Test
66c17e821f
ci / test (push) Failing after 1m49s
- Add LLMAuth struct with support for Bearer, API Key, and Custom auth types - Implement applyAuth() to inject auth headers into LLM requests - Add X-Tenant-ID header for multi-tenant isolation - Add X-OAuth-Scopes header for OAuth2 scope enforcement - Add UpdateAuth() for runtime token refresh (long-running workflows) - Update LLMRouterConfig with Auth and TenantID fields - Document 4 authentication patterns (Bearer, API Key, Custom, Router config) - Add security best practices: token vault integration, tenant isolation, scopes - Add audit headers for compliance & logging - Create multi-tenant router factory pattern Auth types supported: - Bearer: JWT/OAuth2 tokens (most secure for federated access) - API Key: Static keys (X-API-Key header) - Custom: Any custom header-based scheme - None: No authentication Customers can now pass per-tenant JWT tokens with customized scopes and isolated LLM API access per tenant/customer.
79 lines
2.3 KiB
YAML
79 lines
2.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: poimen-worker
|
|
namespace: poimen
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: poimen-worker
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: poimen-worker
|
|
annotations:
|
|
git-commit: "30644a8e" # ✅ Updated on each push, triggers rolling restart
|
|
deployment-date: "2026-09-04"
|
|
spec:
|
|
containers:
|
|
- name: worker
|
|
image: golang:latest
|
|
imagePullPolicy: Always # ✅ Force pull latest image on pod startup
|
|
workingDir: /app
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
echo "[$(date)] Starting poimen worker pod..."
|
|
apt-get update && apt-get install -y --no-install-recommends git
|
|
echo "[$(date)] Cloning latest code from git..."
|
|
git clone https://forgejo.riotpiao.com/rock/poimen-workflows.git /app
|
|
cd /app
|
|
echo "[$(date)] Latest commit: $(git rev-parse HEAD)"
|
|
echo "[$(date)] Downloading dependencies..."
|
|
go mod download
|
|
echo "[$(date)] Starting orchestrator worker..."
|
|
go run ./cmd/worker
|
|
env:
|
|
- name: TEMPORAL_NAMESPACE
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: TEMPORAL_NAMESPACE
|
|
- name: TEMPORAL_HOSTPORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: TEMPORAL_HOSTPORT
|
|
- name: ANTHROPIC_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: poimen-secrets
|
|
key: ANTHROPIC_API_KEY
|
|
- name: LOCAL_LLM_BASE_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: LOCAL_LLM_BASE_URL
|
|
- name: POIMEN_MEMORY_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: POIMEN_MEMORY_URL
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "2000m"
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- ps aux | grep -q "go run ./cmd/worker" && echo ok || exit 1
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|