kubernetes.yaml

# Portainer-Run — Kubernetes deployment manifest example for development
#
# Deploys Portainer-Run as a single pod in the portainer-addon-portainer-run namespace.
#
# Required: update PORTAINER_URL and ENCRYPTION_KEY in the ConfigMap before applying.
# Optional components are commented out with instructions below.
#
# Apply:
#   kubectl apply -f kubernetes.yaml
#
# Remove:
#   kubectl delete -f kubernetes.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: portainer-addon-portainer-run
  labels:
    app: portainer-run

---
# ConfigMap — non-sensitive configuration
# Update PORTAINER_URL before applying.
apiVersion: v1
kind: ConfigMap
metadata:
  name: portainer-run-config
  namespace: portainer-addon-portainer-run
data:
  PORTAINER_URL: 'https://portainer.portainer.svc.cluster.local:9443'
  # Cluster-internal DNS is the default (addon runs alongside Portainer).
  # For an external Portainer, use its public URL instead:
  # PORTAINER_URL: "https://portainer.example.com:9443"

  # ── Ingress base domain ─────────────────────────────────────────────────────
  # If set, Ingress templates default to appname.BASE_DOMAIN as the host.
  # BASE_DOMAIN: "apps.example.com"

  # ── File relay gateway ───────────────────────────────────────────────────────
  # Required for staged file uploads via the run-gateway proxy.
  # When set, large vibe deploy uploads use the gateway instead of inline MCP transfer.
  GATEWAY_URL: 'https://run-gateway.portainer.ai'

  # ── AI model override ────────────────────────────────────────────────────────
  # OpenAI model to use (default: gpt-4o). No effect when using Anthropic.
  # OPENAI_MODEL: "gpt-4o"

  # ── Custom ports ────────────────────────────────────────────────────────────
  # Only needed if you change containerPort below to match.
  # PORT: "443"
  # HTTP_PORT: "80"

  # ── Addon-gateway mode ───────────────────────────────────────────────────
  # Served as a Portainer addon at <portainer>/addons/portainer-run/. TLS
  # terminates at the Portainer gateway, which proxies plain HTTP to us, so we
  # serve HTTP directly. Without this we run HTTPS + an HTTP→HTTPS redirect on
  # port 80; the gateway hits that redirect and bounces the browser to the
  # cluster DNS name, out of the Portainer base URL.
  SERVE_HTTP: '1'
  PORT: '80'

  # ── Cache directory ──────────────────────────────────────────────────────────
  # Override the directory used for persistent cache (default: /app/data).
  # Must match the mountPath of the volume in the Deployment if changed.
  # CACHE_DIR: "/app/data"

---
# Secret — sensitive values
# Add your AI provider key before applying.
# To encode a value:  echo -n 'your-key-here' | base64
# Add your ENCRYPTION_KEY and AI provider key before applying.
# To encode a value:  echo -n 'your-value-here' | base64
apiVersion: v1
kind: Secret
metadata:
  name: portainer-run-secret
  namespace: portainer-addon-portainer-run
type: Opaque
stringData:
  # ── Required: encryption key ────────────────────────────────────────────────
  # Encrypts stored Git target credentials at rest. Min 32 chars.
  # Generate: openssl rand -hex 32 | base64
  ENCRYPTION_KEY: ''

  # ── Anthropic (Claude) ──────────────────────────────────────────────────────
  # Base64-encode your key: echo -n 'sk-ant-...' | base64
  ANTHROPIC_API_KEY: ''

  # ── OpenAI (GPT-4o) — uncomment if using OpenAI instead ────────────────────
  # OPENAI_API_KEY: ""

---
# PersistentVolumeClaim — session cache storage
# Keeps the deployment cache across pod restarts.
# Remove this and the corresponding volume/volumeMount in the Deployment
# if you do not need cache persistence.
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: portainer-run-cache
  namespace: portainer-addon-portainer-run
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  # storageClassName: standard   # Uncomment and set if your cluster requires an explicit class

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: portainer-run
  namespace: portainer-addon-portainer-run
  labels:
    app: portainer-run
spec:
  replicas: 1
  selector:
    matchLabels:
      app: portainer-run
  template:
    metadata:
      labels:
        app: portainer-run
    spec:
      # The ServiceAccount token stays mounted: the server auto-detects
      # CONFIG_NAMESPACE from it. If it is ever disabled, pin CONFIG_NAMESPACE
      # in the ConfigMap at the same time or state silently moves to kube-system.
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: portainer-run
          image: portainer/portainer-run:latest
          imagePullPolicy: Always
          # Note: no runAsNonRoot / drop-ALL-caps / readOnlyRootFilesystem — the
          # server binds a privileged port (80/443, needs CAP_NET_BIND_SERVICE)
          # and writes a self-signed cert to /app in TLS mode.
          securityContext:
            allowPrivilegeEscalation: false
          ports:
            - name: https
              containerPort: 443
              protocol: TCP
            - name: http
              containerPort: 80
              protocol: TCP
          envFrom:
            - configMapRef:
                name: portainer-run-config
          env:
            # ── Encryption key (required) ─────────────────────────────────────
            - name: ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: portainer-run-secret
                  key: ENCRYPTION_KEY

            # ── Anthropic API key ─────────────────────────────────────────────
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: portainer-run-secret
                  key: ANTHROPIC_API_KEY
                  optional: true

            # ── OpenAI API key — uncomment if using OpenAI ───────────────────
            # - name: OPENAI_API_KEY
            #   valueFrom:
            #     secretKeyRef:
            #       name: portainer-run-secret
            #       key: OPENAI_API_KEY
            #       optional: true

            # ── Explicit provider override ────────────────────────────────────
            # Auto-detected from whichever key is set. Override only if needed.
            # - name: AI_PROVIDER
            #   value: "anthropic"

            # ── Real TLS certificates ─────────────────────────────────────────
            # Mount your cert Secret below and uncomment these:
            # - name: SSL_CERT
            #   value: "/certs/tls.crt"
            # - name: SSL_KEY
            #   value: "/certs/tls.key"
            # - name: SSL_CERT_DIR
            #   value: "/certs"

          volumeMounts:
            # ── Session cache ─────────────────────────────────────────────────
            - name: cache
              mountPath: /app/data

            # ── Real TLS certificates ─────────────────────────────────────────
            # Create a TLS Secret and uncomment to mount it:
            # kubectl create secret tls portainer-run-tls \
            #   --cert=/path/to/fullchain.pem \
            #   --key=/path/to/privkey.pem \
            #   -n portainer-addon-portainer-run
            # - name: tls-certs
            #   mountPath: /certs
            #   readOnly: true

          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 256Mi

          livenessProbe:
            httpGet:
              path: /config
              port: 80
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 30
            failureThreshold: 3

          readinessProbe:
            httpGet:
              path: /config
              port: 80
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10

      volumes:
        # ── Session cache ───────────────────────────────────────────────────
        - name: cache
          persistentVolumeClaim:
            claimName: portainer-run-cache

        # ── Real TLS certificates ───────────────────────────────────────────
        # Uncomment after creating the TLS Secret above:
        # - name: tls-certs
        #   secret:
        #     secretName: portainer-run-tls

      # ── DNS override ────────────────────────────────────────────────────────
      # If the pod cannot resolve your Portainer hostname, uncomment:
      #dnsConfig:
      #  options:
      #    - name: ndots
      #      value: "1"
      #  nameservers:
      #     - 8.8.8.8

---
# Service — exposes Portainer-Run within the cluster
apiVersion: v1
kind: Service
metadata:
  name: portainer-run
  namespace: portainer-addon-portainer-run
  labels:
    app: portainer-run
spec:
  selector:
    app: portainer-run
  ports:
    - name: https
      port: 443
      targetPort: 443
      protocol: TCP
    - name: http
      port: 80
      targetPort: 80
      protocol: TCP
  # ── Service type ─────────────────────────────────────────────────────────────
  # ClusterIP: internal access only (use with Ingress below).
  # NodePort:  direct access via node IP and auto-assigned port.
  # LoadBalancer: external IP via cloud provider LB.
  type: ClusterIP
  # type: NodePort
  # type: LoadBalancer

---
# Ingress — expose Portainer-Run via an ingress controller
# Uncomment and configure if using ClusterIP above.
# Requires an ingress controller (nginx, traefik, etc.) in your cluster.
#
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
#   name: portainer-run
#   namespace: portainer-addon-portainer-run
#   annotations:
#     # nginx:
#     kubernetes.io/ingress.class: "nginx"
#     nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
#     nginx.ingress.kubernetes.io/ssl-passthrough: "true"
#     # cert-manager (Let's Encrypt):
#     # cert-manager.io/cluster-issuer: "letsencrypt-prod"
# spec:
#   # tls:
#   #   - hosts:
#   #       - portainer-run.example.com
#   #     secretName: portainer-run-tls
#   rules:
#     - host: portainer-run.example.com
#       http:
#         paths:
#           - path: /
#             pathType: Prefix
#             backend:
#               service:
#                 name: portainer-run
#                 port:
#                   number: 443