feat: add Kubernetes manifests and A2A protocol support

Phase 2 - A2A Protocol:
- Add A2A models (AgentCard, Task, Message)
- Add A2A service layer
- Add A2A routes with SSE streaming
- Add agent discovery endpoints

Phase 3 - Kubernetes:
- Add deploy/ directory with Kustomize structure
- PostgreSQL StatefulSet with pgvector
- Redis Deployment with persistence
- API and Orchestrator Deployments
- RBAC for orchestrator to manage Jobs
- ArgoCD Application manifest
- Development and production overlays
- K8s Jobs API support in orchestrator

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

deploy/base/api/deployment.yaml

@@ -0,0 +1,83 @@
+# RoboCo API Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: roboco-api
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-api
+    app.kubernetes.io/component: api
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: roboco-api
+  template:
+    metadata:
+      labels:
+        app: roboco-api
+        app.kubernetes.io/name: roboco-api
+    spec:
+      containers:
+        - name: api
+          image: ghcr.io/renzof/roboco-api:latest
+          ports:
+            - containerPort: 8000
+              name: http
+          env:
+            # Database
+            - name: ROBOCO_DATABASE_HOST
+              value: postgres
+            - name: ROBOCO_DATABASE_PORT
+              value: "5432"
+            - name: ROBOCO_DATABASE_USER
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: postgres-user
+            - name: ROBOCO_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: postgres-password
+            - name: ROBOCO_DATABASE_NAME
+              value: roboco
+            # Redis
+            - name: ROBOCO_REDIS_HOST
+              value: redis
+            - name: ROBOCO_REDIS_PORT
+              value: "6379"
+            # API
+            - name: ROBOCO_HOST
+              value: "0.0.0.0"
+            - name: ROBOCO_PORT
+              value: "8000"
+            - name: ROBOCO_ENVIRONMENT
+              value: production
+            # LLM
+            - name: ROBOCO_ANTHROPIC_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: anthropic-api-key
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "500m"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3

deploy/base/api/service.yaml

@@ -0,0 +1,36 @@
+# RoboCo API Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: roboco-api
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-api
+    app.kubernetes.io/component: api
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8000
+      targetPort: 8000
+      name: http
+  selector:
+    app: roboco-api
+---
+# NodePort for external access (can be replaced with Ingress)
+apiVersion: v1
+kind: Service
+metadata:
+  name: roboco-api-external
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-api
+    app.kubernetes.io/component: api
+spec:
+  type: NodePort
+  ports:
+    - port: 8000
+      targetPort: 8000
+      nodePort: 30080
+      name: http
+  selector:
+    app: roboco-api

deploy/base/kustomization.yaml

@@ -0,0 +1,41 @@
+# Base Kustomization for RoboCo
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: roboco
+
+resources:
+  # Namespace
+  - namespace/namespace.yaml
+  # Storage
+  - storage/storageclass.yaml
+  # PostgreSQL
+  - postgres/statefulset.yaml
+  - postgres/service.yaml
+  # Redis
+  - redis/deployment.yaml
+  - redis/service.yaml
+  - redis/pvc.yaml
+  # API
+  - api/deployment.yaml
+  - api/service.yaml
+  # Orchestrator
+  - orchestrator/serviceaccount.yaml
+  - orchestrator/role.yaml
+  - orchestrator/rolebinding.yaml
+  - orchestrator/deployment.yaml
+  - orchestrator/service.yaml
+
+# Common labels applied to all resources
+commonLabels:
+  app.kubernetes.io/part-of: roboco
+  app.kubernetes.io/managed-by: kustomize
+
+# Image configurations (can be overridden in overlays)
+images:
+  - name: ghcr.io/renzof/roboco-api
+    newTag: latest
+  - name: ghcr.io/renzof/roboco-orchestrator
+    newTag: latest
+  - name: ghcr.io/renzof/roboco-agent
+    newTag: latest

deploy/base/namespace/namespace.yaml

@@ -0,0 +1,9 @@
+# RoboCo Namespace
+# All RoboCo resources are deployed to this namespace
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: roboco
+  labels:
+    app.kubernetes.io/name: roboco
+    app.kubernetes.io/component: namespace

deploy/base/orchestrator/deployment.yaml

@@ -0,0 +1,110 @@
+# RoboCo Orchestrator Deployment
+# Manages agent lifecycle and task dispatching
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: roboco-orchestrator
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-orchestrator
+    app.kubernetes.io/component: orchestrator
+spec:
+  replicas: 1  # Single instance for now (state coordination needed for HA)
+  selector:
+    matchLabels:
+      app: roboco-orchestrator
+  template:
+    metadata:
+      labels:
+        app: roboco-orchestrator
+        app.kubernetes.io/name: roboco-orchestrator
+    spec:
+      serviceAccountName: roboco-orchestrator
+      containers:
+        - name: orchestrator
+          image: ghcr.io/renzof/roboco-orchestrator:latest
+          ports:
+            - containerPort: 8000
+              name: http
+          env:
+            # Database
+            - name: ROBOCO_DATABASE_HOST
+              value: postgres
+            - name: ROBOCO_DATABASE_PORT
+              value: "5432"
+            - name: ROBOCO_DATABASE_USER
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: postgres-user
+            - name: ROBOCO_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: postgres-password
+            - name: ROBOCO_DATABASE_NAME
+              value: roboco
+            # Redis
+            - name: ROBOCO_REDIS_HOST
+              value: redis
+            - name: ROBOCO_REDIS_PORT
+              value: "6379"
+            # API
+            - name: ROBOCO_HOST
+              value: "0.0.0.0"
+            - name: ROBOCO_PORT
+              value: "8000"
+            - name: ROBOCO_API_URL
+              value: "http://roboco-api:8000"
+            - name: ROBOCO_ENVIRONMENT
+              value: production
+            # K8s settings
+            - name: ROBOCO_K8S_ENABLED
+              value: "true"
+            - name: ROBOCO_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: ROBOCO_K8S_AGENT_IMAGE
+              value: "ghcr.io/renzof/roboco-agent"
+            # LLM
+            - name: ROBOCO_ANTHROPIC_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: anthropic-api-key
+          volumeMounts:
+            - name: blueprints
+              mountPath: /app/agents/blueprints
+              readOnly: true
+            - name: claude-auth
+              mountPath: /root/.claude
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "500m"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+      volumes:
+        - name: blueprints
+          configMap:
+            name: roboco-blueprints
+        - name: claude-auth
+          secret:
+            secretName: claude-auth
+            optional: true

deploy/base/orchestrator/role.yaml

@@ -0,0 +1,31 @@
+# Orchestrator Role
+# Permissions for spawning and managing agent Jobs
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: roboco-orchestrator
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-orchestrator
+    app.kubernetes.io/component: orchestrator
+rules:
+  # Create/manage agent Jobs
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "delete", "get", "list", "watch", "patch"]
+  # Watch pods for job status
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  # Read pod logs for debugging
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get"]
+  # Manage ConfigMaps for agent configs (MCP configs, prompts)
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "delete", "get", "list", "update", "patch"]
+  # Read secrets for agent environment (API keys)
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]

deploy/base/orchestrator/rolebinding.yaml

@@ -0,0 +1,17 @@
+# Orchestrator RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: roboco-orchestrator
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-orchestrator
+    app.kubernetes.io/component: orchestrator
+subjects:
+  - kind: ServiceAccount
+    name: roboco-orchestrator
+    namespace: roboco
+roleRef:
+  kind: Role
+  name: roboco-orchestrator
+  apiGroup: rbac.authorization.k8s.io

deploy/base/orchestrator/service.yaml

@@ -0,0 +1,17 @@
+# Orchestrator Service (internal only)
+apiVersion: v1
+kind: Service
+metadata:
+  name: roboco-orchestrator
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-orchestrator
+    app.kubernetes.io/component: orchestrator
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8000
+      targetPort: 8000
+      name: http
+  selector:
+    app: roboco-orchestrator

deploy/base/orchestrator/serviceaccount.yaml

@@ -0,0 +1,10 @@
+# Orchestrator ServiceAccount
+# Used by the orchestrator to interact with K8s API for spawning agent Jobs
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: roboco-orchestrator
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: roboco-orchestrator
+    app.kubernetes.io/component: orchestrator

deploy/base/postgres/service.yaml

@@ -0,0 +1,17 @@
+# PostgreSQL Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: postgres
+    app.kubernetes.io/component: database
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5432
+      targetPort: 5432
+      name: postgres
+  selector:
+    app: postgres

deploy/base/postgres/statefulset.yaml

@@ -0,0 +1,84 @@
+# PostgreSQL StatefulSet with pgvector for RAG
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: postgres
+    app.kubernetes.io/component: database
+spec:
+  serviceName: postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+        app.kubernetes.io/name: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: pgvector/pgvector:pg16
+          ports:
+            - containerPort: 5432
+              name: postgres
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: postgres-user
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: roboco-secrets
+                  key: postgres-password
+            - name: POSTGRES_DB
+              value: roboco
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "2Gi"
+              cpu: "1000m"
+          livenessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - roboco
+                - -d
+                - roboco
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - roboco
+                - -d
+                - roboco
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: nfs-roboco
+        resources:
+          requests:
+            storage: 10Gi

deploy/base/redis/deployment.yaml

@@ -0,0 +1,64 @@
+# Redis Deployment for cache, sessions, and event bus
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/component: cache
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+        app.kubernetes.io/name: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:8-alpine
+          command:
+            - redis-server
+            - --appendonly
+            - "yes"
+            - --maxmemory
+            - "256mb"
+            - --maxmemory-policy
+            - allkeys-lru
+          ports:
+            - containerPort: 6379
+              name: redis
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: redis-data

deploy/base/redis/pvc.yaml

@@ -0,0 +1,16 @@
+# Redis Persistent Volume Claim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-data
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/component: cache
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-roboco
+  resources:
+    requests:
+      storage: 1Gi

deploy/base/redis/service.yaml

@@ -0,0 +1,17 @@
+# Redis Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: roboco
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/component: cache
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6379
+      targetPort: 6379
+      name: redis
+  selector:
+    app: redis

deploy/base/storage/storageclass.yaml

@@ -0,0 +1,19 @@
+# NFS StorageClass for RoboCo
+# Uses NFS CSI driver for persistent storage on UGREEN NAS
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-roboco
+provisioner: nfs.csi.k8s.io
+parameters:
+  # NFS server address (UGREEN NAS)
+  server: 192.168.50.111
+  # NFS share path
+  share: /volume1/roboco/k8s-data
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - nfsvers=4.1
+  - hard
+  - timeo=600
+  - retrans=2