feat(ql3): establish 3.0 incubation baseline

2026-09-23 03:18:09 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,26 @@
+# Optional Cluster AI component
+
+This component replaces only the Cluster Control image with the explicit
+`runtime-ai` target. The default Cluster deployment and image remain AI-free.
+
+Before applying it:
+
+1. Replace the example Project, provider URL, model and policy revision in
+   `provider-authority-configmap.yaml`; keep `authority.json` canonical,
+   one-line JSON with one trailing newline.
+2. Bind the same Project/provider to a canonical SecretRef through the
+   append-only model-provider credential catalog.
+3. Project each provider authorization value under the lowercase SHA-256 of
+   its canonical SecretRef. Use `provider-secrets.example.yaml` only as a
+   shape reference and provision the real Secret through a Secret manager.
+4. Build and publish the Docker `runtime-ai` target, then pin its independent
+   digest in a private overlay based on `private-overlay.example.yaml`.
+
+The component mounts ConfigMap and Secret volumes read-only with mode `0440`,
+does not mount a ServiceAccount token, and grants no Kubernetes API access.
+It remains live-output-only by default. Compose the separate
+`../cluster-ai-prompt-output` component only when encrypted durable Prompt
+output and its externally provisioned keyring are required.
+Each replica adds a separate, bounded PostgreSQL runtime pool of four
+connections by default; tune `QL3_CLUSTER_AI_DATABASE_MAX_CONNECTIONS` and
+`QL3_CLUSTER_AI_MAX_CONCURRENT` together for the cluster's resource budget.
@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ql3-cluster-control
+spec:
+  template:
+    spec:
+      containers:
+        - name: cluster-control
+          image: qinglong3-cluster-control-ai:3.0.0-alpha.0
+          env:
+            - name: QL3_CLUSTER_AI_ENABLED
+              value: "true"
+            - name: QL3_CLUSTER_AI_PROVIDER_AUTHORITY_FILE
+              value: /var/run/qinglong3/ai/provider-authority/authority.json
+            - name: QL3_CLUSTER_AI_SECRET_ROOT
+              value: /var/run/secrets/qinglong3/ai/provider-secrets
+            - name: QL3_CLUSTER_AI_MAX_CONCURRENT
+              value: "4"
+            - name: QL3_CLUSTER_AI_RECOVERY_LIMIT
+              value: "32"
+            - name: QL3_CLUSTER_AI_DATABASE_MAX_CONNECTIONS
+              value: "4"
+          volumeMounts:
+            - name: cluster-ai-provider-authority
+              mountPath: /var/run/qinglong3/ai/provider-authority
+              readOnly: true
+            - name: cluster-ai-provider-secrets
+              mountPath: /var/run/secrets/qinglong3/ai/provider-secrets
+              readOnly: true
+      volumes:
+        - name: cluster-ai-provider-authority
+          configMap:
+            name: ql3-cluster-ai-provider-authority
+            defaultMode: 288
+            items:
+              - key: authority.json
+                path: authority.json
+        - name: cluster-ai-provider-secrets
+          secret:
+            secretName: ql3-cluster-ai-provider-secrets
+            defaultMode: 288
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - provider-authority-configmap.yaml
+
+patches:
+  - path: deployment-patch.yaml
@@ -0,0 +1,15 @@
+# Example only. Save as kustomization.yaml in a private overlay and replace the
+# digest with the independently verified runtime-ai image digest.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+components:
+  - ../../components/cluster-ai
+
+images:
+  - name: qinglong3-cluster-control-ai
+    newName: registry.example.com/qinglong/qinglong3-cluster-control-ai
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ql3-cluster-ai-provider-authority
+  labels:
+    app.kubernetes.io/name: ql3-cluster-control
+    app.kubernetes.io/component: control-plane-ai
+    app.kubernetes.io/part-of: qinglong3
+data:
+  authority.json: |
+    {"schema":"qinglong/projected-model-gateway-authority@v1","providers":[{"type":"openai-compatible","baseUrl":"https://models.example.invalid/v1/","allowPlaintextLoopback":false,"maxResponseBytes":1048576}],"projects":[{"projectId":"replace-project-id","policy":{"revision":"replace-policy-v1","allowedProviders":["openai-compatible"],"allowedModels":["replace-model-id"],"maxInputBytes":65536,"maxOutputBytes":1048576,"maxOutputTokens":4096,"maxTotalTokens":32768,"maxCostMicros":null,"priceRevision":null}}]}
@@ -0,0 +1,11 @@
+# Example only. Populate through a Secret manager and never commit real values.
+# The data key is sha256(canonical SecretRef); the matching catalog binding is:
+# qlsecret:v1:eyJwcm9qZWN0SWQiOiJyZXBsYWNlLXByb2plY3QtaWQiLCJuYW1lIjoib3BlbmFpLWNvbXBhdGlibGUtdG9rZW4ifQ
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-ai-provider-secrets
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  2ac34db919c697fd198d1a4fdfd90f69d9fa58c363c7ce5c8e4ca113413fbc6b: REPLACE_WITH_PROVIDER_AUTHORIZATION_VALUE