OSVauco — GCP Agent Master Repo

Prosjekt: propane-will-491900-m5 | Region: us-central1

Status

Komponent	Status
Cloud Run Agent	✅ Live
Service URL	https://osvauco-agent-357036551735.us-central1.run.app
CI/CD Trigger	✅ Auto-deploy ved push til main
ADK Versjon	1.x (google-adk>=1.0.0,<2.0.0)
Siste revisjon	osvauco-agent-00006-mvb

Hurtigtest

TOKEN=$(gcloud auth print-identity-token)
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"user_id":"chris","session_id":"test-1","message":"Hei, hvem er du?"}' \
  https://osvauco-agent-357036551735.us-central1.run.app/run | jq

Repo-struktur

├── agents/
│   └── core-logic/        # Live agent: app.py (FastAPI + ADK Runner)
├── infrastructure/
│   ├── 01-setupenv.sh     # ✅ Ferdig
│   ├── 05-cloudrun-deploy.sh  # ✅ Ferdig
│   ├── 06-cicd-setup.sh   # ✅ Ferdig
│   ├── 07-rag-setup.sh    # ⏳ Neste
│   └── 08-memorybank-setup.sh # ⏳ Planlagt
├── docs/
├── scripts/
├── cloudbuild.yaml        # CI/CD pipeline
└── .env.example

Service Account roller (osvauco-agent-sa)

Rolle	Formål
roles/aiplatform.user	Vertex AI / Gemini
roles/secretmanager.secretAccessor	Secrets
roles/logging.logWriter	Logging
roles/cloudtrace.agent	Tracing
roles/monitoring.metricWriter	Monitoring
roles/run.invoker	Cloud Run kall
roles/iam.serviceAccountUser	Deploy
roles/artifactregistry.writer	Docker push
roles/run.developer	Cloud Run deploy

Cloud Scheduler for Daglig Fakturering

For å automatisk generere daglige kostnads-snapshots, må en Cloud Scheduler-jobb konfigureres til å kalle /billing/snapshot-endepunktet.

Oppsett med gcloud:

1. Service URL: https://osvauco-agent-357036551735.us-central1.run.app
2. Service Account: osvauco-agent-sa@propane-will-491900-m5.iam.gserviceaccount.com

gcloud scheduler jobs create http daily-billing-snapshot \
  --schedule="0 5 * * *" \
  --uri="https://osvauco-agent-357036551735.us-central1.run.app/billing/snapshot" \
  --http-method=POST \
  --oidc-service-account-email="osvauco-agent-sa@propane-will-491900-m5.iam.gserviceaccount.com" \
  --oidc-token-audience="https://osvauco-agent-357036551735.us-central1.run.app" \
  --location="us-central1" \
  --time-zone="Etc/UTC" \
  --description="Kaller /billing/snapshot for å lagre daglig kostnadsdata."

Denne kommandoen oppretter en jobb som kjører hver dag kl. 05:00 UTC.

OPAX MCP connector authentication

The public Cloud Run service permits network invocation so that third-party MCP clients can reach the application. Authentication is enforced by the application.

The server accepts a credential supplied in one of these request headers:

• api-key
• X-MCP-Secret
• Authorization: Bearer <token>

For every supported header form, the extracted credential must exactly match the MCPSECRET value injected from Google Secret Manager (mcp-server-key). The service rejects missing or non-matching credentials with HTTP 401.

Do not commit, log, or document the secret value itself.