first commit

2026-08-21 08:37:51 -03:00
commit 881a99b0a8
214 changed files with 61407 additions and 0 deletions
--- a/k8s/regional/deployment-region.yaml
+++ b/k8s/regional/deployment-region.yaml
@@ -0,0 +1,211 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${APP_NAME}-${REGION_ID}
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-regional
+    tia-region: ${REGION_ID}
+spec:
+  replicas: ${REGION_REPLICAS}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: ${APP_NAME}-regional
+      tia-region: ${REGION_ID}
+  template:
+    metadata:
+      labels:
+        app: ${APP_NAME}-regional
+        tia-region: ${REGION_ID}
+    spec:
+      terminationGracePeriodSeconds: ${TERMINATION_GRACE_SECONDS}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: bridge
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.bridge_entry", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
+          ports:
+            - name: bridge-http
+              containerPort: 8000
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          readinessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "${CPU_TIA_BRIDGE_REQ}", memory: "${MEM_TIA_BRIDGE_REQ}"}
+            limits: {cpu: "${CPU_TIA_BRIDGE_LIM}", memory: "${MEM_TIA_BRIDGE_LIM}"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: agent
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.agent_entry", "start", "--log-level", "info"]
+          ports:
+            - name: agent-http
+              containerPort: 18081
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: AGENT_SERVER_PORT
+              value: "18081"
+            - name: NUM_IDLE_PROCESSES
+              value: "1"
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+            # Agent sees a local xAI-compatible endpoint. Real OCI credentials stay in xai-pool.
+            - name: XAI_WEBSOCKET_URL
+              value: ws://127.0.0.1:18100/xai/v1/tts
+            - name: XAI_TTS_AUTH_METHOD
+              value: API_KEY
+            - name: XAI_API_KEY
+              value: local-pool-proxy
+          startupProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "${CPU_TIA_REQ}", memory: "${MEM_TIA_REQ}"}
+            limits: {cpu: "${CPU_TIA_LIM}", memory: "${MEM_TIA_LIM}"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: xai-pool
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.livekit.adapters.xai_pool_proxy"]
+          ports:
+            - name: xai-pool
+              containerPort: 18100
+          env:
+            - name: PYTHONPATH
+              value: /app/src
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+            - name: XAI_POOL_UPSTREAM_URL
+              value: ${XAI_UPSTREAM_URL}
+            - name: XAI_POOL_SIZE
+              value: "${XAI_POOL_SIZE}"
+            - name: XAI_POOL_UNAVAILABLE_FREE
+              value: "${XAI_POOL_UNAVAILABLE_FREE}"
+            - name: XAI_POOL_RECOVER_FREE
+              value: "${XAI_POOL_RECOVER_FREE}"
+            - name: XAI_POOL_CONNECTION_TTL_S
+              value: "${XAI_POOL_CONNECTION_TTL_S}"
+            - name: XAI_POOL_REFRESH_JITTER_S
+              value: "${XAI_POOL_REFRESH_JITTER_S}"
+            - name: XAI_POOL_PREWARM_CONCURRENCY
+              value: "${XAI_POOL_PREWARM_CONCURRENCY}"
+            - name: XAI_TTS_VOICE
+              value: ${XAI_TTS_VOICE}
+            - name: XAI_TTS_LANGUAGE
+              value: ${XAI_TTS_LANGUAGE}
+            - name: XAI_TTS_AUTH_METHOD
+              value: ${XAI_UPSTREAM_AUTH_METHOD}
+            - name: OCI_COMPARTMENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: ${XAI_SECRET_NAME}
+                  key: OCI_COMPARTMENT_ID
+                  optional: true
+            - name: XAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ${XAI_SECRET_NAME}
+                  key: XAI_API_KEY
+                  optional: true
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+          readinessProbe:
+            httpGet: {path: /readyz, port: 18100}
+            initialDelaySeconds: 5
+            periodSeconds: 2
+            timeoutSeconds: 1
+            failureThreshold: 2
+            successThreshold: 1
+          livenessProbe:
+            httpGet: {path: /healthz, port: 18100}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "curl -sf -X POST http://127.0.0.1:18100/drain || true; sleep ${DRAIN_SECONDS}"]
+          resources:
+            requests: {cpu: "${CPU_XAI_POOL_REQ}", memory: "${MEM_XAI_POOL_REQ}"}
+            limits: {cpu: "${CPU_XAI_POOL_LIM}", memory: "${MEM_XAI_POOL_LIM}"}
+          volumeMounts:
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+      volumes:
+        - name: google-sa-volume
+          secret:
+            secretName: ${APP_NAME}-google-sa-secret
+        - name: trusted-ca-volume
+          secret:
+            secretName: shared-tls-secret
--- a/k8s/regional/hpa-region.yaml
+++ b/k8s/regional/hpa-region.yaml
@@ -0,0 +1,32 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: ${APP_NAME}-${REGION_ID}
+  namespace: ${K8S_NAMESPACE}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: ${APP_NAME}-${REGION_ID}
+  minReplicas: ${HPA_MIN_REPLICAS}
+  maxReplicas: ${HPA_MAX_REPLICAS}
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 25
+          periodSeconds: 60
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: ${HPA_CPU_TARGET}
--- a/k8s/regional/pdb.yaml
+++ b/k8s/regional/pdb.yaml
@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: ${APP_NAME}-regional
+  namespace: ${K8S_NAMESPACE}
+spec:
+  minAvailable: ${PDB_MIN_AVAILABLE}
+  selector:
+    matchLabels:
+      app: ${APP_NAME}-regional
--- a/k8s/regional/regions.env.example
+++ b/k8s/regional/regions.env.example
@@ -0,0 +1,51 @@
+# Common
+APP_NAME=tim-ai-atend-agnt-integ-tia
+K8S_NAMESPACE=agnt-ai-atendimento
+IMAGE_REPOSITORY=iad.ocir.io/SEU_NAMESPACE/tia
+IMAGE_TAG=regional-xai-pool-v1
+TIA_SERVICE_TYPE=LoadBalancer
+TERMINATION_GRACE_SECONDS=600
+DRAIN_SECONDS=30
+PDB_MIN_AVAILABLE=2
+
+# Existing TIA resources
+CPU_TIA_BRIDGE_REQ=250m
+MEM_TIA_BRIDGE_REQ=512Mi
+CPU_TIA_BRIDGE_LIM=1000m
+MEM_TIA_BRIDGE_LIM=1Gi
+CPU_TIA_REQ=500m
+MEM_TIA_REQ=1Gi
+CPU_TIA_LIM=2000m
+MEM_TIA_LIM=2Gi
+CPU_XAI_POOL_REQ=200m
+MEM_XAI_POOL_REQ=256Mi
+CPU_XAI_POOL_LIM=1000m
+MEM_XAI_POOL_LIM=768Mi
+
+# Pool profile - 50 means 50 prewarmed upstream WebSockets PER POD.
+XAI_POOL_SIZE=50
+XAI_POOL_UNAVAILABLE_FREE=2
+XAI_POOL_RECOVER_FREE=5
+XAI_POOL_CONNECTION_TTL_S=540
+XAI_POOL_REFRESH_JITTER_S=45
+XAI_POOL_PREWARM_CONCURRENCY=5
+XAI_TTS_VOICE=c8x2ieiocufs
+XAI_TTS_LANGUAGE=pt-BR
+XAI_UPSTREAM_AUTH_METHOD=API_KEY
+
+# HPA. WARNING: replicas * XAI_POOL_SIZE must respect OCI/xAI quota.
+HPA_MIN_REPLICAS=1
+HPA_MAX_REPLICAS=3
+HPA_CPU_TARGET=65
+
+# ORD
+ORD_REGION_ID=ord
+ORD_REGION_REPLICAS=1
+ORD_XAI_UPSTREAM_URL=wss://peordagnt002prd.pe.inference.generativeai.us-chicago-1.oci.oraclecloud.com/xai/v1/tts
+ORD_XAI_SECRET_NAME=xai-ord-credentials
+
+# IAD
+IAD_REGION_ID=iad
+IAD_REGION_REPLICAS=1
+IAD_XAI_UPSTREAM_URL=wss://peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com/xai/v1/tts
+IAD_XAI_SECRET_NAME=xai-iad-credentials
--- a/k8s/regional/service.yaml
+++ b/k8s/regional/service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${APP_NAME}-regional
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-regional
+spec:
+  type: ${TIA_SERVICE_TYPE}
+  sessionAffinity: None
+  selector:
+    app: ${APP_NAME}-regional
+  ports:
+    - name: ws-http
+      protocol: TCP
+      port: 80
+      targetPort: 8000
--- a/k8s/regional/xai-secret.example.yaml
+++ b/k8s/regional/xai-secret.example.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: xai-ord-credentials
+  namespace: ${K8S_NAMESPACE}
+type: Opaque
+stringData:
+  XAI_API_KEY: "REPLACE_ME"
+  OCI_COMPARTMENT_ID: ""
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: xai-iad-credentials
+  namespace: ${K8S_NAMESPACE}
+type: Opaque
+stringData:
+  XAI_API_KEY: "REPLACE_ME"
+  OCI_COMPARTMENT_ID: ""