Skip to main content
MentatLab docs

Deployment

MentatLab is deployed through GitOps (Flux CD) to K3s.

Kubernetes Manifests

Located in k8s/:

  • namespace.yaml - namespace
  • gateway.yaml - API gateway
  • orchestrator.yaml - orchestration service
  • orchestrator-rbac.yaml - RBAC permissions for orchestrator
  • frontend.yaml - web UI
  • redis.yaml - Redis backend
  • minio.yaml - object storage + bootstrap bucket Job
  • echoagent.yaml - sample agent
  • ingress.yaml - ingress routes

MinIO Stability Guardrails

k8s/minio.yaml includes operational safety defaults for single-replica object storage in this cluster:

  • strategy: Recreate to avoid RWO PVC multi-attach races during updates
  • explicit nodeSelector (amd64) to avoid cross-arch scheduling failures
  • non-trivial CPU/memory/ephemeral-storage requests and limits
  • bucket bootstrap Job retries MinIO readiness before creating mentatlab-artifacts
  • MinIO and mc images are pulled through Harbor's Docker Hub cache (registry.harbor.lan/dockerhub-cache/minio/*)

Orchestrator Ownership and Agent Images

The deployed orchestrator intentionally runs as one replica. Scheduler ownership and approval-gate waiters are process-local, so orchestrator-hpa is retained as a safety lock with both minReplicas and maxReplicas set to one. Keeping the object updates older 2–8 replica HPAs immediately under plain kubectl apply; do not raise its ceiling until durable run leases and distributed gate ownership exist.

The agent registry remains Redis-backed. k8s/kustomization.yaml copies the transformed echoagent image into ORCH_DEFAULT_ECHO_AGENT_IMAGE, while ORCH_RECONCILE_DEFAULT_AGENT_IMAGES=true refreshes image fields for known built-in agents during seeding. A mentatlab.echo node is therefore hydrated with the same immutable image Kustomize deploys, without discarding custom agents or their persisted registry fields.

Container Images

  • registry.harbor.lan/library/mentatlab-gateway-go
  • registry.harbor.lan/library/mentatlab-orchestrator-go
  • registry.harbor.lan/library/mentatlab-frontend

Build and Push

./build-and-push.sh

Build without push:

./build-and-push.sh --skip-push

Deploy

./k8s/deploy.sh --namespace mentatlab

Runtime Configuration

Important environment variables:

  • REDIS_URL
  • ORCHESTRATOR_BASE_URL
  • ORCH_RUNSTORE (memory, redis, or k8s)
  • PORT

Live Release Gates

The browser release gate uses docker-compose.e2e.yml to run Redis, MinIO, the real-agent orchestrator image, gateway, and production frontend. A pinned Playwright container runs services/frontend/e2e/mission-control-real.spec.ts against those live services without route mocks:

scripts/e2e/run-browser-e2e.sh

On failure, Compose logs, Playwright traces, screenshots, and HTML reports are retained beneath services/frontend/test-results/ and services/frontend/playwright-report/. The existing scripts/e2e/run-real-e2e.sh remains the lower-level real echo + MinIO contract test.

Operational Checks

  • Verify pods are Running in mentatlab namespace
  • Verify gateway/orchestrator health endpoints
  • Validate run execution with a known flow
  • Confirm event stream delivery from orchestrator through gateway
Deployment | MentatLab docs