first commit

k8s/regional/deployment-region.yaml

@@ -0,0 +1,211 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${APP_NAME}-${REGION_ID}
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-regional
+    tia-region: ${REGION_ID}
+spec:
+  replicas: ${REGION_REPLICAS}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: ${APP_NAME}-regional
+      tia-region: ${REGION_ID}
+  template:
+    metadata:
+      labels:
+        app: ${APP_NAME}-regional
+        tia-region: ${REGION_ID}
+    spec:
+      terminationGracePeriodSeconds: ${TERMINATION_GRACE_SECONDS}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: bridge
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.bridge_entry", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
+          ports:
+            - name: bridge-http
+              containerPort: 8000
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          readinessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "${CPU_TIA_BRIDGE_REQ}", memory: "${MEM_TIA_BRIDGE_REQ}"}
+            limits: {cpu: "${CPU_TIA_BRIDGE_LIM}", memory: "${MEM_TIA_BRIDGE_LIM}"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: agent
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.agent_entry", "start", "--log-level", "info"]
+          ports:
+            - name: agent-http
+              containerPort: 18081
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: AGENT_SERVER_PORT
+              value: "18081"
+            - name: NUM_IDLE_PROCESSES
+              value: "1"
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+            # Agent sees a local xAI-compatible endpoint. Real OCI credentials stay in xai-pool.
+            - name: XAI_WEBSOCKET_URL
+              value: ws://127.0.0.1:18100/xai/v1/tts
+            - name: XAI_TTS_AUTH_METHOD
+              value: API_KEY
+            - name: XAI_API_KEY
+              value: local-pool-proxy
+          startupProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "${CPU_TIA_REQ}", memory: "${MEM_TIA_REQ}"}
+            limits: {cpu: "${CPU_TIA_LIM}", memory: "${MEM_TIA_LIM}"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: xai-pool
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args: ["app.livekit.adapters.xai_pool_proxy"]
+          ports:
+            - name: xai-pool
+              containerPort: 18100
+          env:
+            - name: PYTHONPATH
+              value: /app/src
+            - name: TIA_XAI_REGION
+              value: ${REGION_ID}
+            - name: XAI_POOL_UPSTREAM_URL
+              value: ${XAI_UPSTREAM_URL}
+            - name: XAI_POOL_SIZE
+              value: "${XAI_POOL_SIZE}"
+            - name: XAI_POOL_UNAVAILABLE_FREE
+              value: "${XAI_POOL_UNAVAILABLE_FREE}"
+            - name: XAI_POOL_RECOVER_FREE
+              value: "${XAI_POOL_RECOVER_FREE}"
+            - name: XAI_POOL_CONNECTION_TTL_S
+              value: "${XAI_POOL_CONNECTION_TTL_S}"
+            - name: XAI_POOL_REFRESH_JITTER_S
+              value: "${XAI_POOL_REFRESH_JITTER_S}"
+            - name: XAI_POOL_PREWARM_CONCURRENCY
+              value: "${XAI_POOL_PREWARM_CONCURRENCY}"
+            - name: XAI_TTS_VOICE
+              value: ${XAI_TTS_VOICE}
+            - name: XAI_TTS_LANGUAGE
+              value: ${XAI_TTS_LANGUAGE}
+            - name: XAI_TTS_AUTH_METHOD
+              value: ${XAI_UPSTREAM_AUTH_METHOD}
+            - name: OCI_COMPARTMENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: ${XAI_SECRET_NAME}
+                  key: OCI_COMPARTMENT_ID
+                  optional: true
+            - name: XAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: ${XAI_SECRET_NAME}
+                  key: XAI_API_KEY
+                  optional: true
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+          readinessProbe:
+            httpGet: {path: /readyz, port: 18100}
+            initialDelaySeconds: 5
+            periodSeconds: 2
+            timeoutSeconds: 1
+            failureThreshold: 2
+            successThreshold: 1
+          livenessProbe:
+            httpGet: {path: /healthz, port: 18100}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "curl -sf -X POST http://127.0.0.1:18100/drain || true; sleep ${DRAIN_SECONDS}"]
+          resources:
+            requests: {cpu: "${CPU_XAI_POOL_REQ}", memory: "${MEM_XAI_POOL_REQ}"}
+            limits: {cpu: "${CPU_XAI_POOL_LIM}", memory: "${MEM_XAI_POOL_LIM}"}
+          volumeMounts:
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+      volumes:
+        - name: google-sa-volume
+          secret:
+            secretName: ${APP_NAME}-google-sa-secret
+        - name: trusted-ca-volume
+          secret:
+            secretName: shared-tls-secret