Merge pull request #120 from agntcy/119-fix-configure-slim-w-spire-and-controller

fix(tourist_scheduling_system): Configure SLIM with SPIRE and Controller

Author: muscariello

.gitignore

@@ -204,3 +204,4 @@ tourist_scheduling_system/__pycache__/
 tourist_scheduling_system/.pytest_cache/
 tourist_scheduling_system/.DS_Store
 tourist_scheduling_system/.agent_pids
+tourist_scheduling_system/docs/issues.md

tourist_scheduling_system/README.md

@@ -96,7 +96,10 @@ tourist_scheduling_system/
 │   ├── slim-controller.sh       # SLIM controller deployment
 │   ├── slim-node.sh             # SLIM data plane node deployment
 │   ├── directory.sh             # Agent Directory deployment
-│   └── run_adk_demo.py          # Main demo runner (Python CLI)
+│   ├── run_adk_demo.py          # Main demo runner (Python CLI)
+│   ├── slim-control-csid.yaml.tpl # SPIRE ID template for Controller
+│   ├── slim-node-csid.yaml.tpl    # SPIRE ID template for Node
+│   └── *-values.yaml            # Helm values files
 ├── deploy/
 │   └── k8s/                     # Kubernetes manifests
 │       ├── namespace.yaml       # Namespace and ConfigMap
@@ -214,14 +217,24 @@ kubectl create secret generic azure-openai-credentials \
 
 ### SLIM Infrastructure Setup
 
-For SLIM transport with mTLS authentication:
+For SLIM transport with mTLS authentication (via SPIRE):
 
 ```bash
 # Install SPIRE (identity provider)
 ./scripts/spire.sh install
 
-# Install SLIM controller and node
+# Install SLIM controller (with SPIRE enabled)
+export SPIRE_ENABLED=true
 ./scripts/slim-controller.sh install
+
+# Install SLIM node (with SPIRE enabled)
+# Default strategy is StatefulSet
+export SPIRE_ENABLED=true
+./scripts/slim-node.sh install
+
+# Or install SLIM node as DaemonSet
+export SLIM_STRATEGY=daemonset
+export SPIRE_ENABLED=true
 ./scripts/slim-node.sh install
 
 # Install Agent Directory (optional)

tourist_scheduling_system/deploy/k8s/deploy.sh

@@ -20,9 +20,9 @@ export NAMESPACE="${NAMESPACE:-lumuscar-jobs}"
 export IMAGE_REGISTRY="${IMAGE_REGISTRY:-ghcr.io/agntcy/apps}"
 export IMAGE_TAG="${IMAGE_TAG:-latest}"
 export TRANSPORT_MODE="${TRANSPORT_MODE:-http}"
-export MODEL_PROVIDER="${MODEL_PROVIDER:-}"
+export MODEL_PROVIDER="${MODEL_PROVIDER:-azure}"
 export MODEL_NAME="${MODEL_NAME:-}"
-export SLIM_GATEWAY_HOST="${SLIM_GATEWAY_HOST:-slim-slim-node}"
+export SLIM_GATEWAY_HOST="${SLIM_GATEWAY_HOST:-slim-node}"
 export SLIM_GATEWAY_PORT="${SLIM_GATEWAY_PORT:-46357}"
 export SCHEDULER_URL="${SCHEDULER_URL:-http://scheduler-agent:10000}"
 export UI_DASHBOARD_URL="${UI_DASHBOARD_URL:-http://ui-dashboard-agent:80/api/update}"
@@ -32,7 +32,7 @@ export HTTP_PROXY="${HTTP_PROXY:-}"
 export HTTPS_PROXY="${HTTPS_PROXY:-}"
 
 # Ensure NO_PROXY includes necessary internal services
-DEFAULT_NO_PROXY="localhost,127.0.0.1,.cluster.local,slim-slim-node,scheduler-agent,ui-dashboard-agent"
+DEFAULT_NO_PROXY="localhost,127.0.0.1,.cluster.local,slim-node,scheduler-agent,ui-dashboard-agent"
 if [[ -n "${NO_PROXY:-}" ]]; then
     # Avoid leading comma if NO_PROXY is set
     export NO_PROXY="${NO_PROXY},${DEFAULT_NO_PROXY}"
@@ -94,6 +94,10 @@ ensure_google_secret() {
 # Create or update the azure-openai-credentials secret from environment variables
 ensure_azure_secret() {
     if [[ -z "${AZURE_OPENAI_API_KEY:-}" ]]; then
+        if kubectl get secret azure-openai-credentials -n "$NAMESPACE" &>/dev/null; then
+            log_info "Using existing azure-openai-credentials secret..."
+            return 0
+        fi
         if [[ "$MODEL_PROVIDER" == "google" ]]; then
             return 0
         fi
@@ -185,11 +189,11 @@ deploy_slim() {
 
     # Set transport mode to SLIM
     export TRANSPORT_MODE=slim
-    export SLIM_GATEWAY_HOST="${SLIM_GATEWAY_HOST:-slim-slim-node}"
+    export SLIM_GATEWAY_HOST="${SLIM_GATEWAY_HOST:-slim-node}"
     export SLIM_GATEWAY_PORT="${SLIM_GATEWAY_PORT:-46357}"
     # For SLIM mode, agents communicate via gateway, not direct HTTP
     export SCHEDULER_URL="http://scheduler-agent:10000"
-    export UI_DASHBOARD_URL="http://ui-dashboard-agent:10021"
+    export UI_DASHBOARD_URL="http://ui-dashboard-agent:80/api/update"
 
     # Verify namespace exists
     if ! kubectl get namespace "$NAMESPACE" &>/dev/null; then

tourist_scheduling_system/deploy/k8s/ui-agent.yaml

@@ -47,6 +47,15 @@ spec:
         - name: ui-dashboard-agent
           image: ${IMAGE_REGISTRY}/ui-agent:${IMAGE_TAG}
           imagePullPolicy: Always
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              python main.py \
+              --host 0.0.0.0 \
+              --port 10021 \
+              --dashboard \
+              --transport "${TRANSPORT_MODE:-http}" \
+              --slim-endpoint "http://${SLIM_GATEWAY_HOST}:${SLIM_GATEWAY_PORT}"
           ports:
             - containerPort: 10021
               protocol: TCP

tourist_scheduling_system/docs/SLIM.md

@@ -103,30 +103,31 @@ Two deployment scripts are provided in `scripts/`:
 #### SLIM Node (`scripts/slim-node.sh`)
 
 ```bash
-# Install a SLIM node
-./scripts/slim-node.sh install slim-node
+# Install a SLIM node (StatefulSet by default)
+./scripts/slim-node.sh install
+
+# Install as DaemonSet
+SLIM_STRATEGY=daemonset ./scripts/slim-node.sh install
 
 # Check status
-./scripts/slim-node.sh status slim-node
+./scripts/slim-node.sh status
 
 # View logs
-./scripts/slim-node.sh logs slim-node
-
-# List all nodes
-./scripts/slim-node.sh list
+./scripts/slim-node.sh logs
 
 # Uninstall
-./scripts/slim-node.sh uninstall slim-node
+./scripts/slim-node.sh uninstall
 
-# Force clean
-./scripts/slim-node.sh force-clean slim-node
+# Clean
+./scripts/slim-node.sh clean
 ```
 
 ### Environment Variables
 
 | Variable               | Default                                           | Description                    |
 |------------------------|---------------------------------------------------|--------------------------------|
 | `SLIM_NAMESPACE`       | `lumuscar-jobs`                                   | Target Kubernetes namespace    |
+| `SLIM_STRATEGY`        | `statefulset`                                     | Deployment strategy (statefulset/daemonset) |
 | `SLIM_CONTROLLER_HOST` | `slim-control`                                    | Controller service hostname    |
 | `SLIM_CONTROLLER_PORT` | `50052`                                           | Controller south API port      |
 | `SPIRE_ENABLED`        | `false`                                           | Enable SPIRE mTLS mode         |
@@ -141,13 +142,12 @@ To deploy SLIM with SPIRE mTLS:
 # 1. Install SPIRE first
 ./scripts/spire.sh install
 
-# 2. Register SLIM workloads with SPIRE
-./scripts/spire.sh register-slim
-
-# 3. Install SLIM Controller with SPIRE
+# 2. Install SLIM Controller with SPIRE
+# This automatically applies the ClusterSPIFFEID
 SPIRE_ENABLED=true ./scripts/slim-controller.sh install
 
-# 4. Install SLIM Node with SPIRE
+# 3. Install SLIM Node with SPIRE
+# This automatically applies the ClusterSPIFFEID
 SPIRE_ENABLED=true ./scripts/slim-node.sh install
 ```