Updated K8s helm charts for api tool calling and vault updates

Author: nuwangeek

DSL/CronManager/script/delete_secrets_from_vault.sh

@@ -6,9 +6,18 @@
 set -e  # Exit on any error
 
 # Configuration
-# Use vaultAgentUrl which points to vault-agent-cron proxy
-# The agent automatically injects the authentication token
-VAULT_ADDR="${vaultAgentUrl:-http://vault-agent-cron:8203}"
+# Resolve Vault Agent URL:
+# 1. Use vaultAgentUrl env var if set (from container env or CronManager request)
+# 2. Auto-detect Kubernetes via KUBERNETES_SERVICE_HOST (injected by kubelet, cannot be disabled)
+# 3. Auto-detect Kubernetes via service account token (mounted by default in every pod)
+# 4. Fallback to Docker Compose hostname
+if [ -n "$vaultAgentUrl" ]; then
+    VAULT_ADDR="$vaultAgentUrl"
+elif [ -n "$KUBERNETES_SERVICE_HOST" ] || [ -f "/var/run/secrets/kubernetes.io/serviceaccount/token" ]; then
+    VAULT_ADDR="http://localhost:8203"
+else
+    VAULT_ADDR="http://vault-agent-cron:8203"
+fi
 
 # Logging function
 log() {
@@ -169,4 +178,4 @@ delete_llm_secrets
 # Delete embedding secrets
 delete_embedding_secrets
 
-log "=== Vault secrets deletion completed ==="
+log "=== Vault secrets deletion completed ==="

DSL/CronManager/script/store_secrets_in_vault.sh

@@ -6,9 +6,20 @@
 set -e  # Exit on any error
 
 # Configuration
-# Use vaultAgentUrl which points to vault-agent-cron proxy
-# The agent automatically injects the authentication token
-VAULT_ADDR="${vaultAgentUrl:-http://vault-agent-cron:8203}"
+# Resolve Vault Agent URL:
+# 1. Use vaultAgentUrl env var if set (from container env or CronManager request)
+# 2. Auto-detect Kubernetes via KUBERNETES_SERVICE_HOST (injected by kubelet, cannot be disabled)
+# 3. Auto-detect Kubernetes via service account token (mounted by default in every pod)
+# 4. Fallback to Docker Compose hostname
+if [ -n "$vaultAgentUrl" ]; then
+    VAULT_ADDR="$vaultAgentUrl"
+elif [ -n "$KUBERNETES_SERVICE_HOST" ] || [ -f "/var/run/secrets/kubernetes.io/serviceaccount/token" ]; then
+    VAULT_ADDR="http://localhost:8203"
+else
+    VAULT_ADDR="http://vault-agent-cron:8203"
+fi
+
+echo "DEBUG: VAULT_ADDR=$VAULT_ADDR vaultAgentUrl=$vaultAgentUrl KUBERNETES_SERVICE_HOST=$KUBERNETES_SERVICE_HOST"
 
 # Decryption Configuration
 PRIVATE_KEY_CACHE=""

kubernetes/Chart.yaml

@@ -113,4 +113,7 @@ dependencies:
     version: 0.1.0
     repository: "file://./charts/Notifications-Node"
     condition: Notifications-Node.enabled
-
+  - name: OpenSearch
+    version: 0.1.0
+    repository: "file://./charts/OpenSearch"
+    condition: OpenSearch.enabled

kubernetes/LANGFUSE_SETUP.md

@@ -51,9 +51,12 @@ kubectl cp store-langfuse-secrets.sh rag-module/vault-0:/tmp/store-langfuse-secr
 kubectl exec -n your-namespace vault-0 -- sh -c \
   "LANGFUSE_INIT_PROJECT_PUBLIC_KEY=pk-lf-YOUR_KEY \
    LANGFUSE_INIT_PROJECT_SECRET_KEY=sk-lf-YOUR_KEY \
+   LANGFUSE_HOST=http://langfuse-web:3005 \
    sh /tmp/store-langfuse-secrets.sh"
 ```
 
 Replace `pk-lf-YOUR_KEY` and `sk-lf-YOUR_KEY` with the actual keys from step 3.
 
-The script stores them at `secret/data/langfuse/config` in Vault, where the LLM Orchestration Service reads them.
+> **Note:** In Kubernetes, the Langfuse-Web service port is `3005` (mapped to container port 3000), so `LANGFUSE_HOST` must be set explicitly. In Docker Compose, the default (`http://langfuse-web:3000`) is used automatically.
+
+The script stores them at `secret/data/langfuse/config` in Vault, where the LLM Orchestration Service reads them.

kubernetes/charts/CronManager/templates/deployment-byk-cronmanager.yaml

@@ -36,6 +36,14 @@ spec:
             mountPath: /app/scripts
           - name: vector-indexer
             mountPath: /app/src/vector_indexer
+          - name: tool-classifier
+            mountPath: /app/src/tool_classifier
+          - name: intent-data-enrichment
+            mountPath: /app/src/intent_data_enrichment
+          - name: api-tool-indexer
+            mountPath: /app/src/api_tool_indexer
+          - name: src-utils
+            mountPath: /app/src/utils
           command:
             - sh
             - -c
@@ -45,12 +53,20 @@ spec:
                 mkdir -p /app/src/vector_indexer &&
                 mkdir -p /app/scripts &&
                 mkdir -p /DSL &&
-                mkdir -p /app/src/utils
+                mkdir -p /app/src/utils &&
+                mkdir -p /app/src/tool_classifier &&
+                mkdir -p /app/src/intent_data_enrichment &&
+                mkdir -p /app/src/api_tool_indexer
                 
                 cp -r /tmp/rag/DSL/CronManager/DSL/* /DSL/ &&
                 cp -r /tmp/rag/DSL/CronManager/script/* /app/scripts/ &&
                 cp -r /tmp/rag/src/vector_indexer/* /app/src/vector_indexer/ &&
-                cp -r /tmp/rag/src/utils/decrypt_vault_secrets.py /app/src/utils/ &&
+                cp -r /tmp/rag/src/tool_classifier/* /app/src/tool_classifier/ &&
+                cp -r /tmp/rag/src/intent_data_enrichment/* /app/src/intent_data_enrichment/ &&
+                cp -r /tmp/rag/src/api_tool_indexer/* /app/src/api_tool_indexer/ &&
+                cp /tmp/rag/src/utils/decrypt_vault_secrets.py /app/src/utils/ &&
+                cp /tmp/rag/src/__init__.py /app/src/__init__.py &&
+                cp /tmp/rag/grafana-configs/loki_logger.py /app/src/vector_indexer/loki_logger.py &&
                 
                 # Set execute permissions on all shell scripts
                 chmod +x /app/scripts/*.sh &&
@@ -91,7 +107,7 @@ spec:
               value: {{ .Values.cronmanager.environment.pythonPath | quote }}
             {{- if .Values.vaultAgent.enabled }}
             # Vault Agent proxy URL (localhost sidecar)
-            - name: VAULT_AGENT_URL
+            - name: vaultAgentUrl
               value: "http://localhost:8203"
             {{- end }}
             - name: RAG_MODULE_RUUTER_PRIVATE
@@ -112,6 +128,14 @@ spec:
               mountPath: /app/scripts
             - name: vector-indexer
               mountPath: /app/src/vector_indexer
+            - name: tool-classifier
+              mountPath: /app/src/tool_classifier
+            - name: intent-data-enrichment
+              mountPath: /app/src/intent_data_enrichment
+            - name: api-tool-indexer
+              mountPath: /app/src/api_tool_indexer
+            - name: src-utils
+              mountPath: /app/src/utils
             - name: datasets
               mountPath: /app/datasets
 
@@ -122,8 +146,16 @@ spec:
           emptyDir: {}
         - name: vector-indexer
           emptyDir: {}
+        - name: tool-classifier
+          emptyDir: {}
+        - name: intent-data-enrichment
+          emptyDir: {}
+        - name: api-tool-indexer
+          emptyDir: {}
         - name: datasets
           emptyDir: {}
+        - name: src-utils
+          emptyDir: {}
         - name: cronmanager-data
           persistentVolumeClaim:
             claimName: "{{ .Values.release_name }}-data"

kubernetes/charts/CronManager/values.yaml

@@ -11,7 +11,7 @@ cronmanager:
 
   environment:
     containerPort: "8080"
-    pythonPath: "/app:/app/src/vector_indexer"
+    pythonPath: "/app:/app/src:/app/src/vector_indexer:/app/src/intent_data_enrichment:/app/src/api_tool_indexer"
     VAULT_ADDR: "http://vault:8200"
 
 service:

kubernetes/charts/GUI/templates/configmap-vite-config.yaml

@@ -45,6 +45,21 @@ data:
             'Content-Security-Policy': process.env.REACT_APP_CSP,
           }),
         },
+        proxy: {
+          '/vault-agent-gui': {
+            target: 'http://localhost:8202',
+            changeOrigin: true,
+            rewrite: (path) => path.replace(/^\/vault-agent-gui/, ''),
+          },
+          '/sse': {
+            target: 'http://notifications-node:4040',
+            changeOrigin: true,
+          },
+          '/channels': {
+            target: 'http://notifications-node:4040',
+            changeOrigin: true,
+          },
+        },
       },
       resolve: {
         alias: {
@@ -53,4 +68,4 @@ data:
         },
       },
     });
-{{- end }}
+{{- end }}

kubernetes/charts/GUI/values.yaml

@@ -14,10 +14,10 @@ gui:
 
     #service URLs 
     services:
-      ruuterPublic: "http://<your-domain>/ruuter-public"
-      ruuterPrivate: "http://<your-domain>/ruuter-private"
-      authenticationLayer: "http://<your-domain>"
-      notificationNode: "http://notifications-node:4040"
+      ruuterPublic: "http://localhost:8086"
+      ruuterPrivate: "http://localhost:8088"
+      authenticationLayer: "http://localhost:3004"
+      notificationNode: "http://localhost:3003"
       datasetGenerator: "http://dataset-gen-service:8000"
 
     # Content Security Policy - Updated for browser access
@@ -33,7 +33,7 @@ gui:
 
     # Ingress host
     ingress:
-      host: "<your-domain>"  # Update with actual domain
+      host: "localhost"  # Update with actual domain
 
     resources:
       limits:
@@ -52,20 +52,4 @@ gui:
 
 # Vault Agent sidecar configuration
 vaultAgent:
-  enabled: true
-  
-    
-    # ingress:
-    #   enabled: true
-    #   className: nginx
-    #   annotations:
-    #     nginx.ingress.kubernetes.io/rewrite-target: /
-    #     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    #     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    #     nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    #   hosts:
-    #     - host: rag.local
-    #       paths:
-    #         - path: /
-    #           pathType: Prefix
-    #   tls: []
+  enabled: true

kubernetes/charts/LLM-Orchestration-Service/templates/deployment-byk-llm-orchestration.yaml

@@ -21,6 +21,7 @@ spec:
       initContainers:
         - name: volume-init
           image: "{{ .Values.initContainer.image.repository }}:{{ .Values.initContainer.image.tag }}"
+          imagePullPolicy: {{ .Values.initContainer.image.pullPolicy }}
           command:
             - sh
             - -c
@@ -146,6 +147,11 @@ spec:
             - name: logs-volume
               mountPath: {{ .Values.volumes.logs.mountPath }}
             {{- end }}
+            {{- if .Values.vaultAgent.enabled }}
+            - name: vault-agent-llm-token
+              mountPath: /agent/llm-token
+              readOnly: true
+            {{- end }}
 
           resources:
             requests:

kubernetes/charts/LLM-Orchestration-Service/values.yaml

@@ -50,6 +50,7 @@ initContainer:
   image: 
     repository: "ghcr.io/buerokratt/llm-orchestration-service"  # Update with actual llm-orchestration image repository
     tag: "latest"
+    pullPolicy: "IfNotPresent"
   # InitContainer will prepare the runtime volumes
   prepareVolumes: true
 
@@ -73,9 +74,22 @@ healthcheck:
   # Additional readiness checks
   readinessPath: "/ready"
 
+# Environment variables injected into the LLM container
+# Redis defaults match the in-cluster Redis service (see Redis chart)
+env:
+  REDIS_HOST: "redis"
+  REDIS_PORT: "6379"
+  REDIS_AUTH: "myredissecret"
+  REDIS_SESSION_DB: "0"
+  VAULT_AGENT_PROXY: "true"
+  TOOL_CLASSIFIER_ENABLED: "true"
+  SERVICE_WORKFLOW_ENABLED: "true"
+  API_TOOL_CALLING_WORKFLOW_ENABLED: "true"
+  CONTEXT_WORKFLOW_ENABLED: "true"
+  MULTI_INTENT_ENABLED: "true"
+
 # Vault Agent sidecar configuration
 # WHY: LLM Orchestration needs read access to encrypted LLM API keys
 # Security: Agent enforces policy - read-only access to LLM secrets
 vaultAgent:
-  enabled: true
-
+  enabled: true