404 task create dev deployment (#410)

Co-authored-by: Nishant Desai <[email protected]>
DARPA-ASKEM · Jun 3, 2024 · bf32ee3 · bf32ee3
1 parent f7a690f
commit bf32ee3
Show file tree

Hide file tree

Showing 64 changed files with 3,890 additions and 60 deletions.
diff --git a/kubernetes/.gitignore b/kubernetes/.gitignore
@@ -6,13 +6,19 @@ overlays/prod/overlays/askem-staging/check-latest/check-latest-rsa
 overlays/prod/overlays/askem-staging/check-latest/secrets.yaml
 overlays/prod/overlays/askem-production/check-latest/check-latest-rsa
 overlays/prod/overlays/askem-production/check-latest/secrets.yaml
+overlays/prod/overlays/askem-dev/check-latest/check-latest-rsa
+overlays/prod/overlays/askem-dev/check-latest/secrets.yaml
 
 overlays/prod/overlays/askem-staging/keycloak/realm/*.json
 !overlays/prod/overlays/askem-staging/keycloak/realm/*.enc.json
 overlays/prod/overlays/askem-production/keycloak/realm/*.json
 !overlays/prod/overlays/askem-production/keycloak/realm/*.enc.json
+overlays/prod/overlays/askem-dev/keycloak/realm/*.json
+!overlays/prod/overlays/askem-dev/keycloak/realm/*.enc.json
 
 overlays/prod/overlays/askem-staging/secrets/*.yaml
 !overlays/prod/overlays/askem-staging/secrets/*.enc.yaml
 overlays/prod/overlays/askem-production/secrets/*.yaml
 !overlays/prod/overlays/askem-production/secrets/*.enc.yaml
+overlays/prod/overlays/askem-dev/secrets/*.yaml
+!overlays/prod/overlays/askem-dev/secrets/*.enc.yaml
diff --git a/kubernetes/base/keycloak/keycloak-service.yaml b/kubernetes/base/keycloak/keycloak-service.yaml
@@ -10,7 +10,7 @@ metadata:
 spec:
   ports:
     - name: keycloak-svc-port
-      port: 8081
+      port: 8080
       protocol: TCP
       targetPort: 8080
   selector:

diff --git a/kubernetes/base/services/redis/kustomization.yaml b/kubernetes/base/services/redis/kustomization.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: terarium
+resources:
+  - redis-deployment.yaml
+  - redis-service.yaml
diff --git a/kubernetes/base/services/redis/redis-deployment.yaml b/kubernetes/base/services/redis/redis-deployment.yaml
@@ -0,0 +1,32 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  labels:
+    software.uncharted.terarium/name: redis
+    software.uncharted.terarium/component: cache
+    software.uncharted.terarium/part-of: services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      software.uncharted.terarium/name: redis
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        software.uncharted.terarium/name: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis-image
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 6379
+          resources: {}
+      imagePullSecrets:
+        - name: ghcr-cred
+      restartPolicy: Always
+status: {}
diff --git a/kubernetes/base/services/redis/redis-service.yaml b/kubernetes/base/services/redis/redis-service.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  labels:
+    software.uncharted.terarium/name: redis
+    software.uncharted.terarium/component: cache
+    software.uncharted.terarium/part-of: services
+spec:
+  ports:
+    - name: 6379-tcp
+      port: 6379
+      protocol: TCP
+      targetPort: 6379
+  selector:
+    software.uncharted.terarium/name: redis
+status:
+  loadBalancer: {}
diff --git a/kubernetes/deploy.sh b/kubernetes/deploy.sh
@@ -13,6 +13,7 @@ DESCRIPTION
     ENVIRONMENT        Must be supplied to indicate which environment should be processed
       staging
       production
+      dev
 
   Launch commands:
     up                Launches the entire TERArium stack
@@ -120,6 +121,11 @@ production)
 	KUSTOMIZATION=overlays/prod/overlays/askem-production
 	KUBECTL_CMD="ssh uncharted-askem-prod-askem-prod-kube-manager-1 sudo kubectl"
 	;;
+dev)
+  SECRET_FILES=${DEV_SECRET_FILES[@]}
+	KUSTOMIZATION=overlays/prod/overlays/askem-dev
+	KUBECTL_CMD="ssh askem-dev-kube-manager-1 sudo kubectl"
+	;;
 esac
 
 case ${COMMAND} in

diff --git a/kubernetes/get_secret_ui.sh b/kubernetes/get_secret_ui.sh
@@ -41,13 +41,13 @@ gum style \
 	--foreground 212 --border-foreground 212 --border double \
 	--margin "1 2" --padding "2 4" \
 	'Extract Secret.
- 
+
 This script will find all the secrets for a given environment,
 decrypting them as requested.'
 
 OPERATION=$(gum choose "decrypt" "encrypt")
 
-ENVIRONMENT=$(gum choose "staging" "production")
+ENVIRONMENT=$(gum choose "staging" "production" "dev")
 
 echo "Using $(gum style --foreground 212 "${ENVIRONMENT}") environment"
 
@@ -58,6 +58,9 @@ staging)
 production)
   SECRET_FILES=(${PRODUCTION_YAML[@]})
 	;;
+dev)
+	SECRET_FILES=(${DEV_YAML[@]})
+	;;
 esac
 
 select_file() {

diff --git a/kubernetes/overlays/prod/base/hmi/server/hmi-server-deployment.yaml b/kubernetes/overlays/prod/base/hmi/server/hmi-server-deployment.yaml
@@ -177,13 +177,6 @@ spec:
                 secretKeyRef:
                   name: data-service-s3
                   key: aws-code-path
-            - name: TERARIUM_AMAZON_S3_DEFAULT_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: data-service-s3
-                  key: aws-region
-            - name: TERARIUM_AMAZON_S3_DEFAULT_URL
-              value: ""
             - name: TERARIUM_AMAZON_S3_DEFAULT_CREDENTIALS-ID
               valueFrom:
                 secretKeyRef:

diff --git a/kubernetes/overlays/prod/base/kustomization.yaml b/kubernetes/overlays/prod/base/kustomization.yaml
@@ -15,6 +15,7 @@ resources:
   - ../../../base/services/funman-taskrunner
   - ../../../base/services/mit
   - ../../../base/services/pyciemss-service
+  - ../../../base/services/redis
   - ../../../base/services/sciml-service
   - ../../../base/services/skema
   - services/beaker/beaker-persistent-volume.yaml
@@ -39,6 +40,7 @@ patches:
   - path: services/mit/mit-tr-deployment.yaml
   - path: services/pyciemss-service/pyciemss-api-deployment.yaml
   - path: services/pyciemss-service/pyciemss-worker-deployment.yaml
+  - path: services/redis/redis-deployment.yaml
   - path: services/sciml-service/sciml-service-deployment.yaml
   - path: services/skema/skema-mathjax-deployment.yaml
   - path: services/skema/skema-memgraph-deployment.yaml

diff --git a/kubernetes/overlays/prod/base/services/gollm-taskrunner/gollm-taskrunner-deployment.yaml b/kubernetes/overlays/prod/base/services/gollm-taskrunner/gollm-taskrunner-deployment.yaml
@@ -12,6 +12,11 @@ spec:
         - name: gollm-taskrunner
           imagePullPolicy: Always
           env:
+            - name: OPENAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: chat-gpt-secrets
+                  key: chatgptkey
             - name: SPRING_RABBITMQ_ADDRESSES
               valueFrom:
                 secretKeyRef:

diff --git a/...on/services/funman/funman-deployment.yaml → ...base/services/redis/redis-deployment.yaml b/...on/services/funman/funman-deployment.yaml → ...base/services/redis/redis-deployment.yaml
@@ -2,11 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: funman
+  name: redis
 spec:
   strategy:
     type: RollingUpdate
-  template:
-    spec:
-      containers:
-        - name: funman
diff --git a/kubernetes/overlays/prod/overlays/askem-dev/check-latest/check-latest-cronjob.yaml b/kubernetes/overlays/prod/overlays/askem-dev/check-latest/check-latest-cronjob.yaml
@@ -0,0 +1,58 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: check-latest
+  namespace: terarium
+spec:
+  schedule: "*/5 * * * *"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            software.uncharted.terarium: check-latest
+        spec:
+          containers:
+            - name: check-latest
+              image: ghcr.io/darpa-askem/check-latest:0.4.0
+              imagePullPolicy: Always
+              env:
+                - name: NAMESPACE
+                  value: terarium
+                - name: GH_USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: check-latest-creds
+                      key: username
+                - name: GH_PAT
+                  valueFrom:
+                    secretKeyRef:
+                      name: check-latest-creds
+                      key: pat
+                - name: SSH_KUBECTL
+                  valueFrom:
+                    secretKeyRef:
+                      name: check-latest-creds
+                      key: ssh_kubectl
+                - name: IMAGES_FILE
+                  valueFrom:
+                    secretKeyRef:
+                      name: check-latest-creds
+                      key: images_file
+              volumeMounts:
+                - name: images-volume
+                  mountPath: /check-latest/data
+                - name: rsa-key-volume
+                  mountPath: /check-latest/.ssh
+          restartPolicy: OnFailure
+          imagePullSecrets:
+            - name: ghcr-cred
+          volumes:
+            - name: images-volume
+              configMap:
+                name: askem-images
+            - name: rsa-key-volume
+              configMap:
+                name: rsa-key
+                defaultMode: 0400
diff --git a/kubernetes/overlays/prod/overlays/askem-dev/check-latest/check-latest-rsa.enc b/kubernetes/overlays/prod/overlays/askem-dev/check-latest/check-latest-rsa.enc
@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:RMJ2Aqjo8uQzD10Wv2f7G2/DwwM6q7kVX3gasI/FWYh+QiSttMHfVO8JnDiDBAu3uX4o5nPrMVpHOpUPbhrBHR8T8sW2I1dQFcCl1OZ07I3GhHN2yZMBJYvCY5CbQc7/CyCZ9dt8Vvn3t0Xz7cfHYuAfVqkwCHdFzwHiNaaaU6HhcyNtOuKgIpqT295hcpJLAiOn1Pe0cKLFoVyIesXf7s258ZQrbhtbleUrhqjPhbqdfSHhk7ugJkx7FVFKG8OJnrwCsGAgRRvuuByhm5VTOQxazJxXZmz+JU7hY2wIt/wxejsT+l1qh6l/F75a9IFydD8kWurV733uR/smINRsDWudcTlU7WVxXMqGS76rZAJ3z/CraGojBemPXO/f/GJIgASx+N+u8hBWtRJmuvetAr2B1Ozx9/1npx9VIWuEyP/tdz87OBkUwfuxCcYxeDsKTU8lbj0kIxTbQKWjw4DcaiVp4VpmsTxtK34tc42Y3IcZJ1icEbPJ8OSl7HC2pt3jJXAewBopa1pQwO3AjSvUD8C+KuR7sDjm7fNCm8P8TtnkInQvJP78w46MtjnCdqjP4DXYxvDmdwHA+2WwkR3pJ2STT93J5mIJWk92tvgHP77CYnyPCLKzglZxdkZv5Z2Rau9BCKRBCk6KkPYmxmY3PBLRyjrqFDtLv4L7RxuTKvubItCHUmzCOWjlKEmel4CI7Znuk13JOYNocwFhrDbyrOtSoFxRooHGRSg8UWQzSH9AV6uV4O5wfGT0oteIBoChVWMv6uuUDvw7BxN+UA76UMUCEZ+5rDYuK8DYhLhRoORvDso7cX75YOi2llBtRfYHkyAXQn+qSizgHSel/6bteAZ7Y3oWK0kOTjR97iV+GV4tClkbhwmB+4qlhjGowyhShEU1wQIFhsCyfckm7y03Y3tT4DFwKnbyEBi6LTe90v2uwjgGXVyboDgt5DT8oxYliPl/oXLuxFVpp4TyV4uvya4emky20KahpVYDqDpVrC7kE8FdTTqQSMYAn6unUnS9+kj49TfXH6g6cJjOM8foyPOiaLhTuJRKC1hU2cJCRl+Jm09YD1mKMlVAHxdpywJqu4vWx1JiQnnGnnGJEpLs25QJJIG6WA3BV7etFIxAaC/aIb7MnIVldSVCVmxvyzQrggu2r251DMGiiXWNl0KlgV7Oc6PK1tfG8fvbYOf+Dj06mW1XTE8v+M/nTeseXYfMHie2jjlGBtLBLmFp4KEJ5BQZO8MqmSfxytQs0UVhRgK2ZB8Z3XE9CqzppcEf1U7ZQo9xLF4q1F7mPbExIB58UwhMEwOQdk4fdVX4nsT8iq/Paz5zTK3FXVvjrl2HHLTp6OUgvhYEtZxuepRLwEVZ00XTen27MTdBV2RR05iaEgN/UupKLaI3azs/V2DlsPyeH3RyjcKCIcUv/2jBxJXLcZIFSLrWPlZ4AXpPh5hwzJBvhJPcGBJX1n6qQnQ7Bo2JTyvoDRTdc4f1IXtdeOyx5uTsBIBQp+RABSXiTeVCV81DCXmYPGIkveA3Yd+Y81MeWFGQZhi68ilCIcmNkdJwdeqG1JsH1Y7QuoAMx6CqDiOFXNjoOdneTwf8Wbw2XTHOtxihIfYdAnvCp3A87opDTgc9zneQEWKRoDNUE/qf/NfXasemD3HCZdVX4IkQjhprjvxepNFN4K2oVqmBSG0vzcAl0TCf6osqgJZinJvC7A7CPyrm4nbR8QYq1PKfql3iMC6EdOfMBlg4EDBRZjtfjGr7uydhP62EqWebObpqKLmzJ6pKMYGRYKXhhwBZgQdGKVTduNT9AKaMQhgke1SetGTjFaQBOdUynefeSuoDuBYoAporNrCNNVJmflY+WDbpdVAhXGyB9tyuRAW3JU2Je5XC+L6z8xTEpNt2QKysWQ9WealEXnhiK0iOjI+z2Af82wT+/xDrGdW77sGmBI8SE0cFRax9u7LJacSKepNx/YpECVd0AIFfqrWQe5MumZ6eq5pjz4BND304d6w71l0klR9lNrB1SCVX6rEQfts+lMZiHqRAA0U1usZmPFMYXV6929dQMD+it7CJUqD5KF1rzfWoOL3ieJScQ8bK+ccCQ8Q6Q9P6cR/2OWbUQZnsQBuwDFudRV6oqEMo2FEWG5jFOxMinW7CEWtCRlVSGjP38VIM7Bfc0sVY0sFEZQJkZfVxY25LD/jLiSmZRvsrf6iO6chNJLB+3fftdrR8THLXFmf+8RzlUppjJmM9dn9OqbYTXXMSLKBtDrmxIsEy4P23KMOEooILQXmiSq4a2GijWqIIGPGGnp5rFPECLMI4q4L7X8NqLeQHP5Ybzqsksd2WzMOYc/JubxYtJyAZnCkWB2D4UY7Vso0N6dTdNFxC51E5ZD19Ap25gM6ACP1S18ye/teU6Swuzc8zJfUDVnxli+vN8GOylY1kxTSruPublcpwPmcrX+i8VJn2IZFbrGHb4hj7Tav9C0/8kDIrcV2tlCzf1JpgGpe6x9HfloLidVBNVottqOBlXnnZWV2ARWguwXTfg420FC3ifBBQ1E9V+QDX5I8Nrhud/9LHPNEfTG/i5gGefpIYI2Je+usphZQA6XVrUANSCtsbSQBpRGY2M2T2+IJbn8JvoniGn42iHk4Jrq/HphAJbq51p6iIxFIfvkkYBNy3k0j74F+wpYM0XHpFX4HEHalcNDxf/ku3f/C2u2Unrjh1bYE6yOwL2z/rxAIFkYlzP9sf7kiL3mTXe9TnyKNdePy7osXGyIMfonHkBUdiuRNJGoXGBJwPiMs5GSYM/A++7A5so6tQaIS7EDGIM76xnOYqAq14xoeYEGn6qICfC298u3z3qy1sZy6brarGpBVj7dYbivqzPIVi+eLwMx0GO5RjShYkRVhm2axC9tt5gfwLi6xc3huom3ozWAwYrhgaPVdDn1n8Q06VGWw6yPmK4kfckmm7YwYkwGyW4j7ka5WFnzy5NqXAFmxHpXqY1pDqgfk/wUzV2OcedzBkFHm2pdX6uap/kVBYEUJnXS4S06j2LVRy15tzMZIYlYblgrakdnUtIOzRDQ8jw4YdVjayEQlQf3UhcrdHzsNilSesnspgOolwD96Ql5U1a2+NQVDapRURhhEQ4rcu87hAN08hMOaZMtayz25WAXq+Qp6RUs+atI/OZPD8ktVk9npQxRrA4wrCQDKjdintKbTdHjipyMeqxkT1sgOeYsXBVjNtdcVhQsZtE9xI0MnVqeENUt2nGBgrDJXydFpb1hutZ64FAlcBQZ7PtOg0Yvyavtc6f0oDxDLn5doQIBizo2kajnr4WsorWS8TmARtKzH6dpLb4+m/wKrr9LIsE8YoKGjpUahWABDfynS/xvYU2aU4EsKNQzIhU2CazsSnE5Qj2Na/T9mYaS+f5VzYZZPOhVqBTlfLpbJkreojQ6NhceS21CXM0aIKQ0KyMG4HSiDVEhrlFuyFazkldgMp4vgu8aZi3P8xgJgjezL2vy6qZbdO,iv:VhiqgqNqROnujm2P5W4GFtGFS0m+t9YS/Bpl1nb/aLU=,tag:8XdUhyXkvZ0MxQvUCf6f3w==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1q5q7lt6twttye7h5dx4zu0eek04pu6szqfx28w00vq3z6nmlc9dq7md4xd",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIOGVlZFhoS3RaOWZaMDdY\ndGtoMTNGSHZPcEJXT2F5cm9JeXpJTjRrVHg4CmdjS3N0bmc5T2NWS2paUjA2dzRh\nRXIyZ1R0U1RWQ3U3SU41WFZWYVF2cWMKLS0tIFpISlg1MjRPVDl0SmxHRUtjeU9p\nSFdVdlNmaXdnL0loc3Q2YTNtZ1I0UzgKOHL0kkbdppbNopaxLOQusvUg/QCCO1A8\nmy8JMz+XpYeIhviuTDK4nHhnIWn2aW7uP5f+ZEVI7oL1Z2Te+EEP4A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-02-21T14:31:30Z",
+		"mac": "ENC[AES256_GCM,data:gy0JhZOvvtwAmiwkdDIG05w2lftaSat/WRQUMEcOswPCOqXytokcMTM2GDst25qgJga/m78hOe4PNky6aMA5mPlNjj6APJDGaGLKmF0kaZgQ+z4yvSNbhrDRgKjEdVMUvGE4k+ApY33ModBvbIio2A4qqlJqti5AxR/ITX+IggM=,iv:B7c0tq1a+EVrcFDJiYNFXbJLgBs1/6Cvgk4gQkcJbzY=,tag:XsSEkuqWVYqt7gPlT8fV5A==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
diff --git a/kubernetes/overlays/prod/overlays/askem-dev/check-latest/images.txt b/kubernetes/overlays/prod/overlays/askem-dev/check-latest/images.txt
@@ -0,0 +1,17 @@
+software.uncharted.terarium/name=beaker ghcr.io/darpa-askem/beaker-kernel:latest
+software.uncharted.terarium/name=climate-data ghcr.io/darpa-askem/climate-data-service:latest
+software.uncharted.terarium/name=climate-data-worker ghcr.io/darpa-askem/climate-data-service:latest
+software.uncharted.terarium/name=gollm-taskrunner ghcr.io/darpa-askem/gollm-taskrunner:latest
+software.uncharted.terarium/name=hmi-client ghcr.io/darpa-askem/hmi-client:latest
+software.uncharted.terarium/name=hmi-server ghcr.io/darpa-askem/hmi-server:latest
+software.uncharted.terarium/name=mira-taskrunner ghcr.io/darpa-askem/mira-taskrunner:latest
+software.uncharted.terarium/name=funman-taskrunner ghcr.io/darpa-askem/funman-taskrunner:latest
+software.uncharted.terarium/name=mit-tr ghcr.io/darpa-askem/mit-tr:latest
+software.uncharted.terarium/name=pyciemss-api ghcr.io/darpa-askem/pyciemss-api:latest
+software.uncharted.terarium/name=pyciemss-worker ghcr.io/darpa-askem/pyciemss-worker:latest
+software.uncharted.terarium/name=sciml-service ghcr.io/darpa-askem/sciml-service:latest
+software.uncharted.terarium/name=skema-mathjax ghcr.io/darpa-askem/skema-py:latest
+software.uncharted.terarium/name=skema-rs ghcr.io/darpa-askem/skema-rs:latest
+software.uncharted.terarium/name=skema-unified ghcr.io/darpa-askem/skema-py:latest
+software.uncharted.terarium/name=terarium-docs ghcr.io/darpa-askem/terarium-docs:latest
+software.uncharted.terarium/name=redis redis:7.2-alpine
diff --git a/kubernetes/overlays/prod/overlays/askem-dev/check-latest/kustomization.yaml b/kubernetes/overlays/prod/overlays/askem-dev/check-latest/kustomization.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: terarium
+resources:
+  - check-latest-cronjob.yaml
+  - secrets.yaml
+configMapGenerator:
+  - files:
+      - images.txt
+    name: askem-images
+  - files:
+      - check-latest-rsa
+    name: rsa-key
diff --git a/kubernetes/overlays/prod/overlays/askem-dev/check-latest/secrets.enc.yaml b/kubernetes/overlays/prod/overlays/askem-dev/check-latest/secrets.enc.yaml
@@ -0,0 +1,32 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+    name: check-latest-creds
+    namespace: terarium
+type: Opaque
+data:
+    username: ENC[AES256_GCM,data:99XHG9E2Jl976O+QoesgCupLogzksXwN,iv:9+9/AYEe29a93BR0WorkfFlIGHN/CqtmwPGP1PMyzeU=,tag:VX82coM4UGL9w5+XjR3eoA==,type:str]
+    pat: ENC[AES256_GCM,data:9fIbq6xUUlOCOLEbOjD+Wv+qfAxHC6n4JhsZKaM0ju9b2jRAECQ6Zw17sfALWKKw3m8trkeqPro=,iv:x1wQ3pX/aeo+xVLIFyIpezgYaIeD6kW/rJq82CWLNM0=,tag:Jmumr+kiM2/xd5eG29DRpg==,type:str]
+    ssh_kubectl: ENC[AES256_GCM,data:xXXIYfgh52OKtt6GQd7iQxIgE2x4CKNja2Xd9QXAOorA2V6514a6OyYuOSAZdYKMrHL+Gah0lbEC2REhDbiiiIEK31dAyriDtFF7V7lrVKUwxrverVd3Z5Qg4Xe4o4fcUnfp4gNElYZ0MYuln/cb3kh9Yjok2fm2ffJLoXdHJpHrZaVxsDFCuLpIOWg=,iv:/5U5/nRzux5kf81kfJMHxZ7kkrFVm/LfUjntpDGigH8=,tag:iuh6dt2AHGUwhGBB5Wfqrw==,type:str]
+    images_file: ENC[AES256_GCM,data:mcGBUoAQ1gY2GXWhllab/cxiVWvljxpapZIUZHAN2s0z6eIZtWD88w==,iv:c2f/fKNLL7wxBmhviGzr4mAnk6JKQDJJ9t81HDop/Yw=,tag:HyOYAHY9vPk9Dg6FcvnYuQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1q5q7lt6twttye7h5dx4zu0eek04pu6szqfx28w00vq3z6nmlc9dq7md4xd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2VXNWaWFVUkVKbHVFR3lL
+            U3o5eFUzT0ZVMkp5cWs0a3Q4bHdKazRBN2k4CjE1VnZPWHZSRjBYNFdhOTBoemt5
+            OWJLbG9KSVNXaGQ3cURXa0lDcFAySVUKLS0tICsyQTdCVEduTTFEQVFLZS9yWUlG
+            dDAvQm5URk5jVW9qOXY0ZlF5NUo1MjgKx5hUzYDYH3z4MkiWm0bJbWXegl4fuLI0
+            U0clQ4rzl73JkQpTtgdE50FVWa2juUI+3fCWhkLiP02wRh8GRi1OxA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-02-21T14:31:30Z"
+    mac: ENC[AES256_GCM,data:dr0Nh5hcyBdMWhCMMLYpAIf0GpaYjmubIgcflWhc8G8EfEt3pyD+AWUE9yBQscC+9QiNDcztVKeTEJLfObVSQkm7ki4FWr4UbqSekNdBGv2L2sUlbyv7yDomQfS2nyDDb6ZzxuxNwgaio7/6B9okTUgZ8GpW6NcGFeIuosUBr4c=,iv:L0/HgAX3zvqrI+m9C1ymTVde+GdS2RT2qmiFxPQra74=,tag:ymYeKDb85MSJm1Qrn7J8rA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1
diff --git a/kubernetes/overlays/prod/overlays/askem-dev/hmi/documentation/terarium-docs-service.yaml b/kubernetes/overlays/prod/overlays/askem-dev/hmi/documentation/terarium-docs-service.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: terarium-docs
+spec:
+  type: NodePort
diff --git a/kubernetes/overlays/prod/overlays/askem-dev/hmi/server/hmi-server-deployment.yaml b/kubernetes/overlays/prod/overlays/askem-dev/hmi/server/hmi-server-deployment.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hmi-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: hmi-server
+          env:
+            - name: TGPT_BASE_URL
+              value: "/beaker/"
+            - name: TGPT_APP_URL
+              value: "/beaker/"
+            - name: TGPT_WS_URL
+              value: "ws://app.dev.terarium.ai/beaker_ws/"
+            - name: TERARIUM_KEYCLOAK_URL
+              value: "https://keycloak.dev.terarium.ai"
+            - name: SPRING_DATA_REDIS_URL
+              value: "redis://redis:6379"
+            - name: TERARIUM_ELASTICSEARCH_URL
+              value: "https://elasticsearch.dev.terarium.ai"
+            - name: TERARIUM_SWAGGER_SERVER-URL
+              value: "https://server.dev.terarium.ai"
+            - name: LOGGING_LEVEL_ROOT
+              value: INFO
+            - name: AWS-URL
+              valueFrom:
+                secretKeyRef:
+                  name: data-service-s3
+                  key: aws-url
+            - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_KEYCLOAK_ISSUER-URI
+              value: "https://keycloak.dev.terarium.ai/realms/terarium"
+            - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_KEYCLOAK_CLIENT-ID
+              value: "app"
+            - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI
+              value: "https://keycloak.dev.terarium.ai/realms/terarium"