Test
4a34c8e672
Implements AWS AssumeRole-like pattern for Poimen: - User/service requests temporary access with identity + scope - AssumeRoleActivity exchanges credentials with OAuth2 auth server - Returns JWT token valid for limited time (default: 1hr, max: 24hrs) - Token used in all subsequent LLM API calls to api.riotpiao.com Key features: - Credentials from vault/K8s secrets (never hardcoded) - Scope-based access control (llm:read, llm:read llm:write, llm:admin) - Automatic token expiration tracking - Retry support for transient auth failures (2x, 1.5s backoff) - Configurable auth server endpoint Usage pattern: 1. AssumeRoleActivity(identity, scope) → JWT token 2. LLMRouter uses token in LLMAuth config 3. All activity calls validated against token + scopes 4. Workflow optionally refreshes token before expiry Security: - No credentials in code/logs (env or vault only) - Short-lived tokens (1hr default, 24hr max) - Server-enforced scope validation - Token revocation support Activity registered: #10 (authentication category) Knowledge base updated with full activity spec New file: action/assume_role.go (5.2 KB)
79 lines
2.3 KiB
YAML
79 lines
2.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: poimen-worker
|
|
namespace: poimen
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: poimen-worker
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: poimen-worker
|
|
annotations:
|
|
git-commit: "f6c6aa03" # ✅ Updated on each push, triggers rolling restart
|
|
deployment-date: "2026-09-04"
|
|
spec:
|
|
containers:
|
|
- name: worker
|
|
image: golang:latest
|
|
imagePullPolicy: Always # ✅ Force pull latest image on pod startup
|
|
workingDir: /app
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
echo "[$(date)] Starting poimen worker pod..."
|
|
apt-get update && apt-get install -y --no-install-recommends git
|
|
echo "[$(date)] Cloning latest code from git..."
|
|
git clone https://forgejo.riotpiao.com/rock/poimen-workflows.git /app
|
|
cd /app
|
|
echo "[$(date)] Latest commit: $(git rev-parse HEAD)"
|
|
echo "[$(date)] Downloading dependencies..."
|
|
go mod download
|
|
echo "[$(date)] Starting orchestrator worker..."
|
|
go run ./cmd/worker
|
|
env:
|
|
- name: TEMPORAL_NAMESPACE
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: TEMPORAL_NAMESPACE
|
|
- name: TEMPORAL_HOSTPORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: TEMPORAL_HOSTPORT
|
|
- name: ANTHROPIC_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: poimen-secrets
|
|
key: ANTHROPIC_API_KEY
|
|
- name: LOCAL_LLM_BASE_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: LOCAL_LLM_BASE_URL
|
|
- name: POIMEN_MEMORY_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: POIMEN_MEMORY_URL
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "2000m"
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- ps aux | grep -q "go run ./cmd/worker" && echo ok || exit 1
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|