From d7e0527e9bc8357fd4626e179e66e1440410b30e Mon Sep 17 00:00:00 2001 From: kevkantes Date: Mon, 24 Aug 2026 16:27:18 -0400 Subject: [PATCH 1/2] fix(helm): harden workload defaults Signed-off-by: kevkantes --- charts/ai-platform-engineering/README.md | 98 ++++++++++++------- .../charts/agentgateway/README.md | 13 +-- .../agentgateway/templates/deployment.yaml | 1 + .../templates/serviceaccount.yaml | 1 + .../charts/agentgateway/values.yaml | 1 + .../charts/audit-service/README.md | 14 +-- .../audit-service/templates/deployment.yaml | 1 + .../charts/audit-service/values.yaml | 5 +- .../charts/autonomous-agents/README.md | 12 +-- .../charts/caipe-ui-mongodb/README.md | 12 +-- .../charts/caipe-ui/README.md | 15 +-- .../charts/caipe-ui/templates/deployment.yaml | 1 + .../charts/caipe-ui/values.yaml | 2 +- .../charts/dynamic-agents/README.md | 14 +-- .../dynamic-agents/templates/deployment.yaml | 1 + .../charts/dynamic-agents/values.yaml | 3 +- .../charts/keycloak/README.md | 27 +++-- .../charts/keycloak/templates/deployment.yaml | 5 + .../templates/job-auth-reconcile.yaml | 8 ++ .../keycloak/templates/job-init-idp.yaml | 8 ++ .../templates/job-init-token-exchange.yaml | 8 ++ .../keycloak/templates/serviceaccount.yaml | 1 + .../charts/keycloak/values.yaml | 33 +++++++ .../charts/mcp-server/README.md | 19 ++-- .../mcp-server/templates/mcp-deployment.yaml | 1 + .../charts/mcp-server/values.yaml | 16 +-- .../charts/openfga-authz-bridge/README.md | 13 +-- .../templates/deployment.yaml | 1 + .../templates/serviceaccount.yaml | 1 + .../charts/openfga-authz-bridge/values.yaml | 1 + .../charts/openfga/README.md | 27 +++-- .../charts/openfga/templates/deployment.yaml | 1 + .../charts/openfga/templates/job-init.yaml | 19 ++-- .../charts/openfga/templates/job-migrate.yaml | 4 + .../openfga/templates/serviceaccount.yaml | 1 + .../charts/openfga/values.yaml | 15 +++ .../charts/scheduler/README.md | 12 +-- .../charts/skill-scanner/README.md | 13 +-- .../skill-scanner/templates/deployment.yaml | 1 + .../charts/skill-scanner/values.yaml | 2 + .../charts/slack-bot/README.md | 13 +-- .../slack-bot/templates/deployment.yaml | 1 + .../slack-bot/templates/serviceaccount.yaml | 1 + .../charts/slack-bot/values.yaml | 1 + .../charts/webex-bot/README.md | 12 +-- .../webex-bot/templates/deployment.yaml | 1 + .../templates/extra-deploy.yaml | 7 +- charts/ai-platform-engineering/values.yaml | 4 +- charts/rag-stack/README.md | 65 ++++++++++-- .../rag-stack/charts/agent-ontology/README.md | 14 +-- .../agent-ontology/templates/deployment.yaml | 1 + .../charts/agent-ontology/values.yaml | 2 +- .../rag-stack/charts/rag-ingestors/README.md | 14 +-- .../rag-ingestors/templates/deployment.yaml | 2 +- .../templates/serviceaccount.yaml | 3 +- .../charts/rag-ingestors/values.yaml | 3 +- charts/rag-stack/charts/rag-redis/README.md | 14 +-- .../rag-redis/templates/deployment.yaml | 1 + charts/rag-stack/charts/rag-redis/values.yaml | 2 +- charts/rag-stack/charts/rag-server/README.md | 12 +-- .../templates/dependency-serviceaccounts.yaml | 31 ++++++ charts/rag-stack/values.yaml | 78 +++++++++++++++ .../ai-platform-engineering/agentgateway.md | 13 +-- .../ai-platform-engineering/audit-service.md | 14 +-- .../autonomous-agents.md | 18 ++-- .../caipe-ui-mongodb.md | 12 +-- .../ai-platform-engineering/caipe-ui.md | 15 +-- .../ai-platform-engineering/dynamic-agents.md | 14 +-- .../ai-platform-engineering/index.md | 98 ++++++++++++------- .../ai-platform-engineering/keycloak.md | 27 +++-- .../ai-platform-engineering/mcp-server.md | 19 ++-- .../openfga-authz-bridge.md | 13 +-- .../ai-platform-engineering/openfga.md | 27 +++-- .../ai-platform-engineering/scheduler.md | 12 +-- .../ai-platform-engineering/skill-scanner.md | 13 +-- .../ai-platform-engineering/slack-bot.md | 13 +-- .../ai-platform-engineering/webex-bot.md | 12 +-- .../helm-charts/rag-stack/agent-ontology.md | 14 +-- .../helm-charts/rag-stack/index.md | 65 ++++++++++-- .../helm-charts/rag-stack/rag-ingestors.md | 14 +-- .../helm-charts/rag-stack/rag-redis.md | 14 +-- .../helm-charts/rag-stack/rag-server.md | 12 +-- 82 files changed, 791 insertions(+), 361 deletions(-) create mode 100644 charts/rag-stack/templates/dependency-serviceaccounts.yaml diff --git a/charts/ai-platform-engineering/README.md b/charts/ai-platform-engineering/README.md index 2fe2ef6a2e..fd790437da 100644 --- a/charts/ai-platform-engineering/README.md +++ b/charts/ai-platform-engineering/README.md @@ -8,17 +8,17 @@ Parent chart to deploy CAIPE — dynamic agents, per-agent MCP servers, RBAC, an | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 +helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 # Upgrade an existing release -helm upgrade ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 +helm upgrade ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 \ +helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 \ +helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 ``` ## Reading the Values Table @@ -58,6 +58,25 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | agentgateway.image.repository | string | `"cr.agentgateway.dev/agentgateway"` | | | agentgateway.image.tag | string | `"v1.1.0"` | | | agentgateway.skillScanner.enabled | bool | `false` | | +| autonomous-agents.config.DYNAMIC_AGENTS_URL | string | `""` | | +| autonomous-agents.config.MONGODB_DATABASE | string | `"caipe"` | | +| autonomous-agents.dynamicAgentsAuth.clientId | string | `"caipe-platform"` | | +| autonomous-agents.dynamicAgentsAuth.clientSecretRef.key | string | `"OIDC_CLIENT_SECRET"` | | +| autonomous-agents.dynamicAgentsAuth.clientSecretRef.name | string | `"caipe-platform-secret"` | | +| autonomous-agents.dynamicAgentsAuth.enabled | bool | `true` | | +| autonomous-agents.dynamicAgentsAuth.scope | string | `"openid profile email"` | | +| autonomous-agents.dynamicAgentsAuth.tokenUrl | string | `""` | | +| autonomous-agents.existingSecret | string | `""` | | +| autonomous-agents.externalSecrets.apiVersion | string | `"v1beta1"` | | +| autonomous-agents.externalSecrets.data | list | `[]` | | +| autonomous-agents.externalSecrets.enabled | bool | `false` | | +| autonomous-agents.externalSecrets.secretStoreRef.kind | string | `"ClusterSecretStore"` | | +| autonomous-agents.externalSecrets.secretStoreRef.name | string | `"vault"` | | +| autonomous-agents.image.pullPolicy | string | `"IfNotPresent"` | | +| autonomous-agents.image.repository | string | `"ghcr.io/cnoe-io/caipe-autonomous-agents"` | | +| autonomous-agents.image.tag | string | `""` | | +| autonomous-agents.nameOverride | string | `"autonomous-agents"` | | +| autonomous-agents.service.port | int | `8002` | | | caipe-ui.config.APP_NAME | string | `"CAIPE"` | | | caipe-ui.config.CAIPE_CREDENTIALS_ENABLED | string | `"false"` | | | caipe-ui.config.CAIPE_ORG_DISPLAY_NAME | string | `"CAIPE"` | | @@ -71,6 +90,8 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | caipe-ui.config.CREDENTIAL_STORE_BACKEND | string | `"mongodb-envelope"` | | | caipe-ui.config.DEFAULT_AGENT_ID | string | `""` | | | caipe-ui.config.DESCRIPTION | string | `"Where Humans and AI agents collaborate to deliver high quality outcomes."` | | +| caipe-ui.config.DYNAMIC_AGENTS_ENABLED | string | `"false"` | | +| caipe-ui.config.ENABLE_AUTONOMOUS_AGENTS | string | `"false"` | | | caipe-ui.config.ENABLE_SUBAGENT_CARDS | string | `"true"` | | | caipe-ui.config.ENV_BADGE | string | `""` | | | caipe-ui.config.IDENTITY_SYNC_LOGIN_AUTO_CREATE_TEAMS | string | `"false"` | | @@ -190,7 +211,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | dynamic-agents.nameOverride | string | `"dynamic-agents"` | | | dynamic-agents.service.metricsPort | int | `0` | | | dynamic-agents.service.port | int | `8001` | | -| extraDeploy | list | `[]` | | +| extraDeployMap | object | `{}` | | | global.agentgateway.enabled | bool | `true` | | | global.agentgateway.extAuth.enabled | bool | `false` | | | global.agentgateway.extAuth.port | int | `9100` | | @@ -563,6 +584,11 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | openfga.image.repository | string | `"openfga/openfga"` | | | openfga.image.tag | string | `"v1.15.1"` | | | openfga.init.enabled | bool | `true` | | +| openfga.init.platformClient.clientId | string | `"caipe-platform"` | | +| openfga.init.platformClient.clientSecretRef.key | string | `"OIDC_CLIENT_SECRET"` | | +| openfga.init.platformClient.clientSecretRef.name | string | `"caipe-platform-secret"` | | +| openfga.init.platformClient.enabled | bool | `false` | | +| openfga.init.platformClient.orgObject | string | `"organization:caipe"` | | | openfga.init.seedTuples | list | `[]` | | | openfga.init.storeName | string | `"caipe-openfga"` | | | openfga.migrate.enabled | bool | `true` | | @@ -633,6 +659,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | slack-bot.resources.limits.memory | string | `"512Mi"` | | | slack-bot.resources.requests.cpu | string | `"100m"` | | | slack-bot.resources.requests.memory | string | `"256Mi"` | | +| tags.autonomous-agents | bool | `false` | | | tags.basic | bool | `false` | | | tags.caipe-ui | bool | `false` | | | tags.complete | bool | `false` | | @@ -696,31 +723,32 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | Name | Version | Condition / Tags | |------|---------|------------------| -| mcp-argocd (mcp-server) | `0.5.68` | tags: mcp-argocd, basic, complete | -| mcp-aws (mcp-server) | `0.5.68` | tags: mcp-aws, complete | -| mcp-backstage (mcp-server) | `0.5.68` | tags: mcp-backstage, basic, complete | -| mcp-confluence (mcp-server) | `0.5.68` | tags: mcp-confluence, complete | -| mcp-github (mcp-server) | `0.5.68` | tags: mcp-github, basic, complete | -| mcp-gitlab (mcp-server) | `0.5.68` | tags: mcp-gitlab, complete | -| mcp-jira (mcp-server) | `0.5.68` | tags: mcp-jira, complete | -| mcp-komodor (mcp-server) | `0.5.68` | tags: mcp-komodor, complete | -| mcp-pagerduty (mcp-server) | `0.5.68` | tags: mcp-pagerduty, complete | -| mcp-slack (mcp-server) | `0.5.68` | tags: mcp-slack, complete | -| mcp-splunk (mcp-server) | `0.5.68` | tags: mcp-splunk, complete | -| mcp-victorops (mcp-server) | `0.5.68` | tags: mcp-victorops | -| mcp-webex (mcp-server) | `0.5.68` | tags: mcp-webex, complete | -| mcp-webex-meetings (mcp-server) | `0.5.68` | tags: mcp-webex-meetings, complete | -| mcp-netutils (mcp-server) | `0.5.68` | tags: mcp-netutils, complete | -| rag-stack | `0.5.68` | tags: rag-stack, complete | -| caipe-ui | `0.5.68` | tags: caipe-ui | -| audit-service | `0.5.68` | | -| dynamic-agents | `0.5.68` | tags: dynamic-agents | -| scheduler | `0.5.68` | `global.scheduler.enabled` | -| mongodb (caipe-ui-mongodb) | `0.5.68` | `caipe-ui.mongodb.enabled` | -| skill-scanner | `0.5.68` | `global.skillScanner.enabled` | -| slack-bot | `0.5.68` | tags: slack-bot | -| webex-bot | `0.5.68` | tags: webex-bot | -| keycloak | `0.5.68` | tags: keycloak | -| openfga | `0.5.68` | `openfga.enabled` | -| openfga-authz-bridge | `0.5.68` | `openfgaAuthzBridge.enabled` | -| agentgateway | `0.5.68` | `agentgateway.enabled` | +| mcp-argocd (mcp-server) | `0.6.0` | tags: mcp-argocd, basic, complete | +| mcp-aws (mcp-server) | `0.6.0` | tags: mcp-aws, complete | +| mcp-backstage (mcp-server) | `0.6.0` | tags: mcp-backstage, basic, complete | +| mcp-confluence (mcp-server) | `0.6.0` | tags: mcp-confluence, complete | +| mcp-github (mcp-server) | `0.6.0` | tags: mcp-github, basic, complete | +| mcp-gitlab (mcp-server) | `0.6.0` | tags: mcp-gitlab, complete | +| mcp-jira (mcp-server) | `0.6.0` | tags: mcp-jira, complete | +| mcp-komodor (mcp-server) | `0.6.0` | tags: mcp-komodor, complete | +| mcp-pagerduty (mcp-server) | `0.6.0` | tags: mcp-pagerduty, complete | +| mcp-slack (mcp-server) | `0.6.0` | tags: mcp-slack, complete | +| mcp-splunk (mcp-server) | `0.6.0` | tags: mcp-splunk, complete | +| mcp-victorops (mcp-server) | `0.6.0` | tags: mcp-victorops | +| mcp-webex (mcp-server) | `0.6.0` | tags: mcp-webex, complete | +| mcp-webex-meetings (mcp-server) | `0.6.0` | tags: mcp-webex-meetings, complete | +| mcp-netutils (mcp-server) | `0.6.0` | tags: mcp-netutils, complete | +| rag-stack | `0.6.0` | tags: rag-stack, complete | +| caipe-ui | `0.6.0` | tags: caipe-ui | +| audit-service | `0.6.0` | | +| dynamic-agents | `0.6.0` | tags: dynamic-agents | +| autonomous-agents | `0.6.0` | tags: autonomous-agents | +| scheduler | `0.6.0` | `global.scheduler.enabled` | +| mongodb (caipe-ui-mongodb) | `0.6.0` | `caipe-ui.mongodb.enabled` | +| skill-scanner | `0.6.0` | `global.skillScanner.enabled` | +| slack-bot | `0.6.0` | tags: slack-bot | +| webex-bot | `0.6.0` | tags: webex-bot | +| keycloak | `0.6.0` | tags: keycloak | +| openfga | `0.6.0` | `openfga.enabled` | +| openfga-authz-bridge | `0.6.0` | `openfgaAuthzBridge.enabled` | +| agentgateway | `0.6.0` | `agentgateway.enabled` | diff --git a/charts/ai-platform-engineering/charts/agentgateway/README.md b/charts/ai-platform-engineering/charts/agentgateway/README.md index 6ce88b2f2a..03a3eb7e5d 100644 --- a/charts/ai-platform-engineering/charts/agentgateway/README.md +++ b/charts/ai-platform-engineering/charts/agentgateway/README.md @@ -8,17 +8,17 @@ AgentGateway standalone proxy for CAIPE MCP traffic | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 +helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 # Upgrade an existing release -helm upgrade agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 +helm upgrade agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 \ +helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 \ +helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 ``` ## Reading the Values Table @@ -97,6 +97,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 | service.statsPort | int | `15020` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/charts/ai-platform-engineering/charts/agentgateway/templates/deployment.yaml b/charts/ai-platform-engineering/charts/agentgateway/templates/deployment.yaml index 3e1612d129..a629054da5 100644 --- a/charts/ai-platform-engineering/charts/agentgateway/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/agentgateway/templates/deployment.yaml @@ -41,6 +41,7 @@ spec: {{- $cbImageTag := $cbImage.tag | default .Chart.AppVersion }} {{- $cbImagePull := $cbImage.pullPolicy | default "IfNotPresent" }} serviceAccountName: {{ include "agentgateway.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} {{- if $cbEnabled }} diff --git a/charts/ai-platform-engineering/charts/agentgateway/templates/serviceaccount.yaml b/charts/ai-platform-engineering/charts/agentgateway/templates/serviceaccount.yaml index a99e1bfe71..79c7e0595a 100644 --- a/charts/ai-platform-engineering/charts/agentgateway/templates/serviceaccount.yaml +++ b/charts/ai-platform-engineering/charts/agentgateway/templates/serviceaccount.yaml @@ -9,4 +9,5 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} diff --git a/charts/ai-platform-engineering/charts/agentgateway/values.yaml b/charts/ai-platform-engineering/charts/agentgateway/values.yaml index 540d6b27f9..868e9db038 100644 --- a/charts/ai-platform-engineering/charts/agentgateway/values.yaml +++ b/charts/ai-platform-engineering/charts/agentgateway/values.yaml @@ -26,6 +26,7 @@ fullnameOverride: "" serviceAccount: create: true + automount: false annotations: {} name: "" diff --git a/charts/ai-platform-engineering/charts/audit-service/README.md b/charts/ai-platform-engineering/charts/audit-service/README.md index d9657c06c5..909fc43f75 100644 --- a/charts/ai-platform-engineering/charts/audit-service/README.md +++ b/charts/ai-platform-engineering/charts/audit-service/README.md @@ -8,17 +8,17 @@ Lightweight CAIPE audit log read/write service | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 +helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 # Upgrade an existing release -helm upgrade audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 +helm upgrade audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 \ +helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 \ +helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 ``` ## Reading the Values Table @@ -106,7 +106,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 | service.port | int | `8010` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `18` | | diff --git a/charts/ai-platform-engineering/charts/audit-service/templates/deployment.yaml b/charts/ai-platform-engineering/charts/audit-service/templates/deployment.yaml index 0fd20e6395..e616905c47 100644 --- a/charts/ai-platform-engineering/charts/audit-service/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/audit-service/templates/deployment.yaml @@ -55,6 +55,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "audit-service.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/ai-platform-engineering/charts/audit-service/values.yaml b/charts/ai-platform-engineering/charts/audit-service/values.yaml index 186b5f6642..df15764e7f 100644 --- a/charts/ai-platform-engineering/charts/audit-service/values.yaml +++ b/charts/ai-platform-engineering/charts/audit-service/values.yaml @@ -123,9 +123,8 @@ readinessProbe: serviceAccount: create: true - # Keep this true by default so IRSA and other projected-token identity flows - # work without extra values. - automount: true + # IRSA and other workload-identity webhooks inject their own projected token. + automount: false annotations: {} name: "" diff --git a/charts/ai-platform-engineering/charts/autonomous-agents/README.md b/charts/ai-platform-engineering/charts/autonomous-agents/README.md index 761c7b4b1f..0e956d6f27 100644 --- a/charts/ai-platform-engineering/charts/autonomous-agents/README.md +++ b/charts/ai-platform-engineering/charts/autonomous-agents/README.md @@ -8,17 +8,17 @@ A Helm chart for Autonomous Agents - Standalone scheduler that fires tasks (cron | | | |---|---| -| **Version** | `0.4.10-dev.1` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 +helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 # Upgrade an existing release -helm upgrade autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 +helm upgrade autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 \ +helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 \ +helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 +helm show values oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 ``` ## Reading the Values Table diff --git a/charts/ai-platform-engineering/charts/caipe-ui-mongodb/README.md b/charts/ai-platform-engineering/charts/caipe-ui-mongodb/README.md index 6b8b93eb12..ff56dbf202 100644 --- a/charts/ai-platform-engineering/charts/caipe-ui-mongodb/README.md +++ b/charts/ai-platform-engineering/charts/caipe-ui-mongodb/README.md @@ -8,17 +8,17 @@ MongoDB database for CAIPE UI persistence | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 +helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 # Upgrade an existing release -helm upgrade caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 +helm upgrade caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 \ +helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 \ +helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 ``` ## Reading the Values Table diff --git a/charts/ai-platform-engineering/charts/caipe-ui/README.md b/charts/ai-platform-engineering/charts/caipe-ui/README.md index dc1e92af0b..c1f5df8a63 100644 --- a/charts/ai-platform-engineering/charts/caipe-ui/README.md +++ b/charts/ai-platform-engineering/charts/caipe-ui/README.md @@ -8,17 +8,17 @@ A Helm chart for CAIPE UI - chat interface for AI Platform Engineering | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 +helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 # Upgrade an existing release -helm upgrade caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 +helm upgrade caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 \ +helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 \ +helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 ``` ## Reading the Values Table @@ -79,6 +79,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 | config.CREDENTIAL_STORE_BACKEND | string | `"mongodb-envelope"` | | | config.DESCRIPTION | string | `"Where Humans and AI agents collaborate to deliver high quality outcomes."` | | | config.DYNAMIC_AGENTS_URL | string | `""` | | +| config.ENABLE_AUTONOMOUS_AGENTS | string | `"false"` | | | config.ENABLE_SUBAGENT_CARDS | string | `"true"` | | | config.ENABLE_USER_INFO_TOOL | string | `"false"` | | | config.ENV_BADGE | string | `""` | | @@ -171,7 +172,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 | service.port | int | `3000` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `30` | | diff --git a/charts/ai-platform-engineering/charts/caipe-ui/templates/deployment.yaml b/charts/ai-platform-engineering/charts/caipe-ui/templates/deployment.yaml index 83fd3b7d94..5ba0a1032b 100644 --- a/charts/ai-platform-engineering/charts/caipe-ui/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/caipe-ui/templates/deployment.yaml @@ -31,6 +31,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "caipe-ui.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/ai-platform-engineering/charts/caipe-ui/values.yaml b/charts/ai-platform-engineering/charts/caipe-ui/values.yaml index 342e715423..fd781c2920 100644 --- a/charts/ai-platform-engineering/charts/caipe-ui/values.yaml +++ b/charts/ai-platform-engineering/charts/caipe-ui/values.yaml @@ -21,7 +21,7 @@ serviceAccount: # Specifies whether a service account should be created create: true # Automatically mount a ServiceAccount's API credentials? - automount: true + automount: false # Annotations to add to the service account annotations: {} # The name of the service account to use. diff --git a/charts/ai-platform-engineering/charts/dynamic-agents/README.md b/charts/ai-platform-engineering/charts/dynamic-agents/README.md index a7a8c71c9a..7b17f5eb6a 100644 --- a/charts/ai-platform-engineering/charts/dynamic-agents/README.md +++ b/charts/ai-platform-engineering/charts/dynamic-agents/README.md @@ -8,17 +8,17 @@ A Helm chart for Dynamic Agents - Standalone agent builder service with MCP tool | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 +helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 # Upgrade an existing release -helm upgrade dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 +helm upgrade dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 \ +helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 \ +helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 ``` ## Reading the Values Table @@ -124,7 +124,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 | service.port | int | `8001` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `30` | | diff --git a/charts/ai-platform-engineering/charts/dynamic-agents/templates/deployment.yaml b/charts/ai-platform-engineering/charts/dynamic-agents/templates/deployment.yaml index 71c13eec44..672fb71c4d 100644 --- a/charts/ai-platform-engineering/charts/dynamic-agents/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/dynamic-agents/templates/deployment.yaml @@ -31,6 +31,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "dynamic-agents.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/ai-platform-engineering/charts/dynamic-agents/values.yaml b/charts/ai-platform-engineering/charts/dynamic-agents/values.yaml index 8bbb0b6dbc..f1c06597d7 100644 --- a/charts/ai-platform-engineering/charts/dynamic-agents/values.yaml +++ b/charts/ai-platform-engineering/charts/dynamic-agents/values.yaml @@ -18,7 +18,7 @@ imagePullSecrets: [] # Service account configuration serviceAccount: create: true - automount: true + automount: false annotations: {} name: "" @@ -244,4 +244,3 @@ externalSecrets: name: "vault" kind: "ClusterSecretStore" data: [] - diff --git a/charts/ai-platform-engineering/charts/keycloak/README.md b/charts/ai-platform-engineering/charts/keycloak/README.md index b5d9e29c09..1f2d29bbf0 100644 --- a/charts/ai-platform-engineering/charts/keycloak/README.md +++ b/charts/ai-platform-engineering/charts/keycloak/README.md @@ -8,17 +8,17 @@ Keycloak identity provider for CAIPE RBAC, token exchange, and identity federati | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 +helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 # Upgrade an existing release -helm upgrade keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 +helm upgrade keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 \ +helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 \ +helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 ``` ## Reading the Values Table @@ -142,6 +142,15 @@ helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 | initImage.pullPolicy | string | `"IfNotPresent"` | | | initImage.repository | string | `"ghcr.io/caipe-io/keycloak-init"` | | | initImage.tag | string | `""` | | +| jobPodSecurityContext.runAsNonRoot | bool | `true` | | +| jobResources.limits.cpu | string | `"500m"` | | +| jobResources.limits.memory | string | `"512Mi"` | | +| jobResources.requests.cpu | string | `"100m"` | | +| jobResources.requests.memory | string | `"128Mi"` | | +| jobSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| jobSecurityContext.capabilities.drop[0] | string | `"ALL"` | | +| jobSecurityContext.runAsNonRoot | bool | `true` | | +| jobSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | | platformClient.externalSecret.enabled | bool | `false` | | @@ -153,6 +162,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 | platformClient.secretKey | string | `"OIDC_CLIENT_SECRET"` | | | platformClient.secretRef | string | `""` | | | podAnnotations | object | `{}` | | +| podSecurityContext.runAsNonRoot | bool | `true` | | | realm.accessTokenLifespan | int | `3600` | | | realm.accessTokenLifespanForImplicitFlow | int | `900` | | | realm.name | string | `"caipe"` | | @@ -174,9 +184,14 @@ helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 | schedulerTokenExchange.externalSecret.secretStoreRef.kind | string | `"ClusterSecretStore"` | | | schedulerTokenExchange.externalSecret.secretStoreRef.name | string | `"vault"` | | | schedulerTokenExchange.secretRef | string | `""` | | +| securityContext.allowPrivilegeEscalation | bool | `false` | | +| securityContext.capabilities.drop[0] | string | `"ALL"` | | +| securityContext.runAsNonRoot | bool | `true` | | +| securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | service.port | int | `8080` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | strictClientSecrets | bool | `false` | | diff --git a/charts/ai-platform-engineering/charts/keycloak/templates/deployment.yaml b/charts/ai-platform-engineering/charts/keycloak/templates/deployment.yaml index 6e4fc27fc3..582fba395c 100644 --- a/charts/ai-platform-engineering/charts/keycloak/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/keycloak/templates/deployment.yaml @@ -23,8 +23,13 @@ spec: {{- include "keycloak.selectorLabels" . | nindent 8 }} spec: serviceAccountName: {{ include "keycloak.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - name: keycloak + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} args: diff --git a/charts/ai-platform-engineering/charts/keycloak/templates/job-auth-reconcile.yaml b/charts/ai-platform-engineering/charts/keycloak/templates/job-auth-reconcile.yaml index 86a12278e7..9082cfe0d4 100644 --- a/charts/ai-platform-engineering/charts/keycloak/templates/job-auth-reconcile.yaml +++ b/charts/ai-platform-engineering/charts/keycloak/templates/job-auth-reconcile.yaml @@ -29,9 +29,15 @@ spec: {{- include "keycloak.selectorLabels" . | nindent 8 }} app.kubernetes.io/component: auth-reconcile spec: + serviceAccountName: {{ include "keycloak.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} restartPolicy: OnFailure + securityContext: + {{- toYaml .Values.jobPodSecurityContext | nindent 8 }} containers: - name: auth-reconcile + securityContext: + {{- toYaml .Values.jobSecurityContext | nindent 12 }} image: "{{ .Values.initImage.repository }}:{{ .Values.initImage.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.initImage.pullPolicy }} command: @@ -154,6 +160,8 @@ spec: - name: init-scripts mountPath: /scripts readOnly: true + resources: + {{- toYaml .Values.jobResources | nindent 12 }} volumes: - name: init-scripts configMap: diff --git a/charts/ai-platform-engineering/charts/keycloak/templates/job-init-idp.yaml b/charts/ai-platform-engineering/charts/keycloak/templates/job-init-idp.yaml index ed4d190177..e9d17970a6 100644 --- a/charts/ai-platform-engineering/charts/keycloak/templates/job-init-idp.yaml +++ b/charts/ai-platform-engineering/charts/keycloak/templates/job-init-idp.yaml @@ -35,9 +35,15 @@ spec: {{- include "keycloak.selectorLabels" . | nindent 8 }} app.kubernetes.io/component: init-idp spec: + serviceAccountName: {{ include "keycloak.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} restartPolicy: OnFailure + securityContext: + {{- toYaml .Values.jobPodSecurityContext | nindent 8 }} containers: - name: init-idp + securityContext: + {{- toYaml .Values.jobSecurityContext | nindent 12 }} image: "{{ .Values.initImage.repository }}:{{ .Values.initImage.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.initImage.pullPolicy }} command: ["/bin/sh", "/scripts/init-idp.sh"] @@ -147,6 +153,8 @@ spec: - name: init-scripts mountPath: /scripts readOnly: true + resources: + {{- toYaml .Values.jobResources | nindent 12 }} volumes: - name: init-scripts configMap: diff --git a/charts/ai-platform-engineering/charts/keycloak/templates/job-init-token-exchange.yaml b/charts/ai-platform-engineering/charts/keycloak/templates/job-init-token-exchange.yaml index 91d3781c0c..66b1cd0d4c 100644 --- a/charts/ai-platform-engineering/charts/keycloak/templates/job-init-token-exchange.yaml +++ b/charts/ai-platform-engineering/charts/keycloak/templates/job-init-token-exchange.yaml @@ -26,9 +26,15 @@ spec: {{- include "keycloak.selectorLabels" . | nindent 8 }} app.kubernetes.io/component: init-token-exchange spec: + serviceAccountName: {{ include "keycloak.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} restartPolicy: OnFailure + securityContext: + {{- toYaml .Values.jobPodSecurityContext | nindent 8 }} containers: - name: init-token-exchange + securityContext: + {{- toYaml .Values.jobSecurityContext | nindent 12 }} image: "{{ .Values.initImage.repository }}:{{ .Values.initImage.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.initImage.pullPolicy }} command: ["/bin/sh", "/scripts/init-token-exchange.sh"] @@ -135,6 +141,8 @@ spec: - name: init-scripts mountPath: /scripts readOnly: true + resources: + {{- toYaml .Values.jobResources | nindent 12 }} volumes: - name: init-scripts configMap: diff --git a/charts/ai-platform-engineering/charts/keycloak/templates/serviceaccount.yaml b/charts/ai-platform-engineering/charts/keycloak/templates/serviceaccount.yaml index ef5153b77b..c209393ea8 100644 --- a/charts/ai-platform-engineering/charts/keycloak/templates/serviceaccount.yaml +++ b/charts/ai-platform-engineering/charts/keycloak/templates/serviceaccount.yaml @@ -9,4 +9,5 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} diff --git a/charts/ai-platform-engineering/charts/keycloak/values.yaml b/charts/ai-platform-engineering/charts/keycloak/values.yaml index 133ca0ff75..40234fa99b 100644 --- a/charts/ai-platform-engineering/charts/keycloak/values.yaml +++ b/charts/ai-platform-engineering/charts/keycloak/values.yaml @@ -23,9 +23,42 @@ fullnameOverride: "" serviceAccount: create: true + automount: false annotations: {} name: "" +podSecurityContext: + runAsNonRoot: true + +securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + +jobPodSecurityContext: + runAsNonRoot: true + +jobSecurityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + +jobResources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi + # ---------- Admin credentials ---------- # Three ways to provide: # (1) DEV — set admin.password explicitly if you want the chart to diff --git a/charts/ai-platform-engineering/charts/mcp-server/README.md b/charts/ai-platform-engineering/charts/mcp-server/README.md index eb75ade48d..9a47b2633c 100644 --- a/charts/ai-platform-engineering/charts/mcp-server/README.md +++ b/charts/ai-platform-engineering/charts/mcp-server/README.md @@ -8,17 +8,17 @@ Deploys one agent's MCP server (Deployment + Service) for CAIPE | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 +helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 # Upgrade an existing release -helm upgrade mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 +helm upgrade mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 \ +helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 \ +helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 ``` ## Reading the Values Table @@ -82,7 +82,10 @@ helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 | mcp.readinessProbe.periodSeconds | int | `5` | | | mcp.readinessProbe.tcpSocket.port | string | `"http"` | | | mcp.readinessProbe.timeoutSeconds | int | `3` | | -| mcp.resources | object | `{}` | | +| mcp.resources.limits.cpu | string | `"500m"` | | +| mcp.resources.limits.memory | string | `"2Gi"` | | +| mcp.resources.requests.cpu | string | `"100m"` | | +| mcp.resources.requests.memory | string | `"500Mi"` | | | mcp.service.port | int | `8000` | | | mcp.service.type | string | `"ClusterIP"` | | | mcp.startupProbe.failureThreshold | int | `30` | | @@ -107,7 +110,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 | securityContext.runAsUser | int | `1001` | | | securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/charts/ai-platform-engineering/charts/mcp-server/templates/mcp-deployment.yaml b/charts/ai-platform-engineering/charts/mcp-server/templates/mcp-deployment.yaml index 00b7a9e05e..a7c8cb25d1 100644 --- a/charts/ai-platform-engineering/charts/mcp-server/templates/mcp-deployment.yaml +++ b/charts/ai-platform-engineering/charts/mcp-server/templates/mcp-deployment.yaml @@ -33,6 +33,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "agent.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/ai-platform-engineering/charts/mcp-server/values.yaml b/charts/ai-platform-engineering/charts/mcp-server/values.yaml index 67dc4a51cf..ad42f93561 100644 --- a/charts/ai-platform-engineering/charts/mcp-server/values.yaml +++ b/charts/ai-platform-engineering/charts/mcp-server/values.yaml @@ -25,7 +25,7 @@ serviceAccount: # Specifies whether a service account should be created create: true # Automatically mount a ServiceAccount's API credentials? - automount: true + automount: false # Annotations to add to the service account annotations: {} # The name of the service account to use. @@ -147,13 +147,13 @@ mcp: # nodePort: 30080 # Resource limits and requests for MCP container - resources: {} - # limits: - # cpu: 500m - # memory: 512Mi - # requests: - # cpu: 250m - # memory: 256Mi + resources: + requests: + cpu: 100m + memory: 500Mi + limits: + cpu: 500m + memory: 2Gi # Health check probes for MCP container startupProbe: diff --git a/charts/ai-platform-engineering/charts/openfga-authz-bridge/README.md b/charts/ai-platform-engineering/charts/openfga-authz-bridge/README.md index cdbb8210f1..c597c1699c 100644 --- a/charts/ai-platform-engineering/charts/openfga-authz-bridge/README.md +++ b/charts/ai-platform-engineering/charts/openfga-authz-bridge/README.md @@ -8,17 +8,17 @@ Envoy ext_authz bridge that adapts AgentGateway authorization checks to OpenFGA | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 +helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 # Upgrade an existing release -helm upgrade openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 +helm upgrade openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 \ +helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 \ +helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 ``` ## Reading the Values Table @@ -93,6 +93,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5 | service.port | int | `9100` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tokenValidation.algorithms[0] | string | `"RS256"` | | diff --git a/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/deployment.yaml b/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/deployment.yaml index cdf071c57d..dd68794c18 100644 --- a/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/deployment.yaml @@ -19,6 +19,7 @@ spec: {{- end }} spec: serviceAccountName: {{ include "openfga-authz-bridge.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: diff --git a/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/serviceaccount.yaml b/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/serviceaccount.yaml index 1739dc9086..649e47a3d4 100644 --- a/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/serviceaccount.yaml +++ b/charts/ai-platform-engineering/charts/openfga-authz-bridge/templates/serviceaccount.yaml @@ -9,4 +9,5 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} diff --git a/charts/ai-platform-engineering/charts/openfga-authz-bridge/values.yaml b/charts/ai-platform-engineering/charts/openfga-authz-bridge/values.yaml index dc559a991b..92ba63f42b 100644 --- a/charts/ai-platform-engineering/charts/openfga-authz-bridge/values.yaml +++ b/charts/ai-platform-engineering/charts/openfga-authz-bridge/values.yaml @@ -10,6 +10,7 @@ fullnameOverride: "" serviceAccount: create: true + automount: false annotations: {} name: "" diff --git a/charts/ai-platform-engineering/charts/openfga/README.md b/charts/ai-platform-engineering/charts/openfga/README.md index ce509420a9..d9fcad3e22 100644 --- a/charts/ai-platform-engineering/charts/openfga/README.md +++ b/charts/ai-platform-engineering/charts/openfga/README.md @@ -8,17 +8,17 @@ OpenFGA authorization service for CAIPE relationship-based access control | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 +helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 # Upgrade an existing release -helm upgrade openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 +helm upgrade openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 \ +helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 \ +helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 ``` ## Reading the Values Table @@ -72,6 +72,16 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 | init.image.pullPolicy | string | `"IfNotPresent"` | | | init.image.repository | string | `"python"` | | | init.image.tag | string | `"3.13-slim"` | | +| init.platformClient.clientId | string | `"caipe-platform"` | | +| init.platformClient.clientSecretRef.key | string | `"OIDC_CLIENT_SECRET"` | | +| init.platformClient.clientSecretRef.name | string | `""` | | +| init.platformClient.enabled | bool | `false` | | +| init.platformClient.orgObject | string | `"organization:caipe"` | | +| init.platformClient.tokenUrl | string | `""` | | +| init.resources.limits.cpu | string | `"500m"` | | +| init.resources.limits.memory | string | `"512Mi"` | | +| init.resources.requests.cpu | string | `"100m"` | | +| init.resources.requests.memory | string | `"128Mi"` | | | init.seedSub | string | `""` | | | init.seedTuples | list | `[]` | | | init.storeName | string | `"caipe-openfga"` | | @@ -79,6 +89,10 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 | migrate.backoffLimit | int | `6` | | | migrate.enabled | bool | `true` | | | migrate.helmHookDeletePolicy | string | `"before-hook-creation,hook-succeeded"` | | +| migrate.resources.limits.cpu | string | `"500m"` | | +| migrate.resources.limits.memory | string | `"512Mi"` | | +| migrate.resources.requests.cpu | string | `"100m"` | | +| migrate.resources.requests.memory | string | `"128Mi"` | | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | | playground.enabled | bool | `false` | | @@ -104,6 +118,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 | service.playgroundPort | int | `3000` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/charts/ai-platform-engineering/charts/openfga/templates/deployment.yaml b/charts/ai-platform-engineering/charts/openfga/templates/deployment.yaml index bd06ce6701..99a82b6539 100644 --- a/charts/ai-platform-engineering/charts/openfga/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/openfga/templates/deployment.yaml @@ -19,6 +19,7 @@ spec: {{- end }} spec: serviceAccountName: {{ include "openfga.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: diff --git a/charts/ai-platform-engineering/charts/openfga/templates/job-init.yaml b/charts/ai-platform-engineering/charts/openfga/templates/job-init.yaml index fd85d310dc..177e8be128 100644 --- a/charts/ai-platform-engineering/charts/openfga/templates/job-init.yaml +++ b/charts/ai-platform-engineering/charts/openfga/templates/job-init.yaml @@ -19,12 +19,11 @@ spec: labels: {{- include "openfga.selectorLabels" . | nindent 8 }} spec: + serviceAccountName: {{ include "openfga.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} restartPolicy: OnFailure securityContext: - runAsNonRoot: true - runAsUser: 1001 - runAsGroup: 1001 - fsGroup: 1001 + {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - name: openfga-init image: "{{ .Values.init.image.repository }}:{{ .Values.init.image.tag }}" @@ -61,15 +60,9 @@ spec: mountPath: /model readOnly: true securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - runAsUser: 1001 - runAsGroup: 1001 - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault + {{- toYaml .Values.securityContext | nindent 12 }} + resources: + {{- toYaml .Values.init.resources | nindent 12 }} volumes: - name: openfga-model configMap: diff --git a/charts/ai-platform-engineering/charts/openfga/templates/job-migrate.yaml b/charts/ai-platform-engineering/charts/openfga/templates/job-migrate.yaml index 1dbd1a59ea..d5a477e2f3 100644 --- a/charts/ai-platform-engineering/charts/openfga/templates/job-migrate.yaml +++ b/charts/ai-platform-engineering/charts/openfga/templates/job-migrate.yaml @@ -19,6 +19,8 @@ spec: labels: {{- include "openfga.selectorLabels" . | nindent 8 }} spec: + serviceAccountName: {{ include "openfga.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} restartPolicy: OnFailure securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} @@ -44,6 +46,8 @@ spec: {{- end }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} + resources: + {{- toYaml .Values.migrate.resources | nindent 12 }} {{- with .Values.extraVolumeMounts }} volumeMounts: {{- toYaml . | nindent 12 }} diff --git a/charts/ai-platform-engineering/charts/openfga/templates/serviceaccount.yaml b/charts/ai-platform-engineering/charts/openfga/templates/serviceaccount.yaml index bbe191c983..8aa644e256 100644 --- a/charts/ai-platform-engineering/charts/openfga/templates/serviceaccount.yaml +++ b/charts/ai-platform-engineering/charts/openfga/templates/serviceaccount.yaml @@ -9,4 +9,5 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} diff --git a/charts/ai-platform-engineering/charts/openfga/values.yaml b/charts/ai-platform-engineering/charts/openfga/values.yaml index 943491c1b9..eb3613a938 100644 --- a/charts/ai-platform-engineering/charts/openfga/values.yaml +++ b/charts/ai-platform-engineering/charts/openfga/values.yaml @@ -14,6 +14,7 @@ fullnameOverride: "" serviceAccount: create: true + automount: false annotations: {} name: "" @@ -38,6 +39,13 @@ migrate: backoffLimit: 6 helmHookDeletePolicy: "before-hook-creation,hook-succeeded" argocdHookDeletePolicy: "BeforeHookCreation,HookSucceeded" + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi playground: enabled: false @@ -62,6 +70,13 @@ init: backoffLimit: 6 helmHookDeletePolicy: "before-hook-creation" argocdHookDeletePolicy: "BeforeHookCreation" + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi resources: requests: diff --git a/charts/ai-platform-engineering/charts/scheduler/README.md b/charts/ai-platform-engineering/charts/scheduler/README.md index 0f58126e23..5dfbb6c088 100644 --- a/charts/ai-platform-engineering/charts/scheduler/README.md +++ b/charts/ai-platform-engineering/charts/scheduler/README.md @@ -8,17 +8,17 @@ A Helm chart for caipe-scheduler - cron schedule registry + k8s CronJob orchestr | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 +helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 # Upgrade an existing release -helm upgrade scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 +helm upgrade scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 \ +helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 \ +helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 ``` ## Reading the Values Table diff --git a/charts/ai-platform-engineering/charts/skill-scanner/README.md b/charts/ai-platform-engineering/charts/skill-scanner/README.md index 82c1209c21..43fad82dff 100644 --- a/charts/ai-platform-engineering/charts/skill-scanner/README.md +++ b/charts/ai-platform-engineering/charts/skill-scanner/README.md @@ -11,17 +11,17 @@ cluster-internal (ClusterIP only — no Ingress). | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 +helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 # Upgrade an existing release -helm upgrade skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 +helm upgrade skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 ``` ## Customizing Values @@ -30,15 +30,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 \ +helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 \ +helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 ``` ## Reading the Values Table @@ -84,6 +84,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 | securityContext.runAsGroup | int | `1001` | GID to run as | | securityContext.runAsNonRoot | bool | `true` | Run as non-root user (matches Dockerfile.skill-scanner) | | securityContext.runAsUser | int | `1001` | UID to run as | +| securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | service.port | int | `8000` | | | service.type | string | `"ClusterIP"` | ClusterIP only — never expose this Service externally. The scanner API is unauthenticated and accepts arbitrary ZIP uploads. | | serviceAccount.annotations | object | `{}` | Annotations to add to the service account | diff --git a/charts/ai-platform-engineering/charts/skill-scanner/templates/deployment.yaml b/charts/ai-platform-engineering/charts/skill-scanner/templates/deployment.yaml index 923d20dfc7..47cdb54ef5 100644 --- a/charts/ai-platform-engineering/charts/skill-scanner/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/skill-scanner/templates/deployment.yaml @@ -27,6 +27,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "skill-scanner.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/ai-platform-engineering/charts/skill-scanner/values.yaml b/charts/ai-platform-engineering/charts/skill-scanner/values.yaml index 85c4890a6a..e26bec698e 100644 --- a/charts/ai-platform-engineering/charts/skill-scanner/values.yaml +++ b/charts/ai-platform-engineering/charts/skill-scanner/values.yaml @@ -123,6 +123,8 @@ securityContext: capabilities: drop: - ALL + seccompProfile: + type: RuntimeDefault # -- Node selector labels nodeSelector: {} diff --git a/charts/ai-platform-engineering/charts/slack-bot/README.md b/charts/ai-platform-engineering/charts/slack-bot/README.md index c17d8ce967..1bb5a32c42 100644 --- a/charts/ai-platform-engineering/charts/slack-bot/README.md +++ b/charts/ai-platform-engineering/charts/slack-bot/README.md @@ -8,17 +8,17 @@ Slack bot integration for AI Platform Engineering using the CAIPE UI BFF | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 +helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 # Upgrade an existing release -helm upgrade slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 +helm upgrade slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 \ +helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 \ +helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 ``` ## Reading the Values Table @@ -80,6 +80,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 | securityContext.runAsUser | int | `1001` | | | securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/charts/ai-platform-engineering/charts/slack-bot/templates/deployment.yaml b/charts/ai-platform-engineering/charts/slack-bot/templates/deployment.yaml index e6a1fa7a79..9f0686175f 100644 --- a/charts/ai-platform-engineering/charts/slack-bot/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/slack-bot/templates/deployment.yaml @@ -24,6 +24,7 @@ spec: {{- include "slack-bot.selectorLabels" . | nindent 8 }} spec: serviceAccountName: {{ include "slack-bot.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/ai-platform-engineering/charts/slack-bot/templates/serviceaccount.yaml b/charts/ai-platform-engineering/charts/slack-bot/templates/serviceaccount.yaml index f7141e0c7a..b25970f100 100644 --- a/charts/ai-platform-engineering/charts/slack-bot/templates/serviceaccount.yaml +++ b/charts/ai-platform-engineering/charts/slack-bot/templates/serviceaccount.yaml @@ -9,4 +9,5 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} diff --git a/charts/ai-platform-engineering/charts/slack-bot/values.yaml b/charts/ai-platform-engineering/charts/slack-bot/values.yaml index f68ff4ebda..04cd5dfdf7 100644 --- a/charts/ai-platform-engineering/charts/slack-bot/values.yaml +++ b/charts/ai-platform-engineering/charts/slack-bot/values.yaml @@ -10,6 +10,7 @@ fullnameOverride: "" serviceAccount: create: true + automount: false annotations: {} name: "" diff --git a/charts/ai-platform-engineering/charts/webex-bot/README.md b/charts/ai-platform-engineering/charts/webex-bot/README.md index 636d8de469..0dc95d14c3 100644 --- a/charts/ai-platform-engineering/charts/webex-bot/README.md +++ b/charts/ai-platform-engineering/charts/webex-bot/README.md @@ -8,17 +8,17 @@ Webex bot integration for AI Platform Engineering using the CAIPE UI BFF | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 +helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 # Upgrade an existing release -helm upgrade webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 +helm upgrade webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 \ +helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 \ +helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 ``` ## Reading the Values Table diff --git a/charts/ai-platform-engineering/charts/webex-bot/templates/deployment.yaml b/charts/ai-platform-engineering/charts/webex-bot/templates/deployment.yaml index a378ecb690..1343c0b68f 100644 --- a/charts/ai-platform-engineering/charts/webex-bot/templates/deployment.yaml +++ b/charts/ai-platform-engineering/charts/webex-bot/templates/deployment.yaml @@ -24,6 +24,7 @@ spec: {{- include "webex-bot.selectorLabels" . | nindent 8 }} spec: serviceAccountName: {{ include "webex-bot.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/ai-platform-engineering/templates/extra-deploy.yaml b/charts/ai-platform-engineering/templates/extra-deploy.yaml index 54bd06d2d1..29e07c8829 100644 --- a/charts/ai-platform-engineering/templates/extra-deploy.yaml +++ b/charts/ai-platform-engineering/templates/extra-deploy.yaml @@ -1,8 +1,7 @@ {{- /* -Render additional Kubernetes resources from extraDeploy array. -This allows users to add custom resources like VirtualServices, DestinationRules, etc. +Render additional Kubernetes resources from the stable-key extraDeployMap. */ -}} -{{- range .Values.extraDeploy }} +{{- range $_, $resource := .Values.extraDeployMap }} --- -{{- toYaml . }} +{{- toYaml $resource }} {{- end }} diff --git a/charts/ai-platform-engineering/values.yaml b/charts/ai-platform-engineering/values.yaml index ccd4c7002d..4e4e7f1e58 100644 --- a/charts/ai-platform-engineering/values.yaml +++ b/charts/ai-platform-engineering/values.yaml @@ -374,8 +374,8 @@ metrics: labels: grafana_dashboard: "1" -# Extra Kubernetes resources to deploy -extraDeploy: [] +# -- Extra Kubernetes resources keyed by a stable, deployment-defined name. Use this form when Helm --set/--set-file must target individual resources. +extraDeployMap: {} # --------------------------------------------------------------------------- # Live-skills command template (rendered as the `/skills` slash command diff --git a/charts/rag-stack/README.md b/charts/rag-stack/README.md index 74cd0377be..6dd12bf0cb 100644 --- a/charts/rag-stack/README.md +++ b/charts/rag-stack/README.md @@ -8,17 +8,17 @@ A complete RAG stack including server, agents, Redis, Neo4j and Milvus | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 +helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 # Upgrade an existing release -helm upgrade rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 +helm upgrade rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 \ +helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 \ +helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 ``` ## Reading the Values Table @@ -119,21 +119,60 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | global.rag.redis.db | int | `0` | | | global.rag.redis.host | string | `"rag-redis"` | | | global.rag.redis.port | int | `6379` | | +| milvus.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| milvus.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | | +| milvus.containerSecurityContext.runAsGroup | int | `1000` | | +| milvus.containerSecurityContext.runAsNonRoot | bool | `true` | | +| milvus.containerSecurityContext.runAsUser | int | `1000` | | +| milvus.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | milvus.dataNode.annotations | object | `{}` | | | milvus.dataNode.podDisruptionBudget.enabled | bool | `false` | | | milvus.dataNode.resources.limits.cpu | string | `"200m"` | | | milvus.dataNode.resources.limits.memory | string | `"256Mi"` | | +| milvus.enabled | bool | `true` | | +| milvus.etcd.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| milvus.etcd.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | | +| milvus.etcd.containerSecurityContext.enabled | bool | `true` | | +| milvus.etcd.containerSecurityContext.runAsNonRoot | bool | `true` | | +| milvus.etcd.containerSecurityContext.runAsUser | int | `1001` | | +| milvus.etcd.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | milvus.etcd.podAnnotations | object | `{}` | | | milvus.etcd.podDisruptionBudget.enabled | bool | `false` | | +| milvus.etcd.podSecurityContext.enabled | bool | `true` | | +| milvus.etcd.podSecurityContext.fsGroup | int | `1001` | | +| milvus.etcd.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | +| milvus.etcd.resources.limits.cpu | string | `"500m"` | | +| milvus.etcd.resources.limits.memory | string | `"512Mi"` | | +| milvus.etcd.resources.requests.cpu | string | `"100m"` | | +| milvus.etcd.resources.requests.memory | string | `"128Mi"` | | +| milvus.etcd.serviceAccount.automountServiceAccountToken | bool | `false` | | +| milvus.etcd.serviceAccount.create | bool | `true` | | | milvus.minio.podAnnotations | object | `{}` | | | milvus.minio.podDisruptionBudget.enabled | bool | `false` | | | milvus.mixCoordinator.annotations | object | `{}` | | +| milvus.mixCoordinator.resources.limits.cpu | string | `"500m"` | | +| milvus.mixCoordinator.resources.limits.memory | string | `"512Mi"` | | +| milvus.mixCoordinator.resources.requests.cpu | string | `"100m"` | | +| milvus.mixCoordinator.resources.requests.memory | string | `"128Mi"` | | | milvus.proxy.annotations | object | `{}` | | +| milvus.proxy.resources.limits.cpu | string | `"500m"` | | +| milvus.proxy.resources.limits.memory | string | `"512Mi"` | | +| milvus.proxy.resources.requests.cpu | string | `"100m"` | | +| milvus.proxy.resources.requests.memory | string | `"128Mi"` | | | milvus.pulsarv3.enabled | bool | `false` | | | milvus.queryNode.annotations | object | `{}` | | | milvus.queryNode.podDisruptionBudget.enabled | bool | `false` | | | milvus.queryNode.resources.limits.cpu | string | `"200m"` | | | milvus.queryNode.resources.limits.memory | string | `"256Mi"` | | +| milvus.securityContext.fsGroup | int | `1000` | | +| milvus.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | | +| milvus.securityContext.runAsGroup | int | `1000` | | +| milvus.securityContext.runAsNonRoot | bool | `true` | | +| milvus.securityContext.runAsUser | int | `1000` | | +| milvus.serviceAccount.annotations | object | `{}` | | +| milvus.serviceAccount.create | bool | `false` | | +| milvus.serviceAccount.name | string | `"rag-milvus"` | | +| milvus.serviceAccount.ragStackManaged | bool | `true` | | | milvus.woodpecker.enabled | bool | `true` | | | neo4j.apoc_config."apoc.import.file.enabled" | string | `"true"` | | | neo4j.apoc_config."apoc.trigger.enabled" | string | `"true"` | | @@ -141,6 +180,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | neo4j.config."dbms.security.procedures.unrestricted" | string | `"apoc.*"` | | | neo4j.config."server.config.strict_validation.enabled" | string | `"false"` | | | neo4j.config."server.directories.plugins" | string | `"/var/lib/neo4j/labs"` | | +| neo4j.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | neo4j.disableLookups | bool | `true` | | | neo4j.enabled | bool | `true` | | | neo4j.fullnameOverride | string | `"rag-neo4j"` | | @@ -149,6 +189,11 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | neo4j.neo4j.resources.cpu | string | `"1"` | | | neo4j.neo4j.resources.memory | string | `"2Gi"` | | | neo4j.podSpec.annotations | object | `{}` | | +| neo4j.podSpec.serviceAccountName | string | `"rag-neo4j"` | | +| neo4j.serviceAccount.annotations | object | `{}` | | +| neo4j.serviceAccount.automount | bool | `false` | | +| neo4j.serviceAccount.create | bool | `true` | | +| neo4j.serviceAccount.name | string | `"rag-neo4j"` | | | neo4j.services.neo4j.enabled | bool | `false` | | | neo4j.volumes.data.dynamic.storageClassName | string | `"gp2"` | | | neo4j.volumes.data.mode | string | `"dynamic"` | | @@ -222,9 +267,9 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | Name | Version | Condition / Tags | |------|---------|------------------| -| rag-server | `0.5.68` | `rag-server.enabled` | -| agent-ontology | `0.5.68` | `agent-ontology.enabled` | -| rag-ingestors | `0.5.68` | `rag-ingestors.enabled` | +| rag-server | `0.6.0` | `rag-server.enabled` | +| agent-ontology | `0.6.0` | `agent-ontology.enabled` | +| rag-ingestors | `0.6.0` | `rag-ingestors.enabled` | | neo4j | `2025.07.1` | `neo4j.enabled` | -| rag-redis | `0.5.68` | `rag-redis.enabled` | +| rag-redis | `0.6.0` | `rag-redis.enabled` | | milvus | `5.0.2` | `milvus.enabled` | diff --git a/charts/rag-stack/charts/agent-ontology/README.md b/charts/rag-stack/charts/agent-ontology/README.md index aa54ff5179..60c4a1dbd4 100644 --- a/charts/rag-stack/charts/agent-ontology/README.md +++ b/charts/rag-stack/charts/agent-ontology/README.md @@ -8,17 +8,17 @@ A Helm chart for Kubernetes | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 +helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 # Upgrade an existing release -helm upgrade agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 +helm upgrade agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 \ +helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 \ +helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 ``` ## Reading the Values Table @@ -113,7 +113,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 | service.port | int | `8098` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `30` | | diff --git a/charts/rag-stack/charts/agent-ontology/templates/deployment.yaml b/charts/rag-stack/charts/agent-ontology/templates/deployment.yaml index a4c192d27e..e55fd2d626 100644 --- a/charts/rag-stack/charts/agent-ontology/templates/deployment.yaml +++ b/charts/rag-stack/charts/agent-ontology/templates/deployment.yaml @@ -29,6 +29,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "agent.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/rag-stack/charts/agent-ontology/values.yaml b/charts/rag-stack/charts/agent-ontology/values.yaml index 77542fc304..3e58e3ee0f 100644 --- a/charts/rag-stack/charts/agent-ontology/values.yaml +++ b/charts/rag-stack/charts/agent-ontology/values.yaml @@ -44,7 +44,7 @@ serviceAccount: # Specifies whether a service account should be created create: true # Automatically mount a ServiceAccount's API credentials? - automount: true + automount: false # Annotations to add to the service account annotations: {} # The name of the service account to use. diff --git a/charts/rag-stack/charts/rag-ingestors/README.md b/charts/rag-stack/charts/rag-ingestors/README.md index 7baed8ace0..f40ae12868 100644 --- a/charts/rag-stack/charts/rag-ingestors/README.md +++ b/charts/rag-stack/charts/rag-ingestors/README.md @@ -8,17 +8,17 @@ Configurable ingestors for RAG system - supports AWS, K8s, ArgoCD, Slack, and We | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 +helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 # Upgrade an existing release -helm upgrade rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 +helm upgrade rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 \ +helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 \ +helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 ``` ## Reading the Values Table @@ -76,7 +76,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 | securityContext.runAsUser | int | `1001` | | | securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/charts/rag-stack/charts/rag-ingestors/templates/deployment.yaml b/charts/rag-stack/charts/rag-ingestors/templates/deployment.yaml index 4fdcb6271a..fd66acaaef 100644 --- a/charts/rag-stack/charts/rag-ingestors/templates/deployment.yaml +++ b/charts/rag-stack/charts/rag-ingestors/templates/deployment.yaml @@ -43,7 +43,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "rag-ingestors.serviceAccountName" $ }} - automountServiceAccountToken: {{ $.Values.serviceAccount.automount | default true }} + automountServiceAccountToken: {{ $.Values.serviceAccount.automount }} {{- with $.Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/rag-stack/charts/rag-ingestors/templates/serviceaccount.yaml b/charts/rag-stack/charts/rag-ingestors/templates/serviceaccount.yaml index e3d394819b..578f7f3247 100644 --- a/charts/rag-stack/charts/rag-ingestors/templates/serviceaccount.yaml +++ b/charts/rag-stack/charts/rag-ingestors/templates/serviceaccount.yaml @@ -9,6 +9,5 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} -automountServiceAccountToken: {{ .Values.serviceAccount.automount | default true }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} - diff --git a/charts/rag-stack/charts/rag-ingestors/values.yaml b/charts/rag-stack/charts/rag-ingestors/values.yaml index d3059e2066..9f3eca94ce 100644 --- a/charts/rag-stack/charts/rag-ingestors/values.yaml +++ b/charts/rag-stack/charts/rag-ingestors/values.yaml @@ -19,7 +19,8 @@ ragServerUrl: "http://rag-server:9446" # Service account configuration serviceAccount: create: true - automount: true + # Set true only for in-cluster Kubernetes ingestors that use the generated RBAC. + automount: false annotations: {} name: "" diff --git a/charts/rag-stack/charts/rag-redis/README.md b/charts/rag-stack/charts/rag-redis/README.md index 6bc7f5a601..05d5cf079d 100644 --- a/charts/rag-stack/charts/rag-redis/README.md +++ b/charts/rag-stack/charts/rag-redis/README.md @@ -8,17 +8,17 @@ A Helm chart for Kubernetes | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 +helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 # Upgrade an existing release -helm upgrade rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 +helm upgrade rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 \ +helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 \ +helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 ``` ## Reading the Values Table @@ -102,7 +102,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 | service.port | int | `6379` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.exec.command[0] | string | `"redis-cli"` | | diff --git a/charts/rag-stack/charts/rag-redis/templates/deployment.yaml b/charts/rag-stack/charts/rag-redis/templates/deployment.yaml index fc000842ee..6360d48338 100644 --- a/charts/rag-stack/charts/rag-redis/templates/deployment.yaml +++ b/charts/rag-stack/charts/rag-redis/templates/deployment.yaml @@ -33,6 +33,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "rag-redis.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- with .Values.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} diff --git a/charts/rag-stack/charts/rag-redis/values.yaml b/charts/rag-stack/charts/rag-redis/values.yaml index 409f23d594..1a89aaeba3 100644 --- a/charts/rag-stack/charts/rag-redis/values.yaml +++ b/charts/rag-stack/charts/rag-redis/values.yaml @@ -28,7 +28,7 @@ serviceAccount: # Specifies whether a service account should be created create: true # Automatically mount a ServiceAccount's API credentials? - automount: true + automount: false # Annotations to add to the service account annotations: {} # The name of the service account to use. diff --git a/charts/rag-stack/charts/rag-server/README.md b/charts/rag-stack/charts/rag-server/README.md index fccb1aada2..f8feec49ff 100644 --- a/charts/rag-stack/charts/rag-server/README.md +++ b/charts/rag-stack/charts/rag-server/README.md @@ -8,17 +8,17 @@ RAG server | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 +helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 # Upgrade an existing release -helm upgrade rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 +helm upgrade rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 ``` ## Customizing Values @@ -27,15 +27,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 \ +helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 \ +helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 ``` ## Reading the Values Table diff --git a/charts/rag-stack/templates/dependency-serviceaccounts.yaml b/charts/rag-stack/templates/dependency-serviceaccounts.yaml new file mode 100644 index 0000000000..77539226bb --- /dev/null +++ b/charts/rag-stack/templates/dependency-serviceaccounts.yaml @@ -0,0 +1,31 @@ +{{- if and .Values.neo4j.enabled .Values.neo4j.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ required "neo4j.serviceAccount.name is required when neo4j.serviceAccount.create=true" .Values.neo4j.serviceAccount.name }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "rag-stack.labels" . | nindent 4 }} + app.kubernetes.io/component: neo4j + {{- with .Values.neo4j.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.neo4j.serviceAccount.automount }} +--- +{{- end }} +{{- if and .Values.milvus.enabled .Values.milvus.serviceAccount.ragStackManaged }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ required "milvus.serviceAccount.name is required when milvus.serviceAccount.ragStackManaged=true" .Values.milvus.serviceAccount.name }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "rag-stack.labels" . | nindent 4 }} + app.kubernetes.io/component: milvus + {{- with .Values.milvus.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: false +{{- end }} diff --git a/charts/rag-stack/values.yaml b/charts/rag-stack/values.yaml index da0bf39d28..2bead251aa 100644 --- a/charts/rag-stack/values.yaml +++ b/charts/rag-stack/values.yaml @@ -211,8 +211,21 @@ neo4j: cpu: "1" memory: "2Gi" + # The Neo4j dependency does not expose pod-level token automount control. + # Use a dedicated account with automount disabled by this parent chart. + serviceAccount: + create: true + name: rag-neo4j + automount: false + annotations: {} + + containerSecurityContext: + seccompProfile: + type: RuntimeDefault + podSpec: annotations: {} + serviceAccountName: rag-neo4j volumes: data: @@ -258,6 +271,32 @@ rag-redis: # Minimal Milvus cluster configuration using Zilliz Helm chart defaults milvus: # Only override what differs from chart defaults + enabled: true + serviceAccount: + create: false + name: rag-milvus + # The Milvus dependency cannot disable token automount on its own ServiceAccount. + ragStackManaged: true + annotations: {} + + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: OnRootMismatch + + containerSecurityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + pulsarv3: enabled: false # Default is true, we need false woodpecker: @@ -265,9 +304,23 @@ milvus: mixCoordinator: annotations: {} + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi proxy: annotations: {} + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi dataNode: annotations: {} @@ -297,6 +350,31 @@ milvus: etcd: podAnnotations: {} + serviceAccount: + create: true + automountServiceAccountToken: false + podSecurityContext: + enabled: true + fsGroup: 1001 + seccompProfile: + type: RuntimeDefault + containerSecurityContext: + enabled: true + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1001 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi # PodDisruptionBudget configuration for etcd # Recommended for production to maintain etcd quorum during voluntary disruptions podDisruptionBudget: diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/agentgateway.md b/docs/docs/installation/helm-charts/ai-platform-engineering/agentgateway.md index b5379b6b1e..4da54d9bff 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/agentgateway.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/agentgateway.md @@ -14,17 +14,17 @@ AgentGateway standalone proxy for CAIPE MCP traffic | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 +helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 # Upgrade an existing release -helm upgrade agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 +helm upgrade agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 \ +helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 \ +helm install agentgateway oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.6.0 ``` ## Reading the Values Table @@ -103,6 +103,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/agentgateway --version 0.5.68 | service.statsPort | int | `15020` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/audit-service.md b/docs/docs/installation/helm-charts/ai-platform-engineering/audit-service.md index dbd6d7a1fe..c7af590a86 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/audit-service.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/audit-service.md @@ -14,17 +14,17 @@ Lightweight CAIPE audit log read/write service | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 +helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 # Upgrade an existing release -helm upgrade audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 +helm upgrade audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 \ +helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 \ +helm install audit-service oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/audit-service --version 0.6.0 ``` ## Reading the Values Table @@ -112,7 +112,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/audit-service --version 0.5.68 | service.port | int | `8010` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `18` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/autonomous-agents.md b/docs/docs/installation/helm-charts/ai-platform-engineering/autonomous-agents.md index 7c20c87fcf..7ebbd32f22 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/autonomous-agents.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/autonomous-agents.md @@ -14,17 +14,17 @@ A Helm chart for Autonomous Agents - Standalone scheduler that fires tasks (cron | | | |---|---| -| **Version** | `0.4.10-dev.1` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 +helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 # Upgrade an existing release -helm upgrade autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 +helm upgrade autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 \ +helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 \ +helm install autonomous-agents oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10-dev.1 +helm show values oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.6.0 ``` ## Reading the Values Table @@ -64,6 +64,12 @@ helm show values oci://ghcr.io/cnoe-io/charts/autonomous-agents --version 0.4.10 | config.DYNAMIC_AGENTS_URL | string | `""` | | | config.MONGODB_DATABASE | string | `"caipe"` | | | config.SUPERVISOR_URL | string | `""` | | +| dynamicAgentsAuth.clientId | string | `"caipe-platform"` | | +| dynamicAgentsAuth.clientSecretRef.key | string | `"OIDC_CLIENT_SECRET"` | | +| dynamicAgentsAuth.clientSecretRef.name | string | `""` | | +| dynamicAgentsAuth.enabled | bool | `false` | | +| dynamicAgentsAuth.scope | string | `"openid profile email"` | | +| dynamicAgentsAuth.tokenUrl | string | `""` | | | existingSecret | string | `""` | | | externalSecrets.apiVersion | string | `"v1beta1"` | | | externalSecrets.data | list | `[]` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui-mongodb.md b/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui-mongodb.md index cd39fde57b..3857893c5c 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui-mongodb.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui-mongodb.md @@ -14,17 +14,17 @@ MongoDB database for CAIPE UI persistence | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 +helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 # Upgrade an existing release -helm upgrade caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 +helm upgrade caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 \ +helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 \ +helm install caipe-ui-mongodb oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui-mongodb --version 0.6.0 ``` ## Reading the Values Table diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui.md b/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui.md index 2188b834a8..0e5061afcc 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/caipe-ui.md @@ -14,17 +14,17 @@ A Helm chart for CAIPE UI - chat interface for AI Platform Engineering | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 +helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 # Upgrade an existing release -helm upgrade caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 +helm upgrade caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 \ +helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 \ +helm install caipe-ui oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.6.0 ``` ## Reading the Values Table @@ -85,6 +85,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 | config.CREDENTIAL_STORE_BACKEND | string | `"mongodb-envelope"` | | | config.DESCRIPTION | string | `"Where Humans and AI agents collaborate to deliver high quality outcomes."` | | | config.DYNAMIC_AGENTS_URL | string | `""` | | +| config.ENABLE_AUTONOMOUS_AGENTS | string | `"false"` | | | config.ENABLE_SUBAGENT_CARDS | string | `"true"` | | | config.ENABLE_USER_INFO_TOOL | string | `"false"` | | | config.ENV_BADGE | string | `""` | | @@ -177,7 +178,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/caipe-ui --version 0.5.68 | service.port | int | `3000` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `30` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/dynamic-agents.md b/docs/docs/installation/helm-charts/ai-platform-engineering/dynamic-agents.md index 4e8e5185d1..64b176663b 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/dynamic-agents.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/dynamic-agents.md @@ -14,17 +14,17 @@ A Helm chart for Dynamic Agents - Standalone agent builder service with MCP tool | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 +helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 # Upgrade an existing release -helm upgrade dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 +helm upgrade dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 \ +helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 \ +helm install dynamic-agents oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.6.0 ``` ## Reading the Values Table @@ -130,7 +130,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/dynamic-agents --version 0.5.68 | service.port | int | `8001` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `30` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/index.md b/docs/docs/installation/helm-charts/ai-platform-engineering/index.md index 2748e975d6..1a1b739fab 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/index.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/index.md @@ -14,17 +14,17 @@ Parent chart to deploy CAIPE — dynamic agents, per-agent MCP servers, RBAC, an | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 +helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 # Upgrade an existing release -helm upgrade ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 +helm upgrade ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 \ +helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 \ +helm install ai-platform-engineering oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version 0.6.0 ``` ## Reading the Values Table @@ -64,6 +64,25 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | agentgateway.image.repository | string | `"cr.agentgateway.dev/agentgateway"` | | | agentgateway.image.tag | string | `"v1.1.0"` | | | agentgateway.skillScanner.enabled | bool | `false` | | +| autonomous-agents.config.DYNAMIC_AGENTS_URL | string | `""` | | +| autonomous-agents.config.MONGODB_DATABASE | string | `"caipe"` | | +| autonomous-agents.dynamicAgentsAuth.clientId | string | `"caipe-platform"` | | +| autonomous-agents.dynamicAgentsAuth.clientSecretRef.key | string | `"OIDC_CLIENT_SECRET"` | | +| autonomous-agents.dynamicAgentsAuth.clientSecretRef.name | string | `"caipe-platform-secret"` | | +| autonomous-agents.dynamicAgentsAuth.enabled | bool | `true` | | +| autonomous-agents.dynamicAgentsAuth.scope | string | `"openid profile email"` | | +| autonomous-agents.dynamicAgentsAuth.tokenUrl | string | `""` | | +| autonomous-agents.existingSecret | string | `""` | | +| autonomous-agents.externalSecrets.apiVersion | string | `"v1beta1"` | | +| autonomous-agents.externalSecrets.data | list | `[]` | | +| autonomous-agents.externalSecrets.enabled | bool | `false` | | +| autonomous-agents.externalSecrets.secretStoreRef.kind | string | `"ClusterSecretStore"` | | +| autonomous-agents.externalSecrets.secretStoreRef.name | string | `"vault"` | | +| autonomous-agents.image.pullPolicy | string | `"IfNotPresent"` | | +| autonomous-agents.image.repository | string | `"ghcr.io/cnoe-io/caipe-autonomous-agents"` | | +| autonomous-agents.image.tag | string | `""` | | +| autonomous-agents.nameOverride | string | `"autonomous-agents"` | | +| autonomous-agents.service.port | int | `8002` | | | caipe-ui.config.APP_NAME | string | `"CAIPE"` | | | caipe-ui.config.CAIPE_CREDENTIALS_ENABLED | string | `"false"` | | | caipe-ui.config.CAIPE_ORG_DISPLAY_NAME | string | `"CAIPE"` | | @@ -77,6 +96,8 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | caipe-ui.config.CREDENTIAL_STORE_BACKEND | string | `"mongodb-envelope"` | | | caipe-ui.config.DEFAULT_AGENT_ID | string | `""` | | | caipe-ui.config.DESCRIPTION | string | `"Where Humans and AI agents collaborate to deliver high quality outcomes."` | | +| caipe-ui.config.DYNAMIC_AGENTS_ENABLED | string | `"false"` | | +| caipe-ui.config.ENABLE_AUTONOMOUS_AGENTS | string | `"false"` | | | caipe-ui.config.ENABLE_SUBAGENT_CARDS | string | `"true"` | | | caipe-ui.config.ENV_BADGE | string | `""` | | | caipe-ui.config.IDENTITY_SYNC_LOGIN_AUTO_CREATE_TEAMS | string | `"false"` | | @@ -196,7 +217,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | dynamic-agents.nameOverride | string | `"dynamic-agents"` | | | dynamic-agents.service.metricsPort | int | `0` | | | dynamic-agents.service.port | int | `8001` | | -| extraDeploy | list | `[]` | | +| extraDeployMap | object | `{}` | | | global.agentgateway.enabled | bool | `true` | | | global.agentgateway.extAuth.enabled | bool | `false` | | | global.agentgateway.extAuth.port | int | `9100` | | @@ -569,6 +590,11 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | openfga.image.repository | string | `"openfga/openfga"` | | | openfga.image.tag | string | `"v1.15.1"` | | | openfga.init.enabled | bool | `true` | | +| openfga.init.platformClient.clientId | string | `"caipe-platform"` | | +| openfga.init.platformClient.clientSecretRef.key | string | `"OIDC_CLIENT_SECRET"` | | +| openfga.init.platformClient.clientSecretRef.name | string | `"caipe-platform-secret"` | | +| openfga.init.platformClient.enabled | bool | `false` | | +| openfga.init.platformClient.orgObject | string | `"organization:caipe"` | | | openfga.init.seedTuples | list | `[]` | | | openfga.init.storeName | string | `"caipe-openfga"` | | | openfga.migrate.enabled | bool | `true` | | @@ -639,6 +665,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | slack-bot.resources.limits.memory | string | `"512Mi"` | | | slack-bot.resources.requests.cpu | string | `"100m"` | | | slack-bot.resources.requests.memory | string | `"256Mi"` | | +| tags.autonomous-agents | bool | `false` | | | tags.basic | bool | `false` | | | tags.caipe-ui | bool | `false` | | | tags.complete | bool | `false` | | @@ -702,31 +729,32 @@ helm show values oci://ghcr.io/cnoe-io/charts/ai-platform-engineering --version | Name | Version | Condition / Tags | |------|---------|------------------| -| mcp-argocd (mcp-server) | `0.5.68` | tags: mcp-argocd, basic, complete | -| mcp-aws (mcp-server) | `0.5.68` | tags: mcp-aws, complete | -| mcp-backstage (mcp-server) | `0.5.68` | tags: mcp-backstage, basic, complete | -| mcp-confluence (mcp-server) | `0.5.68` | tags: mcp-confluence, complete | -| mcp-github (mcp-server) | `0.5.68` | tags: mcp-github, basic, complete | -| mcp-gitlab (mcp-server) | `0.5.68` | tags: mcp-gitlab, complete | -| mcp-jira (mcp-server) | `0.5.68` | tags: mcp-jira, complete | -| mcp-komodor (mcp-server) | `0.5.68` | tags: mcp-komodor, complete | -| mcp-pagerduty (mcp-server) | `0.5.68` | tags: mcp-pagerduty, complete | -| mcp-slack (mcp-server) | `0.5.68` | tags: mcp-slack, complete | -| mcp-splunk (mcp-server) | `0.5.68` | tags: mcp-splunk, complete | -| mcp-victorops (mcp-server) | `0.5.68` | tags: mcp-victorops | -| mcp-webex (mcp-server) | `0.5.68` | tags: mcp-webex, complete | -| mcp-webex-meetings (mcp-server) | `0.5.68` | tags: mcp-webex-meetings, complete | -| mcp-netutils (mcp-server) | `0.5.68` | tags: mcp-netutils, complete | -| rag-stack | `0.5.68` | tags: rag-stack, complete | -| caipe-ui | `0.5.68` | tags: caipe-ui | -| audit-service | `0.5.68` | | -| dynamic-agents | `0.5.68` | tags: dynamic-agents | -| scheduler | `0.5.68` | `global.scheduler.enabled` | -| mongodb (caipe-ui-mongodb) | `0.5.68` | `caipe-ui.mongodb.enabled` | -| skill-scanner | `0.5.68` | `global.skillScanner.enabled` | -| slack-bot | `0.5.68` | tags: slack-bot | -| webex-bot | `0.5.68` | tags: webex-bot | -| keycloak | `0.5.68` | tags: keycloak | -| openfga | `0.5.68` | `openfga.enabled` | -| openfga-authz-bridge | `0.5.68` | `openfgaAuthzBridge.enabled` | -| agentgateway | `0.5.68` | `agentgateway.enabled` | +| mcp-argocd (mcp-server) | `0.6.0` | tags: mcp-argocd, basic, complete | +| mcp-aws (mcp-server) | `0.6.0` | tags: mcp-aws, complete | +| mcp-backstage (mcp-server) | `0.6.0` | tags: mcp-backstage, basic, complete | +| mcp-confluence (mcp-server) | `0.6.0` | tags: mcp-confluence, complete | +| mcp-github (mcp-server) | `0.6.0` | tags: mcp-github, basic, complete | +| mcp-gitlab (mcp-server) | `0.6.0` | tags: mcp-gitlab, complete | +| mcp-jira (mcp-server) | `0.6.0` | tags: mcp-jira, complete | +| mcp-komodor (mcp-server) | `0.6.0` | tags: mcp-komodor, complete | +| mcp-pagerduty (mcp-server) | `0.6.0` | tags: mcp-pagerduty, complete | +| mcp-slack (mcp-server) | `0.6.0` | tags: mcp-slack, complete | +| mcp-splunk (mcp-server) | `0.6.0` | tags: mcp-splunk, complete | +| mcp-victorops (mcp-server) | `0.6.0` | tags: mcp-victorops | +| mcp-webex (mcp-server) | `0.6.0` | tags: mcp-webex, complete | +| mcp-webex-meetings (mcp-server) | `0.6.0` | tags: mcp-webex-meetings, complete | +| mcp-netutils (mcp-server) | `0.6.0` | tags: mcp-netutils, complete | +| rag-stack | `0.6.0` | tags: rag-stack, complete | +| caipe-ui | `0.6.0` | tags: caipe-ui | +| audit-service | `0.6.0` | | +| dynamic-agents | `0.6.0` | tags: dynamic-agents | +| autonomous-agents | `0.6.0` | tags: autonomous-agents | +| scheduler | `0.6.0` | `global.scheduler.enabled` | +| mongodb (caipe-ui-mongodb) | `0.6.0` | `caipe-ui.mongodb.enabled` | +| skill-scanner | `0.6.0` | `global.skillScanner.enabled` | +| slack-bot | `0.6.0` | tags: slack-bot | +| webex-bot | `0.6.0` | tags: webex-bot | +| keycloak | `0.6.0` | tags: keycloak | +| openfga | `0.6.0` | `openfga.enabled` | +| openfga-authz-bridge | `0.6.0` | `openfgaAuthzBridge.enabled` | +| agentgateway | `0.6.0` | `agentgateway.enabled` | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/keycloak.md b/docs/docs/installation/helm-charts/ai-platform-engineering/keycloak.md index 554e519a55..75f0b11f14 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/keycloak.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/keycloak.md @@ -14,17 +14,17 @@ Keycloak identity provider for CAIPE RBAC, token exchange, and identity federati | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 +helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 # Upgrade an existing release -helm upgrade keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 +helm upgrade keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 \ +helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 \ +helm install keycloak oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.6.0 ``` ## Reading the Values Table @@ -148,6 +148,15 @@ helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 | initImage.pullPolicy | string | `"IfNotPresent"` | | | initImage.repository | string | `"ghcr.io/caipe-io/keycloak-init"` | | | initImage.tag | string | `""` | | +| jobPodSecurityContext.runAsNonRoot | bool | `true` | | +| jobResources.limits.cpu | string | `"500m"` | | +| jobResources.limits.memory | string | `"512Mi"` | | +| jobResources.requests.cpu | string | `"100m"` | | +| jobResources.requests.memory | string | `"128Mi"` | | +| jobSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| jobSecurityContext.capabilities.drop[0] | string | `"ALL"` | | +| jobSecurityContext.runAsNonRoot | bool | `true` | | +| jobSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | | platformClient.externalSecret.enabled | bool | `false` | | @@ -159,6 +168,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 | platformClient.secretKey | string | `"OIDC_CLIENT_SECRET"` | | | platformClient.secretRef | string | `""` | | | podAnnotations | object | `{}` | | +| podSecurityContext.runAsNonRoot | bool | `true` | | | realm.accessTokenLifespan | int | `3600` | | | realm.accessTokenLifespanForImplicitFlow | int | `900` | | | realm.name | string | `"caipe"` | | @@ -180,9 +190,14 @@ helm show values oci://ghcr.io/cnoe-io/charts/keycloak --version 0.5.68 | schedulerTokenExchange.externalSecret.secretStoreRef.kind | string | `"ClusterSecretStore"` | | | schedulerTokenExchange.externalSecret.secretStoreRef.name | string | `"vault"` | | | schedulerTokenExchange.secretRef | string | `""` | | +| securityContext.allowPrivilegeEscalation | bool | `false` | | +| securityContext.capabilities.drop[0] | string | `"ALL"` | | +| securityContext.runAsNonRoot | bool | `true` | | +| securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | service.port | int | `8080` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | strictClientSecrets | bool | `false` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/mcp-server.md b/docs/docs/installation/helm-charts/ai-platform-engineering/mcp-server.md index 97d5640238..8aaa8e4245 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/mcp-server.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/mcp-server.md @@ -14,17 +14,17 @@ Deploys one agent's MCP server (Deployment + Service) for CAIPE | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 +helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 # Upgrade an existing release -helm upgrade mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 +helm upgrade mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 \ +helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 \ +helm install mcp-server oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.6.0 ``` ## Reading the Values Table @@ -88,7 +88,10 @@ helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 | mcp.readinessProbe.periodSeconds | int | `5` | | | mcp.readinessProbe.tcpSocket.port | string | `"http"` | | | mcp.readinessProbe.timeoutSeconds | int | `3` | | -| mcp.resources | object | `{}` | | +| mcp.resources.limits.cpu | string | `"500m"` | | +| mcp.resources.limits.memory | string | `"2Gi"` | | +| mcp.resources.requests.cpu | string | `"100m"` | | +| mcp.resources.requests.memory | string | `"500Mi"` | | | mcp.service.port | int | `8000` | | | mcp.service.type | string | `"ClusterIP"` | | | mcp.startupProbe.failureThreshold | int | `30` | | @@ -113,7 +116,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/mcp-server --version 0.5.68 | securityContext.runAsUser | int | `1001` | | | securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/openfga-authz-bridge.md b/docs/docs/installation/helm-charts/ai-platform-engineering/openfga-authz-bridge.md index 9a00bfe637..617497212d 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/openfga-authz-bridge.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/openfga-authz-bridge.md @@ -14,17 +14,17 @@ Envoy ext_authz bridge that adapts AgentGateway authorization checks to OpenFGA | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 +helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 # Upgrade an existing release -helm upgrade openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 +helm upgrade openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 \ +helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 \ +helm install openfga-authz-bridge oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.6.0 ``` ## Reading the Values Table @@ -99,6 +99,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga-authz-bridge --version 0.5 | service.port | int | `9100` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tokenValidation.algorithms[0] | string | `"RS256"` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/openfga.md b/docs/docs/installation/helm-charts/ai-platform-engineering/openfga.md index 2b2ca87854..0356f0b416 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/openfga.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/openfga.md @@ -14,17 +14,17 @@ OpenFGA authorization service for CAIPE relationship-based access control | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 +helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 # Upgrade an existing release -helm upgrade openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 +helm upgrade openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 \ +helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 \ +helm install openfga oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.6.0 ``` ## Reading the Values Table @@ -78,6 +78,16 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 | init.image.pullPolicy | string | `"IfNotPresent"` | | | init.image.repository | string | `"python"` | | | init.image.tag | string | `"3.13-slim"` | | +| init.platformClient.clientId | string | `"caipe-platform"` | | +| init.platformClient.clientSecretRef.key | string | `"OIDC_CLIENT_SECRET"` | | +| init.platformClient.clientSecretRef.name | string | `""` | | +| init.platformClient.enabled | bool | `false` | | +| init.platformClient.orgObject | string | `"organization:caipe"` | | +| init.platformClient.tokenUrl | string | `""` | | +| init.resources.limits.cpu | string | `"500m"` | | +| init.resources.limits.memory | string | `"512Mi"` | | +| init.resources.requests.cpu | string | `"100m"` | | +| init.resources.requests.memory | string | `"128Mi"` | | | init.seedSub | string | `""` | | | init.seedTuples | list | `[]` | | | init.storeName | string | `"caipe-openfga"` | | @@ -85,6 +95,10 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 | migrate.backoffLimit | int | `6` | | | migrate.enabled | bool | `true` | | | migrate.helmHookDeletePolicy | string | `"before-hook-creation,hook-succeeded"` | | +| migrate.resources.limits.cpu | string | `"500m"` | | +| migrate.resources.limits.memory | string | `"512Mi"` | | +| migrate.resources.requests.cpu | string | `"100m"` | | +| migrate.resources.requests.memory | string | `"128Mi"` | | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | | playground.enabled | bool | `false` | | @@ -110,6 +124,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/openfga --version 0.5.68 | service.playgroundPort | int | `3000` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/scheduler.md b/docs/docs/installation/helm-charts/ai-platform-engineering/scheduler.md index 08bc034269..a250567789 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/scheduler.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/scheduler.md @@ -14,17 +14,17 @@ A Helm chart for caipe-scheduler - cron schedule registry + k8s CronJob orchestr | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 +helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 # Upgrade an existing release -helm upgrade scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 +helm upgrade scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 \ +helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 \ +helm install scheduler oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/scheduler --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/scheduler --version 0.6.0 ``` ## Reading the Values Table diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/skill-scanner.md b/docs/docs/installation/helm-charts/ai-platform-engineering/skill-scanner.md index 407745a33a..340a896dc0 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/skill-scanner.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/skill-scanner.md @@ -17,17 +17,17 @@ cluster-internal (ClusterIP only — no Ingress). | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 +helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 # Upgrade an existing release -helm upgrade skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 +helm upgrade skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 ``` ## Customizing Values @@ -36,15 +36,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 \ +helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 \ +helm install skill-scanner oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.6.0 ``` ## Reading the Values Table @@ -90,6 +90,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/skill-scanner --version 0.5.68 | securityContext.runAsGroup | int | `1001` | GID to run as | | securityContext.runAsNonRoot | bool | `true` | Run as non-root user (matches Dockerfile.skill-scanner) | | securityContext.runAsUser | int | `1001` | UID to run as | +| securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | service.port | int | `8000` | | | service.type | string | `"ClusterIP"` | ClusterIP only — never expose this Service externally. The scanner API is unauthenticated and accepts arbitrary ZIP uploads. | | serviceAccount.annotations | object | `{}` | Annotations to add to the service account | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/slack-bot.md b/docs/docs/installation/helm-charts/ai-platform-engineering/slack-bot.md index 187182bde3..4f0a4fac6e 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/slack-bot.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/slack-bot.md @@ -14,17 +14,17 @@ Slack bot integration for AI Platform Engineering using the CAIPE UI BFF | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 +helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 # Upgrade an existing release -helm upgrade slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 +helm upgrade slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 \ +helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 \ +helm install slack-bot oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.6.0 ``` ## Reading the Values Table @@ -86,6 +86,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/slack-bot --version 0.5.68 | securityContext.runAsUser | int | `1001` | | | securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | serviceAccount.annotations | object | `{}` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/docs/docs/installation/helm-charts/ai-platform-engineering/webex-bot.md b/docs/docs/installation/helm-charts/ai-platform-engineering/webex-bot.md index 7b435c13b4..6503b09d10 100644 --- a/docs/docs/installation/helm-charts/ai-platform-engineering/webex-bot.md +++ b/docs/docs/installation/helm-charts/ai-platform-engineering/webex-bot.md @@ -14,17 +14,17 @@ Webex bot integration for AI Platform Engineering using the CAIPE UI BFF | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 +helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 # Upgrade an existing release -helm upgrade webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 +helm upgrade webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 \ +helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 \ +helm install webex-bot oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/webex-bot --version 0.6.0 ``` ## Reading the Values Table diff --git a/docs/docs/installation/helm-charts/rag-stack/agent-ontology.md b/docs/docs/installation/helm-charts/rag-stack/agent-ontology.md index d3688d6bf9..fcc4149ffe 100644 --- a/docs/docs/installation/helm-charts/rag-stack/agent-ontology.md +++ b/docs/docs/installation/helm-charts/rag-stack/agent-ontology.md @@ -14,17 +14,17 @@ A Helm chart for Kubernetes | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 +helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 # Upgrade an existing release -helm upgrade agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 +helm upgrade agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 \ +helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 \ +helm install agent-ontology oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.6.0 ``` ## Reading the Values Table @@ -119,7 +119,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/agent-ontology --version 0.5.68 | service.port | int | `8098` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.failureThreshold | int | `30` | | diff --git a/docs/docs/installation/helm-charts/rag-stack/index.md b/docs/docs/installation/helm-charts/rag-stack/index.md index 12fdedfe60..a346c67639 100644 --- a/docs/docs/installation/helm-charts/rag-stack/index.md +++ b/docs/docs/installation/helm-charts/rag-stack/index.md @@ -14,17 +14,17 @@ A complete RAG stack including server, agents, Redis, Neo4j and Milvus | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 +helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 # Upgrade an existing release -helm upgrade rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 +helm upgrade rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 \ +helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 \ +helm install rag-stack oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.6.0 ``` ## Reading the Values Table @@ -125,21 +125,60 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | global.rag.redis.db | int | `0` | | | global.rag.redis.host | string | `"rag-redis"` | | | global.rag.redis.port | int | `6379` | | +| milvus.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| milvus.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | | +| milvus.containerSecurityContext.runAsGroup | int | `1000` | | +| milvus.containerSecurityContext.runAsNonRoot | bool | `true` | | +| milvus.containerSecurityContext.runAsUser | int | `1000` | | +| milvus.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | milvus.dataNode.annotations | object | `{}` | | | milvus.dataNode.podDisruptionBudget.enabled | bool | `false` | | | milvus.dataNode.resources.limits.cpu | string | `"200m"` | | | milvus.dataNode.resources.limits.memory | string | `"256Mi"` | | +| milvus.enabled | bool | `true` | | +| milvus.etcd.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| milvus.etcd.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | | +| milvus.etcd.containerSecurityContext.enabled | bool | `true` | | +| milvus.etcd.containerSecurityContext.runAsNonRoot | bool | `true` | | +| milvus.etcd.containerSecurityContext.runAsUser | int | `1001` | | +| milvus.etcd.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | milvus.etcd.podAnnotations | object | `{}` | | | milvus.etcd.podDisruptionBudget.enabled | bool | `false` | | +| milvus.etcd.podSecurityContext.enabled | bool | `true` | | +| milvus.etcd.podSecurityContext.fsGroup | int | `1001` | | +| milvus.etcd.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | +| milvus.etcd.resources.limits.cpu | string | `"500m"` | | +| milvus.etcd.resources.limits.memory | string | `"512Mi"` | | +| milvus.etcd.resources.requests.cpu | string | `"100m"` | | +| milvus.etcd.resources.requests.memory | string | `"128Mi"` | | +| milvus.etcd.serviceAccount.automountServiceAccountToken | bool | `false` | | +| milvus.etcd.serviceAccount.create | bool | `true` | | | milvus.minio.podAnnotations | object | `{}` | | | milvus.minio.podDisruptionBudget.enabled | bool | `false` | | | milvus.mixCoordinator.annotations | object | `{}` | | +| milvus.mixCoordinator.resources.limits.cpu | string | `"500m"` | | +| milvus.mixCoordinator.resources.limits.memory | string | `"512Mi"` | | +| milvus.mixCoordinator.resources.requests.cpu | string | `"100m"` | | +| milvus.mixCoordinator.resources.requests.memory | string | `"128Mi"` | | | milvus.proxy.annotations | object | `{}` | | +| milvus.proxy.resources.limits.cpu | string | `"500m"` | | +| milvus.proxy.resources.limits.memory | string | `"512Mi"` | | +| milvus.proxy.resources.requests.cpu | string | `"100m"` | | +| milvus.proxy.resources.requests.memory | string | `"128Mi"` | | | milvus.pulsarv3.enabled | bool | `false` | | | milvus.queryNode.annotations | object | `{}` | | | milvus.queryNode.podDisruptionBudget.enabled | bool | `false` | | | milvus.queryNode.resources.limits.cpu | string | `"200m"` | | | milvus.queryNode.resources.limits.memory | string | `"256Mi"` | | +| milvus.securityContext.fsGroup | int | `1000` | | +| milvus.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | | +| milvus.securityContext.runAsGroup | int | `1000` | | +| milvus.securityContext.runAsNonRoot | bool | `true` | | +| milvus.securityContext.runAsUser | int | `1000` | | +| milvus.serviceAccount.annotations | object | `{}` | | +| milvus.serviceAccount.create | bool | `false` | | +| milvus.serviceAccount.name | string | `"rag-milvus"` | | +| milvus.serviceAccount.ragStackManaged | bool | `true` | | | milvus.woodpecker.enabled | bool | `true` | | | neo4j.apoc_config."apoc.import.file.enabled" | string | `"true"` | | | neo4j.apoc_config."apoc.trigger.enabled" | string | `"true"` | | @@ -147,6 +186,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | neo4j.config."dbms.security.procedures.unrestricted" | string | `"apoc.*"` | | | neo4j.config."server.config.strict_validation.enabled" | string | `"false"` | | | neo4j.config."server.directories.plugins" | string | `"/var/lib/neo4j/labs"` | | +| neo4j.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | neo4j.disableLookups | bool | `true` | | | neo4j.enabled | bool | `true` | | | neo4j.fullnameOverride | string | `"rag-neo4j"` | | @@ -155,6 +195,11 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | neo4j.neo4j.resources.cpu | string | `"1"` | | | neo4j.neo4j.resources.memory | string | `"2Gi"` | | | neo4j.podSpec.annotations | object | `{}` | | +| neo4j.podSpec.serviceAccountName | string | `"rag-neo4j"` | | +| neo4j.serviceAccount.annotations | object | `{}` | | +| neo4j.serviceAccount.automount | bool | `false` | | +| neo4j.serviceAccount.create | bool | `true` | | +| neo4j.serviceAccount.name | string | `"rag-neo4j"` | | | neo4j.services.neo4j.enabled | bool | `false` | | | neo4j.volumes.data.dynamic.storageClassName | string | `"gp2"` | | | neo4j.volumes.data.mode | string | `"dynamic"` | | @@ -228,9 +273,9 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-stack --version 0.5.68 | Name | Version | Condition / Tags | |------|---------|------------------| -| rag-server | `0.5.68` | `rag-server.enabled` | -| agent-ontology | `0.5.68` | `agent-ontology.enabled` | -| rag-ingestors | `0.5.68` | `rag-ingestors.enabled` | +| rag-server | `0.6.0` | `rag-server.enabled` | +| agent-ontology | `0.6.0` | `agent-ontology.enabled` | +| rag-ingestors | `0.6.0` | `rag-ingestors.enabled` | | neo4j | `2025.07.1` | `neo4j.enabled` | -| rag-redis | `0.5.68` | `rag-redis.enabled` | +| rag-redis | `0.6.0` | `rag-redis.enabled` | | milvus | `5.0.2` | `milvus.enabled` | diff --git a/docs/docs/installation/helm-charts/rag-stack/rag-ingestors.md b/docs/docs/installation/helm-charts/rag-stack/rag-ingestors.md index 1098b60605..a8d31be4da 100644 --- a/docs/docs/installation/helm-charts/rag-stack/rag-ingestors.md +++ b/docs/docs/installation/helm-charts/rag-stack/rag-ingestors.md @@ -14,17 +14,17 @@ Configurable ingestors for RAG system - supports AWS, K8s, ArgoCD, Slack, and We | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 +helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 # Upgrade an existing release -helm upgrade rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 +helm upgrade rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 \ +helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 \ +helm install rag-ingestors oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.6.0 ``` ## Reading the Values Table @@ -82,7 +82,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-ingestors --version 0.5.68 | securityContext.runAsUser | int | `1001` | | | securityContext.seccompProfile.type | string | `"RuntimeDefault"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | diff --git a/docs/docs/installation/helm-charts/rag-stack/rag-redis.md b/docs/docs/installation/helm-charts/rag-stack/rag-redis.md index 7616b98108..5064b16a5c 100644 --- a/docs/docs/installation/helm-charts/rag-stack/rag-redis.md +++ b/docs/docs/installation/helm-charts/rag-stack/rag-redis.md @@ -14,17 +14,17 @@ A Helm chart for Kubernetes | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 +helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 # Upgrade an existing release -helm upgrade rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 +helm upgrade rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 \ +helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 \ +helm install rag-redis oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.6.0 ``` ## Reading the Values Table @@ -108,7 +108,7 @@ helm show values oci://ghcr.io/cnoe-io/charts/rag-redis --version 0.5.68 | service.port | int | `6379` | | | service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | -| serviceAccount.automount | bool | `true` | | +| serviceAccount.automount | bool | `false` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | startupProbe.exec.command[0] | string | `"redis-cli"` | | diff --git a/docs/docs/installation/helm-charts/rag-stack/rag-server.md b/docs/docs/installation/helm-charts/rag-stack/rag-server.md index f2aa9cd0ef..9d8f9e428a 100644 --- a/docs/docs/installation/helm-charts/rag-stack/rag-server.md +++ b/docs/docs/installation/helm-charts/rag-stack/rag-server.md @@ -14,17 +14,17 @@ RAG server | | | |---|---| -| **Version** | `0.5.68` | +| **Version** | `0.6.0` | | **Type** | application | ## Quick Start ```bash # Add and install the chart -helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 +helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 # Upgrade an existing release -helm upgrade rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 +helm upgrade rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 ``` ## Customizing Values @@ -33,15 +33,15 @@ Override default values using `--set` flags or a custom values file: ```bash # Override individual values -helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 \ +helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 \ --set replicaCount=2 # Use a custom values file -helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 \ +helm install rag-server oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 \ -f custom-values.yaml # Show all configurable values -helm show values oci://ghcr.io/cnoe-io/charts/rag-server --version 0.5.68 +helm show values oci://ghcr.io/cnoe-io/charts/rag-server --version 0.6.0 ``` ## Reading the Values Table From 81ed862dc153448fbaced76fa11f281f85165d63 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 25 Aug 2026 14:15:42 +0000 Subject: [PATCH 2/2] chore: bump version to 1.0.0-dev.2-chart.1 --- charts/ai-platform-engineering/Chart.yaml | 60 +++++++++---------- .../charts/agentgateway/Chart.yaml | 2 +- .../charts/audit-service/Chart.yaml | 2 +- .../charts/autonomous-agents/Chart.yaml | 2 +- .../charts/caipe-ui-mongodb/Chart.yaml | 2 +- .../charts/caipe-ui/Chart.yaml | 2 +- .../charts/dynamic-agents/Chart.yaml | 2 +- .../charts/keycloak/Chart.yaml | 2 +- .../charts/mcp-server/Chart.yaml | 2 +- .../charts/openfga-authz-bridge/Chart.yaml | 2 +- .../charts/openfga/Chart.yaml | 2 +- .../charts/scheduler/Chart.yaml | 2 +- .../charts/skill-scanner/Chart.yaml | 2 +- .../charts/slack-bot/Chart.yaml | 2 +- .../charts/webex-bot/Chart.yaml | 2 +- charts/rag-stack/Chart.yaml | 10 ++-- .../charts/agent-ontology/Chart.yaml | 2 +- .../rag-stack/charts/rag-ingestors/Chart.yaml | 2 +- charts/rag-stack/charts/rag-redis/Chart.yaml | 2 +- charts/rag-stack/charts/rag-server/Chart.yaml | 2 +- 20 files changed, 53 insertions(+), 53 deletions(-) diff --git a/charts/ai-platform-engineering/Chart.yaml b/charts/ai-platform-engineering/Chart.yaml index ad6f1687f8..3901825922 100644 --- a/charts/ai-platform-engineering/Chart.yaml +++ b/charts/ai-platform-engineering/Chart.yaml @@ -6,12 +6,12 @@ description: Parent chart to deploy CAIPE — dynamic agents, per-agent MCP serv sources: - https://github.com/cnoe-io/ai-platform-engineering/charts # Chart version for ai-platform-engineering parent chart -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow dependencies: # Single MCP-server chart used multiple times with different aliases. # Each alias deploys one agent's MCP server (Deployment + Service). - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-argocd tags: - mcp-argocd @@ -21,7 +21,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.argocd - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-aws tags: - mcp-aws @@ -30,7 +30,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.aws - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-backstage tags: - mcp-backstage @@ -40,7 +40,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.backstage - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-confluence tags: - mcp-confluence @@ -49,7 +49,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.confluence - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-github tags: - mcp-github @@ -59,7 +59,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.github - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-gitlab tags: - mcp-gitlab @@ -68,7 +68,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.gitlab - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-jira tags: - mcp-jira @@ -77,7 +77,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.jira - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-komodor tags: - mcp-komodor @@ -86,7 +86,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.komodor - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-pagerduty tags: - mcp-pagerduty @@ -95,7 +95,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.pagerduty - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-slack tags: - mcp-slack @@ -104,7 +104,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.slack - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-splunk tags: - mcp-splunk @@ -113,7 +113,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.splunk - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-victorops tags: - mcp-victorops @@ -121,7 +121,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.victorops - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-webex tags: - mcp-webex @@ -130,7 +130,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.webex - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-webex-meetings tags: - mcp-webex-meetings @@ -139,7 +139,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.webex-meetings - name: mcp-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow alias: mcp-netutils tags: - mcp-netutils @@ -148,7 +148,7 @@ dependencies: - child: agentExports.data parent: global.enabledSubAgents.netutils - name: rag-stack - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow repository: file://../rag-stack # TODO: might be changed to be separate tags: - rag-stack @@ -158,46 +158,46 @@ dependencies: parent: global.enabledSubAgents.rag # CAIPE UI - name: caipe-ui - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow tags: - caipe-ui # Lightweight audit log read/write service. # Mandatory platform service: installed without a tag or condition so # audit producers can drop/warn when unavailable instead of owning storage. - name: audit-service - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow # Dynamic Agents - Standalone agent builder with MCP tool support - name: dynamic-agents - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow tags: - dynamic-agents # Autonomous Agents - Standalone scheduler firing cron/interval/webhook tasks at the supervisor over A2A - name: autonomous-agents - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow tags: - autonomous-agents # Scheduler service for Dynamic Agents scheduled jobs. - name: scheduler - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow condition: global.scheduler.enabled # MongoDB for CAIPE UI persistence - name: caipe-ui-mongodb - version: 1.0.0-dev.2 + version: 1.0.0-dev.2-chart.1 condition: caipe-ui.mongodb.enabled alias: mongodb # Skill Scanner — standalone cisco-ai-defense/skill-scanner REST API. # Required for the UI's skill safety scan; off by default. - name: skill-scanner - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow condition: global.skillScanner.enabled # Slack Bot Integration (client, not an agent) - name: slack-bot - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow tags: - slack-bot # Webex Bot Integration (client, not an agent) - name: webex-bot - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow tags: - webex-bot # Keycloak Identity Provider for CAIPE RBAC/OIDC. @@ -206,16 +206,16 @@ dependencies: # wiring. There is no upstream Keycloak chart that provides these CAIPE # bootstrap invariants without additional Jobs/templates. - name: keycloak - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow tags: - keycloak # OpenFGA relationship authorization service - name: openfga - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow condition: openfga.enabled # AgentGateway ext_authz bridge backed by OpenFGA - name: openfga-authz-bridge - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow condition: openfgaAuthzBridge.enabled # AgentGateway standalone proxy for RBAC-protected MCP routing. # Intentional local subchart for this release: this deploys the standalone @@ -224,5 +224,5 @@ dependencies: # and remain the target for a later migration once we can preserve this # release's static MCP routing and authz bridge contract. - name: agentgateway - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow condition: agentgateway.enabled diff --git a/charts/ai-platform-engineering/charts/agentgateway/Chart.yaml b/charts/ai-platform-engineering/charts/agentgateway/Chart.yaml index b478b66084..106cdd3ee9 100644 --- a/charts/ai-platform-engineering/charts/agentgateway/Chart.yaml +++ b/charts/ai-platform-engineering/charts/agentgateway/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: agentgateway description: AgentGateway standalone proxy for CAIPE MCP traffic type: application -version: 1.0.0-dev.2 +version: 1.0.0-dev.2-chart.1 appVersion: 1.0.0-dev.2 diff --git a/charts/ai-platform-engineering/charts/audit-service/Chart.yaml b/charts/ai-platform-engineering/charts/audit-service/Chart.yaml index 8464996ca9..093b4e5107 100644 --- a/charts/ai-platform-engineering/charts/audit-service/Chart.yaml +++ b/charts/ai-platform-engineering/charts/audit-service/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: audit-service description: Lightweight CAIPE audit log read/write service type: application -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow appVersion: 1.0.0-dev.2 # Do NOT modify. It will be updated automatically using the release workflow diff --git a/charts/ai-platform-engineering/charts/autonomous-agents/Chart.yaml b/charts/ai-platform-engineering/charts/autonomous-agents/Chart.yaml index 6d58603682..3cb1b8562d 100644 --- a/charts/ai-platform-engineering/charts/autonomous-agents/Chart.yaml +++ b/charts/ai-platform-engineering/charts/autonomous-agents/Chart.yaml @@ -4,6 +4,6 @@ description: A Helm chart for Autonomous Agents - Standalone scheduler that fire # Application chart that can be packaged and deployed type: application # Chart version - automatically updated by release workflow -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow # Application version - automatically updated by release workflow appVersion: 1.0.0-dev.2 # Do NOT modify. It will be updated automatically using the release workflow diff --git a/charts/ai-platform-engineering/charts/caipe-ui-mongodb/Chart.yaml b/charts/ai-platform-engineering/charts/caipe-ui-mongodb/Chart.yaml index 8a6f6fcf7a..cadcd4ff18 100644 --- a/charts/ai-platform-engineering/charts/caipe-ui-mongodb/Chart.yaml +++ b/charts/ai-platform-engineering/charts/caipe-ui-mongodb/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: caipe-ui-mongodb description: MongoDB database for CAIPE UI persistence type: application -version: 1.0.0-dev.2 +version: 1.0.0-dev.2-chart.1 appVersion: "1.0.0-dev.2" diff --git a/charts/ai-platform-engineering/charts/caipe-ui/Chart.yaml b/charts/ai-platform-engineering/charts/caipe-ui/Chart.yaml index 648336cb17..604e8b7124 100644 --- a/charts/ai-platform-engineering/charts/caipe-ui/Chart.yaml +++ b/charts/ai-platform-engineering/charts/caipe-ui/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. diff --git a/charts/ai-platform-engineering/charts/dynamic-agents/Chart.yaml b/charts/ai-platform-engineering/charts/dynamic-agents/Chart.yaml index bd86947967..75dcaf2cbe 100644 --- a/charts/ai-platform-engineering/charts/dynamic-agents/Chart.yaml +++ b/charts/ai-platform-engineering/charts/dynamic-agents/Chart.yaml @@ -4,6 +4,6 @@ description: A Helm chart for Dynamic Agents - Standalone agent builder service # Application chart that can be packaged and deployed type: application # Chart version - automatically updated by release workflow -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow # Application version - automatically updated by release workflow appVersion: 1.0.0-dev.2 # Do NOT modify. It will be updated automatically using the release workflow diff --git a/charts/ai-platform-engineering/charts/keycloak/Chart.yaml b/charts/ai-platform-engineering/charts/keycloak/Chart.yaml index ab467d7d99..3e7ec32b7b 100644 --- a/charts/ai-platform-engineering/charts/keycloak/Chart.yaml +++ b/charts/ai-platform-engineering/charts/keycloak/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: keycloak description: Keycloak identity provider for CAIPE RBAC, token exchange, and identity federation -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow appVersion: 1.0.0-dev.2 type: application diff --git a/charts/ai-platform-engineering/charts/mcp-server/Chart.yaml b/charts/ai-platform-engineering/charts/mcp-server/Chart.yaml index 0d9eada526..f2e0955a3a 100644 --- a/charts/ai-platform-engineering/charts/mcp-server/Chart.yaml +++ b/charts/ai-platform-engineering/charts/mcp-server/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. diff --git a/charts/ai-platform-engineering/charts/openfga-authz-bridge/Chart.yaml b/charts/ai-platform-engineering/charts/openfga-authz-bridge/Chart.yaml index 1e55b724cb..1a8a81da58 100644 --- a/charts/ai-platform-engineering/charts/openfga-authz-bridge/Chart.yaml +++ b/charts/ai-platform-engineering/charts/openfga-authz-bridge/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: openfga-authz-bridge description: Envoy ext_authz bridge that adapts AgentGateway authorization checks to OpenFGA type: application -version: 1.0.0-dev.2 +version: 1.0.0-dev.2-chart.1 appVersion: 1.0.0-dev.2 diff --git a/charts/ai-platform-engineering/charts/openfga/Chart.yaml b/charts/ai-platform-engineering/charts/openfga/Chart.yaml index 062886a480..41fa8bd097 100644 --- a/charts/ai-platform-engineering/charts/openfga/Chart.yaml +++ b/charts/ai-platform-engineering/charts/openfga/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: openfga description: OpenFGA authorization service for CAIPE relationship-based access control type: application -version: 1.0.0-dev.2 +version: 1.0.0-dev.2-chart.1 appVersion: 1.0.0-dev.2 diff --git a/charts/ai-platform-engineering/charts/scheduler/Chart.yaml b/charts/ai-platform-engineering/charts/scheduler/Chart.yaml index 35e1bbec5a..98cf27d6de 100644 --- a/charts/ai-platform-engineering/charts/scheduler/Chart.yaml +++ b/charts/ai-platform-engineering/charts/scheduler/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: scheduler description: A Helm chart for caipe-scheduler - cron schedule registry + k8s CronJob orchestrator. Owns the only RBAC permission to create batch/v1 CronJobs from a hard-coded podTemplate. type: application -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow appVersion: 1.0.0-dev.2 # Do NOT modify. It will be updated automatically using the release workflow diff --git a/charts/ai-platform-engineering/charts/skill-scanner/Chart.yaml b/charts/ai-platform-engineering/charts/skill-scanner/Chart.yaml index 1ba451f0e9..0c3c65bd04 100644 --- a/charts/ai-platform-engineering/charts/skill-scanner/Chart.yaml +++ b/charts/ai-platform-engineering/charts/skill-scanner/Chart.yaml @@ -6,5 +6,5 @@ description: | for safety analysis. The service is unauthenticated and MUST stay cluster-internal (ClusterIP only — no Ingress). type: application -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow appVersion: "1.0.0-dev.2" # Do NOT modify. It will be updated automatically using the release workflow diff --git a/charts/ai-platform-engineering/charts/slack-bot/Chart.yaml b/charts/ai-platform-engineering/charts/slack-bot/Chart.yaml index a4d0327f8a..0c402a85c3 100644 --- a/charts/ai-platform-engineering/charts/slack-bot/Chart.yaml +++ b/charts/ai-platform-engineering/charts/slack-bot/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: slack-bot description: Slack bot integration for AI Platform Engineering using the CAIPE UI BFF -version: 1.0.0-dev.2 +version: 1.0.0-dev.2-chart.1 appVersion: 1.0.0-dev.2 type: application diff --git a/charts/ai-platform-engineering/charts/webex-bot/Chart.yaml b/charts/ai-platform-engineering/charts/webex-bot/Chart.yaml index d19141140e..c2b81f7587 100644 --- a/charts/ai-platform-engineering/charts/webex-bot/Chart.yaml +++ b/charts/ai-platform-engineering/charts/webex-bot/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: webex-bot description: Webex bot integration for AI Platform Engineering using the CAIPE UI BFF -version: 1.0.0-dev.2 +version: 1.0.0-dev.2-chart.1 appVersion: 1.0.0-dev.2 type: application diff --git a/charts/rag-stack/Chart.yaml b/charts/rag-stack/Chart.yaml index 0fdb22c42d..d61fadd8f9 100644 --- a/charts/rag-stack/Chart.yaml +++ b/charts/rag-stack/Chart.yaml @@ -2,19 +2,19 @@ apiVersion: v2 name: rag-stack description: A complete RAG stack including server, agents, Redis, Neo4j and Milvus type: application -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow appVersion: 1.0.0-dev.2 # Do NOT modify. It will be updated automatically using the release workflow dependencies: - name: rag-server - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow repository: "file://./charts/rag-server" condition: rag-server.enabled - name: agent-ontology - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow repository: "file://./charts/agent-ontology" condition: agent-ontology.enabled - name: rag-ingestors - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow repository: "file://./charts/rag-ingestors" condition: rag-ingestors.enabled - name: neo4j @@ -23,7 +23,7 @@ dependencies: alias: neo4j condition: neo4j.enabled - name: rag-redis - version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow + version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow repository: "file://./charts/rag-redis" condition: rag-redis.enabled - name: milvus diff --git a/charts/rag-stack/charts/agent-ontology/Chart.yaml b/charts/rag-stack/charts/agent-ontology/Chart.yaml index 9df6b6a86e..73fb3e699b 100644 --- a/charts/rag-stack/charts/agent-ontology/Chart.yaml +++ b/charts/rag-stack/charts/agent-ontology/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. diff --git a/charts/rag-stack/charts/rag-ingestors/Chart.yaml b/charts/rag-stack/charts/rag-ingestors/Chart.yaml index 0b6a29014c..49b970151f 100644 --- a/charts/rag-stack/charts/rag-ingestors/Chart.yaml +++ b/charts/rag-stack/charts/rag-ingestors/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: rag-ingestors description: Configurable ingestors for RAG system - supports AWS, K8s, ArgoCD, Slack, and Webex type: application -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow appVersion: "1.0.0-dev.2" # Do NOT modify. It will be updated automatically using the release workflow diff --git a/charts/rag-stack/charts/rag-redis/Chart.yaml b/charts/rag-stack/charts/rag-redis/Chart.yaml index 795cf5051b..e0dc2d4f7b 100644 --- a/charts/rag-stack/charts/rag-redis/Chart.yaml +++ b/charts/rag-stack/charts/rag-redis/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. diff --git a/charts/rag-stack/charts/rag-server/Chart.yaml b/charts/rag-stack/charts/rag-server/Chart.yaml index 2acb84b037..da59445c96 100644 --- a/charts/rag-stack/charts/rag-server/Chart.yaml +++ b/charts/rag-stack/charts/rag-server/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: rag-server description: RAG server type: application -version: 1.0.0-dev.2 # Do NOT bump this. It will be updated automatically using the PR or release workflow +version: 1.0.0-dev.2-chart.1 # Do NOT bump this. It will be updated automatically using the PR or release workflow appVersion: "1.0.0-dev.2" # Do NOT modify. It will be updated automatically using the release workflow