seon
a500c3d40c
- Alloy 설정 3종: rule 블록을 한 줄 쉼표 나열에서 줄바꿈 속성으로 수정(실측: k8s DaemonSet
CrashLoopBackOff, db-replica alloy.service "expected TERMINATOR, got ,"). alloy fmt로 3종 파싱 확인.
- vm/postgres-common/alloy.sh: apt에 DPkg::Lock::Timeout=600(db-primary에서 unattended-upgrades 잠금으로 100 종료).
- vm/ai-env/compose.yaml: hitl 8081을 127.0.0.1에만 바인딩(agent는 compose 네트워크로 접근).
- workloads/rbac/ai-reader.yaml: nodes get/list/watch ClusterRole 추가(agent get_k8s(nodes) selfcheck 거부 해소).
- vm/harness/image.tag: f30af2a(POST /proposals/{token}/approve·reject 포함 러너).
vm/ai-env
AI VM (10.20.0.12) of the self-healing lab: experiment design 6 (diagnosis agent, pgvector RAG store, Discord HITL bot).
| file | purpose |
|---|---|
apply.sh |
boot / make vm-sync entry: secrets from Secret Manager to /opt/selfheal/ai/secrets, env file, compose up. Succeeds even when the OpenAI key or Discord token is not registered yet (services run degraded) |
compose.yaml |
agent (8080), hitl (8081), rag-db (pgvector 0.8.7 / PostgreSQL 16, internal) |
ai.env |
non-secret settings: Discord guild and channel ids, model ids, internal endpoints |
image.tag |
image tag (selfheal-public/ai-agent:<sha> and ai-hitl:<sha> built from selfheal-lab-apps/ai) |
prompts/system.md |
system prompt; its sha256 prefix is the prompt_version recorded with every session |
prompts/topology.md, prompts/slo.md |
context blocks of the user message (design 6.4) |
runbooks/*.md |
RAG documents: one per catalogue action, topology, layer-3 procedures. Re-ingested at agent start (hash based) |
Agent API: POST /diagnose {"alert": {...}, "run_id", "scenario_id"} (called by the harness) returns the strict diagnosis plus disposition (proposal | escalated | none). GET /selfcheck checks key presence, rag-db, Mimir, k8s, GCP, AWS and the harness.
HITL bot: POST /post (agent -> Discord message with Approve/Reject buttons), POST /escalate (agent -> escalation channel + runbook thread), GET /selfcheck. Buttons: approve -> harness /proposals/{token}/approve then /actions/execute; reject -> /proposals/{token}/reject; no decision within the window -> escalation channel. Gateway intents: GUILDS only (design 11.7); interactions need no intent.
Secrets (Secret Manager, VM service account): selfheal-openai-api-key, selfheal-discord-bot-token (operator registers the values), selfheal-k8s-ai-token and selfheal-k8s-ca-cert (make token). Verify presence only: gcloud secrets versions list selfheal-openai-api-key --project cms-d-414903.