From 3829e250a0ed3494920a9b112d34486aefa1319f Mon Sep 17 00:00:00 2001 From: Chris Christiansen Date: Mon, 21 Sep 2026 02:51:39 +0000 Subject: [PATCH] ci(opax-mcp): add guarded no-traffic candidate deploy --- opax-mcp.yaml | 23 +++-------------- scripts/deploy-mcp.sh | 59 +++++++++++++++++++++++++------------------ 2 files changed, 38 insertions(+), 44 deletions(-) diff --git a/opax-mcp.yaml b/opax-mcp.yaml index a014f13..3c4015c 100644 --- a/opax-mcp.yaml +++ b/opax-mcp.yaml @@ -9,39 +9,25 @@ metadata: run.googleapis.com/build-source-location: gs://run-sources-propane-will-491900-m5-us-central1/services/opax-mcp/1782754930.916629-ba7acea7e3534f21b658e90dd918d952.zip#1782754931015737 run.googleapis.com/ingress: all run.googleapis.com/ingress-status: all - run.googleapis.com/maxScale: '20' - run.googleapis.com/operation-id: 931f0012-fb7c-422c-b857-8e75cc298a5f - run.googleapis.com/urls: '["https://opax-mcp-357036551735.us-central1.run.app","https://opax-mcp-zjbqp3prqq-uc.a.run.app"]' - serving.knative.dev/creator: 357036551735-compute@developer.gserviceaccount.com - serving.knative.dev/lastModifier: chris.christiansen@vauco.no - creationTimestamp: '2026-06-10T01:03:48.098765Z' - generation: 57 - labels: - cloud.googleapis.com/location: us-central1 name: opax-mcp namespace: '357036551735' - resourceVersion: AAZVlY5b+Ro - selfLink: /apis/serving.knative.dev/v1/namespaces/357036551735/services/opax-mcp - uid: c95aae34-95db-474f-93dc-f8d89b55b2dd spec: template: metadata: annotations: + autoscaling.knative.dev/minScale: '0' autoscaling.knative.dev/maxScale: '5' - run.googleapis.com/client-name: gcloud - run.googleapis.com/client-version: 570.0.0 + run.googleapis.com/vpc-access-egress: private-ranges-only run.googleapis.com/startup-cpu-boost: 'true' - labels: - client.knative.dev/nonce: zcdkbqbeua - run.googleapis.com/startupProbeType: Default spec: + serviceAccountName: jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com containerConcurrency: 80 containers: - env: - name: GOOGLE_CLOUD_PROJECT value: propane-will-491900-m5 - name: OLLAMA_BASE_URL - value: "http://34.67.252.59:11434" + value: "http://10.128.0.15:11434" - name: EMMA_MODEL value: "gemma3:4b" - name: EMMA_FAST_MODEL @@ -109,7 +95,6 @@ spec: tcpSocket: port: 8080 timeoutSeconds: 240 - serviceAccountName: jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com timeoutSeconds: 60 traffic: - latestRevision: true diff --git a/scripts/deploy-mcp.sh b/scripts/deploy-mcp.sh index 558e296..afcb850 100755 --- a/scripts/deploy-mcp.sh +++ b/scripts/deploy-mcp.sh @@ -4,18 +4,22 @@ set -euo pipefail ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)" cd "${ROOT_DIR}" +if [[ -n "$(git status --porcelain)" ]]; then + echo "ERROR: Git working directory is not clean. Aborting." >&2 + git status + exit 1 +fi +echo "==> Git working directory is clean." + PROJECT_ID="propane-will-491900-m5" REGION="us-central1" REPOSITORY="us-central1-docker.pkg.dev/${PROJECT_ID}/osvauco-repo" MCP_SERVICE="opax-mcp" MCP_IMAGE="${REPOSITORY}/opax-mcp" -# Emma runtime requires Direct VPC egress to the internal Ollama host. -# Keep this explicit: a prior manual deployment lost these settings. -MCP_NETWORK="default" -MCP_SUBNET="default" -MCP_VPC_EGRESS="private-ranges-only" +# This is now aligned with opax-mcp.yaml MCP_OLLAMA_BASE_URL="http://10.128.0.15:11434" +COMMIT_SHA=$(git rev-parse --short HEAD) echo "==> Submitting MCP Cloud Build" @@ -53,6 +57,12 @@ BUILD_STATUS="$( --format="value(status)" )" +if [[ "${BUILD_STATUS}" != "SUCCESS" ]]; then + echo "ERROR: Cloud Build did not succeed. Status: ${BUILD_STATUS}. Aborting deploy." >&2 + exit 1 +fi +echo "==> Cloud Build status: SUCCESS." + IMAGE_REF="$( gcloud builds describe "${BUILD_ID}" \ --project="${PROJECT_ID}" \ @@ -83,7 +93,6 @@ else DEPLOY_IMAGE="${MCP_IMAGE}@${IMAGE_DIGEST}" fi -echo "==> Cloud Build status: ${BUILD_STATUS}" echo "==> Deploying immutable MCP image:" echo "${DEPLOY_IMAGE}" @@ -91,26 +100,26 @@ gcloud run deploy "${MCP_SERVICE}" \ --project="${PROJECT_ID}" \ --region="${REGION}" \ --image="${DEPLOY_IMAGE}" \ - --network="${MCP_NETWORK}" \ - --subnet="${MCP_SUBNET}" \ - --vpc-egress="${MCP_VPC_EGRESS}" \ - --update-env-vars="OLLAMA_BASE_URL=${MCP_OLLAMA_BASE_URL}" \ + --tag="candidate-${COMMIT_SHA}" \ + --no-traffic \ + --service-account="jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com" \ + --port="8080" \ + --min-instances="0" \ + --max-instances="5" \ + --cpu="1" \ + --memory="512Mi" \ + --concurrency="80" \ + --timeout="60" \ + --network="default" \ + --subnet="default" \ + --vpc-egress="private-ranges-only" \ + --update-env-vars="^|^GOOGLE_CLOUD_PROJECT=propane-will-491900-m5|OLLAMA_BASE_URL=http://10.128.0.15:11434|EMMA_MODEL=gemma3:4b|EMMA_FAST_MODEL=gemma3:4b|EMMA_LIGHT_MODEL=qwen2.5:3b|GITEA_URL=https://git.vauco.no|GITEA_REPO=chris/OSVauco|STATIC_BUCKET=opax-vauco-static|CLOUD_RUN_SERVICE=osvauco-agent|CLOUD_BUILD_TRIGGER_ID=38423976-91ff-4ff4-859e-1f262344c609|OPAX_IAP_CLIENT_ID=357036551735-kq8nt7ld38hfqlcfb3n52ef7tala4meo.apps.googleusercontent.com|GMAIL_DEFAULT_SENDER=jason.vauger@vauco.no|GMAIL_ALLOWED_SENDERS=jason.vauger@vauco.no,emma.vauger@vauco.no|OSVAUCO_AGENT_URL=https://osvauco-agent-357036551735.us-central1.run.app" \ + --update-secrets="GITEA_TOKEN=gitea-token:latest,INTERNAL_API_KEY=INTERNAL_API_KEY:latest,MCP_SECRET=mcp-server-key:latest,TWILIO_ACCOUNT_SID=TWILIO_ACCOUNT_SID:latest,TWILIO_AUTH_TOKEN=TWILIO_AUTH_TOKEN:latest,TWILIO_FROM_NUMBER=TWILIO_FROM_NUMBER:latest" \ --quiet echo -echo "==> Active MCP deployment" - -gcloud run services describe "${MCP_SERVICE}" \ - --project="${PROJECT_ID}" \ - --region="${REGION}" \ - --format="table( - metadata.name, - status.url, - status.latestReadyRevisionName, - status.traffic[0].revisionName, - spec.template.spec.containers[0].image - )" - +echo "==> Candidate revision created successfully." +echo "Candidate tag: candidate-${COMMIT_SHA}" echo -echo "MCP deployment complete." -echo "Cloud Build log exit code: ${BUILD_LOG_EXIT_CODE}" \ No newline at end of file +echo "No production traffic has been promoted." +echo "Next steps: Perform health and smoke tests against the candidate URL, then promote traffic manually." \ No newline at end of file