zeekay 818d40ed77 deploy: add K8s manifests, fix CI to push to GHCR, add IAM JWT auth ...

Production deployment infrastructure for tasks.hanzo.ai:

K8s manifests (k8s/):
- deployment.yaml: tasks server (gRPC 7233) + tasks-ui (HTTP 8080)
  with PostgreSQL backend, KMS-managed secrets, OTEL tracing
- ingress.yaml: tasks.hanzo.ai (UI) + tasks-api.hanzo.ai (gRPC)
- configmap.yaml: dynamic config (30d retention, rate limits)
- kms-secrets.yaml: KMSSecret CRD for POSTGRES_PASSWORD,
  TASKS_AUTH_SECRET, IAM_CLIENT_SECRET
- init-db.yaml: one-time job to create tasks + tasks_visibility DBs
- kustomization.yaml: Kustomize overlay

IAM integration:
- Client ID: app-tasks (matches live deployment)
- OIDC callback: https://tasks.hanzo.ai/auth/sso/callback
- JWT validation via hanzo.id JWKS (TEMPORAL_JWT_KEY_SOURCE1)
- scripts/register-iam.sh: IAM registration instructions

CI/CD (GHCR migration):
- docker-bake.hcl: IMAGE_REPO -> ghcr.io/hanzoai, image names
  server -> tasks, admin-tools -> tasks-admin-tools
- build-and-publish.yml: GHCR auth via GITHUB_TOKEN
- promote-*.yml: rewritten for GHCR (was DockerHub)
- docker-build-manual.yml: GHCR push support
- server.Dockerfile: user temporal -> tasks, workdir /etc/tasks
- admin-tools.Dockerfile: matching user/path rebrand

2026-03-19 10:54:47 -07:00

..

sh

deploy: add K8s manifests, fix CI to push to GHCR, add IAM JWT auth

2026-03-19 10:54:47 -07:00