Deploying on Kubernetes

kubectl create namespace loom
kubectl create namespace loom-runners

kubectl -n loom create secret generic loom-secrets \
  --from-literal=db-password='change-me' \
  --from-literal=initial-password='first-login-password'

apiVersion: v1
kind: ServiceAccount
metadata:
  name: loom
  namespace: loom
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: loom-config
  namespace: loom
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: loom-uploads
  namespace: loom
spec:
  accessModes: [ReadWriteMany]
  resources:
    requests:
      storage: 200Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: loom-server
  namespace: loom
spec:
  replicas: 1
  selector:
    matchLabels: { app: loom-server }
  template:
    metadata:
      labels: { app: loom-server }
    spec:
      serviceAccountName: loom          # the sandbox backend authenticates with this SA's token
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 0
      containers:
        - name: loom
          image: metaloom/loom-server:latest
          env:
            - name: LOOM_DB_HOST
              value: postgres.loom.svc
            - name: LOOM_DB_NAME
              value: loom
            - name: LOOM_DB_USERNAME
              value: loom
            - name: LOOM_DB_PASSWORD
              valueFrom:
                secretKeyRef: { name: loom-secrets, key: db-password }
            - name: LOOM_INITIAL_PASSWORD
              valueFrom:
                secretKeyRef: { name: loom-secrets, key: initial-password }
          ports:
            - { name: rest, containerPort: 8092 }
            - { name: metrics, containerPort: 8989 }
          livenessProbe:
            httpGet: { path: /api/v1/health, port: rest }
            initialDelaySeconds: 30
            periodSeconds: 20
          readinessProbe:
            httpGet: { path: /api/v1/health, port: rest }
            initialDelaySeconds: 10
            periodSeconds: 10
          volumeMounts:
            - { name: config, mountPath: /config }
            - { name: uploads, mountPath: /uploads }
      volumes:
        - name: config
          persistentVolumeClaim: { claimName: loom-config }
        - name: uploads
          persistentVolumeClaim: { claimName: loom-uploads }
---
apiVersion: v1
kind: Service
metadata:
  name: loom
  namespace: loom
spec:
  selector: { app: loom-server }
  ports:
    - { name: rest, port: 8092, targetPort: rest }
    - { name: metrics, port: 8989, targetPort: metrics }

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cortex-cpu
  namespace: loom
spec:
  serviceName: cortex-cpu
  replicas: 3
  selector:
    matchLabels: { app: cortex-cpu }
  template:
    metadata:
      labels: { app: cortex-cpu }
    spec:
      containers:
        - name: cortex
          image: metaloom/cortex-server:latest
          env:
            - name: LOOM_HOST
              value: loom.loom.svc
            - name: LOOM_PORT
              value: "8092"
            - name: LOOM_TOKEN
              valueFrom:
                secretKeyRef: { name: cortex-token, key: token }
            - name: CORTEX_NODE_ID          # unique + stable: the ordinal from the StatefulSet
              valueFrom:
                fieldRef: { fieldPath: metadata.name }
            - name: CORTEX_META_PATH
              value: /meta
            - name: CORTEX_NODE_BLACKLIST
              value: whisper,llm,vlm,captioning,facedescription
          ports:
            - { name: mon, containerPort: 8093 }
          livenessProbe:
            httpGet: { path: /api/health, port: mon }
          readinessProbe:
            httpGet: { path: /api/ready, port: mon }
            periodSeconds: 10
          volumeMounts:
            - { name: meta, mountPath: /meta }
            - { name: media, mountPath: /media }
      volumes:
        - name: media
          persistentVolumeClaim: { claimName: media }
  volumeClaimTemplates:
    - metadata: { name: meta }
      spec:
        accessModes: [ReadWriteOnce]
        resources: { requests: { storage: 5Gi } }

kubectl -n loom rollout status deploy/loom-server
kubectl -n loom rollout status statefulset/cortex-cpu

# Loom sees the workers
kubectl -n loom exec deploy/loom-server -- \
  curl -sf -H "Authorization: Bearer $TOKEN" localhost:8092/api/v1/processors | jq '.[].nodeId'

kubectl -n loom-runners get pods -l app=loom-session-runner -w

image:
  repository: metaloom/loom-server
  tag: latest
  pullPolicy: IfNotPresent

database:
  host: postgres.loom.svc
  name: loom
  username: loom
  existingSecret: loom-secrets      # key: db-password

persistence:
  config:  { size: 1Gi,   accessMode: ReadWriteOnce }   # keystore + loom.yml — never drop this
  uploads: { size: 200Gi, accessMode: ReadWriteMany }

serviceAccount:
  create: true
  name: loom

ai:                                  # chat agent; needs a reachable provider to answer
  enabled: true
  providerType: OLLAMA
  url: http://ollama.loom.svc:11434
  modelId: gpt-oss:20b

sandbox:                             # renders the RBAC, quota, LimitRange and NetworkPolicy
  enabled: false
  namespace: loom-runners
  image: metaloom/loom-session-runner:latest
  maxConcurrent: 10
  idleTtlSeconds: 900
  maxSessionSeconds: 3600
  rbac:
    create: true
  networkPolicy:
    create: true

cortex:
  pools:
    - name: cpu
      replicas: 3
      nodeBlacklist: [whisper, llm, vlm, captioning, facedescription]
    - name: gpu
      replicas: 1
      nodeWhitelist: [whisper, facedetect, captioning, vlm]
      gpu: 1
  media:
    existingClaim: media
    mountPath: /media