@agents-at-scale/ark 0.1.36 → 0.1.38

package/templates/project/templates/00-rbac.yaml

@@ -0,0 +1,168 @@
+{{/*
+RBAC - Deploy FIRST to ensure permissions are available
+Creates ServiceAccount and necessary RoleBindings for ARK resources
+*/}}
+{{- if .Values.serviceAccount.create }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "{{ .Values.project.name }}.serviceAccountName" . }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-20"
+    "helm.sh/hook-delete-policy": before-hook-creation
+    {{- with .Values.serviceAccount.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-default-permissions
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: agent-viewer-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-default-team-permissions
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: team-viewer-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-default-model-permissions
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: model-viewer-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-secret-reader
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-default-secret-permissions
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-secret-reader
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-agent-viewer
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "{{ .Values.project.name }}.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: agent-viewer-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-team-viewer
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "{{ .Values.project.name }}.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: team-viewer-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "{{ .Values.project.name }}.fullname" . }}-query-admin
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-19"
+    "helm.sh/hook-delete-policy": before-hook-creation
+  labels:
+    {{- include "{{ .Values.project.name }}.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "{{ .Values.project.name }}.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: query-admin-role
+  apiGroup: rbac.authorization.k8s.io

package/templates/project/templates/01-models.yaml

@@ -0,0 +1,11 @@
+{{/*
+Models - Deploy FIRST using pre-install hook
+These resources are deployed before everything else and must be ready before agents can be created
+*/}}
+{{- if not .Values.excludeResources }}
+{{- range $path, $_ := .Files.Glob "models/*.yaml" }}
+---
+{{- $content := $.Files.Get $path }}
+{{- $content | replace "metadata:" "metadata:\n  annotations:\n    \"helm.sh/hook\": pre-install,pre-upgrade\n    \"helm.sh/hook-weight\": \"-10\"\n    \"helm.sh/hook-delete-policy\": before-hook-creation" }}
+{{- end }}
+{{- end }}

package/templates/project/templates/02-mcp-servers.yaml

@@ -0,0 +1,22 @@
+{{/*
+MCP Servers - Deploy after models but before agents
+These resources provide tools and services that agents and teams can use
+They should be deployed before agents so agents can reference them
+*/}}
+{{- if not .Values.excludeResources }}
+{{- range $path, $_ := .Files.Glob "mcp-servers/*/chart/templates/mcpserver.yaml" }}
+---
+{{- $content := $.Files.Get $path }}
+{{- $content | replace "metadata:" "metadata:\n  annotations:\n    \"helm.sh/hook\": pre-install,pre-upgrade\n    \"helm.sh/hook-weight\": \"-5\"\n    \"helm.sh/hook-delete-policy\": before-hook-creation" }}
+{{- end }}
+{{/*
+Also include any standalone MCP server definitions in the mcp-servers directory
+*/}}
+{{- range $path, $_ := .Files.Glob "mcp-servers/*.yaml" }}
+{{- $content := $.Files.Get $path }}
+{{- if contains "kind: MCPServer" $content }}
+---
+{{- $content | replace "metadata:" "metadata:\n  annotations:\n    \"helm.sh/hook\": pre-install,pre-upgrade\n    \"helm.sh/hook-weight\": \"-5\"\n    \"helm.sh/hook-delete-policy\": before-hook-creation" }}
+{{- end }}
+{{- end }}
+{{- end }}

package/templates/project/templates/03-tools.yaml

@@ -0,0 +1,12 @@
+{{/*
+Tools - Deploy after models but before agents
+These resources provide custom tools that agents can use
+They should be deployed before agents so agents can reference them
+*/}}
+{{- if not .Values.excludeResources }}
+{{- range $path, $_ := .Files.Glob "tools/*.yaml" }}
+---
+{{- $content := $.Files.Get $path }}
+{{- $content | replace "metadata:" "metadata:\n  annotations:\n    \"helm.sh/hook\": pre-install,pre-upgrade\n    \"helm.sh/hook-weight\": \"-3\"\n    \"helm.sh/hook-delete-policy\": before-hook-creation" }}
+{{- end }}
+{{- end }}

package/templates/project/templates/04-agents.yaml

@@ -0,0 +1,12 @@
+{{/*
+Agents - Deploy after models, MCP servers, and tools are ready
+These resources depend on models and can reference MCP servers and tools
+Agents must be ready before teams and queries can reference them
+*/}}
+{{- if not .Values.excludeResources }}
+{{- range $path, $_ := .Files.Glob "agents/*.yaml" }}
+---
+{{- $content := $.Files.Get $path }}
+{{- $content | replace "metadata:" "metadata:\n  annotations:\n    \"helm.sh/hook\": pre-install,pre-upgrade\n    \"helm.sh/hook-weight\": \"0\"\n    \"helm.sh/hook-delete-policy\": before-hook-creation" }}
+{{- end }}
+{{- end }}

package/templates/project/templates/05-teams.yaml

@@ -0,0 +1,11 @@
+{{/*
+Teams - Deploy after agents are ready
+Teams depend on agents and should be created after agents but before queries
+*/}}
+{{- if not .Values.excludeResources }}
+{{- range $path, $_ := .Files.Glob "teams/*.yaml" }}
+---
+{{- $content := $.Files.Get $path }}
+{{- $content | replace "metadata:" "metadata:\n  annotations:\n    \"helm.sh/hook\": post-install,post-upgrade\n    \"helm.sh/hook-weight\": \"5\"" }}
+{{- end }}
+{{- end }}

package/templates/project/templates/06-queries.yaml

@@ -0,0 +1,11 @@
+{{/*
+Queries - Deploy LAST after teams and agents are ready
+Queries can reference both teams and agents, so they deploy last
+*/}}
+{{- if not .Values.excludeResources }}
+{{- range $path, $_ := .Files.Glob "queries/*.yaml" }}
+---
+{{- $content := $.Files.Get $path }}
+{{- $content | replace "metadata:" "metadata:\n  annotations:\n    \"helm.sh/hook\": post-install,post-upgrade\n    \"helm.sh/hook-weight\": \"10\"" }}
+{{- end }}
+{{- end }}

package/templates/project/templates/_helpers.tpl

@@ -0,0 +1,91 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "{{ .Values.project.name }}.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "{{ .Values.project.name }}.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "{{ .Values.project.name }}.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "{{ .Values.project.name }}.labels" -}}
+helm.sh/chart: {{ include "{{ .Values.project.name }}.chart" . }}
+{{ include "{{ .Values.project.name }}.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+project: {{ .Values.project.name }}
+{{- with .Values.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "{{ .Values.project.name }}.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "{{ .Values.project.name }}.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "{{ .Values.project.name }}.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "{{ .Values.project.name }}.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Generate image name
+*/}}
+{{- define "{{ .Values.project.name }}.image" -}}
+{{- $registry := .Values.image.registry -}}
+{{- $repository := .repository -}}
+{{- $tag := .Values.image.tag -}}
+{{- printf "%s/%s-%s:%s" $registry .Values.project.name $repository $tag }}
+{{- end }}
+
+{{/*
+Generate model reference
+*/}}
+{{- define "{{ .Values.project.name }}.modelRef" -}}
+{{- if .Values.models.azure.enabled }}
+{{- .Values.models.azure.name }}
+{{- else if .Values.models.openai.enabled }}
+{{- .Values.models.openai.name }}
+{{- else if .Values.models.anthropic.enabled }}
+{{- .Values.models.anthropic.name }}
+{{- else }}
+default
+{{- end }}
+{{- end }}

package/templates/project/tests/e2e/.keep

@@ -0,0 +1,10 @@
+# End-to-End Tests
+
+Add end-to-end tests for your workflows here.
+
+Example:
+```
+tests/e2e/
+├── test_agent_workflow.yaml
+└── test_team_collaboration.yaml
+```

package/templates/project/tests/unit/.keep

@@ -0,0 +1,10 @@
+# Unit Tests
+
+Add unit tests for your custom tools here.
+
+Example:
+```
+tests/unit/
+├── test_my_tool.py
+└── test_agent_logic.py
+```

package/templates/project/tools/.keep

@@ -0,0 +1,25 @@
+# Tools Directory
+
+Add your custom tools here as Kubernetes YAML files.
+
+Each tool should be defined as a YAML file containing the necessary Kubernetes resources:
+- Deployment
+- Service  
+- MCPServer (for MCP integration)
+
+Example structure:
+```
+tools/
+├── my-tool.yaml          # Complete tool definition
+├── data-processor.yaml   # Another tool
+└── examples/             # Example implementations
+    └── data-tool/
+        ├── Dockerfile
+        ├── main.py
+        └── requirements.txt
+```
+
+Tool YAML files will be automatically deployed by the Helm chart.
+
+For complex tools that need their own Helm charts and independent lifecycle, 
+use `ark generate mcp-server` in the `mcp-servers/` directory instead.

package/templates/project/tools/example-tool.yaml.disabled

@@ -0,0 +1,94 @@
+# Example Tool Definition
+# Rename this file to example-tool.yaml to enable it
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "{{ .Values.projectName }}.fullname" . }}-example-tool
+  labels:
+    {{- include "{{ .Values.projectName }}.labels" . | nindent 4 }}
+    component: tool
+    tool: example-tool
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "{{ .Values.projectName }}.selectorLabels" . | nindent 6 }}
+      component: tool
+      tool: example-tool
+  template:
+    metadata:
+      labels:
+        {{- include "{{ .Values.projectName }}.selectorLabels" . | nindent 8 }}
+        component: tool
+        tool: example-tool
+    spec:
+      {{- with .Values.security.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: example-tool
+        image: "{{ .Values.image.registry }}/{{ .Values.project.name }}-example-tool:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        {{- with .Values.security.securityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+        env:
+        - name: PORT
+          value: "8000"
+        - name: TOOL_NAME
+          value: "example-tool"
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "{{ .Values.projectName }}.fullname" . }}-example-tool
+  labels:
+    {{- include "{{ .Values.projectName }}.labels" . | nindent 4 }}
+    component: tool
+    tool: example-tool
+spec:
+  type: ClusterIP
+  ports:
+  - port: 8000
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    {{- include "{{ .Values.projectName }}.selectorLabels" . | nindent 4 }}
+    component: tool
+    tool: example-tool
+
+---
+apiVersion: ark.mckinsey.com/v1alpha1
+kind: MCPServer
+metadata:
+  name: example-tool
+  labels:
+    {{- include "{{ .Values.projectName }}.labels" . | nindent 4 }}
+    component: mcpserver
+    tool: example-tool
+spec:
+  address:
+    valueFrom:
+      serviceRef:
+        name: {{ include "{{ .Values.projectName }}.fullname" . }}-example-tool
+        port: 8000
+        path: /mcp
+  transport: sse
+  timeout: 30s
+  description: "Example tool for demonstration purposes"

package/templates/project/tools/examples/data-tool/Dockerfile

@@ -0,0 +1,32 @@
+FROM python:3.11-slim
+
+# Set working directory
+WORKDIR /app
+
+# Install system dependencies (none needed for this tool)
+# RUN apt-get update && apt-get install -y curl \
+#     && rm -rf /var/lib/apt/lists/*
+
+# Copy requirements
+COPY requirements.txt .
+
+# Install Python dependencies
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy application code
+COPY main.py .
+
+# Create non-root user
+RUN groupadd -r appuser && useradd -r -g appuser appuser
+RUN chown -R appuser:appuser /app
+USER appuser
+
+# Expose port
+EXPOSE 8000
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
+
+# Run the application
+CMD ["python", "main.py", "--port", "8000"]

package/templates/project/values.yaml

@@ -0,0 +1,141 @@
+# Default values for {{ .Values.projectName }}
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# Project configuration
+project:
+  name: {{ .Values.projectName }}
+  namespace: {{ .Values.namespace }}
+
+# Image configuration
+image:
+  registry: localhost:5000
+  tag: latest
+  pullPolicy: IfNotPresent
+
+# Model configurations
+# Models are deployed from the models/ directory
+# Edit files in models/ to configure your model providers
+
+# Agent configurations
+# Agents are deployed from the agents/ directory
+# Edit files in agents/ to configure your agents
+
+# Team configurations
+# Teams are deployed from the teams/ directory
+# Edit files in teams/ to configure your teams
+
+# Query configurations
+# Queries are deployed from the queries/ directory
+# Edit files in queries/ to configure your queries
+
+# Tools configuration
+# Tools are deployed from the tools/ directory as YAML files
+# Each .yaml file in tools/ is automatically deployed
+
+# MCP Servers configuration
+# MCP servers are deployed from the mcp-servers/ directory
+# Use 'ark generate mcp-server <name>' to create new MCP servers
+
+# Memory configuration
+memory:
+  enabled: true
+  name: postgres-memory
+  type: postgres
+  url: "http://postgres-memory:8080"
+
+# Security
+security:
+  # Pod security context
+  podSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    fsGroup: 2000
+
+  # Container security context
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    capabilities:
+      drop:
+        - ALL
+
+# Service configuration
+service:
+  type: ClusterIP
+  port: 8000
+  targetPort: 8000
+
+# Ingress configuration
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: {{ .Values.projectName }}.local
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+
+# Resource defaults
+resources:
+  limits:
+    memory: "1Gi"
+    cpu: "1000m"
+  requests:
+    memory: "512Mi"
+    cpu: "500m"
+
+# Node selection
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+# Monitoring
+monitoring:
+  enabled: false
+  serviceMonitor:
+    enabled: false
+    interval: 30s
+
+# Logging
+logging:
+  level: INFO
+  format: json
+
+# Environment variables
+env: {}
+
+# Additional labels
+labels: {}
+
+# Additional annotations
+annotations: {}
+
+# Service Account configuration
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+# Custom secrets (will be created)
+secrets:
+  {}
+  # example-secret:
+  #   data:
+  #     key: value
+
+# Custom config maps
+configMaps:
+  {}
+  # example-config:
+  #   data:
+  #     config.yaml: |
+  #       key: value

package/templates/query/query.template.yaml

@@ -0,0 +1,13 @@
+apiVersion: ark.mckinsey.com/v1alpha1
+kind: Query
+metadata:
+  name: {{ .Values.queryName }}-query
+  labels:
+    project: {{ .Values.projectName }}
+    type: sample
+    target: {{ .Values.targetType }}
+spec:
+  input: "{{ .Values.inputMessage }}"
+  targets:
+    - type: {{ .Values.targetType }}
+      name: {{ .Values.targetName }}-{{ .Values.targetType }}