diff --git a/infra/blazegraph/README.md b/infra/blazegraph/README.md index ea1e5d4..781fd13 100644 --- a/infra/blazegraph/README.md +++ b/infra/blazegraph/README.md @@ -1,6 +1,6 @@ # Blazegraph Notebooks Playground -An interactive JupyterLab‑based environment for learning and experimenting with Blazegraph graph databases. +An interactive JupyterLab‑based environment for learning and experimenting with Blazegraph graph databases.\ This repository provides hands‑on examples and tutorials for understanding graph database concepts through practical examples. We use Blazegraph as a local stand‑in for **Amazon Neptune** (via its SPARQL REST API). This lets you practice SPARQL queries, graph modeling, and visualization without needing a cloud cluster. @@ -14,7 +14,7 @@ We use Blazegraph as a local stand‑in for **Amazon Neptune** (via its SPARQL R - **SPARQL Tutorials**: Learn querying through interactive examples - **Sample Datasets**: Install example notebooks with pre‑loaded data - **Docker Support**: One‑command containerized setup -- **Graph‑Notebook Magics**: Use `%%sparql`, `%%gremlin`, `%%oc` directly in notebooks +- **GraphTermType‑Notebook Magics**: Use `%%sparql`, `%%gremlin`, `%%oc` directly in notebooks --- @@ -31,6 +31,7 @@ We use Blazegraph as a local stand‑in for **Amazon Neptune** (via its SPARQL R We recommend using [mise](https://mise.jdx.dev/lang/python.html) to manage Python versions and virtual environments. This ensures reproducibility across machines and avoids conflicts with system Python. ### 1. Install mise + - **macOS/Linux**: ```bash curl https://mise.run | sh @@ -45,6 +46,7 @@ We recommend using [mise](https://mise.jdx.dev/lang/python.html) to manage Pytho ``` ### 2. Configure Python with mise + - Pin Python for this project: ```bash mise use python@3.11 uv@latest @@ -89,13 +91,16 @@ We recommend using [mise](https://mise.jdx.dev/lang/python.html) to manage Pytho ## 🚀 Getting Started ### 1. Clone the repository + ```bash git clone https://github.com/ThunderStrike/neptune-playground.git cd neptune-playground ``` ### 2. Set up Python environment + Using [mise](https://mise.jdx.dev/): + ```bash mise use python@3.11 uv@latest uv pip install -r requirements.txt @@ -107,6 +112,7 @@ python -m graph_notebook.ipython_profile.configure_ipython_profile ``` Or with venv: + ```bash python -m venv venv source venv/bin/activate # On Windows: venv\Scripts\activate @@ -119,13 +125,15 @@ python -m graph_notebook.ipython_profile.configure_ipython_profile ``` > **Note**: The `uv pip install` installs all required packages (JupyterLab 4, graph‑notebook, widgets, etc.): -> ```bash -> uv pip install -r requirements.txt -> # OR the slower alternative: -> pip install -r requirements.txt -> ``` +> +> ```bash +> uv pip install -r requirements.txt +> # OR the slower alternative: +> pip install -r requirements.txt +> ``` ### 3. Run Blazegraph in Docker + ```bash docker compose up --build -d ``` @@ -133,6 +141,7 @@ docker compose up --build -d This exposes Blazegraph at: `http://localhost:9999/blazegraph/sparql` ### 4. Open in VS Code + - Open a `.ipynb` file from `./notebooks` - Select your Python environment as the kernel - Run the first cell to configure Blazegraph: @@ -163,14 +172,14 @@ If there are errors with the notebooks in general, try re-cloning the notebooks python -m graph_notebook.notebooks.install --destination ./notebook_examples ``` - --- ## ⚠️ Widget Rendering in VS Code -Graph‑notebook uses **ipywidgets** for tables and graph visualizations. In VS Code, the Jupyter extension sometimes fails to render these widgets, leaving you with a blank cell. +GraphTermType‑notebook uses **ipywidgets** for tables and graph visualizations. In VS Code, the Jupyter extension sometimes fails to render these widgets, leaving you with a blank cell. ### Workarounds: + - **Plain text/table mode**: Switch the output presentation to “Plain Text” or “Table” to see results. - **Test widgets**: Run: ```python @@ -191,7 +200,7 @@ Graph‑notebook uses **ipywidgets** for tables and graph visualizations. In VS ## 📦 Requirements -We follow the [official graph‑notebook requirements](https://github.com/aws/graph-notebook/blob/main/requirements.txt). +We follow the [official graph‑notebook requirements](https://github.com/aws/graph-notebook/blob/main/requirements.txt).\ Install with: ```bash @@ -232,6 +241,7 @@ The Docker image is pre-seeded with comic data during build time: - **Character tags** for themed discovery To reseed with fresh data: + ```bash cd /workspaces/knowledge-grapht-platform/infra/blazegraph @@ -247,17 +257,17 @@ docker compose up --build -d You can also load data into a running Blazegraph instance: -1. **Interactive seeding** +1. **Interactive seeding**\ In a notebook cell: ```python %seed ``` Use the form to insert triples or load `.ttl/.rdf/.sparql` files. -2. **Example notebooks** - Many installed notebooks (e.g. *Air‑Routes*, *EPL*) walk you through loading datasets step by step. +2. **Example notebooks**\ + Many installed notebooks (e.g. _Air‑Routes_, _EPL_) walk you through loading datasets step by step. -3. **Scripts** +3. **Scripts**\ Use your own `.sparql` files with: ```bash curl -X POST http://localhost:9999/blazegraph/sparql \ @@ -270,11 +280,11 @@ You can also load data into a running Blazegraph instance: # Load TTL ontology files python3 scripts/seed_helper.py load-ttl data/narrative.ttl python3 scripts/seed_helper.py load-ttl data/narrative-rec.ttl - + # Convert and load comic data (limit to 1000 issues) python3 scripts/comic_to_sparql.py data/comic_output.jsonl.zip -l 1000 -o comic_data.sparql python3 scripts/seed_helper.py load-sparql comic_data.sparql - + # Check statistics python3 scripts/seed_helper.py stats ``` @@ -295,17 +305,17 @@ The seeded data now includes rich recommendation metadata from `narrative-rec.tt 1. **Getting Started** - Environment Setup - - Basic Graph Concepts + - Basic GraphTermType Concepts - Your First SPARQL Query 2. **Basic Operations** - CRUD Operations - Simple Queries - - Graph Traversal + - GraphTermType Traversal 3. **Advanced Queries** - Complex SPARQL Patterns - - Graph Analytics + - GraphTermType Analytics - Performance Optimization 4. **Use Cases** @@ -329,8 +339,8 @@ This project is licensed under the Apache‑2.0 License – see the LICENSE file ## 📚 Resources -- [Graph‑Notebook README](https://github.com/aws/graph-notebook/blob/main/README.md) -- [Graph‑Notebook Requirements](https://github.com/aws/graph-notebook/blob/main/requirements.txt) +- [GraphTermType‑Notebook README](https://github.com/aws/graph-notebook/blob/main/README.md) +- [GraphTermType‑Notebook Requirements](https://github.com/aws/graph-notebook/blob/main/requirements.txt) - [Blazegraph Documentation](https://github.com/blazegraph/database/) - [SPARQL 1.1 Query Language](https://www.w3.org/TR/sparql11-query/) - [Jupyter Documentation](https://jupyter.org/documentation) diff --git a/infra/blazegraph/docker-compose.yaml b/infra/blazegraph/docker-compose.yaml index 505a0dd..a92ea0f 100644 --- a/infra/blazegraph/docker-compose.yaml +++ b/infra/blazegraph/docker-compose.yaml @@ -71,7 +71,7 @@ services: # Map host port -> container port. # Default is 9999 (Blazegraph standard), but you can override via .env # if you need to run multiple instances or avoid conflicts. - - "${NEPTUNE_PORT:-9999}:9999" + - '${NEPTUNE_PORT:-9999}:9999' volumes: # Persistent storage for the RDF journal file. @@ -107,7 +107,7 @@ services: # The Dockerfile defines a default health check, but we repeat it here # so it's easy to tweak per-environment (e.g., longer intervals in prod). healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:9999/blazegraph/status"] + test: ['CMD', 'curl', '-f', 'http://localhost:9999/blazegraph/status'] interval: ${NEPTUNE_HEALTH_INTERVAL:-30s} timeout: ${NEPTUNE_HEALTH_TIMEOUT:-10s} retries: ${NEPTUNE_HEALTH_RETRIES:-3} @@ -117,7 +117,7 @@ services: # Blazegraph can be chatty (especially with query logging enabled). # This caps logs at 10MB per file, keeping only 3 rotations (~30MB max). logging: - driver: "json-file" + driver: 'json-file' options: max-size: ${NEPTUNE_LOG_MAX_SIZE:-10m} max-file: ${NEPTUNE_LOG_MAX_FILE:-3} diff --git a/infra/qlever/docker-compose.yaml b/infra/qlever/docker-compose.yaml index dc90fdb..e13f299 100644 --- a/infra/qlever/docker-compose.yaml +++ b/infra/qlever/docker-compose.yaml @@ -4,33 +4,33 @@ services: container_name: qlever-init env_file: - ./qlever.env - user: "0:0" + user: '0:0' volumes: - qlever-server-data:/data command: - sh - -lc - | - echo "Fixing /data ownership to ${UID:-1000}:${GID:-1000}" - chown -R ${UID:-1000}:${GID:-1000} /data - chmod -R u+rwX,g+rwX,o+rX /data - restart: "no" + echo "Fixing /data ownership to ${UID:-1000}:${GID:-1000}" + chown -R ${UID:-1000}:${GID:-1000} /data + chmod -R u+rwX,g+rwX,o+rX /data + restart: 'no' qlever-server: build: context: . dockerfile: ./Dockerfile - + image: ghcr.io/popmodern/qlever-wrapper:latest container_name: qlever-server # Optional (Apple Silicon workaround you already discovered): # set QLEVER_PLATFORM=linux/amd64 in a .env file when needed - platform: "${QLEVER_PLATFORM:-linux/amd64}" + platform: '${QLEVER_PLATFORM:-linux/amd64}' # Not strictly required because your entrypoint does `cd /data`, # but it keeps everything consistent and avoids surprises. - user: "${UID:-1000}:${GID:-1000}" # <-- MUST match qlever.env UID/GID + user: '${UID:-1000}:${GID:-1000}' # <-- MUST match qlever.env UID/GID working_dir: /data depends_on: qlever-init: @@ -42,12 +42,12 @@ services: volumes: # QLever working dir (Qleverfile + index artifacts) - qlever-server-data:/data - + # Your raw host data folder, mounted read-only - ./data:/input:ro ports: - - "7001:7001" # server + - '7001:7001' # server restart: unless-stopped @@ -57,7 +57,7 @@ services: depends_on: - qlever-server ports: - - "7002:7000" + - '7002:7000' restart: unless-stopped volumes: - qlever-ui-db:/app/db diff --git a/infra/qlever/k8s/00-namespace.yaml b/infra/qlever/k8s/00-namespace.yaml index 832cfb7..b55f68e 100644 --- a/infra/qlever/k8s/00-namespace.yaml +++ b/infra/qlever/k8s/00-namespace.yaml @@ -9,4 +9,4 @@ metadata: app.kubernetes.io/component: sparql-database pod-security.kubernetes.io/enforce: baseline pod-security.kubernetes.io/audit: baseline - pod-security.kubernetes.io/warn: baseline \ No newline at end of file + pod-security.kubernetes.io/warn: baseline diff --git a/infra/qlever/k8s/01-secrets.yaml b/infra/qlever/k8s/01-secrets.yaml index 114d2e8..5ca8181 100644 --- a/infra/qlever/k8s/01-secrets.yaml +++ b/infra/qlever/k8s/01-secrets.yaml @@ -15,7 +15,7 @@ metadata: type: Opaque stringData: # Replace with secure token: openssl rand -base64 32 - QLEVER_SERVER_ACCESS_TOKEN: "CHANGE-ME-TO-SECURE-TOKEN" + QLEVER_SERVER_ACCESS_TOKEN: 'CHANGE-ME-TO-SECURE-TOKEN' # --- # Optional: Git credentials for private repositories @@ -29,4 +29,4 @@ stringData: # type: Opaque # stringData: # username: "your-git-username" -# password: "your-git-token-or-password" # Use token, not password! \ No newline at end of file +# password: "your-git-token-or-password" # Use token, not password! diff --git a/infra/qlever/k8s/02-configmaps.yaml b/infra/qlever/k8s/02-configmaps.yaml index 6b2288b..b6cf452 100644 --- a/infra/qlever/k8s/02-configmaps.yaml +++ b/infra/qlever/k8s/02-configmaps.yaml @@ -14,36 +14,36 @@ metadata: app.kubernetes.io/component: sparql-database data: # Config file generation - QLEVER_GENERATE_CONFIG_FILE: "true" + QLEVER_GENERATE_CONFIG_FILE: 'true' # [data] - QLEVER_DATA_NAME: "local" - QLEVER_DATA_DESCRIPTION: "Local dataset for QLever" + QLEVER_DATA_NAME: 'local' + QLEVER_DATA_DESCRIPTION: 'Local dataset for QLever' # [index] - QLEVER_INDEX_INPUT_FILES: "../qlever/input/**/*.ttl" - QLEVER_INDEX_CAT_INPUT_FILES: "cat ../qlever/input/**/*.ttl" - QLEVER_INDEX_PARALLEL_PARSING: "false" + QLEVER_INDEX_INPUT_FILES: '../qlever/input/**/*.ttl' + QLEVER_INDEX_CAT_INPUT_FILES: 'cat ../qlever/input/**/*.ttl' + QLEVER_INDEX_PARALLEL_PARSING: 'false' QLEVER_INDEX_SETTINGS_JSON: '{ "ascii-prefixes-only": false, "num-triples-per-batch": 100000 }' # [server] - QLEVER_SERVER_HOST_NAME: "0.0.0.0" - QLEVER_SERVER_PORT: "7001" - QLEVER_SERVER_MEMORY_FOR_QUERIES: "8G" - QLEVER_SERVER_CACHE_MAX_SIZE: "4G" - QLEVER_SERVER_TIMEOUT: "300s" + QLEVER_SERVER_HOST_NAME: '0.0.0.0' + QLEVER_SERVER_PORT: '7001' + QLEVER_SERVER_MEMORY_FOR_QUERIES: '8G' + QLEVER_SERVER_CACHE_MAX_SIZE: '4G' + QLEVER_SERVER_TIMEOUT: '300s' # [runtime] - QLEVER_RUNTIME_SYSTEM: "native" + QLEVER_RUNTIME_SYSTEM: 'native' # Entrypoint behavior - SHOULD_DOWNLOAD: "false" - FORCE_DOWNLOAD: "false" - SHOULD_INDEX: "true" - FORCE_INDEXING: "false" - STOP_ON_CALL_ENABLED: "false" - START_ADDITIONAL_ARGS: "" + SHOULD_DOWNLOAD: 'false' + FORCE_DOWNLOAD: 'false' + SHOULD_INDEX: 'true' + FORCE_INDEXING: 'false' + STOP_ON_CALL_ENABLED: 'false' + START_ADDITIONAL_ARGS: '' # User/Group IDs (used by init container) - UID: "1000" - GID: "1000" \ No newline at end of file + UID: '1000' + GID: '1000' diff --git a/infra/qlever/k8s/03-storage.yaml b/infra/qlever/k8s/03-storage.yaml index 4aab377..4153795 100644 --- a/infra/qlever/k8s/03-storage.yaml +++ b/infra/qlever/k8s/03-storage.yaml @@ -1,5 +1,5 @@ -# Install local-path-storage from rauncher during development -# +# Install local-path-storage from rauncher during development +# # kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml --- # Persistent volume for /data (Qleverfile + index artifacts) @@ -18,4 +18,4 @@ spec: requests: storage: 1Gi # Optional: Uncomment to pin to specific storage class - storageClassName: local-path # Common for local clusters (k3s, Talos) \ No newline at end of file + storageClassName: local-path # Common for local clusters (k3s, Talos) diff --git a/infra/qlever/k8s/04-deployment.yaml b/infra/qlever/k8s/04-deployment.yaml index db082e4..1e0f740 100644 --- a/infra/qlever/k8s/04-deployment.yaml +++ b/infra/qlever/k8s/04-deployment.yaml @@ -8,11 +8,11 @@ metadata: labels: app.kubernetes.io/name: qlever app.kubernetes.io/component: sparql-database - app.kubernetes.io/version: "latest" + app.kubernetes.io/version: 'latest' spec: replicas: 1 strategy: - type: Recreate # Single replica, avoid two pods fighting over ReadWriteOnce PVC + type: Recreate # Single replica, avoid two pods fighting over ReadWriteOnce PVC selector: matchLabels: app: qlever-server @@ -25,7 +25,7 @@ spec: spec: # Graceful shutdown terminationGracePeriodSeconds: 120 - + # Pod-level security context securityContext: runAsUser: 1000 @@ -34,59 +34,59 @@ spec: fsGroupChangePolicy: OnRootMismatch seccompProfile: type: RuntimeDefault - + containers: - name: qlever-server image: ghcr.io/popmodern/qlever-wrapper:latest imagePullPolicy: Always - + # Container-level security context # Best practice: read-only root filesystem + explicit writable volumes securityContext: runAsNonRoot: true allowPrivilegeEscalation: false - readOnlyRootFilesystem: true # Immutable infrastructure + readOnlyRootFilesystem: true # Immutable infrastructure capabilities: drop: [ALL] - + workingDir: /data - + # Environment from ConfigMap and Secret envFrom: - configMapRef: name: qlever-config - secretRef: name: qlever-secrets - + ports: - name: http containerPort: 7001 protocol: TCP - + # Volume mounts volumeMounts: # Data volume - READ/WRITE (database writes here) - name: data mountPath: /data readOnly: false - + # Writable temp directory (required with readOnlyRootFilesystem) - name: tmp mountPath: /tmp - + # Writable cache directory - name: cache mountPath: /var/cache - + # Resource limits resources: requests: - cpu: "250m" - memory: "512Mi" + cpu: '250m' + memory: '512Mi' limits: - cpu: "1" - memory: "2Gi" - + cpu: '1' + memory: '2Gi' + # Health probes using SPARQL queries # Startup probe: Allows up to 30 minutes for initial indexing startupProbe: @@ -95,11 +95,11 @@ spec: - /bin/sh - -c - | - curl -sf http://localhost:7001 > /dev/null + curl -sf http://localhost:7001 > /dev/null periodSeconds: 10 - failureThreshold: 180 # 30 minutes (180 * 10s) + failureThreshold: 180 # 30 minutes (180 * 10s) timeoutSeconds: 5 - + # Readiness probe: Confirms database is responding to queries readinessProbe: exec: @@ -107,15 +107,15 @@ spec: - /bin/sh - -c - | - curl -sf http://localhost:7001 \ - -H "Accept: text/tab-separated-values" \ - --data-urlencode 'query=SELECT * WHERE { ?s ?p ?o } LIMIT 1' \ - > /dev/null + curl -sf http://localhost:7001 \ + -H "Accept: text/tab-separated-values" \ + --data-urlencode 'query=SELECT * WHERE { ?s ?p ?o } LIMIT 1' \ + > /dev/null initialDelaySeconds: 30 periodSeconds: 10 timeoutSeconds: 10 failureThreshold: 3 - + # Liveness probe: Ensures server stays responsive livenessProbe: exec: @@ -123,15 +123,15 @@ spec: - /bin/sh - -c - | - curl -sf http://localhost:7001 \ - -H "Accept: text/tab-separated-values" \ - --data-urlencode 'query=SELECT * WHERE { ?s ?p ?o } LIMIT 1' \ - > /dev/null + curl -sf http://localhost:7001 \ + -H "Accept: text/tab-separated-values" \ + --data-urlencode 'query=SELECT * WHERE { ?s ?p ?o } LIMIT 1' \ + > /dev/null initialDelaySeconds: 120 periodSeconds: 30 timeoutSeconds: 10 failureThreshold: 3 - + # Graceful shutdown lifecycle: preStop: @@ -140,19 +140,19 @@ spec: - /bin/bash - -c - | - cd /data - qlever stop || true - + cd /data + qlever stop || true + volumes: # Persistent data volume - name: data persistentVolumeClaim: claimName: qlever-data-pvc - + # Ephemeral volumes for writable directories # (required when readOnlyRootFilesystem: true) - name: tmp emptyDir: {} - + - name: cache - emptyDir: {} \ No newline at end of file + emptyDir: {} diff --git a/infra/qlever/k8s/05-service.yaml b/infra/qlever/k8s/05-service.yaml index 616555b..a8f2575 100644 --- a/infra/qlever/k8s/05-service.yaml +++ b/infra/qlever/k8s/05-service.yaml @@ -37,7 +37,7 @@ metadata: app.kubernetes.io/component: sparql-database app.kubernetes.io/environment: dev annotations: - description: "NodePort service for local development - remove in production" + description: 'NodePort service for local development - remove in production' spec: type: NodePort selector: @@ -46,5 +46,5 @@ spec: - name: http port: 7001 targetPort: 7001 - nodePort: 30701 # Fixed port 30701 for consistency - protocol: TCP \ No newline at end of file + nodePort: 30701 # Fixed port 30701 for consistency + protocol: TCP diff --git a/infra/qlever/k8s/gateway/01-caddy-gateway-install.yaml b/infra/qlever/k8s/gateway/01-caddy-gateway-install.yaml index a2851c3..46effde 100644 --- a/infra/qlever/k8s/gateway/01-caddy-gateway-install.yaml +++ b/infra/qlever/k8s/gateway/01-caddy-gateway-install.yaml @@ -32,22 +32,29 @@ metadata: name: caddy-gateway-controller rules: # Gateway API resources - - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gatewayclasses", "gateways", "httproutes", "grpcroutes", "tcproutes", "tlsroutes"] - verbs: ["get", "list", "watch"] - - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gatewayclasses/status", "gateways/status", "httproutes/status", "grpcroutes/status", "tcproutes/status", "tlsroutes/status"] - verbs: ["update", "patch"] - + - apiGroups: ['gateway.networking.k8s.io'] + resources: ['gatewayclasses', 'gateways', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes'] + verbs: ['get', 'list', 'watch'] + - apiGroups: ['gateway.networking.k8s.io'] + resources: [ + 'gatewayclasses/status', + 'gateways/status', + 'httproutes/status', + 'grpcroutes/status', + 'tcproutes/status', + 'tlsroutes/status', + ] + verbs: ['update', 'patch'] + # Core resources - - apiGroups: [""] - resources: ["services", "endpoints", "secrets", "configmaps"] - verbs: ["get", "list", "watch"] - + - apiGroups: [''] + resources: ['services', 'endpoints', 'secrets', 'configmaps'] + verbs: ['get', 'list', 'watch'] + # For creating LoadBalancer services - - apiGroups: [""] - resources: ["services"] - verbs: ["create", "update", "patch", "delete"] + - apiGroups: [''] + resources: ['services'] + verbs: ['create', 'update', 'patch', 'delete'] --- # ClusterRoleBinding @@ -90,7 +97,7 @@ spec: fsGroup: 1000 containers: - name: controller - image: ghcr.io/caddyserver/gateway:latest # Use specific version in production + image: ghcr.io/caddyserver/gateway:latest # Use specific version in production imagePullPolicy: IfNotPresent args: - --gateway-class-name=caddy @@ -125,7 +132,7 @@ metadata: labels: app.kubernetes.io/name: caddy-proxy spec: - replicas: 2 # Multiple replicas for HA + replicas: 2 # Multiple replicas for HA selector: matchLabels: app.kubernetes.io/name: caddy-proxy @@ -157,7 +164,7 @@ spec: readOnlyRootFilesystem: true capabilities: drop: [ALL] - add: [NET_BIND_SERVICE] # Bind to ports 80/443 + add: [NET_BIND_SERVICE] # Bind to ports 80/443 resources: requests: cpu: 100m @@ -195,15 +202,15 @@ metadata: # Cloud provider specific annotations # AWS example: # service.beta.kubernetes.io/aws-load-balancer-type: "nlb" - + # GCP example: # cloud.google.com/load-balancer-type: "External" - + # Azure example: # service.beta.kubernetes.io/azure-load-balancer-resource-group: "my-rg" spec: type: LoadBalancer - externalTrafficPolicy: Local # Preserve source IP + externalTrafficPolicy: Local # Preserve source IP selector: app.kubernetes.io/name: caddy-proxy ports: @@ -214,4 +221,4 @@ spec: - name: https port: 443 targetPort: 443 - protocol: TCP \ No newline at end of file + protocol: TCP diff --git a/infra/qlever/k8s/gateway/02-gateway.yaml b/infra/qlever/k8s/gateway/02-gateway.yaml index c02820b..3a561e4 100644 --- a/infra/qlever/k8s/gateway/02-gateway.yaml +++ b/infra/qlever/k8s/gateway/02-gateway.yaml @@ -36,7 +36,7 @@ metadata: annotations: # Caddy-specific annotations for HTTPS # Email for Let's Encrypt notifications - caddy.gateway.kubernetes.io/email: "gateway@popmodern.dev" # ⚠️ CHANGE THIS + caddy.gateway.kubernetes.io/email: 'gateway@popmodern.dev' # ⚠️ CHANGE THIS spec: gatewayClassName: caddy listeners: @@ -47,7 +47,7 @@ spec: allowedRoutes: namespaces: from: Same - + # HTTPS listener (automatic TLS via Caddy) - name: https protocol: HTTPS @@ -74,16 +74,16 @@ spec: parentRefs: - name: qlever-gateway namespace: qlever - + hostnames: - - "qlever.popmodern.dev" # ⚠️ CHANGE THIS to your domain - + - 'qlever.popmodern.dev' # ⚠️ CHANGE THIS to your domain + rules: - matches: - path: type: PathPrefix value: / backendRefs: - - name: qlever-server # ClusterIP service + - name: qlever-server # ClusterIP service port: 7001 - weight: 1 \ No newline at end of file + weight: 1 diff --git a/infra/qlever/k8s/gateway/03-network-policies.yaml b/infra/qlever/k8s/gateway/03-network-policies.yaml index 7448094..b598ffe 100644 --- a/infra/qlever/k8s/gateway/03-network-policies.yaml +++ b/infra/qlever/k8s/gateway/03-network-policies.yaml @@ -1,5 +1,5 @@ # Zero-Trust Network Policies for QLever -# +# # Architecture: # 1. Default deny all traffic # 2. Explicitly allow QLever ingress from Caddy @@ -18,7 +18,7 @@ metadata: labels: app.kubernetes.io/name: qlever spec: - podSelector: {} # Applies to all pods + podSelector: {} # Applies to all pods policyTypes: - Ingress - Egress @@ -145,4 +145,4 @@ spec: # - Ingress # ingress: # - from: -# - podSelector: {} \ No newline at end of file +# - podSelector: {} diff --git a/infra/qlever/k8s/gateway/kustomization.yaml b/infra/qlever/k8s/gateway/kustomization.yaml index 325b709..4254b7c 100644 --- a/infra/qlever/k8s/gateway/kustomization.yaml +++ b/infra/qlever/k8s/gateway/kustomization.yaml @@ -1,6 +1,6 @@ --- # Kustomization for QLever Deployment -# +# # Usage: # kubectl apply -k k8s/gateway/ # @@ -20,4 +20,4 @@ resources: labels: - pairs: app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/part-of: gateway \ No newline at end of file + app.kubernetes.io/part-of: gateway diff --git a/infra/qlever/k8s/kustomization.yaml b/infra/qlever/k8s/kustomization.yaml index b0b160b..0a86f24 100644 --- a/infra/qlever/k8s/kustomization.yaml +++ b/infra/qlever/k8s/kustomization.yaml @@ -1,6 +1,6 @@ --- # Kustomization for QLever Deployment -# +# # Usage: # kubectl apply -k k8s/ # @@ -18,7 +18,7 @@ resources: - 03-storage.yaml - 04-deployment.yaml - 05-service.yaml - + # Only uncomment for Production # - ./gateway @@ -56,4 +56,4 @@ labels: # patch: |- # - op: replace # path: /spec/replicas -# value: 2 \ No newline at end of file +# value: 2 diff --git a/infra/qlever/k8s/storage/00-local-path-storage.yaml b/infra/qlever/k8s/storage/00-local-path-storage.yaml index f03f2b5..b835026 100644 --- a/infra/qlever/k8s/storage/00-local-path-storage.yaml +++ b/infra/qlever/k8s/storage/00-local-path-storage.yaml @@ -21,9 +21,9 @@ metadata: name: local-path-provisioner-role namespace: local-path-storage rules: - - apiGroups: [""] - resources: ["pods"] - verbs: ["get", "list", "watch", "create", "patch", "update", "delete"] + - apiGroups: [''] + resources: ['pods'] + verbs: ['get', 'list', 'watch', 'create', 'patch', 'update', 'delete'] --- apiVersion: rbac.authorization.k8s.io/v1 @@ -31,18 +31,18 @@ kind: ClusterRole metadata: name: local-path-provisioner-role rules: - - apiGroups: [""] - resources: ["nodes", "persistentvolumeclaims", "configmaps", "pods", "pods/log"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "patch", "update", "delete"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] + - apiGroups: [''] + resources: ['nodes', 'persistentvolumeclaims', 'configmaps', 'pods', 'pods/log'] + verbs: ['get', 'list', 'watch'] + - apiGroups: [''] + resources: ['persistentvolumes'] + verbs: ['get', 'list', 'watch', 'create', 'patch', 'update', 'delete'] + - apiGroups: [''] + resources: ['events'] + verbs: ['create', 'patch'] + - apiGroups: ['storage.k8s.io'] + resources: ['storageclasses'] + verbs: ['get', 'list', 'watch'] --- apiVersion: rbac.authorization.k8s.io/v1 diff --git a/infra/qlever/k8s/storage/kustomization.yaml b/infra/qlever/k8s/storage/kustomization.yaml index 88b5a69..d7604fb 100644 --- a/infra/qlever/k8s/storage/kustomization.yaml +++ b/infra/qlever/k8s/storage/kustomization.yaml @@ -1,6 +1,6 @@ --- # Kustomization for QLever Deployment -# +# # Usage: # kubectl apply -k k8s/storage/ # @@ -18,4 +18,4 @@ resources: labels: - pairs: app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/part-of: storage \ No newline at end of file + app.kubernetes.io/part-of: storage