qinglong/deploy/kubernetes/ql3-cluster/components/cluster-ai

Optional Cluster AI component

This component replaces only the Cluster Control image with the explicit runtime-ai target. The default Cluster deployment and image remain AI-free.

Before applying it:

1. Replace the example Project, provider URL, model and policy revision in provider-authority-configmap.yaml; keep authority.json canonical, one-line JSON with one trailing newline.
2. Bind the same Project/provider to a canonical SecretRef through the append-only model-provider credential catalog.
3. Project each provider authorization value under the lowercase SHA-256 of its canonical SecretRef. Use provider-secrets.example.yaml only as a shape reference and provision the real Secret through a Secret manager.
4. Build and publish the Docker runtime-ai target, then pin its independent digest in a private overlay based on private-overlay.example.yaml.

The component mounts ConfigMap and Secret volumes read-only with mode 0440, does not mount a ServiceAccount token, and grants no Kubernetes API access. It remains live-output-only by default. Compose the separate ../cluster-ai-prompt-output component only when encrypted durable Prompt output and its externally provisioned keyring are required. Each replica adds a separate, bounded PostgreSQL runtime pool of four connections by default; tune QL3_CLUSTER_AI_DATABASE_MAX_CONNECTIONS and QL3_CLUSTER_AI_MAX_CONCURRENT together for the cluster's resource budget.