Track the practice cluster's Helm values in Git

2026-08-17 13:59:39 +07:00
parent a1de4715a4
commit c778f7e9cc
8 changed files with 484 additions and 0 deletions
@@ -0,0 +1,72 @@
+# k3s practice cluster — the `medical-chatbot-app` release.
+#
+# This file is the Git source of truth for every stable, non-secret setting of
+# the practice rehearsal environment. It exists because the same values used to
+# live only inside the ArgoCD Application's inline `spec.source.helm.values`,
+# where they were invisible to review, diff and rollback: the cluster could
+# drift from the repository without a single commit recording it. That is how
+# practice ended up on DeepSeek with reranking off while production ran Qwen
+# with reranking on.
+#
+# Two things deliberately stay OUT of this file and remain inline on the
+# Application:
+#
+#   - `aiService.image` / `web.image` — rewritten on every push by
+#     `.github/scripts/sync_practice_argocd.py`, which regex-replaces the tag
+#     in the inline values. A tag committed here would be stale by design.
+#   - anything secret. Nothing in the practice release currently needs one;
+#     Bedrock authenticates through the node's instance role.
+#
+# ArgoCD applies `valueFiles` in order and then the inline values last, so the
+# image block inline still wins over anything the chart defaults set here.
+#
+# The behavioural settings below mirror the production runtime contract audited
+# on 2026-08-17 (see coordination/ARGOCD_PRODUCTION_MIGRATION_STATE_2026-08-17.md).
+# Practice is only useful as a migration rehearsal while they stay in sync.
+
+global:
+  environment: k3s-practice
+  # The GHCR packages are private; without this the Pods fail ImagePullBackOff.
+  imagePullSecrets:
+    - name: ghcr-pull-secret
+
+# PostgreSQL and Qdrant are owned by the separate `medical-chatbot-data`
+# release so that redeploying the app never touches persistent state. This
+# release therefore runs neither, and points at the data release's Services.
+postgres:
+  enabled: false
+
+qdrant:
+  enabled: false
+  url: http://medical-chatbot-data-medical-chatbot-qdrant.medical-chatbot-data.svc.cluster.local:6333
+
+secret:
+  postgresHost: medical-chatbot-data-medical-chatbot-postgres.medical-chatbot-data.svc.cluster.local
+
+aiService:
+  config:
+    embeddingProvider: cohere-v4
+    embeddingDimensions: 1024
+    evidenceMinimumScore: 0.12
+    awsRegion: us-east-1
+    answerProvider: bedrock-converse
+    answerModelId: qwen.qwen3-next-80b-a3b
+    rerankEnabled: true
+
+observability:
+  grafana:
+    # Practice-only convenience: the rehearsal cluster is a throwaway box and
+    # Grafana sits behind the same ingress host. Never set this on production.
+    anonymousAdmin: true
+
+ingress:
+  enabled: true
+  className: traefik
+  host: readytochat.realvuxbaro.me
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  tls:
+    - hosts:
+        - readytochat.realvuxbaro.me
+      secretName: readytochat-tls