Test
ebf95506cd
- Remove TenantID field from LLMAuth (JWT claims handle tenant info) - Remove Scopes field (not part of Poimen's design) - Simplify to 3 core auth types: Bearer, API Key, Custom - Update LLMRouterConfig to only include Auth field - Simplify README examples to per-deployment pattern - Focus on secure token management vs multi-tenant isolation - Clarify token rotation pattern for long-running workflows - Update security section with practical vault integration examples TenantID was introduced without proper context. In Poimen: - JWT token itself contains tenant/customer info in claims - Each deployment gets its own LLM_AUTH_TOKEN from vault - LLM API provider (riotpiao.com) validates token at their end - No need for separate tenant header in Poimen layer Simpler, clearer, more maintainable.
79 lines
2.3 KiB
YAML
79 lines
2.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: poimen-worker
|
|
namespace: poimen
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: poimen-worker
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: poimen-worker
|
|
annotations:
|
|
git-commit: "6eccc86e" # ✅ Updated on each push, triggers rolling restart
|
|
deployment-date: "2026-09-04"
|
|
spec:
|
|
containers:
|
|
- name: worker
|
|
image: golang:latest
|
|
imagePullPolicy: Always # ✅ Force pull latest image on pod startup
|
|
workingDir: /app
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
echo "[$(date)] Starting poimen worker pod..."
|
|
apt-get update && apt-get install -y --no-install-recommends git
|
|
echo "[$(date)] Cloning latest code from git..."
|
|
git clone https://forgejo.riotpiao.com/rock/poimen-workflows.git /app
|
|
cd /app
|
|
echo "[$(date)] Latest commit: $(git rev-parse HEAD)"
|
|
echo "[$(date)] Downloading dependencies..."
|
|
go mod download
|
|
echo "[$(date)] Starting orchestrator worker..."
|
|
go run ./cmd/worker
|
|
env:
|
|
- name: TEMPORAL_NAMESPACE
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: TEMPORAL_NAMESPACE
|
|
- name: TEMPORAL_HOSTPORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: TEMPORAL_HOSTPORT
|
|
- name: ANTHROPIC_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: poimen-secrets
|
|
key: ANTHROPIC_API_KEY
|
|
- name: LOCAL_LLM_BASE_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: LOCAL_LLM_BASE_URL
|
|
- name: POIMEN_MEMORY_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: poimen-config
|
|
key: POIMEN_MEMORY_URL
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "2000m"
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- ps aux | grep -q "go run ./cmd/worker" && echo ok || exit 1
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|