Skip to content

Commit 00cd2bd

Browse files
CataldirCataldir
authored
fix(infra): entra auth for CRUD, Phase 2 migration for truth-enrichment/hitl (#892)
fix(infra): entra auth for CRUD, Phase 2 migration for truth-enrichment/hitl
1 parent 3aaa3b5 commit 00cd2bd

7 files changed

Lines changed: 279 additions & 6 deletions

File tree

‎.infra/azd/hooks/render-helm.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ if ($isAgentService) {
302302
}
303303
}
304304

305-
$resolvedPostgresAuthMode = if ($env:POSTGRES_AUTH_MODE) { $env:POSTGRES_AUTH_MODE } else { 'password' }
305+
$resolvedPostgresAuthMode = if ($env:POSTGRES_AUTH_MODE) { $env:POSTGRES_AUTH_MODE } else { 'entra' }
306306
$resolvedPostgresUser = $env:POSTGRES_USER
307307
$postgresAdminUser = $env:POSTGRES_ADMIN_USER
308308

‎.infra/azd/hooks/render-helm.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ if is_agent_service; then
302302
fi
303303
fi
304304

305-
RESOLVED_POSTGRES_AUTH_MODE="${POSTGRES_AUTH_MODE:-password}"
305+
RESOLVED_POSTGRES_AUTH_MODE="${POSTGRES_AUTH_MODE:-entra}"
306306
RESOLVED_POSTGRES_USER="${POSTGRES_USER:-}"
307307
POSTGRES_ADMIN_USER_VALUE="${POSTGRES_ADMIN_USER:-}"
308308

‎.kubernetes/releases/agents/kustomization.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,5 @@ kind: Kustomization
66
# Migrated services are removed from .kubernetes/rendered/agents/kustomization.yaml.
77
resources:
88
- ecommerce-catalog-search.yaml
9+
- truth-enrichment.yaml
10+
- truth-hitl.yaml

‎.kubernetes/releases/agents/truth-enrichment.yaml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
apiVersion: helm.toolkit.fluxcd.io/v2
2+
kind: HelmRelease
3+
metadata:
4+
name: truth-enrichment
5+
namespace: flux-system
6+
spec:
7+
targetNamespace: holiday-peak-agents
8+
releaseName: truth-enrichment
9+
interval: 5m
10+
timeout: 10m
11+
chart:
12+
spec:
13+
chart: .kubernetes/chart
14+
sourceRef:
15+
kind: GitRepository
16+
name: holiday-peak-gitops
17+
namespace: flux-system
18+
interval: 5m
19+
# Upgrade strategy — force recreate on value changes for dev
20+
upgrade:
21+
remediation:
22+
retries: 3
23+
install:
24+
createNamespace: false
25+
remediation:
26+
retries: 3
27+
values:
28+
serviceName: truth-enrichment
29+
30+
serviceAccount:
31+
create: true
32+
clientId: "e9c11fac-45b3-4057-8477-1d96703eaae4"
33+
34+
image:
35+
repository: holidaypeakhub405devacr.azurecr.io/holiday-peak-hub/truth-enrichment-dev
36+
tag: azd-deploy-1775350057
37+
38+
replicaCount: 2
39+
40+
resources:
41+
limits:
42+
cpu: 500m
43+
memory: 512Mi
44+
requests:
45+
cpu: 250m
46+
memory: 256Mi
47+
48+
nodeSelector:
49+
agentpool: agents
50+
51+
tolerations:
52+
- key: workload
53+
operator: Equal
54+
value: agents
55+
effect: NoSchedule
56+
57+
availability:
58+
strategy:
59+
type: RollingUpdate
60+
rollingUpdate:
61+
maxUnavailable: 25%
62+
maxSurge: 25%
63+
64+
pdb:
65+
enabled: false
66+
67+
keda:
68+
enabled: false
69+
70+
agc:
71+
enabled: true
72+
gatewayClassName: azure-alb-external
73+
hostnames:
74+
- "esbcc8bcfyazbbdg.fz03.alb.azure.com"
75+
parentRefs:
76+
- name: holiday-peak-agc
77+
namespace: holiday-peak-crud
78+
paths:
79+
- path: /truth-enrichment
80+
pathType: PathPrefix
81+
rewriteTo: /
82+
83+
# --------------- Environment Variables ---------------
84+
env:
85+
# --- Identity ---
86+
AZURE_CLIENT_ID: "e9c11fac-45b3-4057-8477-1d96703eaae4"
87+
AZURE_TENANT_ID: "16b3c013-d300-468d-ac64-7eda0820b6d3"
88+
KEY_VAULT_URI: "https://holidaypeakhub405-dev-kv.vault.azure.net/"
89+
90+
# --- AI Search ---
91+
AI_SEARCH_AUTH_MODE: "managed_identity"
92+
AI_SEARCH_ENDPOINT: "https://holidaypeakhub405devsearch.search.windows.net"
93+
AI_SEARCH_INDEX: "catalog-products"
94+
AI_SEARCH_INDEXER_NAME: "search-enriched-products-indexer"
95+
AI_SEARCH_VECTOR_INDEX: "product_search_index"
96+
97+
# --- Foundry ---
98+
PROJECT_ENDPOINT: "https://holidaypeakhub405devais.services.ai.azure.com/api/projects/aipholidaris"
99+
PROJECT_NAME: "aipholidaris"
100+
MODEL_DEPLOYMENT_NAME_FAST: "gpt-5-nano"
101+
MODEL_DEPLOYMENT_NAME_RICH: "gpt-5"
102+
FOUNDRY_AGENT_NAME_FAST: "truth-enrichment-fast"
103+
FOUNDRY_AGENT_NAME_RICH: "truth-enrichment-rich"
104+
FOUNDRY_AUTO_ENSURE_ON_STARTUP: "true"
105+
FOUNDRY_STREAM: "true"
106+
AGENT_FOUNDRY_INVOKE_TIMEOUT_SECONDS: "60"
107+
FOUNDRY_STRICT_ENFORCEMENT: "false"
108+
109+
# --- Embeddings ---
110+
EMBEDDING_DEPLOYMENT_NAME: "text-embedding-3-large"
111+
112+
# --- Data Layer ---
113+
COSMOS_ACCOUNT_URI: "https://holidaypeakhub405-dev-cosmos.documents.azure.com:443/"
114+
COSMOS_DATABASE: "holiday-peak-db"
115+
COSMOS_CONTAINER: "agent-memory"
116+
BLOB_ACCOUNT_URL: "https://holidaypeakhub405devstor.blob.core.windows.net"
117+
BLOB_CONTAINER: "agent-memory"
118+
TRUTH_PRODUCT_BLOB_CONTAINER: "products"
119+
REDIS_HOST: "holidaypeakhub405-dev-redis.redis.cache.windows.net"
120+
REDIS_PASSWORD_SECRET_NAME: "redis-primary-key"
121+
122+
# --- PostgreSQL ---
123+
POSTGRES_AUTH_MODE: "entra"
124+
POSTGRES_DATABASE: "holiday_peak_crud"
125+
POSTGRES_HOST: "holidaypeakhub405-dev-postgres.postgres.database.azure.com"
126+
POSTGRES_PORT: "5432"
127+
POSTGRES_SSL: "true"
128+
POSTGRES_USER: "holidaypeakhub405-dev-crud-identity"
129+
130+
# --- Event Hub ---
131+
PLATFORM_JOBS_EVENT_HUB_NAMESPACE: "holidaypeakhub405-dev-jobs-eh"
132+
TRUTH_EVENT_HUB_CONSUMER_GROUP: "enrichment-engine"
133+
TRUTH_EVENT_HUB_NAME: "enrichment-jobs"
134+
135+
# --- Catalog-Search Specific ---
136+
CATALOG_SEARCH_REQUIRE_AI_SEARCH: "true"

‎.kubernetes/releases/agents/truth-hitl.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
apiVersion: helm.toolkit.fluxcd.io/v2
2+
kind: HelmRelease
3+
metadata:
4+
name: truth-hitl
5+
namespace: flux-system
6+
spec:
7+
targetNamespace: holiday-peak-agents
8+
releaseName: truth-hitl
9+
interval: 5m
10+
timeout: 10m
11+
chart:
12+
spec:
13+
chart: .kubernetes/chart
14+
sourceRef:
15+
kind: GitRepository
16+
name: holiday-peak-gitops
17+
namespace: flux-system
18+
interval: 5m
19+
# Upgrade strategy — force recreate on value changes for dev
20+
upgrade:
21+
remediation:
22+
retries: 3
23+
install:
24+
createNamespace: false
25+
remediation:
26+
retries: 3
27+
values:
28+
serviceName: truth-hitl
29+
30+
serviceAccount:
31+
create: true
32+
clientId: "e9c11fac-45b3-4057-8477-1d96703eaae4"
33+
34+
image:
35+
repository: holidaypeakhub405devacr.azurecr.io/holiday-peak-hub/truth-hitl-dev
36+
tag: azd-deploy-1775350566
37+
38+
replicaCount: 2
39+
40+
resources:
41+
limits:
42+
cpu: 500m
43+
memory: 512Mi
44+
requests:
45+
cpu: 250m
46+
memory: 256Mi
47+
48+
nodeSelector:
49+
agentpool: agents
50+
51+
tolerations:
52+
- key: workload
53+
operator: Equal
54+
value: agents
55+
effect: NoSchedule
56+
57+
availability:
58+
strategy:
59+
type: RollingUpdate
60+
rollingUpdate:
61+
maxUnavailable: 25%
62+
maxSurge: 25%
63+
64+
pdb:
65+
enabled: false
66+
67+
keda:
68+
enabled: false
69+
70+
agc:
71+
enabled: true
72+
gatewayClassName: azure-alb-external
73+
hostnames:
74+
- "esbcc8bcfyazbbdg.fz03.alb.azure.com"
75+
parentRefs:
76+
- name: holiday-peak-agc
77+
namespace: holiday-peak-crud
78+
paths:
79+
- path: /truth-hitl
80+
pathType: PathPrefix
81+
rewriteTo: /
82+
83+
# --------------- Environment Variables ---------------
84+
env:
85+
# --- Identity ---
86+
AZURE_CLIENT_ID: "e9c11fac-45b3-4057-8477-1d96703eaae4"
87+
AZURE_TENANT_ID: "16b3c013-d300-468d-ac64-7eda0820b6d3"
88+
KEY_VAULT_URI: "https://holidaypeakhub405-dev-kv.vault.azure.net/"
89+
90+
# --- AI Search ---
91+
AI_SEARCH_AUTH_MODE: "managed_identity"
92+
AI_SEARCH_ENDPOINT: "https://holidaypeakhub405devsearch.search.windows.net"
93+
AI_SEARCH_INDEX: "catalog-products"
94+
AI_SEARCH_INDEXER_NAME: "search-enriched-products-indexer"
95+
AI_SEARCH_VECTOR_INDEX: "product_search_index"
96+
97+
# --- Foundry ---
98+
PROJECT_ENDPOINT: "https://holidaypeakhub405devais.services.ai.azure.com/api/projects/aipholidaris"
99+
PROJECT_NAME: "aipholidaris"
100+
MODEL_DEPLOYMENT_NAME_FAST: "gpt-5-nano"
101+
MODEL_DEPLOYMENT_NAME_RICH: "gpt-5"
102+
FOUNDRY_AGENT_NAME_FAST: "truth-hitl-fast"
103+
FOUNDRY_AGENT_NAME_RICH: "truth-hitl-rich"
104+
FOUNDRY_AUTO_ENSURE_ON_STARTUP: "true"
105+
FOUNDRY_STREAM: "true"
106+
AGENT_FOUNDRY_INVOKE_TIMEOUT_SECONDS: "60"
107+
FOUNDRY_STRICT_ENFORCEMENT: "false"
108+
109+
# --- Embeddings ---
110+
EMBEDDING_DEPLOYMENT_NAME: "text-embedding-3-large"
111+
112+
# --- Data Layer ---
113+
COSMOS_ACCOUNT_URI: "https://holidaypeakhub405-dev-cosmos.documents.azure.com:443/"
114+
COSMOS_DATABASE: "holiday-peak-db"
115+
COSMOS_CONTAINER: "agent-memory"
116+
BLOB_ACCOUNT_URL: "https://holidaypeakhub405devstor.blob.core.windows.net"
117+
BLOB_CONTAINER: "agent-memory"
118+
REDIS_HOST: "holidaypeakhub405-dev-redis.redis.cache.windows.net"
119+
REDIS_PASSWORD_SECRET_NAME: "redis-primary-key"
120+
121+
# --- PostgreSQL ---
122+
POSTGRES_AUTH_MODE: "entra"
123+
POSTGRES_DATABASE: "holiday_peak_crud"
124+
POSTGRES_HOST: "holidaypeakhub405-dev-postgres.postgres.database.azure.com"
125+
POSTGRES_PORT: "5432"
126+
POSTGRES_SSL: "true"
127+
POSTGRES_USER: "holidaypeakhub405-dev-crud-identity"
128+
129+
# --- Event Hub ---
130+
PLATFORM_JOBS_EVENT_HUB_NAMESPACE: "holidaypeakhub405-dev-jobs-eh"
131+
TRUTH_EVENT_HUB_CONSUMER_GROUP: "hitl-service"
132+
TRUTH_EVENT_HUB_NAME: "hitl-jobs"
133+
134+
# --- Catalog-Search Specific ---
135+
CATALOG_SEARCH_REQUIRE_AI_SEARCH: "true"

‎.kubernetes/rendered/agents/kustomization.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ resources:
2424
- ../product-management-consistency-validation/all.yaml
2525
- ../product-management-normalization-classification/all.yaml
2626
- ../search-enrichment-agent/all.yaml
27-
- ../truth-enrichment/all.yaml
27+
# truth-enrichment: migrated to HelmRelease (Phase 2)
2828
- ../truth-export/all.yaml
29-
- ../truth-hitl/all.yaml
29+
# truth-hitl: migrated to HelmRelease (Phase 2)
3030
- ../truth-ingestion/all.yaml
3131

3232
# Phase 2: Flux HelmRelease-based deployments (migrated from rendered YAML)

‎.kubernetes/rendered/crud-service/all.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ spec:
112112
- name: MODEL_DEPLOYMENT_NAME_RICH
113113
value: "gpt-5"
114114
- name: POSTGRES_AUTH_MODE
115-
value: "password"
115+
value: "entra"
116116
- name: POSTGRES_DATABASE
117117
value: "holiday_peak_crud"
118118
- name: POSTGRES_HOST
@@ -122,7 +122,7 @@ spec:
122122
- name: POSTGRES_SSL
123123
value: "true"
124124
- name: POSTGRES_USER
125-
value: "crud_admin"
125+
value: "holidaypeakhub405-dev-crud-identity"
126126
- name: PROJECT_ENDPOINT
127127
value: "https://holidaypeakhub405devais.services.ai.azure.com/api/projects/aipholidaris"
128128
- name: PROJECT_NAME

0 commit comments

Comments
 (0)