feat(ai2): update AI2 chart to version 2.0.0 with Redis support and enhanced configuration

| Portal | `oop` | Developer portal: web UI and its backend (login, OEG and AI2 proxy, API clients) |

| Data Lab | `oop` | Dataspace metadata catalogue: piveau hub and search, Virtuoso, Elasticsearch, the Data Lab UI and API. Off by default, see [Data Lab](#data-lab) |

Each of OEG, SRM and Federation Manager has its own chart README with all its values:

Each of OEG, SRM, Federation Manager and AI2 has its own chart README with all its values:

[OEG](oop-platform-chart/charts/oeg/README.md), [SRM](oop-platform-chart/charts/srm/README.md),

[Federation Manager](oop-platform-chart/charts/federation-manager/README.md).

[Federation Manager](oop-platform-chart/charts/federation-manager/README.md),

[AI2](oop-platform-chart/charts/ai2/README.md).

### Architecture

    version: "2.0.0"

    condition: federation-manager.enabled

  - name: ai2

    version: "1.0.0"

    version: "2.0.0"

    condition: ai2.enabled

  - name: portal

    version: "1.0.0"

apiVersion: v2

name: ai2

type: application

version: 1.0.0

appVersion: "1.0.0"

version: 2.0.0

appVersion: "2.0.0"

keywords:

  - ai2

  - oop

# AI2 Helm Chart

Deploys AI2, the platform's natural-language assistant:

- **ai-agent**: takes a chat message, asks a Groq model what to do and calls the MCP server's

  tools. The portal forwards `/api/ai2/chat` to it.

- **mcp**: MCP server whose tools call OEG's CAMARA APIs.

- **redis**: in-memory store for the agent's session memory. Nothing is persisted.

Every request needs the user's Keycloak access token (`Authorization: Bearer …`). The agent

passes it to the MCP server, which sends it to OEG, so the user's own roles decide what AI2 may

do. The portal adds the token itself. With `global.auth.enabled=false` no token is needed, and

both components get `AUTH_ENABLED=false`.

## Configuration

| Parameter | Description | Default |

|-----------|-------------|---------|

| `images.mcp.repository` / `tag` | MCP server image | `labs.etsi.org:5050/oop/code/ai2/mcp_module` |

| `images.aiAgent.repository` / `tag` | Agent image | `labs.etsi.org:5050/oop/code/ai2/ai_agent` |

| `images.waitForMcp` | Init container image that waits for the MCP server | `curlimages/curl:8.11.1` |

| `config.mcp.oegServiceUrl` | OEG base URL, without a path | `http://oeg` |

| `config.aiAgent.groqModelName` | Groq model | `qwen/qwen3-32b` |

| `config.aiAgent.memoryWindowTurns` | Turns of a chat kept as context | `3` |

| `config.aiAgent.memoryTtlSeconds` | How long an idle chat is remembered | `3600` |

| `secrets.groqApiKey` | Groq API key; required for the agent to answer | `""` |

| `redis.enabled` | Deploy Redis; `false` turns session memory off | `true` |

| `redis.image` | Redis image | `redis:7.4-alpine` |

| `service.mcp.type` / `service.aiAgent.type` | Service types | `ClusterIP` in the umbrella chart |

Only the ai-agent may connect to Redis (NetworkPolicy), since Redis has no password.

## Troubleshooting

```bash

kubectl get pods -n oop -l app.kubernetes.io/name=ai2

kubectl logs -f deployment/ai2-ai-agent -n oop

kubectl logs -f deployment/ai2-mcp -n oop

```

A 401 from the agent means the request carried no bearer token. A tool error naming OEG's

status means OEG refused the call, usually because the user lacks the API product's role.

{{- define "ai2.aiAgentServiceName" -}}

{{- include "ai2.fullname" . }}-ai-agent

{{- end }}

{{- define "ai2.redisServiceName" -}}

{{- include "ai2.fullname" . }}-redis

{{- end }}