ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
10 changed files with 145336 additions and 0 deletions
--- a/vendor/workloads/hf-chat-ui/configmap.yaml
+++ b/vendor/workloads/hf-chat-ui/configmap.yaml
@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hf-chat-ui
+  namespace: hf-chat-ui
+data:
+  PUBLIC_ORIGIN: https://chat.quorate.internal
+  ORIGIN: https://chat.quorate.internal
+  PUBLIC_APP_NAME: Quorate Chat
+  PERSIST_BACKEND: postgres
+  OPENID_PROVIDER_URL: https://auth.quorate.dev
+  OPENID_SCOPES: openid profile email
+  OPENID_NAME_CLAIM: name
+  AUTOMATIC_LOGIN: 'true'
+  ENABLE_CONFIG_MANAGER: 'false'
+  COOKIE_NAME: hf-chat
+  OPENAI_BASE_URL: http://agentgateway-proxy.agentgateway-system.svc.cluster.local/v1
+  NODE_EXTRA_CA_CERTS: /var/run/certs/internal-ca.crt
--- a/vendor/workloads/hf-chat-ui/deployment.yaml
+++ b/vendor/workloads/hf-chat-ui/deployment.yaml
@ -0,0 +1,108 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hf-chat-ui
+  namespace: hf-chat-ui
+  labels:
+    app.kubernetes.io/name: hf-chat-ui
+    app.kubernetes.io/instance: hf-chat-ui
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hf-chat-ui
+      app.kubernetes.io/instance: hf-chat-ui
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hf-chat-ui
+        app.kubernetes.io/instance: hf-chat-ui
+        quorate.dev/zitadel-relay: 'true'
+    spec:
+      imagePullSecrets:
+        - name: quay-cluster-pull
+      runtimeClassName: gvisor
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: hf-chat-ui
+          image: registry.quorate.internal/quorate/hf-chat-ui@sha256:372c8b2c6d57c297acc2a5457d7ad85fb8a1176d3f63bd74cf46952c3901910c
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: hf-chat-ui
+            - secretRef:
+                name: hf-chat-ui-oidc
+            - secretRef:
+                name: hf-chat-ui-db
+          startupProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            failureThreshold: 60
+            periodSeconds: 5
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            failureThreshold: 3
+            periodSeconds: 10
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /healthcheck
+              port: http
+            failureThreshold: 3
+            periodSeconds: 30
+            timeoutSeconds: 3
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: cas
+              mountPath: /var/run/certs
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: cas
+          projected:
+            sources:
+              - secret:
+                  name: ca-internal
+                  items:
+                    - key: ca.crt
+                      path: internal-ca.crt
+              - secret:
+                  name: ca-postgres
+                  items:
+                    - key: ca.crt
+                      path: postgres-ca.crt
+      serviceAccountName: hf-chat-ui
--- a/vendor/workloads/hf-chat-ui/kustomization.yaml
+++ b/vendor/workloads/hf-chat-ui/kustomization.yaml
@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - configmap.yaml
+  - vso.yaml
+  - deployment.yaml
+  - service.yaml
+  - route.yaml
+  - poddisruptionbudget.yaml
+  - network-policies.yaml
--- a/vendor/workloads/hf-chat-ui/namespace.yaml
+++ b/vendor/workloads/hf-chat-ui/namespace.yaml
@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hf-chat-ui
+  labels:
+    gateway.quorate.internal/allow-internal: 'true'
--- a/vendor/workloads/hf-chat-ui/network-policies.yaml
+++ b/vendor/workloads/hf-chat-ui/network-policies.yaml
@ -0,0 +1,182 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-chat-ui
+  namespace: hf-chat-ui
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: hf-chat-ui
+      app.kubernetes.io/instance: hf-chat-ui
+  ingress:
+    - fromEntities:
+        - host
+        - ingress
+      toPorts:
+        - ports:
+            - port: '3000'
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            gateway.networking.k8s.io/gateway-name: gateway-internal
+      toPorts:
+        - ports:
+            - port: '3000'
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+            cnpg.io/cluster: main
+      toPorts:
+        - ports:
+            - port: '5432'
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: agentgateway-system
+            gateway.networking.k8s.io/gateway-name: agentgateway-proxy
+      toPorts:
+        - ports:
+            - port: '80'
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: '53'
+              protocol: UDP
+            - port: '53'
+              protocol: TCP
+    - toServices:
+        - k8sService:
+            namespace: kube-system
+            serviceName: kube-dns
+      toPorts:
+        - ports:
+            - port: '53'
+              protocol: UDP
+            - port: '53'
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zitadel
+            app.kubernetes.io/name: zitadel-oidc-internal
+      toPorts:
+        - ports:
+            - port: '8443'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: gateway-hf-chat-ui
+spec:
+  endpointSelector:
+    matchLabels:
+      reserved:ingress: ''
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: hf-chat-ui
+            app.kubernetes.io/name: hf-chat-ui
+            app.kubernetes.io/instance: hf-chat-ui
+      toPorts:
+        - ports:
+            - port: '3000'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-hf-chat-ui
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: hf-chat-ui
+            app.kubernetes.io/instance: hf-chat-ui
+      toPorts:
+        - ports:
+            - port: '3000'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: hf-chat-ui-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: hf-chat-ui
+            app.kubernetes.io/instance: hf-chat-ui
+      toPorts:
+        - ports:
+            - port: '32768'
+              endPort: 60999
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-chat-ui-ingress
+  namespace: postgres
+spec:
+  endpointSelector:
+    matchLabels:
+      cnpg.io/cluster: main
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: hf-chat-ui
+            app.kubernetes.io/name: hf-chat-ui
+            app.kubernetes.io/instance: hf-chat-ui
+      toPorts:
+        - ports:
+            - port: '5432'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-chat-ui-ingress
+  namespace: agentgateway-system
+spec:
+  endpointSelector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: agentgateway-proxy
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: hf-chat-ui
+            app.kubernetes.io/name: hf-chat-ui
+      toPorts:
+        - ports:
+            - port: '80'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-chat-ui-ingress
+  namespace: zitadel
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: zitadel-oidc-internal
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: hf-chat-ui
+            app.kubernetes.io/name: hf-chat-ui
+            app.kubernetes.io/instance: hf-chat-ui
+      toPorts:
+        - ports:
+            - port: '8443'
+              protocol: TCP
--- a/vendor/workloads/hf-chat-ui/poddisruptionbudget.yaml
+++ b/vendor/workloads/hf-chat-ui/poddisruptionbudget.yaml
@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: hf-chat-ui
+  namespace: hf-chat-ui
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hf-chat-ui
+      app.kubernetes.io/instance: hf-chat-ui
--- a/vendor/workloads/hf-chat-ui/route.yaml
+++ b/vendor/workloads/hf-chat-ui/route.yaml
@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: hf-chat-ui
+  namespace: hf-chat-ui
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - chat.quorate.internal
+  rules:
+    - backendRefs:
+        - name: hf-chat-ui
+          port: 3000
--- a/vendor/workloads/hf-chat-ui/service.yaml
+++ b/vendor/workloads/hf-chat-ui/service.yaml
@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: hf-chat-ui
+  namespace: hf-chat-ui
+spec:
+  selector:
+    app.kubernetes.io/name: hf-chat-ui
+    app.kubernetes.io/instance: hf-chat-ui
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+      protocol: TCP
--- a/vendor/workloads/hf-chat-ui/serviceaccount.yaml
+++ b/vendor/workloads/hf-chat-ui/serviceaccount.yaml
@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hf-chat-ui
+  namespace: hf-chat-ui
--- a/vendor/workloads/hf-chat-ui/vso.yaml
+++ b/vendor/workloads/hf-chat-ui/vso.yaml
@ -0,0 +1,154 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hf-chat-ui-vso
+  namespace: hf-chat-ui
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: hf-chat-ui
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: hf-chat-ui
+    serviceAccount: hf-chat-ui-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: hf-chat-ui-oidc
+  namespace: hf-chat-ui
+spec:
+  type: kv-v2
+  mount: secret
+  path: hf-chat-ui/oidc/zitadel
+  destination:
+    name: hf-chat-ui-oidc
+    create: true
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: hf-chat-ui
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: hf-chat-ui-ca
+  namespace: hf-chat-ui
+spec:
+  type: kv-v2
+  mount: secret
+  path: ca/internal
+  hmacSecretData: true
+  destination:
+    name: ca-internal
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        ca.crt:
+          text: >-
+            {{- $ca := get .Secrets "certificate" -}}
+            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
+            {{- fail "CA publication is pending" -}}
+            {{- end -}}
+            {{- $ca -}}
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: hf-chat-ui
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: hf-chat-ui-pg-ca
+  namespace: hf-chat-ui
+spec:
+  type: kv-v2
+  mount: secret
+  path: ca/postgres
+  hmacSecretData: true
+  destination:
+    name: ca-postgres
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        ca.crt:
+          text: >-
+            {{- $ca := get .Secrets "certificate" -}}
+            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
+            {{- fail "CA publication is pending" -}}
+            {{- end -}}
+            {{- $ca -}}
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: hf-chat-ui
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: hf-chat-ui-db
+  namespace: hf-chat-ui
+spec:
+  mount: database
+  path: static-creds/hf-chat-ui
+  allowStaticCreds: true
+  refreshAfter: 5m
+  destination:
+    name: hf-chat-ui-db
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        POSTGRES_URL:
+          text: postgresql://{{ get .Secrets "username" | urlquery }}:{{ get .Secrets "password" | urlquery }}@main-rw.postgres.svc.cluster.local:5432/hf_chat_ui?uselibpqcompat=true&sslmode=verify-full&sslrootcert=/var/run/certs/postgres-ca.crt
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: hf-chat-ui
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: quay-cluster-pull
+  namespace: hf-chat-ui
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  destination:
+    name: quay-cluster-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        .dockerconfigjson:
+          text: >-
+            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: hf-chat-ui
+  vaultAuthRef: default