turtlecode.yaml

# TurtleCode on k3s.
# - redis: in-cluster queue with a local-path PVC (AOF persistence).
# - ollama: in-cluster model server with a persistent model volume (codellama).
# - turtlecode-web: producer (webhook receiver), ClusterIP Service on :3000 (tunnel origin).
# - turtlecode-worker: consumer; reaches ollama + redis via cluster DNS.
# All pods pinned to node "black" (local registry + local-path PVCs are node-local there).
# Secret `turtlecode-secrets` (GITHUB_TOKEN, GITHUB_WEBHOOK_SECRET) is created out-of-band via kubectl.
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: redis-data
  namespace: turtlecode
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: local-path
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  namespace: turtlecode
spec:
  replicas: 1
  strategy:
    type: Recreate            # single writer over a RWO volume
  selector:
    matchLabels: { app: redis }
  template:
    metadata:
      labels: { app: redis }
    spec:
      nodeSelector:
        kubernetes.io/hostname: black
      containers:
        - name: redis
          image: docker.io/redis:7-alpine
          args: ["redis-server", "--appendonly", "yes"]
          ports:
            - containerPort: 6379
          volumeMounts:
            - name: data
              mountPath: /data
          readinessProbe:
            exec: { command: ["redis-cli", "ping"] }
            initialDelaySeconds: 2
            periodSeconds: 5
          resources:
            requests: { cpu: "25m", memory: "32Mi" }
            limits:   { cpu: "500m", memory: "256Mi" }
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: redis-data
---
apiVersion: v1
kind: Service
metadata:
  name: redis
  namespace: turtlecode
spec:
  selector: { app: redis }
  ports:
    - port: 6379
      targetPort: 6379
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ollama-models
  namespace: turtlecode
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: local-path
  resources:
    requests:
      storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ollama
  namespace: turtlecode
spec:
  replicas: 1
  strategy:
    type: Recreate            # single writer over a RWO volume
  selector:
    matchLabels: { app: ollama }
  template:
    metadata:
      labels: { app: ollama }
    spec:
      nodeSelector:
        kubernetes.io/hostname: black
      containers:
        - name: ollama
          image: docker.io/ollama/ollama:latest
          env:
            - { name: OLLAMA_HOST, value: "0.0.0.0:11434" }   # listen on all interfaces in-pod
          ports:
            - containerPort: 11434
          volumeMounts:
            - name: models
              mountPath: /root/.ollama
          readinessProbe:
            httpGet: { path: /api/tags, port: 11434 }
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests: { cpu: "500m", memory: "2Gi" }
            limits:   { cpu: "6", memory: "8Gi" }
      volumes:
        - name: models
          persistentVolumeClaim:
            claimName: ollama-models
---
apiVersion: v1
kind: Service
metadata:
  name: ollama
  namespace: turtlecode
spec:
  selector: { app: ollama }
  ports:
    - port: 11434
      targetPort: 11434
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: turtlecode-web
  namespace: turtlecode
spec:
  replicas: 1
  selector:
    matchLabels: { app: turtlecode-web }
  template:
    metadata:
      labels: { app: turtlecode-web }
    spec:
      nodeSelector:
        kubernetes.io/hostname: black
      terminationGracePeriodSeconds: 30
      containers:
        - name: web
          image: localhost:5000/turtlecode:0.1.1
          imagePullPolicy: IfNotPresent
          env:
            - { name: ROLE, value: "web" }
            - { name: PORT, value: "3000" }
            - { name: REDIS_URL, value: "redis://redis:6379" }
          envFrom:
            - secretRef: { name: turtlecode-secrets }   # GITHUB_WEBHOOK_SECRET (+ token, harmless)
          ports:
            - containerPort: 3000
          readinessProbe:
            httpGet: { path: /healthz, port: 3000 }
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /healthz, port: 3000 }
            initialDelaySeconds: 10
            periodSeconds: 20
          resources:
            requests: { cpu: "50m", memory: "64Mi" }
            limits:   { cpu: "500m", memory: "256Mi" }
---
apiVersion: v1
kind: Service
metadata:
  name: turtlecode-web
  namespace: turtlecode
spec:
  selector: { app: turtlecode-web }
  ports:
    - port: 3000
      targetPort: 3000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: turtlecode-worker
  namespace: turtlecode
spec:
  replicas: 1
  selector:
    matchLabels: { app: turtlecode-worker }
  template:
    metadata:
      labels: { app: turtlecode-worker }
    spec:
      nodeSelector:
        kubernetes.io/hostname: black
      terminationGracePeriodSeconds: 30
      containers:
        - name: worker
          image: localhost:5000/turtlecode:0.1.1
          imagePullPolicy: IfNotPresent
          env:
            - { name: ROLE, value: "worker" }
            - { name: REDIS_URL, value: "redis://redis:6379" }
            - { name: OLLAMA_BASE_URL, value: "http://ollama:11434" }
            - { name: LLM_MODEL, value: "codellama" }
            - { name: WORKER_CONCURRENCY, value: "2" }
          envFrom:
            - secretRef: { name: turtlecode-secrets }   # GITHUB_TOKEN (+ webhook secret)
          resources:
            requests: { cpu: "50m", memory: "96Mi" }
            limits:   { cpu: "1000m", memory: "512Mi" }