helix-ttd-gemini-cli/cloud-run-service.yaml at main · helixprojectai-code/helix-ttd-gemini-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# [FACT] Google Cloud Run service definition for Constitutional Guardian
# [HYPOTHESIS] Declarative service configuration enables reproducible deployments
#
# Google Cloud Service: Cloud Run
# Documentation: https://cloud.google.com/run/docs/reference/yaml/v1
#
# Deploy with:
#   gcloud run services replace cloud-run-service.yaml --region us-central1

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: constitutional-guardian
  annotations:
    run.googleapis.com/ingress: all
    run.googleapis.com/execution-environment: gen2
    # [FACT] Enable Cloud Run VPC connector for private Pub/Sub access
    run.googleapis.com/vpc-access-connector: constitutional-vpc
spec:
  template:
    metadata:
      annotations:
        # [FACT] Scaling configuration
        autoscaling.knative.dev/minScale: "1"
        autoscaling.knative.dev/maxScale: "100"

        # [FACT] Enable Cloud SQL if using Postgres for state
        # run.googleapis.com/cloudsql-instances: helix-constitutional-guardian:us-central1:guardian-db

        # [FACT] Enable secrets from Secret Manager
        run.googleapis.com/secrets: |
          HELIX_DBC_ENC_KEY=projects/helix-constitutional-guardian/secrets/dbc-master-key:latest

        # [FACT] Execution environment
        run.googleapis.com/execution-environment: gen2

    spec:
      containerConcurrency: 50
      timeoutSeconds: 300
      serviceAccountName: constitutional-guardian@helix-constitutional-guardian.iam.gserviceaccount.com

      containers:
        - image: gcr.io/helix-constitutional-guardian/constitutional-guardian:latest
          ports:
            - containerPort: 8180
              name: http1

          env:
            # [FACT] Node identification
            - name: HELIX_NODE_ID
              value: "GCS-GUARDIAN"

            # [FACT] Deployment environment
            - name: HELIX_ENV
              value: "production"

            # [FACT] GCP Project configuration
            - name: GOOGLE_CLOUD_PROJECT
              value: "helix-constitutional-guardian"
            - name: GOOGLE_CLOUD_REGION
              value: "us-central1"

            # [FACT] Pub/Sub configuration
            - name: PUBSUB_TOPIC
              value: "constitutional-federation"

            # [FACT] Cloud Storage configuration
            - name: GCS_RECEIPT_BUCKET
              value: "constitutional-receipts-helix"

            - name: HELIX_DBC_ENC_KEY
              valueFrom:
                secretKeyRef:
                  name: dbc-master-key
                  key: latest

            # [FACT] Gemini API Key (injected from Secret Manager)
            - name: GEMINI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: GEMINI_API_KEY
                  key: latest

          resources:
            limits:
              cpu: "2"
              memory: "1Gi"

          # [FACT] Health checks for container lifecycle
          startupProbe:
            httpGet:
              path: /health
              port: 8180
            initialDelaySeconds: 0
            periodSeconds: 1
            failureThreshold: 10

          livenessProbe:
            httpGet:
              path: /health
              port: 8180
            periodSeconds: 10
            failureThreshold: 3

          # [FACT] Graceful shutdown handling
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 10"]

  # [FACT] Traffic splitting for blue/green deployments
  traffic:
    - percent: 100
      latestRevision: true