rock
4d23c983ab
The init container fetched a token once at pod start with a client_credentials grant against a web app. A web app has no such grant, so the fetch could not work; and a token fetched once is dead within the hour while the pod runs for weeks. llm-token-vendor runs beside the app. It signs a machine-key assertion for the paperless-llm service account, exchanges it for a token, and rewrites /app/data/llm_token.txt atomically at 80% of the token lifetime. The vendor image keeps using CUSTOM_API_KEY_FILE, so it needs no change and no OIDC support. The key is re-read on every mint, so a rotation lands without a restart: publish the new key, the next mint uses it, retire the old one. paperless-llm is a separate service account from poimen-llm, so revoking one caller leaves the other working.
11 lines
294 B
Docker
11 lines
294 B
Docker
FROM golang:1.26 AS build
|
|
WORKDIR /src
|
|
COPY go.mod ./
|
|
COPY *.go ./
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/vendor .
|
|
|
|
FROM gcr.io/distroless/static:nonroot
|
|
COPY --from=build /out/vendor /usr/local/bin/vendor
|
|
USER 65532:65532
|
|
ENTRYPOINT ["/usr/local/bin/vendor"]
|