Will Anderson
73004fa287
The registry currently allows anonymous cluster-internal pulls so the imagePullSecrets reference was failing the externalsecret reconcile (secret/data/mudcraft has no registry creds for this app). Pod was pulling fine anyway. If the registry later gets locked down, add a proper externalsecret using the path from secret/data/<app> instead of borrowing mudcraft's.
94 lines
3.0 KiB
YAML
94 lines
3.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: neuron-web
|
|
namespace: neuron-web
|
|
labels:
|
|
app: neuron-web
|
|
env: stage
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: neuron-web
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: neuron-web
|
|
env: stage
|
|
spec:
|
|
# The registry currently allows anonymous reads from the cluster; if we
|
|
# later flip it to require auth, add a registry-pull-secret here that
|
|
# ESO populates from Vault. See the mudcraft externalsecret-registry
|
|
# for the pattern.
|
|
containers:
|
|
- name: neuron-web
|
|
image: registry.neuralplatform.ai/neuron-web:dev-dfe41234
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
env:
|
|
- name: NODE_ENV
|
|
value: production
|
|
- name: PORT
|
|
value: "8080"
|
|
- name: NEURON_PORT
|
|
value: "7772"
|
|
- name: LANDING_ROOT
|
|
value: /srv/landing
|
|
# Public Cloud Run env that the El runtime reads at startup.
|
|
- name: NEURON_LLM_0_FORMAT
|
|
value: anthropic
|
|
- name: NEURON_LLM_0_MODEL
|
|
value: claude-sonnet-4-5
|
|
- name: NEURON_LLM_0_URL
|
|
value: https://api.anthropic.com/v1/messages
|
|
- name: GCS_SHARE_BUCKET
|
|
value: neuron-shares-prod
|
|
- name: NEURON_ORIGIN
|
|
value: https://web-stage.neuralplatform.ai
|
|
envFrom:
|
|
- secretRef:
|
|
name: neuron-web-secrets
|
|
# The El runtime fs_writes index.html, about.html, terms.html,
|
|
# enterprise-terms.html into LANDING_ROOT at startup. The image
|
|
# ships a baseline /srv/landing layout (assets, llms.txt) but
|
|
# the HTML files are runtime-generated. Mount a writable
|
|
# emptyDir over /srv/landing so the runtime can write, while
|
|
# keeping the image's static layout via subPath copies — but
|
|
# since the image already chowns /srv/landing to the landing
|
|
# user, no overlay is needed for normal operation. The
|
|
# readOnlyRootFilesystem flag is intentionally NOT set so
|
|
# /srv/landing stays writable.
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|