helm: upgrade helm 1.4.3 with ai analysis

helm: upgrade helm 1.4.3 with ai analysis

Author: hoalongnatsu

helm/versus-incident/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: versus-incident
 description: A Helm chart for Versus Incident Management System
 type: application
-version: 1.4.0
-appVersion: "1.4.0"
+version: 1.4.3
+appVersion: "1.4.3"
 
 # Dependencies
 dependencies:

helm/versus-incident/README.md

@@ -105,6 +105,11 @@ alert:
 | `agent.ai.apiKey` | OpenAI API key (stored in chart Secret) | `""` |
 | `agent.ai.model` | Model identifier | `"gpt-4o-mini"` |
 | `agent.ai.maxCallsPerHour` | Per-hour AI call rate limit (`0` = unlimited) | `60` |
+| `agent.ai.analyze.model` | Override model for the on-demand analyze agent (empty inherits `agent.ai.model`) | `""` |
+| `agent.tools.toolTimeout` | Per-tool dispatch timeout for analyze tools | `"20s"` |
+| `agent.tools.parallelTools` | Run multiple tool calls in one model turn concurrently | `false` |
+| `agent.tools.recentChanges.git.repos` | Remote git repos read by the `recent_changes` tool (empty = unregistered) | `[]` |
+| `agent.tools.describeDependencies.services` | Service-dependency graph for the `describe_dependencies` tool (empty = unregistered) | `[]` |
 | `agent.sources` | Inline list of signal sources (snake_case keys) | `[]` |
 | `alert.slack.enable` | Enable Slack notifications | `false` |
 | `alert.slack.token` | Slack bot token | `""` |
@@ -404,49 +409,19 @@ config:
   publicHost: "https://versus-incident.example.com"
 ```
 
-## Horizontal Pod Autoscaler Configuration
+## Scaling and Replicas
 
-The Helm chart supports configuring a Horizontal Pod Autoscaler (HPA) to automatically scale the number of pods based on CPU and memory utilization:
+This chart does NOT ship a HorizontalPodAutoscaler. The AI SRE Agent worker is
+a single writer to the pattern catalog and detect log, so the agent must run
+with `replicaCount: 1` — horizontal scaling would produce racing writes (the
+chart fails fast if `agent.enable=true` with more than one replica). For
+deployments that do not enable the agent you may raise `replicaCount`, but the
+number of pods is fixed by that value and is not autoscaled.
 
 ```yaml
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 10
-  targetCPUUtilizationPercentage: 80
-  targetMemoryUtilizationPercentage: 80
+replicaCount: 1   # required when agent.enable=true
 ```
 
-For more advanced scaling behavior, you can use the `behavior` configuration:
-
-```yaml
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 10
-  targetCPUUtilizationPercentage: 80
-  targetMemoryUtilizationPercentage: 80
-  behavior:
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      policies:
-      - type: Percent
-        value: 100
-        periodSeconds: 15
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      policies:
-      - type: Percent
-        value: 100
-        periodSeconds: 15
-      - type: Pods
-        value: 4
-        periodSeconds: 15
-      selectPolicy: Max
-```
-
-Note: When enabling autoscaling, the `replicaCount` value in your values.yaml is only used for the initial deployment before the HPA takes over scaling control.
-
 ## Uninstalling the Chart
 
 To uninstall/delete the `versus-incident` deployment:

helm/versus-incident/templates/_validate.tpl

@@ -47,13 +47,10 @@ Caught here:
 {{- end -}}
 {{- if eq $type "file" -}}
   {{- $replicas := int (default 1 .Values.replicaCount) -}}
-  {{- if .Values.autoscaling.enabled -}}
-    {{- $replicas = int (default 1 .Values.autoscaling.minReplicas) -}}
-  {{- end -}}
   {{- if and .Values.storage.persistence.enabled (gt $replicas 1) -}}
     {{- $access := .Values.storage.persistence.accessMode | default "ReadWriteOnce" -}}
     {{- if eq $access "ReadWriteOnce" -}}
-      {{- fail (printf "versus-incident: storage.persistence.enabled=true with %d replicas and accessMode=ReadWriteOnce. The PVC cannot be mounted on more than one pod. Set replicaCount=1 (and autoscaling.enabled=false), use accessMode=ReadWriteMany, or switch to a non-file storage backend." $replicas) -}}
+      {{- fail (printf "versus-incident: storage.persistence.enabled=true with %d replicas and accessMode=ReadWriteOnce. The PVC cannot be mounted on more than one pod. Set replicaCount=1, use accessMode=ReadWriteMany, or switch to a non-file storage backend." $replicas) -}}
     {{- end -}}
   {{- end -}}
   {{- if and .Values.storage.persistence.existingClaim (not .Values.storage.persistence.enabled) -}}
@@ -79,11 +76,8 @@ Caught here:
     {{- fail (printf "versus-incident: agent.mode=%q is not recognised. Valid values: training, shadow, detect." $mode) -}}
   {{- end -}}
   {{- $replicas := int (default 1 .Values.replicaCount) -}}
-  {{- if .Values.autoscaling.enabled -}}
-    {{- $replicas = int (default 1 .Values.autoscaling.minReplicas) -}}
-  {{- end -}}
   {{- if gt $replicas 1 -}}
-    {{- fail (printf "versus-incident: agent.enable=true with %d replicas. The agent worker is single-writer to the pattern catalog and detect log; running multiple replicas will produce racing writes. Set replicaCount=1 and autoscaling.enabled=false when running the agent." $replicas) -}}
+    {{- fail (printf "versus-incident: agent.enable=true with %d replicas. The agent worker is single-writer to the pattern catalog and detect log; running multiple replicas will produce racing writes. Set replicaCount=1 when running the agent." $replicas) -}}
   {{- end -}}
   {{- if .Values.agent.ai.enable -}}
     {{- if not .Values.agent.ai.apiKey -}}

helm/versus-incident/templates/configmap.yaml

@@ -211,6 +211,10 @@ data:
         max_tokens: {{ .Values.agent.ai.maxTokens | default 512 }}
         max_calls_per_hour: {{ .Values.agent.ai.maxCallsPerHour | default 60 }}
         cache_ttl: {{ .Values.agent.ai.cacheTtl | default "1h" | quote }}
+        {{- if .Values.agent.ai.analyze.model }}
+        analyze:
+          model: {{ .Values.agent.ai.analyze.model | quote }}
+        {{- end }}
     {{- end }}
 
   {{- if .Values.agent.enable }}
@@ -223,6 +227,55 @@ data:
       {{- end }}
   {{- end }}
 
+  {{- if .Values.agent.enable }}
+  tools.yaml: |
+    # Per-tool DATA config for the analyze tools (rendered by Helm).
+    tools:
+      tool_timeout: {{ .Values.agent.tools.toolTimeout | default "20s" | quote }}
+      parallel_tools: {{ .Values.agent.tools.parallelTools | default false }}
+      recent_changes:
+        git:
+          auth:
+            token: {{ .Values.agent.tools.recentChanges.git.auth.token | default "" | quote }}
+            ssh_key_path: {{ .Values.agent.tools.recentChanges.git.auth.sshKeyPath | default "" | quote }}
+          repos:
+          {{- if .Values.agent.tools.recentChanges.git.repos }}
+          {{- range .Values.agent.tools.recentChanges.git.repos }}
+            - url: {{ .url | quote }}
+              {{- if .branch }}
+              branch: {{ .branch | quote }}
+              {{- end }}
+              {{- if .service }}
+              service: {{ .service | quote }}
+              {{- end }}
+              {{- if .auth }}
+              auth:
+                token: {{ .auth.token | default "" | quote }}
+                ssh_key_path: {{ .auth.sshKeyPath | default "" | quote }}
+              {{- end }}
+          {{- end }}
+          {{- else }}
+            []
+          {{- end }}
+      describe_dependencies:
+        services:
+        {{- if .Values.agent.tools.describeDependencies.services }}
+        {{- range .Values.agent.tools.describeDependencies.services }}
+          - name: {{ .name | quote }}
+            depends_on:
+            {{- if .dependsOn }}
+            {{- range .dependsOn }}
+              - {{ . | quote }}
+            {{- end }}
+            {{- else }}
+              []
+            {{- end }}
+        {{- end }}
+        {{- else }}
+          []
+        {{- end }}
+  {{- end }}
+
   {{- if .Values.templates.slack }}
   slack_message.tmpl: |
 {{ .Values.templates.slack | indent 4 }}

helm/versus-incident/templates/deployment.yaml

@@ -5,9 +5,7 @@ metadata:
   labels:
     {{- include "versus-incident.labels" . | nindent 4 }}
 spec:
-  {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
-  {{- end }}
   selector:
     matchLabels:
       {{- include "versus-incident.selectorLabels" . | nindent 6 }}
@@ -406,6 +404,9 @@ spec:
             - name: config-volume
               mountPath: /app/config/agent_sources.yaml
               subPath: agent_sources.yaml
+            - name: config-volume
+              mountPath: /app/config/tools.yaml
+              subPath: tools.yaml
             {{- end }}
             {{- if eq (.Values.storage.type | default "file") "file" }}
             - name: data-volume

helm/versus-incident/templates/hpa.yaml

@@ -44,32 +44,6 @@ resources:
     cpu: 200m
     memory: 256Mi
 
-# Autoscaling configuration
-autoscaling:
-  enabled: false
-  minReplicas: 2
-  maxReplicas: 10
-  targetCPUUtilizationPercentage: 80
-  targetMemoryUtilizationPercentage: 80
-  # Optional: configure scaling behavior
-  # behavior:
-  #   scaleDown:
-  #     stabilizationWindowSeconds: 300
-  #     policies:
-  #     - type: Percent
-  #       value: 100
-  #       periodSeconds: 15
-  #   scaleUp:
-  #     stabilizationWindowSeconds: 0
-  #     policies:
-  #     - type: Percent
-  #       value: 100
-  #       periodSeconds: 15
-  #     - type: Pods
-  #       value: 4
-  #       periodSeconds: 15
-  #     selectPolicy: Max
-
 livenessProbe:
   httpGet:
     path: /healthz
@@ -150,6 +124,55 @@ agent:
     maxTokens: 512
     maxCallsPerHour: 60
     cacheTtl: "1h"
+    # AnalyzeAgent — powers POST /api/admin/incidents/:id/analyze and the
+    # "Run analysis" button in the UI. Tool-calling (ReAct), read-only, never
+    # emits a notification. Active whenever ai.enable=true; this block only
+    # tunes it.
+    analyze:
+      # Override the shared ai.model for analyze deep dives. Empty inherits
+      # the top-level model above.
+      model: ""
+
+  # Per-tool configuration for the analyze tools (rendered into tools.yaml).
+  # This is DATA config only, never a registration allow-list — tools are
+  # wired in code. A missing/empty block degrades the affected tool to a
+  # clean "nothing found" rather than an error.
+  tools:
+    # Shared tool-loop knobs applied to every analyze tool dispatch.
+    toolTimeout: "20s"   # cap per tool dispatch; empty/"0"/invalid = 20s default
+    parallelTools: false # run tool calls in one model turn concurrently
+    # recent_changes — correlate an incident with recent deploys / config
+    # changes pulled from one or more REMOTE git repositories' commit
+    # histories (pure-Go go-git; no git binary required). An empty repos
+    # list leaves the tool unregistered.
+    recentChanges:
+      git:
+        # Global default auth applied to every repo without its own block.
+        # Empty relies on ambient credentials.
+        auth:
+          token: ""        # HTTPS access token / PAT (e.g. ${GIT_TOKEN})
+          sshKeyPath: ""   # path to a private SSH key for ssh/scp-like remotes
+        # Each entry: { url, branch?, service?, auth? }. url is required.
+        repos: []
+        #  - url: https://github.com/acme/api.git
+        #    branch: main          # optional; empty = default HEAD
+        #    service: api          # optional; empty = auto-detected from repo name
+        #  - url: git@github.com:acme/web.git   # service auto-detected as "web"
+        #    auth:                 # optional; per-repo override of git.auth
+        #      sshKeyPath: /home/versus/.ssh/web_deploy
+    # describe_dependencies — surface a service's upstream/downstream
+    # neighbours. Only depends_on (upstream) is authored; downstream edges
+    # are derived automatically. An empty services list leaves the tool
+    # unregistered.
+    describeDependencies:
+      services: []
+      #  - name: web
+      #    dependsOn:
+      #      - api
+      #  - name: api
+      #    dependsOn:
+      #      - database
+      #      - cache
 
   # Inline signal sources. Each entry is rendered verbatim (via toYaml)
   # into agent_sources.yaml — use snake_case keys matching the Go config