feat: onboard Simple IMA on local k3s

2026-07-13 17:56:26 +08:00
parent 81e6dd9c7a
commit 57fec14864
14 changed files with 290 additions and 0 deletions
@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: simple-ima-config
+data:
+  NODE_ENV: production
+  PORT: "8787"
+  DIST_DIR: /app/dist
+  DIFY_BASE_URL: http://api.ljwx-dify-dev.svc.cluster.local:5001
+  DIFY_DATASET_BASE_URL: http://api.ljwx-dify-dev.svc.cluster.local:5001
+  DIFY_DATASET_ID: eb51dabb-83d2-41fb-b7f5-bf7cc31ddbbb
+  DIFY_AUTO_GENERATE_NAME: "false"
+  DIFY_SOURCE_INDEX_FILE: /data/dify-source-index.json
+  SIMPLE_IMA_DIFY_NAMESPACE: ljwx-dify-dev
+  SIMPLE_IMA_DEPLOYMENT_ID: ljwx-zhishiku-local-k3s
+  SIMPLE_IMA_LICENSE_EDITION: basic
+  SIMPLE_IMA_NETWORK_MODE: AIRGAPPED
+  SIMPLE_IMA_LLM_GATEWAY_URL: http://mlx-qwen.ljwx-dify-dev.svc.cluster.local:18088
+  SIMPLE_IMA_LLM_ADMIN_URL: http://192.168.1.83:18180
+  SIMPLE_IMA_MINERU_MODE: auto
+  SIMPLE_IMA_TABLE_MODE: auto
+  SIMPLE_IMA_CONTRACT_MODE: auto
+  SIMPLE_IMA_DATA_FILE: /data/conversations.json
+  SIMPLE_IMA_UPLOADS_FILE: /data/uploads.json
+  SIMPLE_IMA_AUDIT_FILE: /data/audit-events.json
+  SIMPLE_IMA_COMPLIANCE_FILE: /data/compliance-hits.json
+  SIMPLE_IMA_RULEBOOK_FILE: /data/rulebook.json
+  SIMPLE_IMA_PERMISSIONS_FILE: /data/document-permissions.json
+  SIMPLE_IMA_USERS_FILE: /data/users.json
+  SIMPLE_IMA_DEPARTMENTS_FILE: /data/departments.json
+  SIMPLE_IMA_QUOTA_REQUESTS_FILE: /data/quota-requests.json
+  SIMPLE_IMA_QUOTA_POLICY_FILE: /data/quota-policy.json
+  SIMPLE_IMA_ALERT_POLICY_FILE: /data/alert-policy.json
+  SIMPLE_IMA_ALERT_STATE_FILE: /data/alert-state.json
+  SIMPLE_IMA_TOKEN_USAGE_FILE: /data/token-usage.json
+  SIMPLE_IMA_RUNTIME_INDEX_FILE: /data/source-index-runtime.json
+  SIMPLE_IMA_ATTACHMENTS_DIR: /data/conversation-attachments
+  SIMPLE_IMA_MEETING_NOTES_FILE: /data/meeting-notes.json
+  SIMPLE_IMA_MEETING_CONNECTORS_FILE: /data/meeting-connectors.json
+  SIMPLE_IMA_MEETING_CLOUDEVENTS_FILE: /data/meeting-cloudevents.json
+  SIMPLE_IMA_RESEARCH_SIGNALS_FILE: /data/research-signals.json
+  SIMPLE_IMA_UPLOAD_MAX_BYTES: "31457280"
+  SIMPLE_IMA_TOKEN_USAGE_MAX_RECORDS: "20000"
+  SIMPLE_IMA_MAX_DAILY_QUOTA: "100000000"
+  DEFAULT_TIMEOUT_SECONDS: "240"
+  FIRST_TOKEN_TIMEOUT_SECONDS: "30"
@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: simple-ima-web
+  labels:
+    app.kubernetes.io/name: simple-ima-web
+    app.kubernetes.io/part-of: ljwx-zhishiku
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: simple-ima-web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: simple-ima-web
+        app.kubernetes.io/part-of: ljwx-zhishiku
+    spec:
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: simple-ima-web
+        image: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web@sha256:40bcd635f0b67adb2a515ec2d64a493267ef363ec8f39bedaab9bbf708eab622
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 1000
+        envFrom:
+        - configMapRef:
+            name: simple-ima-config
+        - secretRef:
+            name: simple-ima-secrets
+        ports:
+        - name: http
+          containerPort: 8787
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 3
+          failureThreshold: 6
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: http
+          initialDelaySeconds: 20
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: "1"
+            memory: 1Gi
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: tmp
+          mountPath: /tmp
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: simple-ima-data
+      - name: tmp
+        emptyDir: {}
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- configmap.yaml
+- pvc.yaml
+- deployment.yaml
+- service.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: simple-ima-data
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: simple-ima-web
+  labels:
+    app.kubernetes.io/name: simple-ima-web
+    app.kubernetes.io/part-of: ljwx-zhishiku
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: simple-ima-web
+  ports:
+  - name: http
+    port: 8787
+    targetPort: http
+    protocol: TCP
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ljwx-dify-dev
+resources:
+- ../../base
@@ -0,0 +1,28 @@
+# ljwx-zhishiku capability contract (dev)
+
+## Namespace baseline
+
+- namespace: `ljwx-dify-dev`
+- namespace profile: `dev-default`
+- registry profile: `harbor-only`
+- runtime secret profile: `none`
+- image pull secrets: `regcred`
+- runtime contract secrets: `none`
+
+## Capabilities
+
+- ghcr_pull (namespace): Bind GHCR pull secret ghcr-pull to the namespace baseline.
+- harbor_pull (namespace): Bind Harbor pull secret regcred to the namespace baseline.
+- runtime_app_secret (application): Standardize service-specific runtime secret as runtime-app.
+
+## Bootstrap commands
+
+```bash
+bash scripts/ops/sync-registry-pull-secrets.sh --target-namespace ljwx-dify-dev --registry-profile harbor-only
+```
+
+## Notes
+
+- `runtime-contract/*.secret.example.yaml` are placeholders only and must not contain real credentials.
+- `cluster_bootstrap` is disabled for this entry; keep the existing cluster namespace/application manifests as the current source of truth.
+- For legacy workloads, migrate deployment manifests gradually to `runtime-infra`, `runtime-llm`, and `runtime-app` instead of app-specific secret names.
@@ -0,0 +1,20 @@
+service: ljwx-zhishiku
+environment: dev
+namespace: ljwx-dify-dev
+cluster_bootstrap: false
+ingress_profile: none
+public_host: ''
+generate_ingress: true
+ingress_class_name: ''
+cluster_issuer: ''
+tls_secret_name: ''
+namespace_profile: dev-default
+registry_profile: harbor-only
+runtime_secret_profile: none
+capabilities:
+- ghcr_pull
+- harbor_pull
+- runtime_app_secret
+image_pull_secrets:
+- regcred
+contract_secret_names: []
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: simple-ima-secrets
+  namespace: ljwx-dify-dev
+type: Opaque
+stringData:
+  SESSION_SECRET: replace-me
+  DIFY_APP_API_KEY: replace-me
+  DIFY_DATASET_API_KEY: replace-me
+  SIMPLE_IMA_USERS: '[]'
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ljwx-zhishiku-dev
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/lingjingwanxiang/ljwx-deploy.git
+    targetRevision: main
+    path: apps/ljwx-zhishiku/overlays/dev
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ljwx-dify-dev
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
@@ -153,6 +153,29 @@ services:
    smoke_host: web
    smoke_port: '3000'
    smoke_path: /
+- service: ljwx-zhishiku
+  environment: dev
+  template: legacy-service
+  overlay_name: dev
+  overlay_path: apps/ljwx-zhishiku/overlays/dev/kustomization.yaml
+  deploy_namespace: ljwx-dify-dev
+  argocd_app: ljwx-zhishiku-dev
+  argocd_app_file: argocd-apps/85-ljwx-zhishiku-dev.yaml
+  argocd_order: 85
+  cluster_bootstrap: false
+  scaffold_app: false
+  profiles:
+  - local-k3s
+  registry_profile: harbor-only
+  runtime_secret_profile: none
+  capabilities: []
+  image_repo: simple-ima-web
+  kustomize_image_name: ghcr.io/lingjingwanxiang/ljwx-zhishiku/simple-ima-web
+  harbor_image: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web
+  deploy_image: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web
+  smoke_host: simple-ima-web
+  smoke_port: '8787'
+  smoke_path: /api/health
 - service: ljwx-stock-qlib-predict
  environment: dev
  template: batch-multi-image-service
@@ -209,3 +209,11 @@ services:
        kustomizeImageName: ghcr.io/lingjingwanxiang/zhihu-engine/frontend
        harborImage: ghcr.io/lingjingwanxiang/zhihu-engine/frontend
        argocdApp: zhihu-engine-dev
+  ljwx-zhishiku:
+    envs:
+      dev:
+        overlayPath: apps/ljwx-zhishiku/overlays/dev/kustomization.yaml
+        kustomizeImageName: ghcr.io/lingjingwanxiang/ljwx-zhishiku/simple-ima-web
+        harborImage: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web
+        argocdApp: ljwx-zhishiku-dev
+        deployImage: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web
@@ -189,3 +189,11 @@ services:
        harborImage: ghcr.io/lingjingwanxiang/zhihu-engine-new
        deployImage: ghcr.io/lingjingwanxiang/zhihu-engine-new
        argocdApp: zhihu-engine-new-dev
+  ljwx-zhishiku:
+    envs:
+      dev:
+        overlayPath: apps/ljwx-zhishiku/overlays/dev/kustomization.yaml
+        kustomizeImageName: ghcr.io/lingjingwanxiang/ljwx-zhishiku/simple-ima-web
+        harborImage: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web
+        argocdApp: ljwx-zhishiku-dev
+        deployImage: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web
@@ -132,6 +132,12 @@
      "environment": "dev",
      "argocd_app": "ljwx-tuoyu-dev",
      "endpoint": "http://ljwx-tuoyu.ljwx-tuoyu-dev.svc.cluster.local:8080/health"
+    },
+    {
+      "service": "ljwx-zhishiku",
+      "environment": "dev",
+      "argocd_app": "ljwx-zhishiku-dev",
+      "endpoint": "http://simple-ima-web.ljwx-dify-dev.svc.cluster.local:8787/api/health"
    }
  ]
 }