HolmesGPT offline

Values

helm show values oci://registry.internal/ai/charts/holmes > holmes-default-values.yaml

grep -n -E 'image|registry|additionalEnvVars|toolsets|serviceAccount' holmes-default-values.yaml | head -40

cat > holmes-offline-values.yaml <<'EOF2'
# Verify every key against holmes-default-values.yaml for your chart version
registry: registry.internal/ai
additionalEnvVars:
  - name: OLLAMA_API_BASE
    value: http://ollama.ai-llm.svc:11434
  - name: MODEL
    value: ollama_chat/qwen2.5:14b-instruct
  # vLLM instead of Ollama:
  # - name: OPENAI_API_BASE
  #   value: http://vllm.ai-llm.svc:8000/v1
  # - name: OPENAI_API_KEY
  #   value: dummy
  # - name: MODEL
  #   value: openai/qwen2.5-14b-instruct
toolsets:
  kubernetes/core:
    enabled: true
  kubernetes/logs:
    enabled: true
  prometheus/metrics:
    enabled: true
    config:
      prometheus_url: http://kps-kube-prometheus-stack-prometheus.monitoring.svc:9090
EOF2

kubectl create namespace holmes

kubectl label namespace holmes ai-llm-access=true

helm upgrade --install holmes oci://registry.internal/ai/charts/holmes -n holmes -f holmes-offline-values.yaml

kubectl -n holmes get pods,svc

Permessi

Il chart crea un ServiceAccount con un ClusterRole proprio. Controlla che sia read-only e senza accesso ai secret:

kubectl get clusterrole -l app.kubernetes.io/instance=holmes -o yaml | yq '.items[].rules'

kubectl auth can-i get secrets --all-namespaces --as=system:serviceaccount:holmes:$(kubectl -n holmes get sa -o jsonpath='{.items[0].metadata.name}')

Uso via API

kubectl -n holmes port-forward svc/$(kubectl -n holmes get svc -o jsonpath='{.items[0].metadata.name}') 8080:80

curl -s localhost:8080/api/chat -H 'Content-Type: application/json' -d '{"ask":"which pods in namespace <app-namespace> are not ready and why?"}' | jq -r '.analysis'

RCA periodica sugli alert (CronJob)

Ogni 15 minuti Holmes analizza gli alert attivi e scrive la diagnosi nei log del Job, raccolti dal logging del cluster.

cat > holmes-alert-rca.yaml <<'EOF2'
apiVersion: v1
kind: ConfigMap
metadata:
  name: holmes-cli-config
  namespace: holmes
data:
  config.yaml: |
    model: ollama_chat/qwen2.5:14b-instruct
    alertmanager_url: http://kps-kube-prometheus-stack-alertmanager.monitoring.svc:9093
    toolsets:
      prometheus/metrics:
        enabled: true
        config:
          prometheus_url: http://kps-kube-prometheus-stack-prometheus.monitoring.svc:9090
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: holmes-alert-rca
  namespace: holmes
spec:
  schedule: "*/15 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 5
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: 840
      template:
        spec:
          restartPolicy: Never
          serviceAccountName: ai-readonly    # from the RBAC page, or the chart's SA
          imagePullSecrets:
            - name: registry-internal
          containers:
            - name: holmes
              image: registry.internal/ai/holmes:<tag>
              command: ["holmes", "investigate", "alertmanager", "--config", "/config/config.yaml"]
              env:
                - { name: OLLAMA_API_BASE, value: "http://ollama.ai-llm.svc:11434" }
                - { name: HOME, value: /tmp }
              resources:
                requests: { cpu: 100m, memory: 256Mi }
                limits: { memory: 1Gi }
              volumeMounts:
                - { name: config, mountPath: /config }
          volumes:
            - name: config
              configMap: { name: holmes-cli-config }
EOF2

Entrypoint e flag dell’immagine variano tra versioni: verifica con

podman run --rm registry.internal/ai/holmes:<tag> holmes investigate alertmanager --help

kubectl apply -f holmes-alert-rca.yaml

kubectl -n holmes create job --from=cronjob/holmes-alert-rca holmes-rca-manual

kubectl -n holmes logs job/holmes-rca-manual -f

Per inviare le diagnosi a un canale (Teams, Mattermost interno) valuta Robusta, che integra Holmes con il routing degli alert.