first commit

k8s/regional/deployment-region.yaml

@@ -157,6 +157,8 @@ spec:
               value: "${XAI_POOL_REFRESH_JITTER_S}"
             - name: XAI_POOL_PREWARM_CONCURRENCY
               value: "${XAI_POOL_PREWARM_CONCURRENCY}"
+            - name: XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S
+              value: "${XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S}"
             - name: XAI_TTS_VOICE
               value: ${XAI_TTS_VOICE}
             - name: XAI_TTS_LANGUAGE

k8s/regional/regions.env.example

@@ -23,17 +23,20 @@ CPU_XAI_POOL_LIM=1000m
 MEM_XAI_POOL_LIM=768Mi
 
 # Pool profile - 50 means 50 prewarmed upstream WebSockets PER POD.
+# Tamanho do pool por réplica TIA. NÃO representa limite do OCI/xAI.
+# Ajuste conforme capacidade negociada para o ambiente.
 XAI_POOL_SIZE=50
 XAI_POOL_UNAVAILABLE_FREE=2
 XAI_POOL_RECOVER_FREE=5
 XAI_POOL_CONNECTION_TTL_S=540
 XAI_POOL_REFRESH_JITTER_S=45
 XAI_POOL_PREWARM_CONCURRENCY=5
+XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S=1.0
 XAI_TTS_VOICE=c8x2ieiocufs
 XAI_TTS_LANGUAGE=pt-BR
 XAI_UPSTREAM_AUTH_METHOD=API_KEY
 
-# HPA. WARNING: replicas * XAI_POOL_SIZE must respect OCI/xAI quota.
+# HPA. replicas * XAI_POOL_SIZE deve respeitar a capacidade efetivamente negociada/provisionada para cada região/endpoint.
 HPA_MIN_REPLICAS=1
 HPA_MAX_REPLICAS=3
 HPA_CPU_TARGET=65

k8s/regional/rendered/deployment-iad.yaml

@@ -0,0 +1,213 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tim-ai-atend-agnt-integ-tia-iad
+  namespace: agnt-ai-atendimento
+  labels:
+    app: tim-ai-atend-agnt-integ-tia-regional
+    tia-region: iad
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: tim-ai-atend-agnt-integ-tia-regional
+      tia-region: iad
+  template:
+    metadata:
+      labels:
+        app: tim-ai-atend-agnt-integ-tia-regional
+        tia-region: iad
+    spec:
+      terminationGracePeriodSeconds: 600
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: bridge
+          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
+          imagePullPolicy: IfNotPresent
+          args: ["app.bridge_entry", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
+          ports:
+            - name: bridge-http
+              containerPort: 8000
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: iad
+          envFrom:
+            - configMapRef:
+                name: tim-ai-atend-agnt-integ-tia-config
+            - secretRef:
+                name: tim-ai-atend-agnt-integ-tia-api-secrets
+          readinessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "250m", memory: "512Mi"}
+            limits: {cpu: "1000m", memory: "1Gi"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: agent
+          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
+          imagePullPolicy: IfNotPresent
+          args: ["app.agent_entry", "start", "--log-level", "info"]
+          ports:
+            - name: agent-http
+              containerPort: 18081
+          envFrom:
+            - configMapRef:
+                name: tim-ai-atend-agnt-integ-tia-config
+            - secretRef:
+                name: tim-ai-atend-agnt-integ-tia-api-secrets
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: AGENT_SERVER_PORT
+              value: "18081"
+            - name: NUM_IDLE_PROCESSES
+              value: "1"
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: iad
+            # Agent sees a local xAI-compatible endpoint. Real OCI credentials stay in xai-pool.
+            - name: XAI_WEBSOCKET_URL
+              value: ws://127.0.0.1:18100/xai/v1/tts
+            - name: XAI_TTS_AUTH_METHOD
+              value: API_KEY
+            - name: XAI_API_KEY
+              value: local-pool-proxy
+          startupProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "500m", memory: "1Gi"}
+            limits: {cpu: "2000m", memory: "2Gi"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: xai-pool
+          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
+          imagePullPolicy: IfNotPresent
+          args: ["app.livekit.adapters.xai_pool_proxy"]
+          ports:
+            - name: xai-pool
+              containerPort: 18100
+          env:
+            - name: PYTHONPATH
+              value: /app/src
+            - name: TIA_XAI_REGION
+              value: iad
+            - name: XAI_POOL_UPSTREAM_URL
+              value: wss://peiadagnt003prd.pe.inference.generativeai.us-ashburn-1.oci.oraclecloud.com/xai/v1/tts
+            - name: XAI_POOL_SIZE
+              value: "50"
+            - name: XAI_POOL_UNAVAILABLE_FREE
+              value: "2"
+            - name: XAI_POOL_RECOVER_FREE
+              value: "5"
+            - name: XAI_POOL_CONNECTION_TTL_S
+              value: "540"
+            - name: XAI_POOL_REFRESH_JITTER_S
+              value: "45"
+            - name: XAI_POOL_PREWARM_CONCURRENCY
+              value: "5"
+            - name: XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S
+              value: "1.0"
+            - name: XAI_TTS_VOICE
+              value: c8x2ieiocufs
+            - name: XAI_TTS_LANGUAGE
+              value: pt-BR
+            - name: XAI_TTS_AUTH_METHOD
+              value: API_KEY
+            - name: OCI_COMPARTMENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: xai-iad-credentials
+                  key: OCI_COMPARTMENT_ID
+                  optional: true
+            - name: XAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: xai-iad-credentials
+                  key: XAI_API_KEY
+                  optional: true
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+          readinessProbe:
+            httpGet: {path: /readyz, port: 18100}
+            initialDelaySeconds: 5
+            periodSeconds: 2
+            timeoutSeconds: 1
+            failureThreshold: 2
+            successThreshold: 1
+          livenessProbe:
+            httpGet: {path: /healthz, port: 18100}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "curl -sf -X POST http://127.0.0.1:18100/drain || true; sleep 30"]
+          resources:
+            requests: {cpu: "200m", memory: "256Mi"}
+            limits: {cpu: "1000m", memory: "768Mi"}
+          volumeMounts:
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+      volumes:
+        - name: google-sa-volume
+          secret:
+            secretName: tim-ai-atend-agnt-integ-tia-google-sa-secret
+        - name: trusted-ca-volume
+          secret:
+            secretName: shared-tls-secret

k8s/regional/rendered/deployment-ord.yaml

@@ -0,0 +1,213 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tim-ai-atend-agnt-integ-tia-ord
+  namespace: agnt-ai-atendimento
+  labels:
+    app: tim-ai-atend-agnt-integ-tia-regional
+    tia-region: ord
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: tim-ai-atend-agnt-integ-tia-regional
+      tia-region: ord
+  template:
+    metadata:
+      labels:
+        app: tim-ai-atend-agnt-integ-tia-regional
+        tia-region: ord
+    spec:
+      terminationGracePeriodSeconds: 600
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: bridge
+          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
+          imagePullPolicy: IfNotPresent
+          args: ["app.bridge_entry", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]
+          ports:
+            - name: bridge-http
+              containerPort: 8000
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ord
+          envFrom:
+            - configMapRef:
+                name: tim-ai-atend-agnt-integ-tia-config
+            - secretRef:
+                name: tim-ai-atend-agnt-integ-tia-api-secrets
+          readinessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /health, port: 8000}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "250m", memory: "512Mi"}
+            limits: {cpu: "1000m", memory: "1Gi"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: agent
+          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
+          imagePullPolicy: IfNotPresent
+          args: ["app.agent_entry", "start", "--log-level", "info"]
+          ports:
+            - name: agent-http
+              containerPort: 18081
+          envFrom:
+            - configMapRef:
+                name: tim-ai-atend-agnt-integ-tia-config
+            - secretRef:
+                name: tim-ai-atend-agnt-integ-tia-api-secrets
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/google/credentials.json
+            - name: PYTHONPATH
+              value: /app/src
+            - name: AGENT_SERVER_PORT
+              value: "18081"
+            - name: NUM_IDLE_PROCESSES
+              value: "1"
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+            - name: TIA_XAI_REGION
+              value: ord
+            # Agent sees a local xAI-compatible endpoint. Real OCI credentials stay in xai-pool.
+            - name: XAI_WEBSOCKET_URL
+              value: ws://127.0.0.1:18100/xai/v1/tts
+            - name: XAI_TTS_AUTH_METHOD
+              value: API_KEY
+            - name: XAI_API_KEY
+              value: local-pool-proxy
+          startupProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /, port: 18081}
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests: {cpu: "500m", memory: "1Gi"}
+            limits: {cpu: "2000m", memory: "2Gi"}
+          volumeMounts:
+            - {name: google-sa-volume, mountPath: /etc/google, readOnly: true}
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+        - name: xai-pool
+          image: iad.ocir.io/SEU_NAMESPACE/tia:regional-xai-pool-v1
+          imagePullPolicy: IfNotPresent
+          args: ["app.livekit.adapters.xai_pool_proxy"]
+          ports:
+            - name: xai-pool
+              containerPort: 18100
+          env:
+            - name: PYTHONPATH
+              value: /app/src
+            - name: TIA_XAI_REGION
+              value: ord
+            - name: XAI_POOL_UPSTREAM_URL
+              value: wss://peordagnt002prd.pe.inference.generativeai.us-chicago-1.oci.oraclecloud.com/xai/v1/tts
+            - name: XAI_POOL_SIZE
+              value: "50"
+            - name: XAI_POOL_UNAVAILABLE_FREE
+              value: "2"
+            - name: XAI_POOL_RECOVER_FREE
+              value: "5"
+            - name: XAI_POOL_CONNECTION_TTL_S
+              value: "540"
+            - name: XAI_POOL_REFRESH_JITTER_S
+              value: "45"
+            - name: XAI_POOL_PREWARM_CONCURRENCY
+              value: "5"
+            - name: XAI_POOL_BARGE_IN_CLEAR_TIMEOUT_S
+              value: "1.0"
+            - name: XAI_TTS_VOICE
+              value: c8x2ieiocufs
+            - name: XAI_TTS_LANGUAGE
+              value: pt-BR
+            - name: XAI_TTS_AUTH_METHOD
+              value: API_KEY
+            - name: OCI_COMPARTMENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: xai-ord-credentials
+                  key: OCI_COMPARTMENT_ID
+                  optional: true
+            - name: XAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: xai-ord-credentials
+                  key: XAI_API_KEY
+                  optional: true
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/custom/tls.crt
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/custom/tls.crt
+          readinessProbe:
+            httpGet: {path: /readyz, port: 18100}
+            initialDelaySeconds: 5
+            periodSeconds: 2
+            timeoutSeconds: 1
+            failureThreshold: 2
+            successThreshold: 1
+          livenessProbe:
+            httpGet: {path: /healthz, port: 18100}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "curl -sf -X POST http://127.0.0.1:18100/drain || true; sleep 30"]
+          resources:
+            requests: {cpu: "200m", memory: "256Mi"}
+            limits: {cpu: "1000m", memory: "768Mi"}
+          volumeMounts:
+            - {name: trusted-ca-volume, mountPath: /etc/ssl/custom, readOnly: true}
+
+      volumes:
+        - name: google-sa-volume
+          secret:
+            secretName: tim-ai-atend-agnt-integ-tia-google-sa-secret
+        - name: trusted-ca-volume
+          secret:
+            secretName: shared-tls-secret

k8s/regional/rendered/hpa-iad.yaml

@@ -0,0 +1,32 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: tim-ai-atend-agnt-integ-tia-iad
+  namespace: agnt-ai-atendimento
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: tim-ai-atend-agnt-integ-tia-iad
+  minReplicas: 1
+  maxReplicas: 3
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 25
+          periodSeconds: 60
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 65

k8s/regional/rendered/hpa-ord.yaml

@@ -0,0 +1,32 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: tim-ai-atend-agnt-integ-tia-ord
+  namespace: agnt-ai-atendimento
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: tim-ai-atend-agnt-integ-tia-ord
+  minReplicas: 1
+  maxReplicas: 3
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 25
+          periodSeconds: 60
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 65

k8s/regional/rendered/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: tim-ai-atend-agnt-integ-tia-regional
+  namespace: agnt-ai-atendimento
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: tim-ai-atend-agnt-integ-tia-regional

k8s/regional/rendered/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tim-ai-atend-agnt-integ-tia-regional
+  namespace: agnt-ai-atendimento
+  labels:
+    app: tim-ai-atend-agnt-integ-tia-regional
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  selector:
+    app: tim-ai-atend-agnt-integ-tia-regional
+  ports:
+    - name: ws-http
+      protocol: TCP
+      port: 80
+      targetPort: 8000