devops-infra-helm-charts-gcp/helm-overrides/gke-central-prd-ase1a/ai-gateway-ext/custom-values.yaml

# Custom values for Bifrost (ai-gateway-ext) - Meesho Production
# Usage: helm install bifrost ./helm-templates/bifrost-v1.5.12-latest/ -f ./helm-overrides/gke-central-prd-ase1a/ai-gateway-ext/custom-values.yaml -n prd-ai-gateway-ext

# -- Deployment Configuration --
replicaCount: 2

fullnameOverride: "prd-ai-gateway-ext"

image:
  repository: docker.io/maximhq/bifrost
  pullPolicy: IfNotPresent
  tag: "v1.6.3"

# -- Service Account --
serviceAccount:
  create: true
  automount: true
  annotations:
    iam.gke.io/gcp-service-account: sa-dvops-ai-gateway@meesho-central-prd-0622.iam.gserviceaccount.com
  name: "prd-ai-gateway-ext"

# -- Pod Metadata --
deploymentLabels:
  bu: central
  env: prod
  team: devops
  priority: p1
  priority_v2: sp1
  primary_owner: deep.shah
  secondary_owner: anupam.satsangi
  service: ai-gateway-ext
  service_type: producer-httpstateless

podLabels:
  bu: central
  env: prod
  team: devops
  priority: p1
  priority_v2: sp1
  primary_owner: deep.shah
  secondary_owner: anupam.satsangi
  service: ai-gateway-ext
  service_type: producer-httpstateless

podAnnotations:
  prometheus.io/path: /metrics
  prometheus.io/port: "8080"
  prometheus.io/scrape: "true"
  telegraf.influxdata.com/class: infra

# -- Security Context --
podSecurityContext:
  fsGroup: 65534
  runAsUser: 65534
  runAsGroup: 65534
  runAsNonRoot: true

securityContext:
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: false
  runAsNonRoot: true
  runAsUser: 65534

# -- Service --
service:
  type: ClusterIP
  port: 8080

# -- Contour HTTPProxy --
# ingress.enabled=false disables Bifrost's official K8s Ingress
# httpProxy.enabled=true enables the Meesho Contour HTTPProxy templates
# HTTPProxy templates read from ingress.* for hosts, class, etc.
httpProxy:
  enabled: true
createContourGateway: true
namespace: prd-ai-gateway-ext
contourResponseTimeout: false
ingress:
  enabled: false
  ingressClassName: contour-external
  servicePortNumber: 8080
  enableWebsocket: false
  hosts:
    - host: ai-gateway-ext.meeshogcp.in
      paths:
        - path: /
          pathType: ImplementationSpecific
  slowStart:
    enabled: false
    aggression: 1
    minPercent: 10
    window: 120s

# -- Resources --
resources:
  limits:
    cpu: "5"
    memory: 10Gi
  requests:
    cpu: "4"
    memory: 8Gi

# -- Health Probes --
livenessProbe:
  httpGet:
    path: /health
    port: http
    scheme: HTTP
  initialDelaySeconds: 15
  periodSeconds: 5
  timeoutSeconds: 3
  failureThreshold: 5
  successThreshold: 1

readinessProbe:
  httpGet:
    path: /health
    port: http
    scheme: HTTP
  initialDelaySeconds: 15
  periodSeconds: 5
  timeoutSeconds: 3
  failureThreshold: 5
  successThreshold: 1

# -- HPA (disabled - using KEDA) --
autoscaling:
  enabled: false

# -- Scheduling --
nodeSelector:
  cloud.google.com/compute-class: megatetralite

tolerations:
  - key: cloud.google.com/compute-class
    operator: Equal
    value: megatetralite
    effect: NoSchedule

affinity: {}

# -- Lifecycle & Graceful Shutdown --
terminationGracePeriodSeconds: 300
lifecycle:
  preStop:
    exec:
      command:
        - /bin/bash
        - "-c"
        - "kill -SIGQUIT; /bin/sleep 120"

# -- Bifrost Application Config --
bifrost:
  appDir: /app/data
  port: 8080
  host: 0.0.0.0
  logLevel: warn
  logStyle: json

  # Auth configured via Bifrost UI (stored in DB), not in Helm values
  # This avoids blocking /metrics scrape while still protecting the dashboard

  client:
    dropExcessRequests: false
    initialPoolSize: 300
    allowedOrigins:
      - "*"
    enableLogging: true
    disableContentLogging: false
    disableDbPingsInHealth: false
    logRetentionDays: 365
    enforceGovernanceHeader: false
    allowDirectKeys: false
    maxRequestBodySizeMb: 100

  # Configure providers with env.VAR_NAME references for API keys
  # providers:
  #   openai:
  #     - keys:
  #         - value: "env.OPENAI_API_KEY"
  #           models: ["gpt-4o", "gpt-4o-mini"]
  #           weight: 1.0

# -- Storage (External PostgreSQL) --
storage:
  mode: postgres
  configStore:
    enabled: true
  logsStore:
    enabled: true

postgresql:
  enabled: false
  external:
    enabled: true
    host: "env.BIFROST_POSTGRES_HOST"
    port: 5432
    user: "env.BIFROST_POSTGRES_USER"
    database: "env.BIFROST_POSTGRES_DATABASE"
    sslMode: "disable"
    existingSecret: "prd-ai-gateway-ext-vault"
    passwordKey: "BIFROST_POSTGRES_PASSWORD"

# -- Vector Store (disabled) --
vectorStore:
  enabled: false
  type: none

# -- Meesho Standard Env Vars --
env:
  - name: TZ
    value: "Asia/Kolkata"
  - name: BIFROST_POSTGRES_HOST
    valueFrom:
      secretKeyRef:
        name: prd-ai-gateway-ext-vault
        key: BIFROST_POSTGRES_HOST
  - name: BIFROST_POSTGRES_USER
    valueFrom:
      secretKeyRef:
        name: prd-ai-gateway-ext-vault
        key: BIFROST_POSTGRES_USER
  - name: BIFROST_POSTGRES_DATABASE
    valueFrom:
      secretKeyRef:
        name: prd-ai-gateway-ext-vault
        key: BIFROST_POSTGRES_DATABASE
  - name: TELEGRAF_UDP_HOST
    valueFrom:
      fieldRef:
        fieldPath: status.podIP
  - name: NODE_IP
    valueFrom:
      fieldRef:
        fieldPath: spec.nodeName
  - name: POD_NAME
    valueFrom:
      fieldRef:
        fieldPath: metadata.name
  - name: POD_NAMESPACE
    valueFrom:
      fieldRef:
        fieldPath: metadata.namespace
  - name: POD_IP
    valueFrom:
      fieldRef:
        fieldPath: status.podIP

# --- Meesho Infrastructure Extensions ---

# -- PodDisruptionBudget --
podDisruptionBudget:
  enabled: true
  maxUnavailable: "10%"

# -- ExternalSecret (Vault) --
# Creates K8s Secret "prd-ai-gateway-ext-vault" from Vault path
# This secret is referenced by postgresql.external.existingSecret above
externalSecret:
  enabled: true
  secretName: "prd-ai-gateway-ext-vault"
  path: "prd/cntr/devop/ai-gateway-ext"
  refreshInterval: "0"
  secretStoreRef: "vault-backend"

# -- KEDA ScaledObject --
keda:
  enabled: true
  pollingInterval: 30
  minReplicaCount: 2
  maxReplicaCount: 200
  scaledown:
    stabilizationWindowSeconds: 1800
    selectpolicy: Min
    policies:
      - type: Pods
        value: 2
        periodseconds: 15
  scaleup:
    stabilizationWindowSeconds: 120
    selectpolicy: Max
    policies:
      - type: Pods
        value: 2
        periodseconds: 15
      - type: Percent
        value: 10
        periodseconds: 15
  triggers:
    - type: cpu
      metricType: Utilization
      metadata:
        value: "40"