apiVersion: apps/v1
kind: Deployment
metadata: {name: knowledge, namespace: enkly, labels: {app: knowledge}}
spec:
  replicas: 1
  selector: {matchLabels: {app: knowledge}}
  template:
    metadata: {labels: {app: knowledge}}
    spec:
      imagePullSecrets: [{name: enkly-registry}]
      containers:
        - name: knowledge
          image: registry.enkly.org/enkly/knowledge:latest
          ports: [{name: grpc, containerPort: 9005}]
          envFrom: [{configMapRef: {name: enkly-config}}]
          env:
            - name: POSTGRES_PASSWORD
              valueFrom: {secretKeyRef: {name: enkly-secrets, key: POSTGRES_PASSWORD}}
            - {name: ENKLY_KNOWLEDGE_POSTGRES_DSN, value: "postgres://enkly:$(POSTGRES_PASSWORD)@knowledge-db:5432/enkly_knowledge?sslmode=disable"}
            # Bearer token knowledge authenticates to vllm-embed with
            # (see services/knowledge/cmd/server/main.go) — without
            # this, embedding calls 401 against vllm-embed's --api-key.
            - name: ENKLY_VLLM_API_KEY
              valueFrom: {secretKeyRef: {name: enkly-secrets, key: ENKLY_VLLM_API_KEY}}
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {cpu: 1, memory: 512Mi}
          readinessProbe: {grpc: {port: 9005}, initialDelaySeconds: 5, periodSeconds: 10, failureThreshold: 10}
          livenessProbe: {grpc: {port: 9005}, initialDelaySeconds: 15, periodSeconds: 20, failureThreshold: 6}
---
apiVersion: v1
kind: Service
metadata: {name: knowledge, namespace: enkly, labels: {app: knowledge}}
spec:
  selector: {app: knowledge}
  ports: [{name: grpc, port: 9005, targetPort: grpc}]