Skip to content

ASK Onboarding & Deployment — Overview

Master index for bringing the ASK platform up in the air-gapped Core42 environment (cl1.sq4.aegis.internal). Deploy the base-layer platform services first (once per environment), run the platform onboarding steps, then deploy the application services.

graph LR
    A[Base-Layer Platform<br/>GitLab · Vault · cert-manager<br/>ArgoCD · ESO · CNPG · Reloader] --> B[Platform Onboarding<br/>domain/TLS · CA trust · first-user seed]
    B --> C[Application Services<br/>core-service · assistant-service · KMS · frontend]

1. Base-Layer / Platform Services

Deploy these first — every ASK application depends on them. Rough deploy order top→bottom.

# Service Role Deployment docs
1 GitLab Git + container/Helm registry (source of all charts & manifests for ArgoCD) GitLab Deployment & Setup · Registry Auth & imagePullSecret
2 Vault Source of all secrets (tokens, passwords, keys); HA Raft + Transit auto-unseal Vault Root · Main Vault HA · Vault Auth (UserPass + K8s)
3 cert-manager Issues TLS from the internal CA (internal-ca-issuer, O=ai71,CN=modgpt) TLS & cert-manager
4 ArgoCD GitOps delivery for every ASK app (3-level App-of-Apps) ArgoCD Install (Air-Gap) · GitOps Pipeline · App-of-Apps Architecture
5 External Secrets Operator (ESO) Syncs secrets from Vault → Kubernetes Secrets via ClusterSecretStore External Secrets Operator
6 CloudNativePG (CNPG) Manages the 3 HA PostgreSQL clusters (core-pg, hatchet-pg, knowledge-pg) CloudNativePG Operator · ASK PostgreSQL Cluster
7 Stakater Reloader Auto-restarts workloads when their ConfigMap/Secret changes Stakater Reloader

Full air-gap platform build

The end-to-end infra build (image mirroring → storage → registry → platform components → DNS → TLS → ESO → CNPG → Reloader → HAProxy) is the Core42 Deployment phase guide. The detailed GitLab/Vault/ArgoCD build steps live in the deployment guide referenced above.

2. Platform Onboarding (once per environment)

After the base layer is up, these one-time steps make the platform ready to host ASK services.

Page Purpose
ASK Application Onboarding End-to-end onboarding — ArgoCD Applications, namespace setup, imagePullSecrets
ASK PostgreSQL Cluster (CNPG) CNPG cluster spec, PG tuning, PgBouncer — all three clusters
ASK Domain Migration Establishing ask.mod.auh1.dev.dir — DNS records, ingress, TLS
ArgoCD Internal CA Trust (ESO) Patching ArgoCD + ESO to trust the internal CA for GitLab HTTPS
Multi-Microservice Deployment Pattern The generic ApplicationSet pattern used across all ASK services — read before deploying a new service

3. Application Services

Each ASK application, with its reference docs. Deploy after the base layer + onboarding are complete.

Core Service

The IAM / org / catalog service (bundles Zitadel as the IdP). Everything else authenticates through it.

Page Purpose
Overview What core-service is + how it fits
Deployment Runbook · Deployment In-repo Helm chart deploy
Zitadel Onboarding (org + service user + PAT) · Onboarding Runbook Org, Super Admin, service users
Hatchet Wiring · Ceph S3 Wiring · Model Catalog Async jobs, object storage, model catalog
Air-Gap Alignment · Config Updates · TOML Config Flow Config model & air-gap changes

Assistant Service

The agent/chat service (main API + intelligence + tooling + workers). Reuses one image across all deployments.

Page Purpose
Overview What assistant-service is
Deployment Guide (Air-Gapped) · Workload Architecture Deploy + the 4 workloads
Integration Tests & Verification Post-deploy smoke tests
Model References (two-layer) · Built-in Tools · Context & Safeguards Models, tools, guardrails
Qdrant (vector DB) · Foundry / LLM Endpoint Dependencies

Knowledge Management Service

Document ingestion + RAG (vector via Weaviate, lexical via OpenSearch).

Page Purpose
Overview What KMS is
KMS Deployment · Config & Model References · Architecture, Integrations & Ops Deploy, config, ops
S3 Wiring (Ceph RGW) · Model Reference Object storage + models
Deploy OpenSearch for Lexical Indexing 3-node OpenSearch for BM25 lexical search

Frontend Service

The ASK web UI (Next.js). Browser entry point at ask.mod.auh1.dev.dir.

Page Purpose
Overview · Frontend Deployment What it is + deploy

Hatchet (workflow engine — shared dependency)

Durable task/workflow orchestration used by core-service and KMS. Runs in its own hatchet namespace.

Page Purpose
Hatchet Workflow Engine · Production Readiness Deploy + hardening
Workers, Scheduling & Observability · PgBouncer Connection Pooler Workers + DB pooling