devspace.yaml

version: v2beta1

vars:
  LLM_PROXY_NAMESPACE: agyn-platform

functions:
  patch_deployment: |-
    echo "Patching llm-proxy deployment for DevSpace..."
    # Resolve by label: the umbrella names the deployment llm-proxy and the
    # bootstrap stack has used llm-proxy-llm-proxy, so a hardcoded name works
    # in one and aborts the whole pipeline in the other.
    LLM_PROXY_DEPLOYMENT="$(kubectl get deployment -n ${LLM_PROXY_NAMESPACE} \
      -l app.kubernetes.io/name=llm-proxy -o jsonpath='{.items[0].metadata.name}')"
    if [ -z "${LLM_PROXY_DEPLOYMENT}" ]; then
      echo "ERROR: no deployment with app.kubernetes.io/name=llm-proxy in ${LLM_PROXY_NAMESPACE}" >&2
      exit 1
    fi
    echo "  target deployment: ${LLM_PROXY_DEPLOYMENT}"
    kubectl patch deployment "${LLM_PROXY_DEPLOYMENT}" -n ${LLM_PROXY_NAMESPACE} --type strategic --patch "$(cat <<'EOF'
    spec:
      template:
        spec:
          securityContext:
            runAsUser: 1000
            fsGroup: 1000
          initContainers: []
          volumes:
            - name: data
              emptyDir: {}
          containers:
            - name: llm-proxy
              image: ghcr.io/agynio/devcontainer-go:1 # dev container for source deploy
              workingDir: /opt/app/data
              # Both go, for the same reason: the container has no source until
              # DevSpace syncs it, and DevSpace syncs only after the pod reports
              # Ready. A readiness probe on the app port makes that circular --
              # the port cannot open until the sync that is waiting on it lands.
              # Liveness would additionally kill the container mid-compile. The
              # pipeline's own health check is what confirms the service is
              # serving before the session exits.
              livenessProbe: null
              readinessProbe: null
              startupProbe: null
              command:
                - sh
                - -c
                - |
                  set -eu
                  elapsed=0
                  while [ ! -f /opt/app/data/go.mod ]; do
                    sleep 1; elapsed=$((elapsed + 1))
                    # DevSpace only starts syncing once the pod is healthy, so a
                    # short wait here deadlocks: the container exits, the pod
                    # crashloops, and the sync never gets a window.
                    [ "$elapsed" -ge 900 ] && { echo "ERROR: sync timeout" >&2; exit 1; }
                  done
                  buf generate buf.build/agynio/api \
                    --path agynio/api/agents/v1 \
                    --path agynio/api/llm/v1 \
                    --path agynio/api/users/v1 \
                    --path agynio/api/organizations/v1 \
                    --path agynio/api/authorization/v1 \
                    --path agynio/api/metering/v1 \
                    --path agynio/api/ziti_management/v1 \
                    --path agynio/api/identity/v1 \
                    --path agynio/api/notifications/v1
                  exec go run ./cmd/llm-proxy
              volumeMounts:
                - name: data
                  mountPath: /opt/app/data
              resources:
                requests:
                  cpu: 500m
                  memory: 1Gi
                limits:
                  cpu: "2"
                  memory: 4Gi
              securityContext:
                runAsNonRoot: true
                runAsUser: 1000
                runAsGroup: 1000
                readOnlyRootFilesystem: false
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
                seccompProfile:
                  type: RuntimeDefault
    EOF
    )"
  patch_agents_orchestrator: |-
    echo "Patching agents-orchestrator to target llm-proxy over Ziti..."
    kubectl set env deployment/agents-orchestrator -n ${LLM_PROXY_NAMESPACE} \
      AGENT_LLM_BASE_URL=http://llm-proxy.agyn/v1
    kubectl rollout status deployment/agents-orchestrator -n ${LLM_PROXY_NAMESPACE} --timeout=120s

  run_llm_proxy_e2e: |-
    bootstrap_dir="${GITHUB_WORKSPACE:-$(pwd)}/bootstrap"
    platform_stack="${bootstrap_dir}/stacks/platform"
    apps_stack="${bootstrap_dir}/stacks/apps"

    if [ -z "${AGYN_API_TOKEN:-}" ]; then
      if [ ! -d "${platform_stack}" ]; then
        echo "ERROR: AGYN_API_TOKEN is not set and ${platform_stack} does not exist." >&2
        exit 1
      fi
      AGYN_API_TOKEN="$(terraform -chdir="${platform_stack}" output -raw cluster_admin_api_token)"
      if [ -z "${AGYN_API_TOKEN}" ]; then
        echo "ERROR: Terraform output cluster_admin_api_token is empty." >&2
        exit 1
      fi
      export AGYN_API_TOKEN
    fi

    if [ -z "${AGYN_ORGANIZATION_ID:-}" ]; then
      if [ ! -d "${apps_stack}" ]; then
        echo "ERROR: AGYN_ORGANIZATION_ID is not set and ${apps_stack} does not exist." >&2
        exit 1
      fi
      AGYN_ORGANIZATION_ID="$(terraform -chdir="${apps_stack}" output -raw bootstrap_organization_id)"
      if [ -z "${AGYN_ORGANIZATION_ID}" ]; then
        echo "ERROR: Terraform output bootstrap_organization_id is empty." >&2
        exit 1
      fi
      export AGYN_ORGANIZATION_ID
    fi

    if [ -z "${AGYN_MODEL_ID:-}" ]; then
      gateway_setup_url="${AGYN_BASE_URL:-}"
      if [ -z "${gateway_setup_url}" ]; then
        k8s_stack="${bootstrap_dir}/stacks/k8s"
        if [ ! -d "${k8s_stack}" ]; then
          echo "ERROR: AGYN_MODEL_ID is not set and ${k8s_stack} does not exist." >&2
          exit 1
        fi
        domain="$(terraform -chdir="${k8s_stack}" output -raw domain)"
        ingress_port="$(terraform -chdir="${k8s_stack}" output -raw ingress_port)"
        if [ -z "${domain}" ] || [ -z "${ingress_port}" ]; then
          echo "ERROR: Bootstrap k8s outputs domain or ingress_port are empty." >&2
          exit 1
        fi
        gateway_setup_url="https://gateway.${domain}:${ingress_port}"
      fi

      list_models_payload=$(cat <<EOF
    {"organizationId":"${AGYN_ORGANIZATION_ID}","llmProviderId":"","pageSize":200,"pageToken":""}
    EOF
      )
      model_id="$(curl -fsS -k \
        -H 'Content-Type: application/json' \
        -H 'Connect-Protocol-Version: 1' \
        -H "Authorization: Bearer ${AGYN_API_TOKEN}" \
        -d "${list_models_payload}" \
        "${gateway_setup_url}/agynio.api.gateway.v1.LLMGateway/ListModels" \
        | python3 -c "$(cat <<'PY'
    import json
    import sys

    payload = json.load(sys.stdin)
    for model in payload.get("models") or []:
        meta = model.get("meta") or {}
        model_id = meta.get("id") or model.get("id") or ""
        if model_id:
            print(model_id)
            break
    PY
    )")"

      if [ -z "${model_id}" ]; then
        now="$(date +%s)"
        create_provider_payload=$(cat <<EOF
    {"endpoint":"https://testllm.dev/v1/org/agynio/suite/agn/responses","authMethod":"AUTH_METHOD_BEARER","token":"e2e-token-${now}","organizationId":"${AGYN_ORGANIZATION_ID}","protocol":"PROTOCOL_RESPONSES"}
    EOF
        )
        provider_id="$(curl -fsS -k \
          -H 'Content-Type: application/json' \
          -H 'Connect-Protocol-Version: 1' \
          -H "Authorization: Bearer ${AGYN_API_TOKEN}" \
          -d "${create_provider_payload}" \
          "${gateway_setup_url}/agynio.api.gateway.v1.LLMGateway/CreateLLMProvider" \
          | python3 -c "$(cat <<'PY'
    import json
    import sys

    payload = json.load(sys.stdin)
    provider = payload.get("provider") or {}
    meta = provider.get("meta") or {}
    provider_id = meta.get("id") or provider.get("id") or ""
    if provider_id:
        print(provider_id)
    PY
    )")"
        if [ -z "${provider_id}" ]; then
          echo "ERROR: CreateLLMProvider did not return an id." >&2
          exit 1
        fi

        create_model_payload=$(cat <<EOF
    {"name":"E2E LLM Proxy Model ${now}","llmProviderId":"${provider_id}","remoteName":"simple-hello","organizationId":"${AGYN_ORGANIZATION_ID}"}
    EOF
        )
        model_id="$(curl -fsS -k \
          -H 'Content-Type: application/json' \
          -H 'Connect-Protocol-Version: 1' \
          -H "Authorization: Bearer ${AGYN_API_TOKEN}" \
          -d "${create_model_payload}" \
          "${gateway_setup_url}/agynio.api.gateway.v1.LLMGateway/CreateModel" \
          | python3 -c "$(cat <<'PY'
    import json
    import sys

    payload = json.load(sys.stdin)
    model = payload.get("model") or {}
    meta = model.get("meta") or {}
    model_id = meta.get("id") or model.get("id") or ""
    if model_id:
        print(model_id)
    PY
    )")"
      fi

      if [ -z "${model_id}" ]; then
        echo "ERROR: Unable to determine AGYN_MODEL_ID." >&2
        exit 1
      fi
      export AGYN_MODEL_ID="${model_id}"
    fi

    cd e2e
    export AGYN_AGENT_IMAGE="${AGYN_AGENT_IMAGE:-ghcr.io/agynio/agent-runtime:v1.0.0}"
    export CODEX_INIT_IMAGE="${CODEX_INIT_IMAGE:-ghcr.io/agynio/agent-init-codex:latest}"
    export AGYN_AGENT_INIT_IMAGE="${AGYN_AGENT_INIT_IMAGE:-${CODEX_INIT_IMAGE}}"
    export AGN_INIT_IMAGE="${AGN_INIT_IMAGE:-ghcr.io/agynio/agent-init-agn:latest}"
    export CLAUDE_INIT_IMAGE="${CLAUDE_INIT_IMAGE:-ghcr.io/agynio/agent-init-claude:latest}"
    export AGN_EXPOSE_INIT_IMAGE="${AGN_EXPOSE_INIT_IMAGE:-ghcr.io/agynio/agent-init-agn:latest}"
    test_tags="${E2E_TAGS:-svc_llm_proxy}"
    test_suites="${E2E_SUITES:-go-core}"
    LLM_PROXY_URL=http://llm-proxy.${LLM_PROXY_NAMESPACE}.svc.cluster.local:8080 \
      E2E_SUITES="${test_suites}" \
      devspace run test-e2e $(for tag in ${test_tags}; do printf ' --tag %s' "${tag}"; done)

commands:
  test-e2e: |-
    devspace run-pipeline test-e2e $@
  ci-e2e: |-
    devspace run-pipeline ci-e2e $@

pipelines:
  dev:
    flags:
      - name: watch
        short: w
        description: "Keep DevSpace running and stream logs"
    run: |-
      patch_deployment
      if [ "$(get_flag "watch")" == "true" ]; then
        start_dev --disable-pod-replace llm-proxy
      else
        start_dev --disable-pod-replace llm-proxy
        stop_dev llm-proxy
      fi
  test-e2e:
    run: |-
      run_llm_proxy_e2e
  ci-e2e:
    run: |-
      patch_deployment
      run_pipelines --background ci-e2e-source
      patch_agents_orchestrator
      run_llm_proxy_e2e
  ci-e2e-source:
    run: |-
      start_dev --disable-pod-replace llm-proxy

hooks:

dev:
  llm-proxy:
    namespace: ${LLM_PROXY_NAMESPACE}
    labelSelector:
      # Name only: the release name differs between the umbrella (agyn-platform)
      # and the bootstrap stack, so pinning the instance label matches in one
      # environment and finds nothing in the other.
      app.kubernetes.io/name: llm-proxy
    containers:
      llm-proxy:
        container: llm-proxy
        sync:
          - path: ./:/opt/app/data
            excludePaths:
              - .git/
              - .devspace/
              - /.gen/
              - /tmp/
            uploadExcludePaths:
              - .git/
              - .devspace/
              - /.gen/
              - /tmp/
            downloadExcludePaths:
              - .git/
              - .devspace/
              - /.gen/
              - /tmp/
        logs:
          enabled: true
          lastLines: 200