ce7cb702218693d08ea6d83464d2457c9250027c

services/agentgateway-model-catalog-sync/k8s/configmap.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: agentgateway-model-costs
+  namespace: agentgateway-system
+  annotations:
+    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
+  labels:
+    app.kubernetes.io/name: model-catalog
+    app.kubernetes.io/instance: agentgateway
+    app.kubernetes.io/part-of: agentgateway
+data:
+  catalog.json: '{"providers":{}}'

services/agentgateway-model-catalog-sync/k8s/deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: model-catalog
+  namespace: agentgateway-system
+  labels:
+    app.kubernetes.io/name: model-catalog
+    app.kubernetes.io/instance: agentgateway
+    app.kubernetes.io/part-of: agentgateway
+    app.kubernetes.io/version: "0.1.1"
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: model-catalog
+      app.kubernetes.io/instance: agentgateway
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: model-catalog
+        app.kubernetes.io/instance: agentgateway
+        app.kubernetes.io/part-of: agentgateway
+        app.kubernetes.io/version: "0.1.1"
+    spec:
+      automountServiceAccountToken: true
+      serviceAccountName: model-catalog
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: model-catalog
+              app.kubernetes.io/instance: agentgateway
+      containers:
+        - name: catalog
+          image: registry.quorate.internal/quorate/agentgateway-catalog:0.1.1@sha256:919e63ef02b9d6f40efa613570a5cb04af40764e9f377da4db4f58b4c3f23389
+          imagePullPolicy: IfNotPresent
+          args:
+            - run
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: ENABLED_PROVIDERS
+              value: google-vertex,novita
+            - name: NOVITA_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: agentgateway-novita
+                  key: api_key
+            - name: SYNC_INTERVAL
+              value: 6h
+            - name: SYNC_RETRY_INTERVAL
+              value: 5m
+          ports:
+            - name: metrics
+              containerPort: 8080
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: metrics
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: catalog
+              mountPath: /catalog
+              readOnly: true
+      volumes:
+        - name: catalog
+          configMap:
+            name: agentgateway-model-costs
+            optional: true

services/agentgateway-model-catalog-sync/k8s/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: agentgateway-system
+resources:
+  - service-account.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml
+  - poddisruptionbudget.yaml
+  - network-policy.yaml

services/agentgateway-model-catalog-sync/k8s/network-policy.yaml

@@ -0,0 +1,77 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: model-catalog
+  namespace: agentgateway-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: model-catalog
+      app.kubernetes.io/instance: agentgateway
+  ingress:
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmagent
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: agentgateway-system
+            gateway.networking.k8s.io/gateway-name: agentgateway-proxy
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toEntities:
+        - world
+      toPorts:
+        - serverNames:
+            - models.dev
+            - api.novita.ai
+          ports:
+            - port: "443"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-agentgateway-model-catalog
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: agentgateway-system
+            app.kubernetes.io/name: model-catalog
+            app.kubernetes.io/instance: agentgateway
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP

services/agentgateway-model-catalog-sync/k8s/poddisruptionbudget.yaml

@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: model-catalog
+  namespace: agentgateway-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: model-catalog
+      app.kubernetes.io/instance: agentgateway

services/agentgateway-model-catalog-sync/k8s/service-account.yaml

@@ -0,0 +1,43 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: model-catalog
+  namespace: agentgateway-system
+automountServiceAccountToken: true
+imagePullSecrets:
+  - name: quay-cluster-pull
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: model-catalog
+  namespace: agentgateway-system
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    resourceNames:
+      - agentgateway-model-costs
+    verbs:
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: model-catalog
+  namespace: agentgateway-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: model-catalog
+subjects:
+  - kind: ServiceAccount
+    name: model-catalog
+    namespace: agentgateway-system

services/agentgateway-model-catalog-sync/k8s/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: model-catalog
+  namespace: agentgateway-system
+  labels:
+    app.kubernetes.io/name: model-catalog
+    app.kubernetes.io/instance: agentgateway
+    app.kubernetes.io/component: metrics
+spec:
+  selector:
+    app.kubernetes.io/name: model-catalog
+    app.kubernetes.io/instance: agentgateway
+  ports:
+    - name: metrics
+      port: 8080
+      targetPort: metrics
+      protocol: TCP