graph-agents-cli 0.3.1__py3-none-any.whl

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/examples/networkpolicy.yaml

@@ -0,0 +1,103 @@
+# NetworkPolicy for staging and prod: a worked example of `networkPolicy` (off
+# by default in values.yaml). Copy the block below into values-staging.yaml or
+# values-prod.yaml and replace every address marked CHANGE. It needs a CNI that
+# enforces NetworkPolicy (Calico, Cilium, Antrea, kube-router, recent kindnet
+# and most managed clusters); without one the policy is accepted and ignored.
+#
+# What the agent pods may then do, and nothing else:
+#   in:  the http port, from the Gateway's (or ingress controller's) namespace
+#        and from Prometheus (for /metrics); the kubelet's probes are not
+#        subject to NetworkPolicy
+#   out: DNS (the cluster's kube-dns / CoreDNS pods), the database, the model
+#        endpoint and the APIs in api-policy.yaml; add anything else the agent
+#        must reach, such as the jwt policy's JWKS URL (AUTH_JWT_JWKS_URL) or an
+#        OTLP collector
+#
+# NetworkPolicy matches addresses, not host names. A hosted service (a model
+# provider, an identity provider's JWKS, a SaaS API) is therefore "public
+# addresses on port 443", which excludes every private range and the cloud
+# metadata endpoint, so nothing inside your networks is reachable unless it is
+# listed. Check the result: `graph-agents-cli deploy --env <env> --dry-run`
+# renders the policy; once deployed, a pod in another namespace must not reach
+# the agent, and `/ready` must answer 200 (the database is reachable).
+networkPolicy:
+  enabled: true
+  ingressFrom:
+    # CHANGE: the namespace of the Gateway (or ingress controller) routing to the agent.
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: gateway-system
+    # CHANGE or remove: your Prometheus's namespace, for /metrics.
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: monitoring
+  # DNS to the kube-dns pods is always allowed once egress is restricted.
+  restrictEgress: true
+  egressTo:
+{%- if cookiecutter.runtime == 'langgraph-server' %}
+    # The database (DATABASE_URI) and Redis (REDIS_URI): CHANGE to their addresses...
+    - to:
+        - ipBlock:
+            cidr: 192.0.2.10/32
+      ports:
+        - port: 5432
+          protocol: TCP
+    - to:
+        - ipBlock:
+            cidr: 192.0.2.11/32
+      ports:
+        - port: 6379
+          protocol: TCP
+{%- else %}
+    # The database (POSTGRES_DSN): CHANGE to its address...
+    - to:
+        - ipBlock:
+            cidr: 192.0.2.10/32
+      ports:
+        - port: 5432
+          protocol: TCP
+{%- endif %}
+    # ...or, for a database running in this cluster, select its pods instead:
+    # - to:
+    #     - namespaceSelector:
+    #         matchLabels:
+    #           kubernetes.io/metadata.name: databases
+    #       podSelector:
+    #         matchLabels:
+    #           app.kubernetes.io/name: postgresql
+    #   ports:
+    #     - port: 5432
+    #       protocol: TCP
+{%- if cookiecutter.model_provider == 'openai-compatible' %}
+    # The on-network model server (OPENAI_BASE_URL): CHANGE to its address and port.
+    - to:
+        - ipBlock:
+            cidr: 192.0.2.20/32
+      ports:
+        - port: 11434
+          protocol: TCP
+{%- endif %}
+    # HTTPS to public addresses: the hosted model provider, the APIs in
+    # api-policy.yaml that live on the internet{% if cookiecutter.runtime == 'langgraph-server' %}, the LangGraph Server licence check{% endif %}.
+    # Never the private ranges or the metadata endpoint (169.254.169.254).
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 169.254.0.0/16
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+      ports:
+        - port: 443
+          protocol: TCP
+    # An API of api-policy.yaml on your own network (its <NAME>_API_BASE_URL is a
+    # private address): one entry per API, CHANGE to its address and port.
+    # - to:
+    #     - ipBlock:
+    #         cidr: 192.0.2.30/32
+    #   ports:
+    #     - port: 8443
+    #       protocol: TCP

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/NOTES.txt

@@ -0,0 +1,48 @@
+{{ .Release.Name }} ({{ .Values.runtime }} runtime, image tag {{ include "agent.imageTag" . }}) is installed in namespace {{ .Release.Namespace }}.
+Pods receive traffic once {{ .Values.probes.readiness.path }} answers (the database is reachable).
+
+App Secret {{ if .Values.secretOptional }}expected (optional here: pods start without it){{ else }}required (pods do not start without it){{ end }}: {{ include "agent.secretName" . }}
+  create or rotate it with: graph-agents-cli secrets apply --env <env>   (reads .env.<env>)
+  then, after rotation:     graph-agents-cli deploy --env <env> --restart   (waits for the new pods)
+
+{{- $published := list }}
+{{- $everything := false }}
+{{- if or .Values.gateway.enabled .Values.ingress.enabled }}
+{{- range (include "agent.publicPaths" . | fromYamlArray) }}
+{{- $published = append $published (printf "%s%s" .path (ternary "" " (prefix)" (eq .type "Exact"))) }}
+{{- if and (eq .path "/") (eq .type "PathPrefix") }}{{ $everything = true }}{{ end }}
+{{- end }}
+{{- end }}
+{{- if .Values.gateway.enabled }}
+Traffic: HTTPRoute {{ include "agent.fullname" . }} attached to Gateway {{ .Values.gateway.parentRef.name }}{{ if .Values.gateway.hostname }} for {{ .Values.gateway.hostname }}{{ end }}.
+  Published paths: {{ join ", " $published }} (route.publicPaths).
+{{- else if .Values.ingress.enabled }}
+Traffic: Ingress {{ include "agent.fullname" . }}{{ if .Values.ingress.hostname }} for {{ .Values.ingress.hostname }}{{ end }}.
+  Published paths: {{ join ", " $published }} (route.publicPaths).
+{{- else }}
+Traffic: ClusterIP only. Port-forward for a quick check:
+  kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "agent.fullname" . }} 8000:{{ .Values.service.port }}
+  curl http://127.0.0.1:8000/health
+{{- end }}
+{{- if .Values.postgresql.enabled }}
+Postgres: bundled subchart {{ include "agent.postgresql.host" . }} (dev only).
+{{- else }}
+Postgres: external; the connection string comes from the Secret.
+{{- end }}
+{{- $replicas := ternary .Values.hpa.minReplicas .Values.replicaCount (and .Values.hpa.enabled true) }}
+{{- if and .Values.pdb.enabled (not (kindIs "string" .Values.pdb.minAvailable)) (ge (int .Values.pdb.minAvailable) (int $replicas)) }}
+
+WARNING: pdb.minAvailable ({{ .Values.pdb.minAvailable }}) is not below the replica count ({{ $replicas }}):
+node drains will wait forever on this Deployment. Lower pdb.minAvailable or raise the replicas.
+{{- end }}
+{{- if and (or .Values.gateway.enabled .Values.ingress.enabled) (not (include "agent.appUrl" .)) }}
+
+WARNING: APP_URL resolves to nothing (no appUrl and no gateway/ingress hostname): the A2A
+agent card advertises the pod's bind address, which remote clients cannot dial. Set
+appUrl or a hostname in values-<env>.yaml.
+{{- end }}
+{{- if $everything }}
+
+WARNING: route.publicPaths publishes every path (PathPrefix /), /metrics, /health and
+/ready included. List only the agent's API paths.
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/_helpers.tpl

@@ -0,0 +1,189 @@
+{{/*
+Helpers for the graph-agents-cli agent chart. Copied verbatim into projects.
+*/}}
+
+{{- define "agent.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/* Release name = project name; resources are named after the release. */}}
+{{- define "agent.fullname" -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "agent.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+image.tag as a string. A number written unquoted in a values file reaches the
+chart as a float that may already have lost digits (0123456 is read as octal
+42798, long digit strings are rounded), so only a string is accepted, plus the
+exact integer `--set image.tag=1234567` produces (`--set-string` is preferred).
+*/}}
+{{- define "agent.imageTag" -}}
+{{- $tag := .Values.image.tag -}}
+{{- if or (kindIs "string" $tag) (kindIs "int64" $tag) -}}
+{{- toString $tag -}}
+{{- else if not (kindIs "invalid" $tag) -}}
+{{- fail (printf "image.tag must be a quoted string, got the %s %v: quote it in the values file (tag: \"<tag>\"); an unquoted number loses digits (0123456 reads as 42798)." (kindOf $tag) $tag) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+What the HTTPRoute / Ingress publish, as a YAML list of {path, type}:
+route.publicPaths, plus route.devPaths while env.APP_ENV is exactly dev (the app's
+own test: `DEV` or ` dev` is a deployed environment). Read it back
+with `include "agent.publicPaths" . | fromYamlArray`. Every entry is checked
+here, so each template that publishes paths fails with the same message. An
+empty list is refused while a Gateway or Ingress is enabled: it would publish
+nothing, and a Gateway API rule without matches would publish every path.
+*/}}
+{{- define "agent.publicPaths" -}}
+{{- $paths := .Values.route.publicPaths | default list -}}
+{{- if eq (dig "APP_ENV" "" (.Values.env | default dict) | toString) "dev" -}}
+{{- $paths = concat $paths (.Values.route.devPaths | default list) -}}
+{{- end -}}
+{{- if and (or .Values.gateway.enabled .Values.ingress.enabled) (not $paths) -}}
+{{- fail "route.publicPaths is empty: the HTTPRoute / Ingress would publish nothing (and a Gateway API rule without matches publishes every path). List the agent's API paths." -}}
+{{- end -}}
+{{- if gt (len $paths) 64 -}}
+{{- fail (printf "route.publicPaths lists %d paths; a Gateway API rule takes at most 64." (len $paths)) -}}
+{{- end -}}
+{{- range $paths -}}
+{{- if not (kindIs "map" .) -}}
+{{- fail (printf "route.publicPaths: each entry is {path, type}, got %v." .) -}}
+{{- end -}}
+{{- $path := .path | default "" | toString -}}
+{{- if not (regexMatch "^/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$" $path) -}}
+{{- fail (printf "route.publicPaths: path %q must be an absolute URL path (start with /, no spaces, query or fragment)." $path) -}}
+{{- end -}}
+{{- if or (contains "//" $path) (contains "/./" $path) (contains "/../" $path) (hasSuffix "/." $path) (hasSuffix "/.." $path) (contains "%2f" (lower $path)) -}}
+{{- fail (printf "route.publicPaths: path %q holds //, /./, /../ or an encoded slash, which the Gateway API and Ingress refuse." $path) -}}
+{{- end -}}
+{{- if not (has (.type | default "" | toString) (list "PathPrefix" "Exact")) -}}
+{{- fail (printf "route.publicPaths: %s has type %q; use PathPrefix or Exact." $path (.type | default "" | toString)) -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $paths -}}
+{{- end -}}
+
+{{/*
+Render-time checks: a misconfiguration fails `helm template` / `helm upgrade`
+(and shows as a comparison error in Argo CD) instead of producing pods that
+pull a missing image or an autoscaler that cannot compute utilisation.
+*/}}
+{{- define "agent.validate" -}}
+{{- if not (include "agent.imageTag" .) -}}
+{{- fail "image.tag is empty: deploy a built image (`graph-agents-cli deploy --env <env>` passes the tag it deploys; in argocd mode CI or `deploy` writes image.tag into values-<env>.yaml). The chart never defaults to latest." -}}
+{{- end -}}
+{{- if .Values.hpa.enabled -}}
+{{- if not (dig "requests" "cpu" "" (.Values.resources | default dict)) -}}
+{{- fail "hpa.enabled needs resources.requests.cpu: the HPA targets a percentage of the CPU request, so without one it can never scale." -}}
+{{- end -}}
+{{- if gt (int .Values.hpa.minReplicas) (int .Values.hpa.maxReplicas) -}}
+{{- fail (printf "hpa.minReplicas (%v) is greater than hpa.maxReplicas (%v)." .Values.hpa.minReplicas .Values.hpa.maxReplicas) -}}
+{{- end -}}
+{{- end -}}
+{{- if or .Values.gateway.enabled .Values.ingress.enabled -}}
+{{- $_ := include "agent.publicPaths" . -}}
+{{- end -}}
+{{- $shutdown := .Values.shutdown | default dict -}}
+{{- $pause := int ($shutdown.preStopSleepSeconds | default 0) -}}
+{{- $drain := int ($shutdown.drainSeconds | default 0) -}}
+{{- $grace := int .Values.terminationGracePeriodSeconds -}}
+{{- if or (lt $pause 0) (lt $drain 0) -}}
+{{- fail "shutdown.preStopSleepSeconds and shutdown.drainSeconds must be 0 or more." -}}
+{{- end -}}
+{{- if le $grace (add $pause $drain) -}}
+{{- fail (printf "terminationGracePeriodSeconds (%d) must be greater than shutdown.preStopSleepSeconds + shutdown.drainSeconds (%d + %d): Kubernetes kills the pod at the grace period, counted from the start of the preStop pause." $grace $pause $drain) -}}
+{{- end -}}
+{{- if not (or (kindIs "bool" .Values.secretOptional) (kindIs "invalid" .Values.secretOptional)) -}}
+{{- fail (printf "secretOptional must be true or false, got %v." .Values.secretOptional) -}}
+{{- end -}}
+{{- if or .Values.metrics.scrapeAnnotations .Values.metrics.serviceMonitor.enabled -}}
+{{- if has (dig "METRICS_ENABLED" "" (.Values.env | default dict) | toString | trim | lower) (list "0" "false" "no" "off") -}}
+{{- fail "metrics.scrapeAnnotations / metrics.serviceMonitor.enabled scrape /metrics, which env.METRICS_ENABLED turns off: turn scraping off, or set env.METRICS_ENABLED to true." -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "agent.labels" -}}
+helm.sh/chart: {{ include "agent.chart" . }}
+{{ include "agent.selectorLabels" . }}
+app.kubernetes.io/version: {{ include "agent.imageTag" . | default .Chart.AppVersion | trunc 63 | trimSuffix "-" | trimSuffix "." | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+graph-agents-cli/runtime: {{ .Values.runtime | quote }}
+{{- end -}}
+
+{{- define "agent.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "agent.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "agent.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- default (include "agent.fullname" .) .Values.serviceAccount.name -}}
+{{- else -}}
+{{- default "default" .Values.serviceAccount.name -}}
+{{- end -}}
+{{- end -}}
+
+{{/* The app Secret: existingSecret, default "<release>-app". */}}
+{{- define "agent.secretName" -}}
+{{- default (printf "%s-app" (include "agent.fullname" .)) .Values.existingSecret -}}
+{{- end -}}
+
+{{/* The TLS Secret: tls.existingSecret, else "<release>-tls" (cert-manager writes it). */}}
+{{- define "agent.tlsSecretName" -}}
+{{- default (printf "%s-tls" (include "agent.fullname" .)) .Values.tls.existingSecret -}}
+{{- end -}}
+
+{{/* Bitnami postgresql subchart service and secret names. */}}
+{{- define "agent.postgresql.host" -}}
+{{- printf "%s-postgresql" .Release.Name -}}
+{{- end -}}
+
+{{/* The subchart renders auth.existingSecret through tpl; so does this chart. */}}
+{{- define "agent.postgresql.secretName" -}}
+{{- if .Values.postgresql.auth.existingSecret -}}
+{{- tpl .Values.postgresql.auth.existingSecret . -}}
+{{- else -}}
+{{- printf "%s-postgresql" .Release.Name -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Connection string for the bundled Postgres; $(POSTGRES_PASSWORD) expands in the container. */}}
+{{- define "agent.postgresql.dsn" -}}
+{{- printf "postgresql://%s:$(POSTGRES_PASSWORD)@%s:5432/%s" .Values.postgresql.auth.username (include "agent.postgresql.host" .) .Values.postgresql.auth.database -}}
+{{- end -}}
+
+{{/* Bitnami redis subchart (standalone) master service. */}}
+{{- define "agent.redis.uri" -}}
+{{- printf "redis://%s-redis-master:6379" .Release.Name -}}
+{{- end -}}
+
+{{- define "agent.hostname" -}}
+{{- if .Values.gateway.enabled -}}{{ .Values.gateway.hostname }}{{- else -}}{{ .Values.ingress.hostname }}{{- end -}}
+{{- end -}}
+
+{{/*
+Public base URL for the A2A agent card (APP_URL): appUrl, else env.APP_URL,
+else derived from the traffic entry's hostname (https on a Gateway listener or
+a TLS Ingress, http on a plain Ingress). Empty when nothing is known.
+*/}}
+{{- define "agent.appUrl" -}}
+{{- if .Values.appUrl -}}
+{{- .Values.appUrl -}}
+{{- else if (index .Values.env "APP_URL") -}}
+{{- index .Values.env "APP_URL" -}}
+{{- else if and .Values.gateway.enabled .Values.gateway.hostname -}}
+{{- printf "https://%s" .Values.gateway.hostname -}}
+{{- else if and .Values.ingress.enabled .Values.ingress.hostname -}}
+{{- if or .Values.tls.existingSecret .Values.tls.certManager.enabled -}}
+{{- printf "https://%s" .Values.ingress.hostname -}}
+{{- else -}}
+{{- printf "http://%s" .Values.ingress.hostname -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/certificate.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.tls.certManager.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+spec:
+  secretName: {{ include "agent.tlsSecretName" . }}
+  dnsNames:
+    - {{ required "a hostname (gateway.hostname or ingress.hostname) is required for cert-manager" (include "agent.hostname" .) | quote }}
+  issuerRef:
+    name: {{ required "tls.certManager.issuerRef.name is required" .Values.tls.certManager.issuerRef.name }}
+    kind: {{ .Values.tls.certManager.issuerRef.kind | default "ClusterIssuer" }}
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/configmap.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+data:
+  {{- range $key, $value := .Values.env }}
+  {{ $key }}: {{ $value | toString | quote }}
+  {{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/deployment.yaml

@@ -0,0 +1,199 @@
+{{- include "agent.validate" . }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.hpa.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "agent.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "agent.selectorLabels" . | nindent 8 }}
+      annotations:
+        # Roll the pods when the non-secret configuration changes. Secret
+        # rotation is a `graph-agents-cli deploy --restart`.
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- if .Values.metrics.scrapeAnnotations }}
+        prometheus.io/scrape: "true"
+        prometheus.io/path: /metrics
+        prometheus.io/port: {{ .Values.service.targetPort | quote }}
+        {{- end }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "agent.serviceAccountName" . }}
+      # The agent never calls the Kubernetes API: no token in the pod.
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: agent
+          image: "{{ .Values.image.repository }}:{{ include "agent.imageTag" . }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.targetPort }}
+              protocol: TCP
+          {{- $shutdown := .Values.shutdown | default dict }}
+          {{- if gt (int ($shutdown.preStopSleepSeconds | default 0)) 0 }}
+          # Keep serving while the Service endpoints drain, then SIGTERM (see `shutdown`).
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep {{ int $shutdown.preStopSleepSeconds }}"]
+          {{- end }}
+          # Secrets by reference (never templated here), then the ConfigMap.
+          # Required outside dev (secretOptional): no Secret, no start.
+          envFrom:
+            - secretRef:
+                name: {{ include "agent.secretName" . }}
+                optional: {{ .Values.secretOptional | default false }}
+            - configMapRef:
+                name: {{ include "agent.fullname" . }}
+          # Chart-set variables; `env` wins over `envFrom`.
+          env:
+            - name: PORT
+              value: {{ .Values.service.targetPort | quote }}
+            - name: HOST
+              value: "0.0.0.0"
+            {{- if not (hasKey .Values.env "PYTHONDONTWRITEBYTECODE") }}
+            - name: PYTHONDONTWRITEBYTECODE
+              value: "1"
+            {{- end }}
+            {{- if and (dig "readOnlyRootFilesystem" false (.Values.securityContext | default dict)) (not (hasKey .Values.env "HOME")) }}
+            # The root filesystem is read-only: caches under ~ go to the /tmp emptyDir.
+            - name: HOME
+              value: /tmp
+            {{- end }}
+            {{- $appUrl := include "agent.appUrl" . }}
+            {{- if $appUrl }}
+            - name: APP_URL
+              value: {{ $appUrl | quote }}
+            {{- end }}
+            - name: TRACING_ENABLED
+              value: {{ .Values.tracing.enabled | quote }}
+            - name: TRACE_CAPTURE
+              value: {{ .Values.tracing.capture | quote }}
+            {{- if .Values.tracing.otlpEndpoint }}
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: {{ .Values.tracing.otlpEndpoint | quote }}
+            {{- end }}
+            {{- if .Values.tracing.langsmith.project }}
+            - name: LANGSMITH_PROJECT
+              value: {{ .Values.tracing.langsmith.project | quote }}
+            {{- end }}
+            {{- if eq .Values.runtime "langgraph-server" }}
+            - name: LANGGRAPH_SERVER
+              value: "1"
+            {{- end }}
+            {{- $drain := int ($shutdown.drainSeconds | default 0) }}
+            {{- $drainVar := ternary "BG_JOB_SHUTDOWN_GRACE_PERIOD_SECS" "UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN" (eq .Values.runtime "langgraph-server") }}
+            {{- if and (gt $drain 0) (not (hasKey .Values.env $drainVar)) }}
+            # SIGTERM to exit within the grace period (see `shutdown.drainSeconds`).
+            - name: {{ $drainVar }}
+              value: {{ $drain | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.enabled }}
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "agent.postgresql.secretName" . }}
+                  key: password
+            {{- if eq .Values.runtime "langgraph-server" }}
+            - name: DATABASE_URI
+              value: {{ include "agent.postgresql.dsn" . | quote }}
+            {{- else }}
+            - name: POSTGRES_DSN
+              value: {{ include "agent.postgresql.dsn" . | quote }}
+            {{- end }}
+            {{- end }}
+            {{- if .Values.redis.enabled }}
+            - name: REDIS_URI
+              value: {{ include "agent.redis.uri" . | quote }}
+            {{- end }}
+          # Liveness and startup: the process answers. Readiness: its database
+          # answers too, so traffic stops (without a restart) while it does not.
+          startupProbe:
+            httpGet:
+              path: {{ .Values.probes.startup.path }}
+              port: http
+            periodSeconds: {{ .Values.probes.startup.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.startup.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.startup.failureThreshold }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+      volumes:
+        # Writable scratch space; everything else is read-only.
+        - name: tmp
+          emptyDir:
+            {{- with .Values.tmpVolume.medium }}
+            medium: {{ . }}
+            {{- end }}
+            {{- with .Values.tmpVolume.sizeLimit }}
+            sizeLimit: {{ . }}
+            {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- if .Values.topologySpread.enabled }}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: {{ .Values.topologySpread.topologyKey }}
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              {{- include "agent.selectorLabels" . | nindent 14 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/hpa.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.hpa.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "agent.fullname" . }}
+  minReplicas: {{ .Values.hpa.minReplicas }}
+  maxReplicas: {{ .Values.hpa.maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.hpa.targetCPU }}
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/httproute.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.gateway.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    - name: {{ required "gateway.parentRef.name is required when gateway.enabled (the Gateway to attach to)" .Values.gateway.parentRef.name }}
+      {{- if .Values.gateway.parentRef.namespace }}
+      namespace: {{ .Values.gateway.parentRef.namespace }}
+      {{- end }}
+  {{- if .Values.gateway.hostname }}
+  hostnames:
+    - {{ .Values.gateway.hostname | quote }}
+  {{- end }}
+  rules:
+    # Only the agent's API (route.publicPaths, plus route.devPaths under
+    # APP_ENV=dev): /health, /ready and /metrics are not published.
+    - matches:
+        {{- range (include "agent.publicPaths" . | fromYamlArray) }}
+        - path:
+            type: {{ .type }}
+            value: {{ .path | quote }}
+        {{- end }}
+      backendRefs:
+        - name: {{ include "agent.fullname" . }}
+          port: {{ .Values.service.port }}
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/ingress.yaml

@@ -0,0 +1,39 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if or .Values.tls.existingSecret .Values.tls.certManager.enabled }}
+  tls:
+    - hosts:
+        - {{ required "ingress.hostname is required for TLS" .Values.ingress.hostname | quote }}
+      secretName: {{ include "agent.tlsSecretName" . }}
+  {{- end }}
+  rules:
+    - {{- if .Values.ingress.hostname }}
+      host: {{ .Values.ingress.hostname | quote }}
+      {{- end }}
+      # Only the agent's API (route.publicPaths, plus route.devPaths under
+      # APP_ENV=dev): /health, /ready and /metrics are not published.
+      http:
+        paths:
+          {{- range (include "agent.publicPaths" . | fromYamlArray) }}
+          - path: {{ .path | quote }}
+            pathType: {{ ternary "Exact" "Prefix" (eq .type "Exact") }}
+            backend:
+              service:
+                name: {{ include "agent.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+{{- end }}