nntrivi2001
57dc91585d
Internal SmartGift build of a Claude Code monitoring dashboard. Lanes: a durable unit of parallel agent work, one per working directory, tracked across session restarts. Managed lanes are git worktrees the dashboard provisions and can reset or remove behind a three-check destroy guard and a counted preflight; adopted lanes are directories you already own and are never destroyable. Pipelines: a lane moves through pipeline stages. A stage the agent declares with evidence renders green; a stage inferred from the tool-event stream renders dashed amber and never counts as done. Detection is forward-only within a 30-minute window, and never writes the declared stage. Workspace: one page at /run with a lane grid, the selected lane's pipeline, and a full Claude console behind a disclosure.
59 lines
2.3 KiB
Markdown
59 lines
2.3 KiB
Markdown
# Kubernetes Manifests
|
||
|
||
Production-ready Kubernetes resources using Kustomize for environment management, with optional blue-green and canary deployment strategies.
|
||
|
||
## Structure
|
||
|
||
```
|
||
kubernetes/
|
||
├── base/ # Shared base (all environments inherit from this)
|
||
│ ├── kustomization.yaml
|
||
│ ├── namespace.yaml # agent-monitor namespace with Pod Security Standards
|
||
│ ├── configmap.yaml # Environment configuration
|
||
│ ├── serviceaccount.yaml # Minimal-privilege service account
|
||
│ ├── deployment.yaml # Main deployment (2 replicas, 3 health probes)
|
||
│ ├── service.yaml # ClusterIP with WebSocket sticky sessions
|
||
│ ├── ingress.yaml # NGINX ingress with TLS + WebSocket headers
|
||
│ ├── pvc.yaml # 10Gi persistent volume for SQLite
|
||
│ ├── hpa.yaml # Horizontal Pod Autoscaler (2–10 pods)
|
||
│ ├── pdb.yaml # Pod Disruption Budget (minAvailable: 1)
|
||
│ └── networkpolicy.yaml # Ingress restricted to NGINX controller
|
||
├── overlays/
|
||
│ ├── dev/ # 1 replica, no HPA, minimal resources
|
||
│ ├── staging/ # 2 replicas, standard resources
|
||
│ └── production/ # 3 replicas, HPA 3–20, strict anti-affinity
|
||
├── strategies/
|
||
│ ├── blue-green/ # Dual-slot deployment with service switching
|
||
│ └── canary/ # Progressive rollout with Argo Rollouts analysis
|
||
└── components/
|
||
├── mcp-sidecar/ # Adds MCP server container to pods
|
||
└── monitoring/ # Adds Prometheus ServiceMonitor
|
||
```
|
||
|
||
## Usage
|
||
|
||
```bash
|
||
# Apply an environment
|
||
kubectl apply -k overlays/dev/
|
||
kubectl apply -k overlays/staging/
|
||
kubectl apply -k overlays/production/
|
||
|
||
# Add MCP sidecar (edit overlay kustomization.yaml):
|
||
# components:
|
||
# - ../../components/mcp-sidecar
|
||
|
||
# Blue-green switch
|
||
kubectl patch svc agent-monitor -n agent-monitor \
|
||
-p '{"spec":{"selector":{"slot":"green"}}}'
|
||
```
|
||
|
||
## Security
|
||
|
||
All manifests enforce:
|
||
- `runAsNonRoot: true`
|
||
- `readOnlyRootFilesystem: true`
|
||
- `drop: [ALL]` capabilities
|
||
- `seccompProfile: RuntimeDefault`
|
||
- No service account token auto-mount
|
||
- NetworkPolicy restricting ingress sources
|