dev_omi_pusher_values.yaml

# Default values for pusher.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Keep every rollout availability delay explicit. CI derives the healthy
# rollout budget from these values and the HPA ceiling, rather than inheriting
# Kubernetes defaults that can make a healthy rollout look stalled.
minReadySeconds: 0
progressDeadlineSeconds: 9600

# This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
replicaCount: 1

# This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
image:
  repository: gcr.io/based-hardware-dev/pusher
  # This sets the pull policy for images.
  pullPolicy: Always
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""
  # Build-once promotion: set `digest: sha256:<64 lowercase hex>` (and clear
  # `tag`, set `pullPolicy: IfNotPresent`) to deploy an exact content-addressed
  # image qualified once in dev. Malformed/ambiguous identity is rejected at
  # render time. See backend/scripts/verify_pusher_rollout_gate.py.

# This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imagePullSecrets: []
# This is to override the chart name.
nameOverride: ""
fullnameOverride: ""

# This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Automatically mount a ServiceAccount's API credentials?
  automount: false
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

# This is for setting Kubernetes Annotations to a Pod.
# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
podAnnotations:
  prometheus.io/scrape: "true"
  prometheus.io/port: "8080"
  prometheus.io/path: "/metrics"
# This is for setting Kubernetes Labels to a Pod.
# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
podLabels:
  env: dev
  # The development Prometheus job keeps this target in the development
  # evidence plane as a second boundary alongside its namespace selector.

podSecurityContext: {}
  # fsGroup: 2000

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  runAsNonRoot: true
  runAsUser: 10001
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

# This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
service:
  # This sets the service type more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
  type: ClusterIP
  # This sets the ports more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#field-spec-ports
  backendConfig: dev-pusher-backend-config
  port: 8080
  annotations:
    cloud.google.com/neg: '{"ingress": true}'
    cloud.google.com/backend-config: '{"default": "dev-pusher-backend-config"}'  # Link to BackendConfig

# BackendConfig connectionDraining: bounds how long the LB waits before cutting
# in-flight WS on endpoint removal (must be <= terminationGracePeriodSeconds 120).
backendConfig:
  connectionDraining:
    drainingTimeoutSec: 60

# This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
ingress:
  enabled: true
  className: ""
  annotations:
    kubernetes.io/ingress.class: "gce-internal"
    kubernetes.io/ingress.regional-static-ip-name: "dev-pusher-ilb-ip-address"
    kubernetes.io/ingress.allow-http: "true"
  hosts:
    - host: pusher.omiapi.com
      paths:
        - path: /
          pathType: Prefix

  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

envFrom:
  - configMapRef:
      name: dev-omi-backend-config
runtimeConfigMapName: dev-omi-backend-config

env:
  - name: BUCKET_SPEECH_PROFILES
    value: "speech-profiles-dev"
  - name: GITHUB_TOKEN
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: GITHUB_TOKEN
  - name: OPENAI_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: OPENAI_API_KEY
  - name: OMI_LLM_GATEWAY_URL
    value: "http://dev-omi-llm-gateway.dev-omi-backend.svc.cluster.local:8080"
  - name: OMI_ENV_STAGE
    value: "dev"
  - name: OMI_LLM_GATEWAY_FEATURE_MODE
    value: "gateway"
  - name: OMI_LLM_CHAT_AGENT_ROUTE
    value: "gateway"
  - name: OMI_LLM_GATEWAY_ALLOW_DIRECT_MODEL_EXCEPTION
    value: "false"
  - name: OMI_LLM_GATEWAY_SERVICE_TOKEN
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: OMI_LLM_GATEWAY_SERVICE_TOKEN
  - name: MEMORY_ENABLED
    value: "on"
  # Shared process_conversation rollout flags. Must match backend-listen in this
  # environment — pusher hosts the same finalizer after 2026-08-30.
  - name: CONVERSATION_NOTES_V2_ENABLED
    value: "true"
  - name: CONVERSATION_CALENDAR_CONTEXT_READ_ENABLED
    value: "true"
  - name: CONVERSATION_OCR_CONTEXT_ENABLED
    value: "true"
  - name: MEMORY_BELIEF_MODEL_ENABLED
    value: "true"
  - name: FAL_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: FAL_KEY
  - name: HOSTED_SPEAKER_EMBEDDING_API_URL
    value: "http://diarizer.omiapi.com:80"
  - name: PINECONE_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: PINECONE_API_KEY
  - name: PINECONE_INDEX_NAME
    value: "memories-backend-dev"
  - name: REDIS_DB_PORT
    value: "13151"
  - name: REDIS_DB_HOST
    valueFrom:
      configMapKeyRef:
        name: dev-omi-backend-config
        key: REDIS_DB_HOST
      # Preserve this explicit null through Helm's strategic merge patch so an
      # older live Secret-backed REDIS_DB_HOST source is removed on upgrade.
      secretKeyRef: null
  - name: REDIS_DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: REDIS_DB_PASSWORD
  - name: ADMIN_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: ADMIN_KEY
  - name: MODULATE_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: MODULATE_API_KEY
  - name: GOOGLE_MAPS_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: GOOGLE_MAPS_API_KEY
  - name: GOOGLE_CLIENT_ID
    valueFrom:
      configMapKeyRef:
        name: dev-omi-backend-config
        key: GOOGLE_CLIENT_ID
      # Clear the historical named Secret source when Helm strategically merges
      # this item into an existing Deployment during an upgrade.
      secretKeyRef: null
  - name: GOOGLE_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: GOOGLE_CLIENT_SECRET
  - name: NO_SOCKET_TIMEOUT
    value: "true"
  - name: BUCKET_TEMPORAL_SYNC_LOCAL
    value: "syncing-local-development"
  - name: ENCRYPTION_SECRET
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: ENCRYPTION_SECRET
  - name: BUCKET_PRIVATE_CLOUD_SYNC
    value: "omi-dev-private-cloud-sync"
  - name: BUCKET_PLUGINS_LOGOS
    value: "plugin_resources"
  - name: DD_SERVICE
    value: "pusher"
  - name: DD_ENV
    value: "dev"
  - name: DD_TRACE_SAMPLE_RATE
    value: "1"
  - name: DD_SITE
    value: "us5.datadoghq.com"
  - name: DD_TRACE_PROPAGATION_STYLE
    value: "datadog"
  - name: DD_TRACE_ENABLED
    value: "false"
  - name: DD_VERSION
    value: "1"
  - name: DD_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: DD_API_KEY
  - name: LANGCHAIN_TRACING_V2
    value: "false"
  - name: LANGCHAIN_ENDPOINT
    value: "https://api.smith.langchain.com"
  - name: LANGCHAIN_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: LANGCHAIN_API_KEY
  - name: LANGCHAIN_PROJECT
    value: "development"
  - name: DD_LOGS_ENABLED
    value: "false"
  - name: STRIPE_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: STRIPE_API_KEY
  - name: STRIPE_WEBHOOK_SECRET
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: STRIPE_WEBHOOK_SECRET
  - name: MARKETPLACE_APP_REVIEWERS
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: MARKETPLACE_APP_REVIEWERS
  - name: TYPESENSE_HOST
    valueFrom:
      configMapKeyRef:
        name: dev-omi-backend-config
        key: TYPESENSE_HOST
      # TYPESENSE_HOST is public runtime configuration. Clear a historical
      # Secret-backed binding when Helm strategically merges this named env.
      secretKeyRef: null
  - name: TYPESENSE_HOST_PORT
    value: "443"
  - name: TYPESENSE_API_KEY
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: TYPESENSE_API_KEY
  - name: HOSTED_PARAKEET_API_URL
    value: "http://parakeet.omiapi.com"
  - name: STT_PRERECORDED_MODEL
    value: "parakeet,modulate-velma-2"
  - name: STT_SERVICE_MODELS
    value: "modulate-velma-2,soniox,dg-nova-3,parakeet"
  - name: BASIC_TIER_MINUTES_LIMIT_PER_MONTH
    value: "1000000"
  - name: BASIC_TIER_WORDS_TRANSCRIBED_LIMIT_PER_MONTH
    value: "0"
  - name: BASIC_TIER_INSIGHTS_GAINED_LIMIT_PER_MONTH
    value: "0"
  - name: STRIPE_UNLIMITED_MONTHLY_PRICE_ID
    value: "price_1RrxXL1F8wnoWYvwIddzR902"
  - name: STRIPE_UNLIMITED_ANNUAL_PRICE_ID
    value: "price_1RrxXL1F8wnoWYvw3kDbWmjs"
  - name: STRIPE_ARCHITECT_MONTHLY_PRICE_ID
    value: "price_1TN7s21F8wnoWYvwG6JuEFm6"
  - name: STRIPE_ARCHITECT_ANNUAL_PRICE_ID
    value: "price_1TN7sF1F8wnoWYvwd0QaLZNA"
  - name: STRIPE_OPERATOR_MONTHLY_PRICE_ID
    value: "price_1TN7jS1F8wnoWYvwM5GqfxDw"
  - name: STRIPE_OPERATOR_ANNUAL_PRICE_ID
    value: "price_1TN7jo1F8wnoWYvw6Xu1zAtC"
  - name: SUBSCRIPTION_LAUNCH_DATE
    value: "2025-08-21"
  - name: SERVICE_ACCOUNT_JSON
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: SERVICE_ACCOUNT_JSON
  - name: GOOGLE_CLOUD_PROJECT
    value: "based-hardware-dev"
  - name: METRICS_SECRET
    valueFrom:
      secretKeyRef:
        name: dev-omi-backend-secrets
        key: METRICS_SECRET

resources:
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  requests:
    cpu: 0.7
    memory: 2Gi
  limits:
    cpu: 1
    memory: 4Gi

# This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
livenessProbe:
  httpGet:
    path: /health
    port: 8080
  failureThreshold: 5
  periodSeconds: 10
  timeoutSeconds: 5

readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  failureThreshold: 3
  initialDelaySeconds: 0
  periodSeconds: 10
  successThreshold: 1
  timeoutSeconds: 5

startupProbe:
  httpGet:
    path: /health
    port: 8080
  failureThreshold: 60
  initialDelaySeconds: 0
  periodSeconds: 10
  timeoutSeconds: 5

# This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
autoscaling:
  enabled: true
  minReplicas: 1
  maxReplicas: 3
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 600
      policies:
      - type: Percent
        value: 25
        periodSeconds: 60
      - type: Pods
        value: 1
        periodSeconds: 60
      selectPolicy: Max
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
      - type: Percent
        value: 25
        periodSeconds: 15
      - type: Pods
        value: 4
        periodSeconds: 15
      selectPolicy: Max
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 70

podDisruptionBudget:
  minAvailable: "80%"
  # maxUnavailable: "20%"

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxUnavailable: 0
    maxSurge: 1

terminationGracePeriodSeconds: 120
lifecycle:
  preStop:
    exec:
      # preStop flips readiness (via Lane A /__internal/drain) so the kubelet removes the endpoint
      # early; sleep covers NEG->backend-service->ALB reprogram convergence before SIGTERM.
      command: ["sh", "-c", "curl -sf -m 5 -X POST http://localhost:8080/__internal/drain || true; sleep 15"]

# Additional volumes on the output Deployment definition.
volumes: []
# - name: foo
#   secret:
#     secretName: mysecret
#     optional: false

# Additional volumeMounts on the output Deployment definition.
volumeMounts: []
# - name: foo
#   mountPath: "/etc/foo"
#   readOnly: true

nodeSelector: {}

# The dedicated dev Pusher pool is tainted to keep other workloads out. The
# existing affinity below still confines this workload to matching Pusher nodes.
tolerations:
  - key: dedicated
    operator: Equal
    value: pusher
    effect: NoSchedule

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
        - matchExpressions:
            - key: service
              operator: In
              values:
                - pusher
            - key: env
              operator: In
              values:
                - dev