Requirements

Platform

Requirement	Minimum
Kubernetes	1.27, or 1.29 for the GKE Cloud SQL Auth Proxy native sidecar
Helm	3.8
PostgreSQL	14
Object storage	An S3-compatible bucket, or GCS
Identity	An OIDC issuer, an identity-aware proxy, or Google Sign-In

Terraform 1.11 if you use the blueprints.

The image

ghcr.io/m-a-m-a-ai/presponsievelite. Add an image pull secret if the package is private to you.

Compute

The workload is one stateless Deployment. Chart defaults request 250m CPU and 512Mi, with limits of 1 CPU and 1Gi.

Deployment	Replicas	Per pod
Evaluation	1	250m / 512Mi
Production	2 to 5, autoscaled on CPU	250m–1 CPU / 512Mi–1Gi

Two replicas is the production floor, and SESSION_SECRET must be set for more than one. Without it, an SSO callback landing on a different pod than the one that started the flow will fail.

Crypto material you generate

Four values, before you deploy anything:

openssl rand -base64 32   # APP_KEK            envelope-encryption key
openssl rand -base64 32   # SESSION_SECRET     signs the session cookie
openssl rand -base64 32   # INDEX_PEPPER       HMAC for blind indexes
openssl rand -base64 32   # AUTH_TOKEN_PEPPER  HMAC for token hashing at rest

warning

APP_KEK is not recoverable. Lose it and every encrypted row is permanently unreadable, and no database restore brings it back. Back it up somewhere that outlives the cluster, the namespace, and the person who created it.

A license key

Purchased separately. See Licensing.

Network

Destination	Port	When
PostgreSQL	5432	Always
Object storage	443	Report artifacts
Your OIDC issuer	443	At sign-in
api.openai.com	443	Only if OPENAI_API_KEY is set
kube-dns	53	Always

Inbound: your ingress controller to app pods on 8080.

Full detail in Network.

Ingress sizing

Transcripts and audio go past the nginx 1MB body default, and an analysis can hold a connection for minutes.

nginx.ingress.kubernetes.io/proxy-body-size: "100m"
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"

On GKE, a BackendConfig with timeoutSec: 600. The GCLB default of 30 seconds is shorter than a long analysis, and past it the load balancer returns an HTML 502 the app never sees.

What you do not need

• A message broker
• Redis
• GPUs
• A separate worker tier