mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 09:58:46 +08:00
27 lines
1.4 KiB
Markdown
27 lines
1.4 KiB
Markdown
# Optional Cluster AI component
|
|
|
|
This component replaces only the Cluster Control image with the explicit
|
|
`runtime-ai` target. The default Cluster deployment and image remain AI-free.
|
|
|
|
Before applying it:
|
|
|
|
1. Replace the example Project, provider URL, model and policy revision in
|
|
`provider-authority-configmap.yaml`; keep `authority.json` canonical,
|
|
one-line JSON with one trailing newline.
|
|
2. Bind the same Project/provider to a canonical SecretRef through the
|
|
append-only model-provider credential catalog.
|
|
3. Project each provider authorization value under the lowercase SHA-256 of
|
|
its canonical SecretRef. Use `provider-secrets.example.yaml` only as a
|
|
shape reference and provision the real Secret through a Secret manager.
|
|
4. Build and publish the Docker `runtime-ai` target, then pin its independent
|
|
digest in a private overlay based on `private-overlay.example.yaml`.
|
|
|
|
The component mounts ConfigMap and Secret volumes read-only with mode `0440`,
|
|
does not mount a ServiceAccount token, and grants no Kubernetes API access.
|
|
It remains live-output-only by default. Compose the separate
|
|
`../cluster-ai-prompt-output` component only when encrypted durable Prompt
|
|
output and its externally provisioned keyring are required.
|
|
Each replica adds a separate, bounded PostgreSQL runtime pool of four
|
|
connections by default; tune `QL3_CLUSTER_AI_DATABASE_MAX_CONNECTIONS` and
|
|
`QL3_CLUSTER_AI_MAX_CONCURRENT` together for the cluster's resource budget.
|