TOOL_OPTIONS
|
||||
value: "-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -XX:+ExitOnOutOfMemoryError"
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: swarm-beta-config
|
||||
- secretRef:
|
||||
name: swarm-beta-secrets
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 1536Mi
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["sh", "-c", "sleep 5"]
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
failureThreshold: 30
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/readiness
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-beta-data
|
||||
@@ -0,0 +1,120 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: neuron-mcp
|
||||
namespace: swarm-gamma
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
env: swarm
|
||||
variant: gamma
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: neuron-mcp
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
env: swarm
|
||||
variant: gamma
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 30
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
initContainers:
|
||||
- name: wait-for-sqlite-clone
|
||||
image: busybox:1.36
|
||||
command: ["sh", "-c", "until [ -f /data/neuron.db ]; do echo 'waiting for SQLite clone...'; sleep 2; done; echo 'SQLite ready'"]
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
containers:
|
||||
- name: neuron-mcp
|
||||
image: registry.neuralplatform.ai/neuron-technologies/neuron-mcp:v0.15.3
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
env:
|
||||
- name: NEURON_SWARM_VARIANT
|
||||
value: "gamma"
|
||||
- name: NEURON_SWARM_SESSION
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-gamma-session
|
||||
key: session_id
|
||||
optional: true
|
||||
- name: NEURON_SWARM_GOAL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-gamma-session
|
||||
key: goal
|
||||
optional: true
|
||||
- name: NEURON_SWARM_LOOP_MAX
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-gamma-session
|
||||
key: loop_max
|
||||
optional: true
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "http://alloy-otlp.monitoring.svc.cluster.local:4318"
|
||||
- name: JAVA_TOOL_OPTIONS
|
||||
value: "-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -XX:+ExitOnOutOfMemoryError"
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: swarm-gamma-config
|
||||
- secretRef:
|
||||
name: swarm-gamma-secrets
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 1536Mi
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["sh", "-c", "sleep 5"]
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
failureThreshold: 30
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/readiness
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-gamma-data
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: swarm-alpha
|
||||
labels:
|
||||
app: neuron-technologies
|
||||
tier: swarm
|
||||
variant: alpha
|
||||
managed-by: argocd
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: swarm-beta
|
||||
labels:
|
||||
app: neuron-technologies
|
||||
tier: swarm
|
||||
variant: beta
|
||||
managed-by: argocd
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: swarm-gamma
|
||||
labels:
|
||||
app: neuron-technologies
|
||||
tier: swarm
|
||||
variant: gamma
|
||||
managed-by: argocd
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: swarm-alpha-data
|
||||
namespace: swarm-alpha
|
||||
spec:
|
||||
storageClassName: local-path
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: swarm-beta-data
|
||||
namespace: swarm-beta
|
||||
spec:
|
||||
storageClassName: local-path
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: swarm-gamma-data
|
||||
namespace: swarm-gamma
|
||||
spec:
|
||||
storageClassName: local-path
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
@@ -0,0 +1,97 @@
|
||||
# RBAC for swarm variant namespaces
|
||||
# Grants the CI runner ServiceAccount permission to deploy to swarm-* namespaces.
|
||||
# Mirrors the pattern used for neuron-dev/stage deployments.
|
||||
# The CI runner runs in the `ci` namespace as the `default` ServiceAccount.
|
||||
---
|
||||
# swarm-alpha
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: swarm-deployer
|
||||
namespace: swarm-alpha
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "services", "pods", "pods/log"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ci-runner-swarm-alpha
|
||||
namespace: swarm-alpha
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: default
|
||||
namespace: ci
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: swarm-deployer
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
# swarm-beta
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: swarm-deployer
|
||||
namespace: swarm-beta
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "services", "pods", "pods/log"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ci-runner-swarm-beta
|
||||
namespace: swarm-beta
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: default
|
||||
namespace: ci
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: swarm-deployer
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
# swarm-gamma
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: swarm-deployer
|
||||
namespace: swarm-gamma
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "services", "pods", "pods/log"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ci-runner-swarm-gamma
|
||||
namespace: swarm-gamma
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: default
|
||||
namespace: ci
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: swarm-deployer
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,99 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: neuron-rest
|
||||
namespace: swarm-alpha
|
||||
labels:
|
||||
app: neuron-rest
|
||||
env: swarm
|
||||
variant: alpha
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: neuron-rest
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: neuron-rest
|
||||
env: swarm
|
||||
variant: alpha
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: neuron-rest
|
||||
image: registry.neuralplatform.ai/neuron-technologies/neuron-rest:v0.15.3
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8081
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
env:
|
||||
- name: NEURON_SWARM_VARIANT
|
||||
value: "alpha"
|
||||
- name: NEURON_SWARM_SESSION
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-alpha-session
|
||||
key: session_id
|
||||
optional: true
|
||||
- name: NEURON_SWARM_GOAL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-alpha-session
|
||||
key: goal
|
||||
optional: true
|
||||
- name: NEURON_SWARM_LOOP_MAX
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-alpha-session
|
||||
key: loop_max
|
||||
optional: true
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: swarm-alpha-config
|
||||
- secretRef:
|
||||
name: swarm-alpha-secrets
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
failureThreshold: 30
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/readiness
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-alpha-data
|
||||
@@ -0,0 +1,99 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: neuron-rest
|
||||
namespace: swarm-beta
|
||||
labels:
|
||||
app: neuron-rest
|
||||
env: swarm
|
||||
variant: beta
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: neuron-rest
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: neuron-rest
|
||||
env: swarm
|
||||
variant: beta
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: neuron-rest
|
||||
image: registry.neuralplatform.ai/neuron-technologies/neuron-rest:v0.15.3
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8081
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
env:
|
||||
- name: NEURON_SWARM_VARIANT
|
||||
value: "beta"
|
||||
- name: NEURON_SWARM_SESSION
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-beta-session
|
||||
key: session_id
|
||||
optional: true
|
||||
- name: NEURON_SWARM_GOAL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-beta-session
|
||||
key: goal
|
||||
optional: true
|
||||
- name: NEURON_SWARM_LOOP_MAX
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-beta-session
|
||||
key: loop_max
|
||||
optional: true
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: swarm-beta-config
|
||||
- secretRef:
|
||||
name: swarm-beta-secrets
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
failureThreshold: 30
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/readiness
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-beta-data
|
||||
@@ -0,0 +1,99 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: neuron-rest
|
||||
namespace: swarm-gamma
|
||||
labels:
|
||||
app: neuron-rest
|
||||
env: swarm
|
||||
variant: gamma
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: neuron-rest
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: neuron-rest
|
||||
env: swarm
|
||||
variant: gamma
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: neuron-rest
|
||||
image: registry.neuralplatform.ai/neuron-technologies/neuron-rest:v0.15.3
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8081
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
env:
|
||||
- name: NEURON_SWARM_VARIANT
|
||||
value: "gamma"
|
||||
- name: NEURON_SWARM_SESSION
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-gamma-session
|
||||
key: session_id
|
||||
optional: true
|
||||
- name: NEURON_SWARM_GOAL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-gamma-session
|
||||
key: goal
|
||||
optional: true
|
||||
- name: NEURON_SWARM_LOOP_MAX
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: swarm-gamma-session
|
||||
key: loop_max
|
||||
optional: true
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: swarm-gamma-config
|
||||
- secretRef:
|
||||
name: swarm-gamma-secrets
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
failureThreshold: 30
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/liveness
|
||||
port: http
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /actuator/health/readiness
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-gamma-data
|
||||
@@ -0,0 +1,103 @@
|
||||
# Services for swarm variants — ClusterIP only, no external exposure needed
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: neuron-mcp
|
||||
namespace: swarm-alpha
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
variant: alpha
|
||||
spec:
|
||||
selector:
|
||||
app: neuron-mcp
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: neuron-rest
|
||||
namespace: swarm-alpha
|
||||
labels:
|
||||
app: neuron-rest
|
||||
variant: alpha
|
||||
spec:
|
||||
selector:
|
||||
app: neuron-rest
|
||||
ports:
|
||||
- name: http
|
||||
port: 8081
|
||||
targetPort: 8081
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: neuron-mcp
|
||||
namespace: swarm-beta
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
variant: beta
|
||||
spec:
|
||||
selector:
|
||||
app: neuron-mcp
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: neuron-rest
|
||||
namespace: swarm-beta
|
||||
labels:
|
||||
app: neuron-rest
|
||||
variant: beta
|
||||
spec:
|
||||
selector:
|
||||
app: neuron-rest
|
||||
ports:
|
||||
- name: http
|
||||
port: 8081
|
||||
targetPort: 8081
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: neuron-mcp
|
||||
namespace: swarm-gamma
|
||||
labels:
|
||||
app: neuron-mcp
|
||||
variant: gamma
|
||||
spec:
|
||||
selector:
|
||||
app: neuron-mcp
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: neuron-rest
|
||||
namespace: swarm-gamma
|
||||
labels:
|
||||
app: neuron-rest
|
||||
variant: gamma
|
||||
spec:
|
||||
selector:
|
||||
app: neuron-rest
|
||||
ports:
|
||||
- name: http
|
||||
port: 8081
|
||||
targetPort: 8081
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,66 @@
|
||||
# SQLite clone Job for swarm-alpha
|
||||
# Creates a snapshot of the prod neuron.db into swarm-alpha's PVC.
|
||||
# This Job is created by swarm.sh at session start; it is NOT static.
|
||||
# This file is the template — swarm.sh applies it via kubectl after substituting SESSION_ID.
|
||||
#
|
||||
# The Job mounts both the prod PVC (read-only) and the variant PVC (read-write).
|
||||
# It uses a simple cp to snapshot the database before the variant MCP starts.
|
||||
#
|
||||
# NOTE: The prod MCP must be scaled down to 0 OR the Job must use SQLite's backup API
|
||||
# (via sqlite3 .backup command) to ensure consistency. swarm.sh handles the hot-backup
|
||||
# approach using the sqlite3 CLI, so the prod pod does NOT need to stop.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: sqlite-clone-alpha
|
||||
namespace: swarm-alpha
|
||||
labels:
|
||||
app: swarm-clone
|
||||
variant: alpha
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 3600
|
||||
backoffLimit: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: swarm-clone
|
||||
variant: alpha
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
runAsNonRoot: false # sqlite3 needs to run as root to access both PVCs
|
||||
containers:
|
||||
- name: sqlite-clone
|
||||
image: keinos/sqlite3:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Starting SQLite hot-backup from prod to swarm-alpha..."
|
||||
# Use SQLite's .backup command for a consistent online backup
|
||||
sqlite3 /prod-data/neuron.db ".backup /variant-data/neuron.db"
|
||||
echo "Backup complete. Verifying..."
|
||||
sqlite3 /variant-data/neuron.db "PRAGMA integrity_check;"
|
||||
echo "SQLite clone complete for swarm-alpha."
|
||||
volumeMounts:
|
||||
- name: prod-data
|
||||
mountPath: /prod-data
|
||||
readOnly: true
|
||||
- name: variant-data
|
||||
mountPath: /variant-data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: prod-data
|
||||
persistentVolumeClaim:
|
||||
claimName: neuron-prod-data
|
||||
readOnly: true
|
||||
- name: variant-data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-alpha-data
|
||||
@@ -0,0 +1,54 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: sqlite-clone-beta
|
||||
namespace: swarm-beta
|
||||
labels:
|
||||
app: swarm-clone
|
||||
variant: beta
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 3600
|
||||
backoffLimit: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: swarm-clone
|
||||
variant: beta
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
runAsNonRoot: false
|
||||
containers:
|
||||
- name: sqlite-clone
|
||||
image: keinos/sqlite3:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Starting SQLite hot-backup from prod to swarm-beta..."
|
||||
sqlite3 /prod-data/neuron.db ".backup /variant-data/neuron.db"
|
||||
echo "Backup complete. Verifying..."
|
||||
sqlite3 /variant-data/neuron.db "PRAGMA integrity_check;"
|
||||
echo "SQLite clone complete for swarm-beta."
|
||||
volumeMounts:
|
||||
- name: prod-data
|
||||
mountPath: /prod-data
|
||||
readOnly: true
|
||||
- name: variant-data
|
||||
mountPath: /variant-data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: prod-data
|
||||
persistentVolumeClaim:
|
||||
claimName: neuron-prod-data
|
||||
readOnly: true
|
||||
- name: variant-data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-beta-data
|
||||
@@ -0,0 +1,54 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: sqlite-clone-gamma
|
||||
namespace: swarm-gamma
|
||||
labels:
|
||||
app: swarm-clone
|
||||
variant: gamma
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 3600
|
||||
backoffLimit: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: swarm-clone
|
||||
variant: gamma
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
runAsNonRoot: false
|
||||
containers:
|
||||
- name: sqlite-clone
|
||||
image: keinos/sqlite3:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Starting SQLite hot-backup from prod to swarm-gamma..."
|
||||
sqlite3 /prod-data/neuron.db ".backup /variant-data/neuron.db"
|
||||
echo "Backup complete. Verifying..."
|
||||
sqlite3 /variant-data/neuron.db "PRAGMA integrity_check;"
|
||||
echo "SQLite clone complete for swarm-gamma."
|
||||
volumeMounts:
|
||||
- name: prod-data
|
||||
mountPath: /prod-data
|
||||
readOnly: true
|
||||
- name: variant-data
|
||||
mountPath: /variant-data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: prod-data
|
||||
persistentVolumeClaim:
|
||||
claimName: neuron-prod-data
|
||||
readOnly: true
|
||||
- name: variant-data
|
||||
persistentVolumeClaim:
|
||||
claimName: swarm-gamma-data
|
||||
@@ -50,3 +50,43 @@ resource "kubernetes_namespace" "neuron_tim" {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Swarm variant namespaces — isolated execution environments for swarm self-improvement loops
|
||||
resource "kubernetes_namespace" "swarm_alpha" {
|
||||
metadata {
|
||||
name = "swarm-alpha"
|
||||
labels = {
|
||||
managed-by = "terraform"
|
||||
tier = "swarm"
|
||||
environment = "swarm"
|
||||
app = "neuron-technologies"
|
||||
variant = "alpha"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "swarm_beta" {
|
||||
metadata {
|
||||
name = "swarm-beta"
|
||||
labels = {
|
||||
managed-by = "terraform"
|
||||
tier = "swarm"
|
||||
environment = "swarm"
|
||||
app = "neuron-technologies"
|
||||
variant = "beta"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "swarm_gamma" {
|
||||
metadata {
|
||||
name = "swarm-gamma"
|
||||
labels = {
|
||||
managed-by = "terraform"
|
||||
tier = "swarm"
|
||||
environment = "swarm"
|
||||
app = "neuron-technologies"
|
||||
variant = "gamma"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user