feat: restructure deployment into Kustomize base/overlays

.github/workflows/build-base-image.yml

@@ -213,6 +213,25 @@ jobs:
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
 
+      - name: Update deployment image tag
+        if: github.event_name != 'pull_request'
+        run: |
+          cd deployment/base
+          TAG="${{ steps.version.outputs.version }}"
+          sed -i "s|newTag:.*|newTag: ${TAG}|" kustomization.yaml
+          echo "Updated deployment image tag to: ${TAG}"
+          cat kustomization.yaml | grep -A2 'images:'
+
+      - name: Commit deployment tag update
+        if: github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/')
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add deployment/base/kustomization.yaml
+          git diff --cached --quiet && echo "No changes to commit" && exit 0
+          git commit -m "chore: update deployment image tag to ${{ steps.version.outputs.version }}"
+          git push origin HEAD:${{ github.ref_name }}
+
       - name: Create deployment package metadata
         if: github.event_name != 'pull_request'
         run: |

deployment/base/configmap.yaml

@@ -3,9 +3,15 @@ kind: ConfigMap
 metadata:
   name: agent-config
 data:
-  # Config Path (required for base image pattern)
-  # Config path — mount config/agent at this path (see Containerfile)
   CONFIG_PATH: "/app/config/agent"
-
-  # Note: PostgreSQL and Redis environment variables are added by
-  # optional components when postgres or redis components are included
+  AGENT_HOST: "0.0.0.0"
+  AGENT_PORT: "5002"
+  PYTHON_LOG_LEVEL: "INFO"
+  ENVIRONMENT: "production"
+  REQUEST_BODY_MAX_SIZE: "10485760"  # 10MB
+  REQUEST_LOG_BODY_MAX_SIZE: "10240"
+  LANGFUSE_TRACING_ENVIRONMENT: "production"
+  REDIS_URL: ""
+  POSTGRES_HOST: ""
+  POSTGRES_PORT: "5432"
+  POSTGRES_DB: "template_agent"

deployment/overlays/openshift/deployment.yaml → deployment/base/deployment.yaml

@@ -24,15 +24,35 @@ spec:
     spec:
       serviceAccountName: agent
       terminationGracePeriodSeconds: 60
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: agent
+                    component: agent
+                topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: agent
+              component: agent
       containers:
         - name: agent
-          image: agent:latest
+          image: ghcr.io/redhat-data-and-ai/template-agent:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 5002
               name: http
               protocol: TCP
           env:
+            - name: PYTHONUNBUFFERED
+              value: "1"
             - name: AGENT_HOST
               valueFrom:
                 configMapKeyRef:
@@ -46,7 +66,7 @@ spec:
             - name: ENABLE_AUTH
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: ENABLE_AUTH
             - name: PYTHON_LOG_LEVEL
               valueFrom:
@@ -137,6 +157,8 @@ spec:
                   name: agent-secrets
                   key: VLLM_API_KEY
                   optional: true
+            - name: DATABASE_URL
+              value: "postgresql://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)"
             - name: REDIS_URL
               valueFrom:
                 configMapKeyRef:
@@ -157,23 +179,82 @@ spec:
             - name: REQUEST_LOGGING_ENABLED
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: REQUEST_LOGGING_ENABLED
             - name: REQUEST_LOG_HEADERS
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: REQUEST_LOG_HEADERS
             - name: REQUEST_LOG_BODY
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: REQUEST_LOG_BODY
             - name: REQUEST_LOG_BODY_MAX_SIZE
               valueFrom:
                 configMapKeyRef:
                   name: agent-config
                   key: REQUEST_LOG_BODY_MAX_SIZE
+            - name: ENABLE_USER_ID_ENCRYPTION
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: ENABLE_USER_ID_ENCRYPTION
+            - name: ENABLE_OTEL_METRICS
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: ENABLE_OTEL_METRICS
+            - name: ENABLE_OTEL_TRACES
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: ENABLE_OTEL_TRACES
+            - name: PLATFORM_AUDIT_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: PLATFORM_AUDIT_ENABLED
+            - name: MIDDLEWARE_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: MIDDLEWARE_ENABLED
+            - name: REDIS_BROKER_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: REDIS_BROKER_ENABLED
+            - name: CONFIG_AUTO_RELOAD
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: CONFIG_AUTO_RELOAD
+            - name: CACHE_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: CACHE_ENABLED
+            - name: MEMORY_CONSOLIDATION_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: MEMORY_CONSOLIDATION_ENABLED
+            - name: OPA_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: OPA_ENABLED
+            - name: GUARDIAN_SSL_VERIFY
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: GUARDIAN_SSL_VERIFY
+          lifecycle:
+            preStop:
+              exec:
+                command: ["sh", "-c", "sleep 5"]
           securityContext:
             runAsNonRoot: true
             allowPrivilegeEscalation: false
@@ -191,15 +272,13 @@ spec:
             httpGet:
               path: /health
               port: 5002
-            initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
           readinessProbe:
             httpGet:
               path: /health
               port: 5002
-            initialDelaySeconds: 10
             periodSeconds: 5
             timeoutSeconds: 3
             failureThreshold: 3

deployment/base/feature-flags.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: agent-feature-flags
+data:
+  ENABLE_AUTH: "true"
+  ENABLE_USER_ID_ENCRYPTION: "true"
+  ENABLE_OTEL_METRICS: "true"
+  ENABLE_OTEL_TRACES: "true"
+  PLATFORM_AUDIT_ENABLED: "true"
+  REQUEST_LOGGING_ENABLED: "true"
+  REQUEST_LOG_HEADERS: "true"
+  REQUEST_LOG_BODY: "true"
+  MIDDLEWARE_ENABLED: "true"
+  REDIS_BROKER_ENABLED: "true"
+  CONFIG_AUTO_RELOAD: "true"
+  CACHE_ENABLED: "true"
+  CACHE_MODEL_ENABLED: "true"
+  CACHE_PERSONALIZATION_ENABLED: "true"
+  CACHE_METRICS_ENABLED: "true"
+  CACHE_WARMING_ENABLED: "true"
+  CACHE_REDIS_ENABLED: "true"
+  MEMORY_CONSOLIDATION_ENABLED: "true"
+  MEMORY_DECAY_ENABLED: "true"
+  MEMORY_CLUSTERING_ENABLED: "true"
+  MEMORY_RELATIONSHIPS_ENABLED: "true"
+  OPA_ENABLED: "true"
+  GUARDIAN_SSL_VERIFY: "true"

deployment/base/kustomization.yaml

@@ -1,12 +1,19 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-# Core resources - always deployed
-# Postgres and Redis are now optional components
 resources:
+  - serviceaccount.yaml
   - configmap.yaml
+  - feature-flags.yaml
   - secret.yaml
+  - deployment.yaml
+  - service.yaml
 
 labels:
   - pairs:
-      app: template-agent
+      app: agent
+      component: agent
+
+images:
+  - name: ghcr.io/redhat-data-and-ai/template-agent
+    newTag: latest

deployment/base/secret.yaml

@@ -4,23 +4,16 @@ metadata:
   name: agent-secrets
 type: Opaque
 stringData:
-  # PostgreSQL credentials (default for in-cluster deployment)
   POSTGRES_USER: "postgres"
   POSTGRES_PASSWORD: "postgres"
-
-  # SSO / OIDC Authentication
   SSO_ISSUER_URL: ""
   SSO_CLIENT_ID: ""
   SSO_CLIENT_SECRET: ""
-
-  # Langfuse (optional - external service)
   LANGFUSE_PUBLIC_KEY: ""
   LANGFUSE_SECRET_KEY: ""
   LANGFUSE_BASE_URL: ""
-
-  # Google Vertex AI (optional)
   GOOGLE_APPLICATION_CREDENTIALS_CONTENT: ""
-
-  # vLLM / OpenAI-compatible (optional)
   VLLM_BASE_URL: ""
   VLLM_API_KEY: ""
+  SSL_KEYFILE: ""
+  SSL_CERTFILE: ""

deployment/base/serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: agent
+  labels:
+    app: agent
+    component: agent
+automountServiceAccountToken: false