feat: Kubernetes deployment (kustomize + sealed secrets)

[jcschaff]

Summary

Adds a Kubernetes deployment for VCell-AI under kustomize/, modeled on ../sms-api/kustomize. Deploys the three docker-compose.yml services — qdrant, backend (FastAPI :8000), frontend (Next.js :3000) — with a base → config → overlays structure and sealed secrets.

Layout

kustomize/
├── base/            qdrant StatefulSet(+10Gi PVC), backend & frontend Deployments+Services
├── config/<env>/    non-secret config -> backend-config / frontend-config ConfigMaps
├── overlays/<env>/  namespace, image tags, ingress, secrets.sh, secrets.dat.template
└── scripts/         sealed_secret_{backend,frontend,ghcr}.sh + build_and_push.sh

Environments: vcell-ai-rke (prod, on-prem UCHC RKE), vcell-ai-rke-dev (dev), vcell-ai-local (minikube).

Images: ghcr.io/virtualcell/vcell-ai-backend, ghcr.io/virtualcell/vcell-ai-frontend (pulled via a sealed ghcr-secret).

Sealed secrets

Each overlay has a master secrets.sh that reads plaintext secrets.dat (created from the committed secrets.dat.template) and emits three SealedSecret manifests:

Sealed secret	Keys	Script
backend-secrets	AZURE_API_KEY, LANGFUSE_SECRET_KEY, LANGFUSE_PUBLIC_KEY, SUPABASE_SERVICE_ROLE_KEY	sealed_secret_backend.sh
frontend-secrets	AUTH0_SECRET, AUTH0_CLIENT_SECRET	sealed_secret_frontend.sh
ghcr-secret	ghcr.io image-pull .dockerconfigjson	sealed_secret_ghcr.sh

Only genuinely sensitive values are sealed; everything else (Azure endpoint/deployment names, Qdrant URL, Auth0 domain/audience, Langfuse host, hostnames) lives in the committed config/<env>/*.env ConfigMaps. secrets.dat and the generated secret-*.yaml are gitignored.

Ingress

Frontend at /, backend proxied at /api/* with the /api prefix stripped via rewrite-target (FastAPI routes live at the root, e.g. /biomodel, /kb, /query). Prod/dev use nginx + cert-manager (letsencrypt-prod) on vcell-ai.cam.uchc.edu / vcell-ai-dev.cam.uchc.edu; local uses plain HTTP on vcell-ai.local (minikube).

Validation

• kubectl kustomize renders cleanly for all three overlays (13 objects each); ConfigMap name-hashes correctly propagate into the deployments' envFrom.
• All shell scripts pass bash -n.
• Confirmed .gitignore excludes secrets.dat and generated secret-*.yaml (no secret material committed).

Deploy (per environment)

cd kustomize/overlays/vcell-ai-rke
kubectl create namespace vcell-ai-rke
cp secrets.dat.template secrets.dat && $EDITOR secrets.dat   # gitignored
./secrets.sh                                                 # needs kubeseal + controller
kubectl apply -k .

Notes for reviewers

• Placeholder values in config/<env>/*.env (Azure endpoint, Auth0 domain/client-id, Supabase URL) must be filled in per deployment.
• NEXT_PUBLIC_* are inlined at Next.js build time — NEXT_PUBLIC_API_URL must be set when building the frontend image, not just at runtime.
• Sealed secret-*.yaml are gitignored (cluster-specific; can't be generated without the target cluster's key), so an overlay only renders fully after secrets.sh is run. This mirrors the required-but-absent secrets.dat contract.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XpNzobVi83p3YKL9sqtGwZ

---

Follow-ups

• Frontend NEXT_PUBLIC_API_URL is baked into the image at build time (not environment-portable) #70 — frontend NEXT_PUBLIC_API_URL is baked into the image at build time (touches build_containers.yml + frontend Dockerfile; out of scope here).