first commit

k8s/tia/deployment.yaml

@@ -0,0 +1,264 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${APP_NAME}-app
+  namespace: ${K8S_NAMESPACE}
+spec:
+  replicas: ${TIA_REPLICAS}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: ${APP_NAME}-app
+  template:
+    metadata:
+      labels:
+        app: ${APP_NAME}-app
+    spec:
+      hostAliases:
+      - ip: "10.151.225.135"
+        hostnames:
+        - "speech-agent-ai-atendi-fqa-01.cognitiveservices.azure.com"
+      - ip: 10.153.35.23
+        hostnames:
+        - tim-ai-atend-agnt-opentelemetry
+      - ip: 10.154.0.154
+        hostnames:
+        - peordagnt002prd.pe.inference.generativeai.us-chicago-1.oci.oraclecloud.com
+      - ip: 10.154.16.244
+        hostnames:
+        - peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com
+      - ip: ${REDIS_IP}
+        hostnames:
+        - ${REDIS_HOST}
+      - ip: 10.154.16.244
+        hostnames:
+        - peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: ${APP_NAME}-app-bridge
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args:
+            - app.bridge_entry
+            - --host
+            - 0.0.0.0
+            - --port
+            - "8000"
+            - --log-level
+            - info
+          ports:
+            - name: http
+              containerPort: 8000
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: "/etc/google/credentials.json"
+            - name: PYTHONPATH
+              value: /app/src
+            - name: REQUESTS_CA_BUNDLE
+              value: "/etc/ssl/custom/tls.crt"
+            - name: SSL_CERT_FILE
+              value: "/etc/ssl/custom/tls.crt"
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          volumeMounts:
+            - name: google-sa-volume
+              mountPath: /etc/google
+              readOnly: true
+            - name: trusted-ca-volume
+              mountPath: "/etc/ssl/custom"
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "${CPU_TIA_BRIDGE_REQ}"
+              memory: "${MEM_TIA_BRIDGE_REQ}"
+            limits:
+              cpu: "${CPU_TIA_BRIDGE_LIM}"
+              memory: "${MEM_TIA_BRIDGE_LIM}"
+
+        - name: ${APP_NAME}-app-agent
+          image: ${IMAGE_REPOSITORY}:${IMAGE_TAG}
+          imagePullPolicy: IfNotPresent
+          args:
+            - app.agent_entry
+            - start
+            - --log-level
+            - info
+          ports:
+            - name: agent-http
+              containerPort: 18081
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: "/etc/google/credentials.json"
+            - name: PYTHONPATH
+              value: /app/src
+            - name: AGENT_SERVER_PORT
+              value: "18081"
+            - name: NUM_IDLE_PROCESSES
+              value: "1"
+            - name: REQUESTS_CA_BUNDLE
+              value: "/etc/ssl/custom/tls.crt"
+            - name: SSL_CERT_FILE
+              value: "/etc/ssl/custom/tls.crt"
+          envFrom:
+            - configMapRef:
+                name: ${APP_NAME}-config
+            - secretRef:
+                name: ${APP_NAME}-api-secrets
+          volumeMounts:
+            - name: google-sa-volume
+              mountPath: /etc/google
+              readOnly: true
+            - name: trusted-ca-volume
+              mountPath: "/etc/ssl/custom"
+              readOnly: true
+          startupProbe:
+            httpGet:
+              path: /
+              port: 18081
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 18081
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 18081
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "${CPU_TIA_REQ}"
+              memory: "${MEM_TIA_REQ}"
+            limits:
+              cpu: "${CPU_TIA_LIM}"
+              memory: "${MEM_TIA_LIM}"
+      volumes:
+        - name: google-sa-volume
+          secret:
+            secretName: ${APP_NAME}-google-sa-secret
+        - name: trusted-ca-volume
+          secret:
+            secretName: shared-tls-secret
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${APP_NAME}-app
+  namespace: ${K8S_NAMESPACE}
+  labels:
+    app: ${APP_NAME}-app
+spec:
+  type: NodePort
+  selector:
+    app: ${APP_NAME}-app
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 8000
+    - name: https
+      protocol: TCP
+      port: 443
+      targetPort: 8000
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ${APP_NAME}-route
+  namespace: ${K8S_NAMESPACE}
+spec:
+  parentRefs:
+    - name: istio-gateway
+      namespace: istio-gateway 
+  hostnames:
+    - ${APP_NAME}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      timeouts:
+        request: 1600s
+      backendRefs:
+        - name: ${APP_NAME}-app
+          port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ${APP_NAME}-route-http
+  namespace: ${K8S_NAMESPACE}
+spec:
+  parentRefs:
+    - name: istio-gateway
+      namespace: istio-gateway 
+  hostnames:
+    - ${DNS}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      timeouts:
+        request: 1600s
+      backendRefs:
+        - name: ${APP_NAME}-app
+          port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ${APP_NAME}-route-https
+  namespace: ${K8S_NAMESPACE}
+spec:
+  parentRefs:
+    - name: istio-gateway
+      namespace: istio-gateway 
+  hostnames:
+    - ${DNS}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      timeouts:
+        request: 1600s
+      backendRefs:
+        - name: ${APP_NAME}-app
+          port: 443