graph-agents-cli 0.3.1__py3-none-any.whl

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/networkpolicy.yaml

@@ -0,0 +1,48 @@
+{{- /*
+Optional NetworkPolicy for the agent pods (networkPolicy.enabled, off by
+default). Ingress: the http port only, from networkPolicy.ingressFrom (empty:
+any source). Egress stays open unless networkPolicy.restrictEgress is true;
+then only DNS and networkPolicy.egressTo are allowed. Kubelet probes are not
+subject to NetworkPolicy.
+*/ -}}
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "agent.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    {{- if .Values.networkPolicy.restrictEgress }}
+    - Egress
+    {{- end }}
+  ingress:
+    - ports:
+        - port: http
+          protocol: TCP
+      {{- with .Values.networkPolicy.ingressFrom }}
+      from:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  {{- if .Values.networkPolicy.restrictEgress }}
+  egress:
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    {{- with .Values.networkPolicy.egressTo }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/pdb.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.pdb.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+spec:
+  minAvailable: {{ .Values.pdb.minAvailable }}
+  selector:
+    matchLabels:
+      {{- include "agent.selectorLabels" . | nindent 6 }}
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/postgresql-secret.yaml

@@ -0,0 +1,37 @@
+{{- /*
+Credentials of the bundled (dev) Postgres, read by the subchart through
+postgresql.auth.existingSecret and by the agent (POSTGRES_PASSWORD).
+
+The database volume keeps the password it was initialised with, so this Secret
+must never change once created: `helm upgrade` reuses the live values (lookup),
+the Secret is kept on uninstall (the volume outlives the release too), and the
+dev Argo CD Application, which renders without cluster access, ignores its data
+after the first sync (ignoreDifferences + RespectIgnoreDifferences). A release
+whose subchart generated its own "<release>-postgresql" Secret (charts from
+before this one) carries those passwords over on its first upgrade.
+*/ -}}
+{{- /* An empty existingSecret hands the Secret back to the subchart (generated per render). */ -}}
+{{- if and .Values.postgresql.enabled .Values.postgresqlSecret.create .Values.postgresql.auth.existingSecret }}
+{{- $name := include "agent.postgresql.secretName" . }}
+{{- $live := lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $previous := lookup "v1" "Secret" .Release.Namespace (printf "%s-postgresql" .Release.Name) }}
+{{- $data := dict }}
+{{- if and $live $live.data }}
+{{- $data = $live.data }}
+{{- else if and $previous $previous.data }}
+{{- $data = $previous.data }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/resource-policy: keep
+    argocd.argoproj.io/sync-options: Delete=false
+type: Opaque
+data:
+  password: {{ index $data "password" | default (randAlphaNum 32 | b64enc) }}
+  postgres-password: {{ index $data "postgres-password" | default (randAlphaNum 32 | b64enc) }}
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "agent.selectorLabels" . | nindent 4 }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "agent.serviceAccountName" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: false
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/templates/servicemonitor.yaml

@@ -0,0 +1,42 @@
+{{- /*
+Optional Prometheus Operator ServiceMonitor for /metrics
+(metrics.serviceMonitor.enabled, off by default; needs the monitoring.coreos.com
+CRDs). It scrapes the Service's http port inside the cluster: /metrics is never
+published by the HTTPRoute / Ingress. With METRICS_TOKEN set in the app,
+metrics.serviceMonitor.bearerToken.enabled makes Prometheus send it (the
+endpoint's `authorization` field), read from <release>-metrics, a Secret that
+holds only that token (written by `graph-agents-cli secrets apply`), never
+from the app Secret with every other credential.
+*/ -}}
+{{- if .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "agent.fullname" . }}
+  labels:
+    {{- include "agent.labels" . | nindent 4 }}
+    {{- with .Values.metrics.serviceMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "agent.selectorLabels" . | nindent 6 }}
+  endpoints:
+    - port: http
+      path: /metrics
+      {{- with .Values.metrics.serviceMonitor.interval }}
+      interval: {{ . }}
+      {{- end }}
+      {{- with .Values.metrics.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ . }}
+      {{- end }}
+      {{- $bearer := .Values.metrics.serviceMonitor.bearerToken | default dict }}
+      {{- if $bearer.enabled }}
+      authorization:
+        type: Bearer
+        credentials:
+          name: {{ $bearer.secretName | default (printf "%s-metrics" (include "agent.fullname" .)) | quote }}
+          key: {{ $bearer.key | default "METRICS_TOKEN" | quote }}
+      {{- end }}
+{{- end }}

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/values-dev.yaml

@@ -0,0 +1,22 @@
+# dev: a local-load cluster or a dev namespace. Bundled Postgres, no gateway.
+env:
+  APP_ENV: dev
+# The pods start even before the app Secret exists (staging and prod require it).
+secretOptional: true
+postgresql:
+  enabled: true
+{%- if cookiecutter.runtime == 'langgraph-server' %}
+redis:
+  enabled: true
+{%- endif %}
+gateway:
+  enabled: false
+image:
+  # Set per deploy (`graph-agents-cli deploy --env dev` passes the tag it built;
+  # in argocd mode it writes it here, quoted). Empty until then: the chart
+  # refuses to render without a tag rather than roll out an image that was
+  # never pushed.
+  tag: ""
+  pullPolicy: IfNotPresent
+tracing:
+  enabled: false

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/values-prod.yaml

@@ -0,0 +1,45 @@
+# prod: external Postgres (POSTGRES_DSN / DATABASE_URI from the Secret), gateway on.
+# Changes to this file reach the cluster only through a reviewed pull request.
+env:
+  APP_ENV: prod
+# The app Secret is required: without it the pods do not start (no keys).
+secretOptional: false
+postgresql:
+  enabled: false
+{%- if cookiecutter.runtime == 'langgraph-server' %}
+redis:
+  enabled: false           # REDIS_URI from the Secret
+{%- endif %}
+gateway:
+  enabled: true
+  hostname: ""
+  parentRef:
+    name: ""
+    namespace: ""
+image:
+  # Promoted by promote-to-prod (argocd mode) or passed with `deploy --image` (helm-push).
+  # Empty until the first promotion: the chart refuses to render without a tag.
+  tag: ""
+replicaCount: 2
+pdb:
+  enabled: true
+  minAvailable: 1
+topologySpread:
+  enabled: true
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    memory: 1Gi
+# CPU autoscaling (needs metrics-server). While enabled the HPA owns the
+# replica count; minReplicas stays above pdb.minAvailable so node drains can
+# proceed:
+# hpa:
+#   enabled: true
+#   minReplicas: 2
+#   maxReplicas: 10
+#   targetCPU: 70
+# Network isolation (off): examples/networkpolicy.yaml is a worked NetworkPolicy
+# for this environment (DNS, the database, the model endpoint, the APIs in
+# api-policy.yaml); copy its networkPolicy block here and set the addresses.

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/values-staging.yaml

@@ -0,0 +1,29 @@
+# staging: external Postgres (POSTGRES_DSN / DATABASE_URI from the Secret), gateway on.
+env:
+  APP_ENV: staging
+# The app Secret is required: without it the pods do not start (no keys).
+secretOptional: false
+postgresql:
+  enabled: false
+{%- if cookiecutter.runtime == 'langgraph-server' %}
+redis:
+  enabled: false           # REDIS_URI from the Secret
+{%- endif %}
+gateway:
+  enabled: true
+  hostname: ""
+  parentRef:
+    name: ""
+    namespace: ""
+image:
+  # Written by CI (argocd mode) or passed with `deploy --image` (helm-push / direct).
+  # Empty until the first staging build: the chart refuses to render without a tag.
+  tag: ""
+replicaCount: 1
+# Requests and limits come from values.yaml; override them here, for example:
+# resources:
+#   requests: {cpu: 250m, memory: 512Mi}
+#   limits: {memory: 1Gi}
+# Network isolation (off): examples/networkpolicy.yaml is a worked NetworkPolicy
+# for this environment (DNS, the database, the model endpoint, the APIs in
+# api-policy.yaml); copy its networkPolicy block here and set the addresses.

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/deployment/helm/{{cookiecutter.project_name}}/values.yaml

@@ -0,0 +1,396 @@
+# Default values for {{cookiecutter.project_name}}.
+# Per-environment overrides live in values-dev.yaml, values-staging.yaml and
+# values-prod.yaml; `graph-agents-cli deploy --env <env>` passes both files.
+# Helm merges maps key by key, so an environment file only lists what differs
+# (set a key to null there to drop a default, e.g. `resources.limits: null`).
+
+image:
+  repository: {{cookiecutter.registry}}/{{cookiecutter.project_name}}
+  # Always an immutable build tag, never a default: `graph-agents-cli deploy`
+  # passes it on the command line, and in argocd mode CI (staging) or `deploy`
+  # (prod) writes it into values-<env>.yaml. The chart refuses to render while
+  # it is empty, so nothing rolls out an image that was never pushed. Keep it a
+  # quoted string ("0123456"): an unquoted number loses digits in YAML (0123456
+  # reads as octal), so the chart refuses one.
+  tag: ""
+  pullPolicy: IfNotPresent
+
+# Names of existing image pull secrets in the namespace (operator-provided).
+imagePullSecrets: []
+
+replicaCount: 1
+
+# Informational: selects the variable names for the subchart-derived
+# connection strings (fastapi -> POSTGRES_DSN, langgraph-server -> DATABASE_URI + REDIS_URI).
+runtime: {{cookiecutter.runtime}}
+
+# Non-secret environment (becomes a ConfigMap mounted with envFrom). Secret
+# values (provider key, API_KEY, POSTGRES_DSN/DATABASE_URI/REDIS_URI when the
+# subcharts are disabled, LANGSMITH_API_KEY, ...) come from `existingSecret`.
+env:
+  APP_ENV: prod
+  MODEL_PROVIDER: {{cookiecutter.model_provider}}
+  MODEL_NAME: {{cookiecutter.model}}
+{%- if cookiecutter.model_provider == 'openai-compatible' %}
+  OPENAI_BASE_URL: http://CHANGE-ME:11434/v1
+{%- endif %}
+{%- if cookiecutter.model_provider in ['openai', 'openai-compatible'] %}
+  # Reasoning effort (none | minimal | low | medium | high | xhigh) and the API: "true" for
+  # the Responses API, "false" for Chat Completions. Unset: the model's default effort, and
+  # langchain-openai chooses the API. A model that refuses function tools with an effort on
+  # Chat Completions needs MODEL_USE_RESPONSES_API: "true".
+  # MODEL_REASONING_EFFORT: ""
+  # MODEL_USE_RESPONSES_API: ""
+{%- endif %}
+  # Structured answers (only with the agent's response_schema.json): auto | provider | tool.
+  # RESPONSE_FORMAT_STRATEGY: auto
+{%- if cookiecutter.runtime == 'fastapi' %}
+  CHECKPOINTER: postgres
+{%- endif %}
+  AUTH_POLICY: {{cookiecutter.auth_policy}}
+{%- if cookiecutter.auth_policy == 'jwt' %}
+  # Verified OIDC/JWT tokens: set a JWKS URL (or AUTH_JWT_PUBLIC_KEY), the issuer
+  # and the audience; outside APP_ENV=dev the pod refuses to start without them.
+  AUTH_JWT_JWKS_URL: ""
+  AUTH_JWT_ISSUER: ""
+  AUTH_JWT_AUDIENCE: ""
+{%- endif %}
+  AUTH_READ_ACROSS_ROLES: ""
+  AUTH_ADMIN_ROLES: ""
+{%- if cookiecutter.has_api_policy %}
+  # Base URLs of the APIs in api-policy.yaml (tokens come from the Secret).
+{%- for api in cookiecutter.apis %}
+  {{ api.base_url_env }}: http://CHANGE-ME
+{%- endfor %}
+{%- if cookiecutter.apis | selectattr('auth', 'equalto', 'exchange') | list %}
+  # Token exchange (RFC 8693) for the auth: exchange APIs (the client secret comes from the Secret).
+  TOKEN_EXCHANGE_URL: http://CHANGE-ME
+  TOKEN_EXCHANGE_CLIENT_ID: {{ cookiecutter.project_name }}
+{%- endif %}
+{%- endif %}
+  A2A_NAME: {{cookiecutter.agent_directory}}
+  # What the A2A agent card (and its chat skill) says the agent does; empty: a
+  # generic description. The card's version is AGENT_VERSION (default 0.1.0).
+  A2A_DESCRIPTION: ""
+  PORT: "8000"
+
+# Kubernetes Secret with the allow-listed keys (created by `graph-agents-cli
+# secrets apply`, never by this chart). Empty means "<release>-app".
+existingSecret: ""
+# Whether the pods may start without that Secret. false (staging, prod): a
+# missing Secret keeps the pods in CreateContainerConfigError instead of
+# running without their keys. values-dev.yaml sets true, so a dev cluster can
+# run (the fake model, say) before any Secret exists.
+secretOptional: false
+
+service:
+  port: 80
+  targetPort: 8000
+
+# Public base URL advertised in the A2A agent card (APP_URL). Empty derives
+# https://<gateway.hostname> (or the ingress hostname, http without TLS) when
+# a hostname is set; with neither, the pod falls back to its bind address and
+# warns, and remote A2A clients cannot dial the card's URL. `env.APP_URL`
+# (the ConfigMap) is honoured when this is empty.
+appUrl: ""
+
+# Traffic entry: Gateway API HTTPRoute (default) or a legacy Ingress.
+gateway:
+  enabled: true
+  className: ""          # informational; the parentRef selects the Gateway
+  hostname: ""
+  parentRef:
+    name: ""
+    namespace: ""
+
+ingress:
+  enabled: false
+  className: ""
+  hostname: ""
+  annotations: {}
+
+# The paths the HTTPRoute (or Ingress) publishes: the agent's API and nothing
+# else. /health and /ready stay inside the cluster (the kubelet probes the pod
+# directly) and so does /metrics (see `metrics`). A request for any other path
+# gets the Gateway's (or ingress controller's) 404. Each entry is a `path` and a
+# `type`: PathPrefix (the path and everything below it, whole segments only:
+# /threads covers /threads/<id>/messages, never /threadsX) or Exact. With a
+# Gateway or Ingress on, the chart refuses an empty list: a Gateway API rule
+# without matches would publish every path.
+route:
+  publicPaths:
+    # POST /chat (SSE).
+    - path: /chat
+      type: Exact
+    # GET /threads, GET /threads/<id>/messages, DELETE /threads/<id>.
+{%- if cookiecutter.runtime == 'langgraph-server' %}
+    # Under LangGraph Server this prefix also publishes the server's native
+    # thread routes (search, state, runs of a thread), which the auth handler
+    # limits to the caller's own threads; a run started there skips this app's
+    # /chat guardrails (run timeout, one run per thread, run records).
+{%- endif %}
+    - path: /threads
+      type: PathPrefix
+    # The A2A agent card (<path>/.well-known/agent-card.json) and JSON-RPC
+    # endpoint. Keep it in step with env.A2A_NAME (/a2a/<A2A_NAME>).
+    - path: /a2a/{{cookiecutter.agent_directory}}
+      type: PathPrefix
+{%- if cookiecutter.runtime == 'langgraph-server' %}
+    # LangGraph Server's other native APIs are not published. The auth handler
+    # protects them too (assistants, crons and store writes need a role in
+    # AUTH_ADMIN_ROLES; store reads are not per user), but runs started through
+    # them skip this app's /chat guardrails and run records. Add what your
+    # clients need, for example the LangGraph SDK's:
+    # - path: /assistants
+    #   type: PathPrefix
+    # - path: /runs
+    #   type: PathPrefix
+    # - path: /store
+    #   type: PathPrefix
+    # - path: /crons
+    #   type: PathPrefix
+{%- endif %}
+  # Published as well while env.APP_ENV is dev, the only environment where the
+  # app serves them.
+  devPaths:
+    - path: /playground
+      type: Exact
+    - path: /docs
+      type: Exact
+    - path: /openapi.json
+      type: Exact
+
+# Prometheus scraping of /metrics (served on the http port unless
+# env.METRICS_ENABLED is false; never published by the route). Off by default.
+metrics:
+  # prometheus.io/scrape, /path and /port annotations on the pods, for a
+  # Prometheus that discovers pods by annotation. Annotations cannot carry a
+  # token: with METRICS_TOKEN set, give that Prometheus's scrape job the token
+  # (`authorization.credentials_file`) or use the ServiceMonitor below.
+  scrapeAnnotations: false
+  # A ServiceMonitor for the Prometheus Operator (needs its CRDs installed).
+  serviceMonitor:
+    enabled: false
+    interval: 30s
+    scrapeTimeout: 10s
+    # Extra labels, e.g. `release: kube-prometheus-stack`, so the Prometheus's
+    # serviceMonitorSelector picks it up.
+    labels: {}
+    # With METRICS_TOKEN in the app Secret, /metrics answers only
+    # `Authorization: Bearer <token>`: enable this so the ServiceMonitor sends
+    # it. Prometheus reads the token from a Secret of its own, <release>-metrics,
+    # which `graph-agents-cli secrets apply` (and a direct `deploy`) writes from
+    # METRICS_TOKEN (add it to secrets.keys): grant Prometheus read access to
+    # that Secret only, never to the app Secret, which also holds the provider
+    # key, the API tokens and the database DSN. `secretName` / `key` select a
+    # Secret you manage yourself (same namespace).
+    bearerToken:
+      enabled: false
+      secretName: ""     # default: <release>-metrics
+      key: METRICS_TOKEN
+
+tls:
+  existingSecret: ""     # operator-provided certificate Secret
+  certManager:
+    enabled: false       # adds a cert-manager Certificate (requires cert-manager)
+    issuerRef:
+      name: ""
+      kind: ClusterIssuer
+
+# Bundled Postgres and Redis (Bitnami subcharts, pinned in Chart.yaml) are for
+# dev only; staging and prod read the connection strings from the Secret.
+#
+# The Bitnami catalogue: since August 2025 Bitnami publishes its free images
+# only as `latest` (meant for development) under docker.io/bitnami; versioned
+# tags need a Broadcom subscription and the old tags were frozen, without
+# updates, under docker.io/bitnamilegacy. So the images below are pinned by
+# digest: renders are reproducible and `latest` moving never changes a running
+# dev database. To refresh a pin, look up the current digest
+# (`docker buildx imagetools inspect docker.io/bitnami/postgresql:latest`).
+# To use something else, either set postgresql.enabled / redis.enabled to false
+# and put POSTGRES_DSN (fastapi) or DATABASE_URI + REDIS_URI (langgraph-server)
+# in the Secret, pointing at a managed database, an operator such as
+# CloudNativePG or any other chart; or swap the dependency in Chart.yaml for a
+# chart that serves <release>-postgresql:5432 (and <release>-redis-master:6379),
+# the addresses this chart derives.
+postgresql:
+  enabled: false
+  image:
+    registry: registry-1.docker.io
+    repository: bitnami/postgresql
+    tag: latest
+    digest: "sha256:7d77a46bbf200709237318c27dec0eaeae2520e403dd18fdebde2be7a6b04993"
+  auth:
+    database: agent
+    username: agent
+    # Holds `password` (the agent's user) and `postgres-password`. This chart
+    # creates it (postgresqlSecret.create) with random values the first time
+    # and then keeps them, so the password stays the one the database volume
+    # was initialised with, across upgrades, re-renders and Argo CD syncs.
+    existingSecret: {{cookiecutter.project_name}}-postgresql-auth
+  primary:
+    persistence:
+      size: 8Gi
+    # A restart or rollout of the dev database shuts Postgres down in "fast"
+    # mode: open sessions (the agent's pooled connections) are closed and the
+    # data is checkpointed, so the pod stops in about a second. Without it,
+    # Kubernetes' SIGTERM asks Postgres for a "smart" shutdown, which waits for
+    # every client to disconnect, and the pod is killed after 30 s and needs
+    # crash recovery on the next start. (pg_ctl signals the server and returns;
+    # the SIGTERM that follows cannot slow a fast shutdown down.)
+    lifecycleHooks:
+      preStop:
+        exec:
+          command: ["/bin/sh", "-c", "pg_ctl -D \"$PGDATA\" -m fast --no-wait stop"]
+
+# The bundled Postgres's credentials Secret (postgresql.auth.existingSecret):
+# created by this chart when the subchart is enabled, reused on upgrade (helm
+# lookup), kept on uninstall and ignored by Argo CD after the first sync (the
+# Applications ignore its data). Set create: false to provide your own Secret
+# under that name (keys `password` and `postgres-password`).
+postgresqlSecret:
+  create: true
+
+# Bundled Redis (Bitnami subchart), langgraph-server only.
+redis:
+  enabled: false
+  architecture: standalone
+  image:
+    registry: registry-1.docker.io
+    repository: bitnami/redis
+    tag: latest
+    digest: "sha256:ef8442c1ec2e28cef662999f348a4369c22343dc0c86c3bc23041fad22f13ca1"
+  auth:
+    enabled: false
+
+# Health probes. Liveness and startup ask whether the process answers
+# (/health); readiness asks whether the database (and run store) answer within
+# 2 s (/ready), so a pod that loses its database leaves the Service endpoints
+# instead of being restarted. Liveness and readiness start after the startup
+# probe passes (up to failureThreshold x periodSeconds for the first boot).
+probes:
+  liveness:
+    path: /health
+    periodSeconds: 15
+    timeoutSeconds: 3
+    failureThreshold: 3
+  readiness:
+    path: /ready
+    periodSeconds: 10
+    timeoutSeconds: 3
+    failureThreshold: 3
+  startup:
+    path: /health
+    periodSeconds: 5
+    timeoutSeconds: 3
+    failureThreshold: 30
+
+# Requests reserve capacity (and are what the HPA's CPU target is a percentage
+# of); the memory limit stops a leaking pod before it starves its node. No CPU
+# limit by default: throttling hurts latency more than it protects neighbours.
+# Override per environment in values-<env>.yaml.
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    memory: 1Gi
+
+# CPU-based autoscaling (needs metrics-server). The HPA owns the replica count
+# while enabled (replicaCount is ignored); the chart refuses to render it
+# without resources.requests.cpu. Keep minReplicas above pdb.minAvailable so
+# node drains can proceed.
+hpa:
+  enabled: false
+  minReplicas: 2
+  maxReplicas: 5
+  targetCPU: 70
+
+pdb:
+  enabled: false
+  minAvailable: 1
+
+# Spread the replicas over nodes when possible (never blocks scheduling).
+topologySpread:
+  enabled: false
+  topologyKey: kubernetes.io/hostname
+
+# Graceful shutdown (rollouts, `deploy --restart`, scale-down, node drains).
+# A stopping pod first keeps serving for `preStopSleepSeconds`, while the
+# Service endpoints, kube-proxy and the Gateway stop sending it new
+# connections: without that pause a rolling restart refuses connections. Then
+# it gets SIGTERM and has `drainSeconds` to finish in-flight requests and
+# streams: uvicorn's graceful-shutdown timeout under the fastapi runtime
+# (UVICORN_TIMEOUT_GRACEFUL_SHUTDOWN), the background-run grace period under
+# langgraph-server (BG_JOB_SHUTDOWN_GRACE_PERIOD_SECS). A /chat stream still
+# running after that is cut off. Kubernetes kills the pod
+# terminationGracePeriodSeconds after it started stopping, pause included, so
+# the chart refuses a grace period that is not longer than
+# preStopSleepSeconds + drainSeconds. For long runs (RUN_TIMEOUT_S) raise
+# drainSeconds and terminationGracePeriodSeconds together.
+shutdown:
+  preStopSleepSeconds: 5   # 0: no pause
+  drainSeconds: 20         # 0: no limit of its own (the grace period still applies)
+terminationGracePeriodSeconds: 30
+
+serviceAccount:
+  create: true
+  name: ""
+  annotations: {}
+
+# Tracing. Off unless enabled; capture defaults to metadata (no prompt or
+# completion text leaves the pod).
+tracing:
+  enabled: false
+  capture: metadata      # metadata | full
+  otlpEndpoint: ""       # OTLP/HTTP collector, used when no LANGSMITH_API_KEY is in the Secret
+  langsmith:
+    project: "{{cookiecutter.project_name}}"
+
+podAnnotations: {}
+# Restricted Pod Security Standard: non-root uid/gid 1000 (the image's user),
+# no privilege escalation, no capabilities, the runtime's default seccomp
+# profile, a read-only root filesystem and no service account token.
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
+securityContext:
+  allowPrivilegeEscalation: false
+  privileged: false
+  runAsNonRoot: true
+  capabilities:
+    drop: ["ALL"]
+  readOnlyRootFilesystem: true
+
+# The only writable path with a read-only root filesystem: an emptyDir at
+# /tmp (HOME points there too, for libraries that cache under ~). Mount more
+# with extraVolumes / extraVolumeMounts.
+tmpVolume:
+  sizeLimit: 256Mi
+  medium: ""             # "Memory" for a tmpfs (counts against the memory limit)
+extraVolumes: []
+extraVolumeMounts: []
+
+# Optional NetworkPolicy for the agent pods (off by default; needs a CNI that
+# enforces NetworkPolicy). When enabled, ingress is limited to the http port,
+# from the sources in ingressFrom (empty: from anywhere, but only that port;
+# list the Gateway's namespace and, for /metrics, your Prometheus's).
+# With restrictEgress the pods may only reach DNS (pods labelled
+# k8s-app=kube-dns; add a node-local DNS cache address yourself) plus egressTo:
+# the database, the model endpoint and every API in api-policy.yaml.
+# examples/networkpolicy.yaml is a worked staging/prod example to copy into
+# values-<env>.yaml.
+networkPolicy:
+  enabled: false
+  ingressFrom: []
+  #   - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: gateway-system}}
+  restrictEgress: false
+  egressTo: []
+
+nodeSelector: {}
+tolerations: []
+affinity: {}