Initial segregate: proxy source, deploy manifests, ImagePolicy Flux CRs.

Move workload out of infra with cursor-devbox-style GitRepository + run_number-sha image automation.
2026-09-21 10:31:36 +03:00
commit 57a036ba5e
22 changed files with 2444 additions and 0 deletions
@@ -0,0 +1,153 @@
+# Cursor Agent API workload (node4).
+# Namespace + SecretAdapters live in infra glue (131-cursor-agent-api.yaml).
+# Image tag updated by Flux ImageUpdateAutomation (run_number-sha tags).
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cursor-agent-state
+  namespace: cursor-agent-api
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-storage
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cursor-agent-api
+  namespace: cursor-agent-api
+  labels:
+    app: cursor-agent-api
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: cursor-agent-api
+  template:
+    metadata:
+      labels:
+        app: cursor-agent-api
+    spec:
+      imagePullSecrets:
+        - name: dcr-registry-auth-ro
+      initContainers:
+        - name: bootstrap-cursor
+          image: dcr.trinitysan.by/infra/cursor-agent-api-proxy:latest # {"$imagepolicy": "flux-system:cursor-agent-api-proxy"}
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: CURSOR_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: cursor-auth
+                  key: CURSOR_API_KEY
+          command:
+            - /app/scripts/bootstrap-cursor.sh
+          volumeMounts:
+            - name: cursor-state
+              mountPath: /home/nobody/.cursor
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        fsGroup: 65534
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: proxy
+          image: dcr.trinitysan.by/infra/cursor-agent-api-proxy:latest # {"$imagepolicy": "flux-system:cursor-agent-api-proxy"}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 4646
+          env:
+            - name: CURSOR_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: cursor-auth
+                  key: CURSOR_API_KEY
+            - name: PORT
+              value: "4646"
+            - name: PROXY_SESSION_TTL_MS
+              value: "120000"
+            - name: PROXY_MAX_CONCURRENT_SESSIONS
+              value: "4"
+            - name: ACP_REQUEST_TIMEOUT_MS
+              value: "300000"
+            - name: PROXY_INTERNAL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: cursor-proxy-internal-token
+                  key: PROXY_INTERNAL_TOKEN
+          volumeMounts:
+            - name: cursor-state
+              mountPath: /home/nobody/.cursor
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop:
+                - ALL
+      volumes:
+        - name: cursor-state
+          persistentVolumeClaim:
+            claimName: cursor-agent-state
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cursor-agent-api
+  namespace: cursor-agent-api
+  annotations:
+    service.kubernetes.io/topology-mode: Auto
+spec:
+  selector:
+    app: cursor-agent-api
+  ports:
+    - name: http
+      port: 4646
+      targetPort: http
+
+---
+apiVersion: multicluster.x-k8s.io/v1alpha1
+kind: ServiceExport
+metadata:
+  name: cursor-agent-api
+  namespace: cursor-agent-api