AIAC Init Container

Create aiac/src/aiac/agent/init/main.py, requirements.txt, and Dockerfile; start by reviewing the agent pod configuration and the stated environment variables. Run pytest aiac/ -m "not integration" and the provided docker build command. Done means all five dependency gates and idempotent aiac-events provisioning work, with the specified success and failure exits.

Status: ready-for-agent

3.16 — AIAC Init Container

What to build

Implement aiac-init — a standalone Python script that gates Agent pod startup. It runs as a Kubernetes init container before the main aiac-agent container starts. The init container exits 0 only when all five AIAC dependencies are healthy and the aiac-events JetStream stream exists.

Startup gates (all must pass before exit 0)

Each check is polled with backoff (configurable via INIT_RETRY_INTERVAL_S, default 5; INIT_MAX_RETRIES, default 60). On max retries exceeded, exit non-zero with a descriptive error message — Kubernetes will restart the init container.

Stream provisioning

After all gates pass, create the aiac-events JetStream stream idempotently:

StreamConfig(
    name="aiac-events",
    subjects=["aiac.apply.>"],
    retention=RetentionPolicy.WORK_QUEUE,
    max_deliver=5,
    # DLQ routing is configured via consumer max_deliver; aiac.apply.dlq is the dead-letter subject
)

If the stream already exists with the same config, no-op. If it exists with different config, log a warning and continue — do not overwrite.

Consumer group (aiac-agent-consumer) is created lazily by nats-py when the Agent subscribes — no explicit provisioning needed in the init container.

File structure

aiac/src/aiac/agent/init/
├── Dockerfile          # python:3.12-slim base; installs nats-py + httpx
├── requirements.txt    # nats-py, httpx
└── main.py             # standalone script; exits 0 on success, non-zero on failure

Build command (same build context as agent):

docker build -f aiac/src/aiac/agent/init/Dockerfile -t aiac-init:latest aiac/src/

Configuration

All env vars come from the aiac-pdp-config ConfigMap mounted in the agent pod spec.

Acceptance criteria

• Init container polls NATS TCP connectivity; does not proceed until NATS is reachable
• Init container polls IdP Configuration Service GET /health; does not proceed until 2xx
• Init container polls PDP Policy Writer GET /health; does not proceed until 2xx
• Init container polls Policy Ingest Service GET /health; does not proceed until 2xx
• Init container TCP-probes the Policy Store (ChromaDB) on aiac-policy-store-service:8000; does not proceed until the listener accepts
• All five gates must pass before stream provisioning begins
• aiac-events stream created with WorkQueuePolicy, subjects aiac.apply.>, max_deliver=5
• Stream creation is idempotent — re-running against an existing stream does not error
• Exits 0 when all gates pass and stream is provisioned
• Exits non-zero with descriptive message when max retries exceeded on any gate
• INIT_RETRY_INTERVAL_S and INIT_MAX_RETRIES are configurable via env vars
• Dockerfile uses python:3.12-slim base image and build context aiac/src/
• docker build succeeds without errors
• pytest aiac/ -m "not integration" passes with unit tests for this component included

Blocked by

None — can start immediately (does not depend on Agent code).

Migrated from docs/issues/agent/3.16-aiac-init-container.md.

Migrated from https://github.com/s-and-p-team/cortex/issues/23 (opened by @oblinder on 2026-08-03). Copied to rossoctl/aiac.