[delete-cloud]

What

Wires the existing context-injection KB plugin into the Helm chart so an o6n personal-agent deploy can use SRE + Obsidian-vault corpora as RAG, with an in-cluster indexing CronJob. Default OFF — zero blast radius on existing deploys.

This is roadmap step ③ (helm kb wiring). Vault access = Option A: vault lives in a private git repo, an in-cluster CronJob clones SRE+vault and runs kb index.

Changes

• values.yaml: new default-off kb block (embedding model/base_url/dim, corpus, search_corpora, max_distance) + kb.index CronJob knobs (schedule, gitRef, repos, gitSecretName).
• configmap: when kb.enabled, append "kb" to plugins and render [kb] with db_path on the data PVC (separate from docs lancedb); embedding_base_url/max_distance omitted when empty.
• cronjob-kb-index.yaml (new, gated kb.enabled && kb.index.enabled): git-clones repos via a GIT_USERNAME/GIT_PASSWORD askpass helper, runs kb index --corpus, writes to the shared data PVC. Carries chart selectorLabels so the NetworkPolicy covers it, and mounts the same rendered agent.toml ConfigMap as the Deployment so kb index reads the values-driven [kb] config instead of the image-baked default.
• SiliconFlow embedding key reaches pods as OPENAI_API_KEY via existing agent.secretRef/secretEnv; coexists with the LLM's AGENT_API_KEY.
• values-example.yaml: placeholder-only KB example incl. the git-host extraEgress entry. Real topology stays in private values (chore(deploy): genericize o6n deployment config out of public repo #600 boundary).
• tests/deploy: render contracts for default-off, [kb] config, CronJob PVC/env/netpol-labels, and CronJob↔ConfigMap mount agreement.

Verification

• helm lint clean; helm template renders clean for default + kb-enabled.
• uv run pytest tests/deploy/ → 44 passed.
• Two-round subagent code review: clean-to-merge (initial P1 = CronJob not mounting the rendered ConfigMap → kb index would use wrong embedding dim/model and off-PVC db_path; fixed + agreement test added).
• Topology-leak grep over added lines: clean (placeholders only).

Operator follow-up (private values, not in repo)

• Provide secrets: SiliconFlow key as OPENAI_API_KEY; git token (GIT_USERNAME/GIT_PASSWORD) for clone.
• Add the git-host CIDR to networkPolicy.extraEgress (Forgejo is on a private/CGNAT range the default egress except blocks).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added optional knowledge base (KB) feature with support for embedding-based search functionality
  • Implemented scheduled indexing of git repositories with automatic corpus updates
  • Configurable embedding models and similarity search parameters

• Documentation

  • Added example configurations and guidance for KB setup, including API key configuration for embedding providers

• Tests

  • Added tests to verify KB configuration rendering and indexing job creation

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2fd90ec3-b1e3-4a32-8bd5-c3fb56a6429f

📥 Commits

Reviewing files that changed from the base of the PR and between 28151ee and ac6b01f.

📒 Files selected for processing (5)

• coding-agent/helm/templates/configmap-agent-config.yaml
• coding-agent/helm/templates/cronjob-kb-index.yaml
• coding-agent/helm/values-example.yaml
• coding-agent/helm/values.yaml
• coding-agent/tests/deploy/test_helm_chart.py

---

📝 Walkthrough

Walkthrough

Adds an optional knowledge base (kb) feature to the coding-agent Helm chart. A new kb values block defines embedding, corpus, and indexing settings. The agent ConfigMap conditionally emits a [kb] TOML section and plugin entry. A new CronJob template clones configured git repos and runs kb index on a schedule. Tests cover all rendering paths.

Changes

Knowledge Base Helm Feature

Layer / File(s)	Summary
KB values schema and examples coding-agent/helm/values.yaml, coding-agent/helm/values-example.yaml	Introduces a kb values block with defaults for enablement, database path, embedding model/endpoint/dimension, similarity distance, corpus selection, index schedule, and optional git secret. Adds API key documentation comments, a fully-commented kb: example block, and a network policy egress example for private git hosts.
KB plugin and config in agent.toml coding-agent/helm/templates/configmap-agent-config.yaml	Conditionally appends "kb" to agent.plugins.enabled and adds a [kb] TOML block with db_path, embedding settings, corpus/search corpora, and optional max_distance when kb.enabled is true.
KB indexing CronJob template coding-agent/helm/templates/cronjob-kb-index.yaml	Adds a Kubernetes CronJob gated on kb.enabled and kb.index.enabled. Runs a shell script that creates a temp workspace, optionally sets up GIT_ASKPASS, clones each configured repo at the specified branch/depth, and calls kb index. Wires secret-backed envFrom/env, mounts the agent ConfigMap and PVC, and defines the corresponding volumes.
Helm chart KB tests coding-agent/tests/deploy/test_helm_chart.py	Adds a _cronjob selector helper, extends the default contract test to assert KB absence and no CronJob, and adds four KB tests covering config rendering, optional maxDistance propagation, disabled-index behavior, and full CronJob output validation (schedule, labels, security context, env wiring, volume mounts, and script contents).

Sequence Diagram(s)

sequenceDiagram
  participant Scheduler as Kubernetes Scheduler
  participant CronJob as kb-index CronJob
  participant Shell as /bin/sh script
  participant Git as git clone
  participant KBTool as kb index CLI
  participant PVC as Persistent Volume

  Scheduler->>CronJob: trigger on schedule (concurrencyPolicy: Forbid)
  CronJob->>Shell: exec container command
  Shell->>Shell: mktemp -d temp workspace
  Shell->>Shell: trap cleanup on EXIT
  alt GIT_USERNAME and GIT_PASSWORD present
    Shell->>Shell: generate git-askpass helper
  end
  loop each repo in kb.index.repos
    Shell->>Git: git clone --depth 1 --branch <branch> <url> <tmpdir>
    Shell->>KBTool: kb index --corpus <corpus> <tmpdir>
    KBTool->>PVC: write index data to db_path
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐇 Hop hop! A knowledge base takes root,
ConfigMaps grow a [kb] shoot.
CronJobs clone repos by night,
Index the corpus, all feels right.
Tests pass with labels, mounts, and lore—
The rabbit's wiki grows some more! 📚

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main feature addition: optional KB/RAG indexing with both the plugin and CronJob components that constitute the primary change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/helm-kb-wiring

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}