apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: investibook

resources:
  - ../../base
  - namespace.yaml
  - agent-config.yaml
  - eval-runner-agent-config.yaml
  - agent-external-secret.yml
  - investibook-config-secret.yml
  - auth0-external-secret.yml
  - code-cache-pvc.yaml
  - evolver-external-secret.yml
  - evolver-deployment.yaml
  - evolver-service.yaml
  - evolver-ingress.yaml
  - ingress.yaml

configMapGenerator:
  - name: investibook-backend-config
    literals:
      # DevOps skill endpoint (consumed by the backend)
      - DEVOPS_BASE_URL=https://prod.devops.pingcap.com

      # Feishu bot
      - LARK_BASE_URL=https://open.feishu.cn
      - LARK_BOT_NAME=investibook-bot-test
      - CHATBOT_SESSION_TIMEOUT_MINUTES=30
      # 0 = disabled. Sum of interaction_token_usage.cost_amount per ACP session.
      - WORKSPACE_COST_LIMIT_USD=1.0
      # Backend-owned image parser uses the same Bedrock Claude Sonnet profile as chat/claude-standard.
      - INVESTIBOOK_IMAGE_PARSE_PROVIDER=bedrock
      - INVESTIBOOK_IMAGE_PARSE_BEDROCK_REGION=us-east-1
      - INVESTIBOOK_IMAGE_PARSE_BEDROCK_MODEL_ID=arn:aws:bedrock:us-east-1:841162690310:application-inference-profile/2r34a06w99bz
      # Optional Langfuse tracing. API keys are read from investibook-langfuse-secret.
      - LANGFUSE_ENABLED=true
      - LANGFUSE_BASE_URL=http://langfuse-web:3000
      - LANGFUSE_ENVIRONMENT=dev

      # Run9 is available as an opt-in sandbox provider in dev. Credentials
      # are injected from the namespace-local run9-api-secret by the backend
      # patch below. Keep the secret values outside Git; provision the secret
      # before deploying this overlay.
      - INVESTIBOOK_AGENT_SANDBOX_PROVIDERS=run9
      - RUN9_API_BASE_URL=https://api.run.sys9.ai
      - RUN9_PROJECT_CID=fevke8plksrt
      - RUN9_SOURCE_SNAP_ID=s5emzsku6
      - RUN9_WORKSPACE_PREINITIALIZED=true
      - RUN9_EXPECTED_OPENCODE_VERSION=59b65b9
      - RUN9_ENVIRONMENT=dev
      - RUN9_BOX_ID_PREFIX=ib
      - RUN9_NETWORK_MODE=managed
      # Newly created boxes use box-scoped Run9 Secrets. Their agent execs
      # receive generated placeholders, which managed egress substitutes only
      # for the configured host and header. Existing unlabelled boxes retain
      # their current network and legacy env forwarding until migrated.
      - >-
        RUN9_BOX_SECRET_RULES=[{"name":"clinic-api-key","env_names":["CLINIC_API_KEY"],"allowed_hosts":["clinic.pingcap.com","staging-clinic.pingcap.com","dev-clinic.pingcap.com"],"header_name":"Authorization"},{"name":"github-token","env_names":["GITHUB_TOKEN","GH_TOKEN","GITHUB_PAT"],"allowed_hosts":["api.github.com"],"header_name":"Authorization"},{"name":"devops-api-key","env_names":["DEVOPS_API_KEY","DEVOPS_API_TOKEN"],"allowed_hosts":["prod.devops.pingcap.com"],"header_name":"X-API-KEY"},{"name":"bedrock-bearer-token","env_names":["AWS_BEARER_TOKEN_BEDROCK"],"allowed_hosts":["bedrock-runtime.us-east-1.amazonaws.com"],"header_name":"Authorization"}]
      - RUN9_REMOTE_WORKSPACE_DIR=/workspace
      - RUN9_REMOTE_AGENTKIT_DIR=/opt/investibook/agentkit
      - RUN9_AGENT_PULL_WAIT_MS=500
      - RUN9_AGENT_HANDSHAKE_PULL_WAIT_MS=50
      - OPENCODE_ACP_PROFILE=true
      - OPENCODE_DISABLE_DEFAULT_PLUGINS=true
      - OPENCODE_ACP_DIRECT_STARTUP=true
      - AGENT_SESSION_PREWARM_ENABLED=true
      - AGENT_SESSION_PREWARM_MAX_CONCURRENCY=4

      # Jira TCOC import
      - JIRA_TCOC_IMPORT_INTERVAL_SECONDS=3600 # 1 hour
      - JIRA_TCOC_IMPORT_ENABLED=true

      # Investibook non-secret configuration (consumed by the backend)
      - INVESTIBOOK_WEB_BASE_URL=https://dev.investibook.com
      - INVESTIBOOK_AIOPS_API_URL=http://aiops-server.aiops-staging:8090
      - INVESTIBOOK_S3_BUCKET=tidbcloud-aiops-assets-staging
      - INVESTIBOOK_AWS_REGION=us-west-2
      - INVESTIBOOK_EXPORT_S3_PREFIX=investibook_service/export_workspaces
      - INVESTIBOOK_CLINIC_ENDPOINT=https://clinic.pingcap.com
      - INVESTIBOOK_JIRA_BASE_URL=https://tidb.atlassian.net

images:
  - name: investibook/frontend
    newName: 552185537300.dkr.ecr.us-west-2.amazonaws.com/investibook/dev/frontend
    newTag: REPLACED_BY_COMMIT_SHA_IN_CI
  - name: investibook/backend
    newName: 552185537300.dkr.ecr.us-west-2.amazonaws.com/investibook/dev/backend
    newTag: REPLACED_BY_COMMIT_SHA_IN_CI
  - name: investibook/evolver
    newName: 552185537300.dkr.ecr.us-west-2.amazonaws.com/investibook/dev/evolver
    newTag: REPLACED_BY_COMMIT_SHA_IN_CI

patches:
  - path: serviceaccount-patch.yaml
  - path: eval-runner-serviceaccount-patch.yaml
  - path: backend-code-cache-patch.yaml
  - path: tidb-mirror-sync-code-cache-patch.yaml
  - path: run9-backend-patch.yaml