[jcmoro]

What

PR 4 of docs/plan-assistant-genai.md: it deploys the same image to a local kind cluster.

• k8s/ (kustomization):
  • namespace and ConfigMap;
  • Postgres with pgvector as a StatefulSet with a 1 Gi PVC;
  • the api Deployment (without --reload; startup, liveness and readiness probes on /healthz) and its Service;
  • k8s/jobs/ with a migrate Job (alembic upgrade head) and a reindex Job;
  • secrets.example.yaml, a template only, never applied.
• make:
  • k8s-up = build + k8s-deploy;
  • k8s-deploy runs DB ready → migrate → reindex → api rollout, and is safe to re-run;
  • k8s-smoke calls /healthz and GET /products through the Service;
  • k8s-down deletes the cluster.
• Dockerfile: now copies alembic.ini and alembic/. Before, only Compose mounted them, so the migrate Job couldn't run from the image.
• CI: a separate k8s workflow, filtered by path and also runnable by hand. It creates a kind cluster (helm/kind-action@v1.15.1), runs make k8s-deploy and make k8s-smoke, and dumps logs on failure.

Why

To prove the image runs unchanged outside Compose:

• secrets arrive through Secrets;
• migrations and reindexing are explicit steps;
• embeddings are computed in the pod with no network, since the model is baked into the image.

The optional AWS step is out of scope: there's no AWS account. Decisions are in docs/step-19-k8s-deploy.md (Spanish).

Proof (local, kind v0.33.0)

• First deploy: make k8s-deploy exits 0.
  • The migrate Job runs revisions 1 → 4.
  • The reindex Job completes.
  • The api rolls out.
• Smoke test: make k8s-smoke returns {"status":"ok"} and [].
• Second run: after creating a product, a second make k8s-deploy exits 0 and reindex gives indexed=1.
  • The DB StatefulSet stays at generation 1 and db-0 has 0 restarts: the data survives.
  • kubectl diff -k k8s is empty.
• API key: ANTHROPIC_API_KEY is piped from .env through stdin and appears nowhere in the deploy output (0 matches).
• Gates: make lint is clean; make test gives 272 passed, 4 deselected.
• CI: the k8s workflow runs on this PR (see the checks).

🤖 Generated with Claude Code