first commit

k8s/helm_deploy.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: ${APP_NAME}
+description: helm para tia
+version: ${IMAGE_TAG}

k8s/livekit/Dockerfile

@@ -0,0 +1,7 @@
+FROM livekit/livekit-server:v1.11.0
+
+COPY livekit.yaml /etc/livekit/livekit.yaml
+
+EXPOSE 7880 7881 7882
+
+CMD ["--config", "/etc/livekit/livekit.yaml"]

k8s/livekit/configmap.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ${APP_NAME}-livekit-config
+  namespace: ${K8S_NAMESPACE}
+data:
+  livekit.yaml: |
+    port: 7880
+    log_level: warn
+    rtc:
+      tcp_port: 7881
+      udp_port: 7882
+      port_range_start: 50000
+      port_range_end: 60000
+    redis:
+      address: "${REDIS_HOST}:6379"
+      use_tls: true
+    keys:
+      tia_livek_tia_api_key: "TiaLivekitSecret2026KeyBridgeSync01"

k8s/livekit/deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${APP_NAME}-livekit
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-livekit
+    app.kubernetes.io/name: tia-livekit
+    app.kubernetes.io/part-of: tia
+spec:
+  replicas: ${LIVEKIT_REPLICAS}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: ${APP_NAME}
+  template:
+    metadata:
+      labels:
+        app: ${APP_NAME}
+        app.kubernetes.io/name: tia-livekit
+        app.kubernetes.io/part-of: tia
+    spec:
+      hostAliases:
+      - ip: ${REDIS_IP}
+        hostnames:
+        - ${REDIS_HOST}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      volumes:
+        - name: config-volume
+          configMap:
+            name: ${APP_NAME}-livekit-config
+      containers:
+        - name: ${APP_NAME}-livekit
+          image: ${IMAGE_REPOSITORY_LIVEKIT}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args:
+            - "--config"
+            - "/etc/livekit/livekit.yaml"
+          envFrom:
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/livekit
+              readOnly: true
+          ports:
+            - name: signal
+              containerPort: 7880
+            - name: rtc-tcp
+              containerPort: 7881
+            - name: rtc-udp
+              containerPort: 7882
+              protocol: UDP
+          readinessProbe:
+            tcpSocket:
+              port: 7880
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket:
+              port: 7880
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "${CPU_LIVEKIT_REQ}"
+              memory: "${MEM_LIVEKIT_REQ}"
+            limits:
+              cpu: "${CPU_LIVEKIT_LIM}"
+              memory: "${MEM_LIVEKIT_LIM}"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${APP_NAME}-livekit
+  namespace: ${K8S_NAMESPACE}
+spec:
+  type: NodePort
+  selector:
+    app.kubernetes.io/name: tia-livekit
+  ports:
+    - name: signal
+      port: 7880
+      targetPort: 7880
+    - name: rtc-tcp
+      port: 7881
+      targetPort: 7881
+    - name: rtc-udp
+      port: 7882
+      targetPort: 7882
+      protocol: UDP

k8s/regional/deployment-region.yaml

@@ -0,0 +1,211 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${APP_NAME}-${REGION_ID}
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-regional
+    tia-region: ${REGION_ID}
+spec:
+  replicas: ${REGION_REPLICAS}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: ${APP_NAME}-regional
+      tia-region: ${REGION_ID}
+  template:
+    metadata:
+      labels:
+        app: ${APP_NAME}-regional
+        tia-region: ${REGION_ID}
+    spec:
+      terminationGracePeriodSeconds: ${TERMINATION_GRACE_SECONDS}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: bridge
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.bridge_entry", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
+          ports:
+            - name: bridge-http
+              containerPort: 8000
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          readinessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "${CPU_TIA_BRIDGE_REQ}", memory: "${MEM_TIA_BRIDGE_REQ}"}
+            limits: {cpu: "${CPU_TIA_BRIDGE_LIM}", memory: "${MEM_TIA_BRIDGE_LIM}"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: agent
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.agent_entry", "start", "--log-level", "info"]
+          ports:
+            - name: agent-http
+              containerPort: 18081
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: AGENT_SERVER_PORT
+              value: "18081"
+            - name: NUM_IDLE_PROCESSES
+              value: "1"
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+            # Agent sees a local xAI-compatible endpoint. Real OCI credentials stay in xai-pool.
+            - name: XAI_WEBSOCKET_URL
+              value: ws://127.0.0.1:18100/xai/v1/tts
+            - name: XAI_TTS_AUTH_METHOD
+              value: API_KEY
+            - name: XAI_API_KEY
+              value: local-pool-proxy
+          startupProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "${CPU_TIA_REQ}", memory: "${MEM_TIA_REQ}"}
+            limits: {cpu: "${CPU_TIA_LIM}", memory: "${MEM_TIA_LIM}"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: xai-pool
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.livekit.adapters.xai_pool_proxy"]
+          ports:
+            - name: xai-pool
+              containerPort: 18100
+          env:
+            - name: PYTHONPATH
+              value: /app/src
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+            - name: XAI_POOL_UPSTREAM_URL
+              value: ${XAI_UPSTREAM_URL}
+            - name: XAI_POOL_SIZE
+              value: "${XAI_POOL_SIZE}"
+            - name: XAI_POOL_UNAVAILABLE_FREE
+              value: "${XAI_POOL_UNAVAILABLE_FREE}"
+            - name: XAI_POOL_RECOVER_FREE
+              value: "${XAI_POOL_RECOVER_FREE}"
+            - name: XAI_POOL_CONNECTION_TTL_S
+              value: "${XAI_POOL_CONNECTION_TTL_S}"
+            - name: XAI_POOL_REFRESH_JITTER_S
+              value: "${XAI_POOL_REFRESH_JITTER_S}"
+            - name: XAI_POOL_PREWARM_CONCURRENCY
+              value: "${XAI_POOL_PREWARM_CONCURRENCY}"
+            - name: XAI_TTS_VOICE
+              value: ${XAI_TTS_VOICE}
+            - name: XAI_TTS_LANGUAGE
+              value: ${XAI_TTS_LANGUAGE}
+            - name: XAI_TTS_AUTH_METHOD
+              value: ${XAI_UPSTREAM_AUTH_METHOD}
+            - name: OCI_COMPARTMENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: ${XAI_SECRET_NAME}
+                  key: OCI_COMPARTMENT_ID
+                  optional: true
+            - name: XAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ${XAI_SECRET_NAME}
+                  key: XAI_API_KEY
+                  optional: true
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+          readinessProbe:
+            httpGet: {path: /readyz, port: 18100}
+            initialDelaySeconds: 5
+            periodSeconds: 2
+            timeoutSeconds: 1
+            failureThreshold: 2
+            successThreshold: 1
+          livenessProbe:
+            httpGet: {path: /healthz, port: 18100}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "curl -sf -X POST http://127.0.0.1:18100/drain || true; sleep ${DRAIN_SECONDS}"]
+          resources:
+            requests: {cpu: "${CPU_XAI_POOL_REQ}", memory: "${MEM_XAI_POOL_REQ}"}
+            limits: {cpu: "${CPU_XAI_POOL_LIM}", memory: "${MEM_XAI_POOL_LIM}"}
+          volumeMounts:
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+      volumes:
+        - name: google-sa-volume
+          secret:
+            secretName: ${APP_NAME}-google-sa-secret
+        - name: trusted-ca-volume
+          secret:
+            secretName: shared-tls-secret

k8s/regional/hpa-region.yaml

@@ -0,0 +1,32 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: ${APP_NAME}-${REGION_ID}
+  namespace: ${K8S_NAMESPACE}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: ${APP_NAME}-${REGION_ID}
+  minReplicas: ${HPA_MIN_REPLICAS}
+  maxReplicas: ${HPA_MAX_REPLICAS}
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 25
+          periodSeconds: 60
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: ${HPA_CPU_TARGET}

k8s/regional/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: ${APP_NAME}-regional
+  namespace: ${K8S_NAMESPACE}
+spec:
+  minAvailable: ${PDB_MIN_AVAILABLE}
+  selector:
+    matchLabels:
+      app: ${APP_NAME}-regional

k8s/regional/regions.env.example

@@ -0,0 +1,51 @@
+# Common
+APP_NAME=tim-ai-atend-agnt-integ-tia
+K8S_NAMESPACE=agnt-ai-atendimento
+IMAGE_REPOSITORY=iad.ocir.io/SEU_NAMESPACE/tia
+IMAGE_TAG=regional-xai-pool-v1
+TIA_SERVICE_TYPE=LoadBalancer
+TERMINATION_GRACE_SECONDS=600
+DRAIN_SECONDS=30
+PDB_MIN_AVAILABLE=2
+
+# Existing TIA resources
+CPU_TIA_BRIDGE_REQ=250m
+MEM_TIA_BRIDGE_REQ=512Mi
+CPU_TIA_BRIDGE_LIM=1000m
+MEM_TIA_BRIDGE_LIM=1Gi
+CPU_TIA_REQ=500m
+MEM_TIA_REQ=1Gi
+CPU_TIA_LIM=2000m
+MEM_TIA_LIM=2Gi
+CPU_XAI_POOL_REQ=200m
+MEM_XAI_POOL_REQ=256Mi
+CPU_XAI_POOL_LIM=1000m
+MEM_XAI_POOL_LIM=768Mi
+
+# Pool profile - 50 means 50 prewarmed upstream WebSockets PER POD.
+XAI_POOL_SIZE=50
+XAI_POOL_UNAVAILABLE_FREE=2
+XAI_POOL_RECOVER_FREE=5
+XAI_POOL_CONNECTION_TTL_S=540
+XAI_POOL_REFRESH_JITTER_S=45
+XAI_POOL_PREWARM_CONCURRENCY=5
+XAI_TTS_VOICE=c8x2ieiocufs
+XAI_TTS_LANGUAGE=pt-BR
+XAI_UPSTREAM_AUTH_METHOD=API_KEY
+
+# HPA. WARNING: replicas * XAI_POOL_SIZE must respect OCI/xAI quota.
+HPA_MIN_REPLICAS=1
+HPA_MAX_REPLICAS=3
+HPA_CPU_TARGET=65
+
+# ORD
+ORD_REGION_ID=ord
+ORD_REGION_REPLICAS=1
+ORD_XAI_UPSTREAM_URL=wss://peordagnt002prd.pe.inference.generativeai.us-chicago-1.oci.oraclecloud.com/xai/v1/tts
+ORD_XAI_SECRET_NAME=xai-ord-credentials
+
+# IAD
+IAD_REGION_ID=iad
+IAD_REGION_REPLICAS=1
+IAD_XAI_UPSTREAM_URL=wss://peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com/xai/v1/tts
+IAD_XAI_SECRET_NAME=xai-iad-credentials

k8s/regional/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${APP_NAME}-regional
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-regional
+spec:
+  type: ${TIA_SERVICE_TYPE}
+  sessionAffinity: None
+  selector:
+    app: ${APP_NAME}-regional
+  ports:
+    - name: ws-http
+      protocol: TCP
+      port: 80
+      targetPort: 8000

k8s/regional/xai-secret.example.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: xai-ord-credentials
+  namespace: ${K8S_NAMESPACE}
+type: Opaque
+stringData:
+  XAI_API_KEY: "REPLACE_ME"
+  OCI_COMPARTMENT_ID: ""
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: xai-iad-credentials
+  namespace: ${K8S_NAMESPACE}
+type: Opaque
+stringData:
+  XAI_API_KEY: "REPLACE_ME"
+  OCI_COMPARTMENT_ID: ""

k8s/secrets.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${APP_NAME}-api-secrets
+  namespace: ${K8S_NAMESPACE}
+type: Opaque
+stringData:
+  AZURE_SPEECH_KEY: "${AZURE_SPEECH_KEY}"
+  XAI_API_KEY: "${XAI_API_KEY}"
+  LIVEKIT_REDIS_USERNAME: "${LIVEKIT_REDIS_USERNAME}"
+  LIVEKIT_REDIS_PASSWORD: "${LIVEKIT_REDIS_PASSWORD}"

k8s/tia/Dockerfile

@@ -0,0 +1,31 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+ENV PYTHONPATH=/app/src
+ENV HF_HOME=/hf
+ENV HF_HUB_CACHE=/hf/hub
+ENV HUGGINGFACE_HUB_CACHE=/hf/hub
+ENV TRANSFORMERS_CACHE=/hf/hub
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    curl \
+    libsndfile1 \
+&& rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY src/ ./src/
+RUN mkdir -p "$HF_HUB_CACHE" && \
+    python -m app.livekit.main download-files
+
+RUN useradd -m -u 1000 agent && chown -R agent:agent /app /hf
+USER agent
+
+EXPOSE 8000 18081
+
+ENTRYPOINT ["python", "-m"]

k8s/tia/deployment.yaml

@@ -0,0 +1,264 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${APP_NAME}-app
+  namespace: ${K8S_NAMESPACE}
+spec:
+  replicas: ${TIA_REPLICAS}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: ${APP_NAME}-app
+  template:
+    metadata:
+      labels:
+        app: ${APP_NAME}-app
+    spec:
+      hostAliases:
+      - ip: "10.151.225.135"
+        hostnames:
+        - "speech-agent-ai-atendi-fqa-01.cognitiveservices.azure.com"
+      - ip: 10.153.35.23
+        hostnames:
+        - tim-ai-atend-agnt-opentelemetry
+      - ip: 10.154.0.154
+        hostnames:
+        - peordagnt002prd.pe.inference.generativeai.us-chicago-1.oci.oraclecloud.com
+      - ip: 10.154.16.244
+        hostnames:
+        - peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com
+      - ip: ${REDIS_IP}
+        hostnames:
+        - ${REDIS_HOST}
+      - ip: 10.154.16.244
+        hostnames:
+        - peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: ${APP_NAME}-app-bridge
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args:
+            - app.bridge_entry
+            - --host
+            - 0.0.0.0
+            - --port
+            - "8000"
+            - --log-level
+            - info
+          ports:
+            - name: http
+              containerPort: 8000
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: "/etc/google/credentials.json"
+            - name: PYTHONPATH
+              value: /app/src
+            - name: REQUESTS_CA_BUNDLE
+              value: "/etc/ssl/custom/tls.crt"
+            - name: SSL_CERT_FILE
+              value: "/etc/ssl/custom/tls.crt"
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          volumeMounts:
+            - name: google-sa-volume
+              mountPath: /etc/google
+              readOnly: true
+            - name: trusted-ca-volume
+              mountPath: "/etc/ssl/custom"
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "${CPU_TIA_BRIDGE_REQ}"
+              memory: "${MEM_TIA_BRIDGE_REQ}"
+            limits:
+              cpu: "${CPU_TIA_BRIDGE_LIM}"
+              memory: "${MEM_TIA_BRIDGE_LIM}"
+
+        - name: ${APP_NAME}-app-agent
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args:
+            - app.agent_entry
+            - start
+            - --log-level
+            - info
+          ports:
+            - name: agent-http
+              containerPort: 18081
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: "/etc/google/credentials.json"
+            - name: PYTHONPATH
+              value: /app/src
+            - name: AGENT_SERVER_PORT
+              value: "18081"
+            - name: NUM_IDLE_PROCESSES
+              value: "1"
+            - name: REQUESTS_CA_BUNDLE
+              value: "/etc/ssl/custom/tls.crt"
+            - name: SSL_CERT_FILE
+              value: "/etc/ssl/custom/tls.crt"
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          volumeMounts:
+            - name: google-sa-volume
+              mountPath: /etc/google
+              readOnly: true
+            - name: trusted-ca-volume
+              mountPath: "/etc/ssl/custom"
+              readOnly: true
+          startupProbe:
+            httpGet:
+              path: /
+              port: 18081
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 18081
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 18081
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "${CPU_TIA_REQ}"
+              memory: "${MEM_TIA_REQ}"
+            limits:
+              cpu: "${CPU_TIA_LIM}"
+              memory: "${MEM_TIA_LIM}"
+      volumes:
+        - name: google-sa-volume
+          secret:
+            secretName: ${APP_NAME}-google-sa-secret
+        - name: trusted-ca-volume
+          secret:
+            secretName: shared-tls-secret
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${APP_NAME}-app
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-app
+spec:
+  type: NodePort
+  selector:
+    app: ${APP_NAME}-app
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 8000
+    - name: https
+      protocol: TCP
+      port: 443
+      targetPort: 8000
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ${APP_NAME}-route
+  namespace: ${K8S_NAMESPACE}
+spec:
+  parentRefs:
+    - name: istio-gateway
+      namespace: istio-gateway 
+  hostnames:
+    - ${APP_NAME}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      timeouts:
+        request: 1600s
+      backendRefs:
+        - name: ${APP_NAME}-app
+          port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ${APP_NAME}-route-http
+  namespace: ${K8S_NAMESPACE}
+spec:
+  parentRefs:
+    - name: istio-gateway
+      namespace: istio-gateway 
+  hostnames:
+    - ${DNS}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      timeouts:
+        request: 1600s
+      backendRefs:
+        - name: ${APP_NAME}-app
+          port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ${APP_NAME}-route-https
+  namespace: ${K8S_NAMESPACE}
+spec:
+  parentRefs:
+    - name: istio-gateway
+      namespace: istio-gateway 
+  hostnames:
+    - ${DNS}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      timeouts:
+        request: 1600s
+      backendRefs:
+        - name: ${APP_NAME}-app
+          port: 443