feat: execute jobs on Kubernetes

2026-09-18 18:20:10 +00:00
parent af001b6188
commit 86effb72a8
6 changed files with 900 additions and 6 deletions
@@ -0,0 +1,132 @@
+package kubernetes
+
+import (
+	"fmt"
+
+	executionv1alpha1 "git.ddupan.top/panxiao81/ayatori/api/execution/v1alpha1"
+	batchv1 "k8s.io/api/batch/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	ControllerName = "execution.ayatori.ddupan.top/kubernetes"
+	ReferenceType  = "Job"
+	JobUIDLabel    = "execution.ayatori.ddupan.top/job-uid"
+)
+
+var ayatoriJobGVK = schema.GroupVersionKind{
+	Group:   executionv1alpha1.GroupVersion.Group,
+	Version: executionv1alpha1.GroupVersion.Version,
+	Kind:    "Job",
+}
+
+// BuildJob translates the stable execution API into the Kubernetes adapter's
+// backend object. It intentionally does not accept or expose a PodSpec.
+func BuildJob(
+	job *executionv1alpha1.Job,
+	parameters *executionv1alpha1.KubernetesExecutionParameters,
+	resources executionv1alpha1.ExecutionResourceRequirements,
+) *batchv1.Job {
+	backoffLimit := int32(0)
+	controller := true
+	blockOwnerDeletion := true
+
+	//nolint:modernize // ObjectMeta is promoted through embedded TypeMeta; embedlit produces invalid Go here.
+	return &batchv1.Job{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      job.Name,
+			Namespace: job.Namespace,
+			Labels: map[string]string{
+				JobUIDLabel: string(job.UID),
+			},
+			OwnerReferences: []metav1.OwnerReference{{
+				APIVersion:         ayatoriJobGVK.GroupVersion().String(),
+				Kind:               ayatoriJobGVK.Kind,
+				Name:               job.Name,
+				UID:                job.UID,
+				Controller:         &controller,
+				BlockOwnerDeletion: &blockOwnerDeletion,
+			}},
+		},
+		Spec: batchv1.JobSpec{
+			BackoffLimit: &backoffLimit,
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{JobUIDLabel: string(job.UID)}},
+				Spec: corev1.PodSpec{
+					RestartPolicy:      corev1.RestartPolicyNever,
+					ServiceAccountName: parameters.Spec.ServiceAccountName,
+					RuntimeClassName:   optionalString(parameters.Spec.RuntimeClassName),
+					NodeSelector:       parameters.Spec.Scheduling.NodeSelector,
+					Tolerations:        parameters.Spec.Scheduling.Tolerations,
+					SecurityContext:    parameters.Spec.PodSecurityContext,
+					ImagePullSecrets:   job.Spec.Task.ImagePullSecrets,
+					Containers: []corev1.Container{{
+						Name:            "task",
+						Image:           job.Spec.Task.Image,
+						ImagePullPolicy: parameters.Spec.ImagePullPolicy,
+						Command:         job.Spec.Task.Command,
+						Args:            job.Spec.Task.Args,
+						WorkingDir:      job.Spec.Task.WorkingDir,
+						Env:             environment(job.Spec.Task.Env),
+						Resources:       resourceRequirements(resources),
+					}},
+				},
+			},
+		},
+	}
+}
+
+func ValidateOwnership(owner *executionv1alpha1.Job, backend *batchv1.Job) error {
+	if backend.Labels[JobUIDLabel] != string(owner.UID) {
+		return fmt.Errorf("backend Job %s/%s is not owned by Ayatori Job UID %s", backend.Namespace, backend.Name, owner.UID)
+	}
+	return nil
+}
+
+func environment(values []executionv1alpha1.EnvVar) []corev1.EnvVar {
+	result := make([]corev1.EnvVar, 0, len(values))
+	for _, value := range values {
+		env := corev1.EnvVar{Name: value.Name}
+		if value.Value != nil {
+			env.Value = *value.Value
+		}
+		if value.ValueFrom != nil {
+			env.ValueFrom = &corev1.EnvVarSource{
+				SecretKeyRef:    value.ValueFrom.SecretKeyRef,
+				ConfigMapKeyRef: value.ValueFrom.ConfigMapKeyRef,
+			}
+		}
+		result = append(result, env)
+	}
+	return result
+}
+
+func resourceRequirements(resources executionv1alpha1.ExecutionResourceRequirements) corev1.ResourceRequirements {
+	return corev1.ResourceRequirements{
+		Requests: resourceList(resources.Requests),
+		Limits:   resourceList(resources.Limits),
+	}
+}
+
+func resourceList(values executionv1alpha1.ResourceValues) corev1.ResourceList {
+	result := corev1.ResourceList{}
+	if values.CPU != nil {
+		result[corev1.ResourceCPU] = values.CPU.DeepCopy()
+	}
+	if values.Memory != nil {
+		result[corev1.ResourceMemory] = values.Memory.DeepCopy()
+	}
+	if len(result) == 0 {
+		return nil
+	}
+	return result
+}
+
+func optionalString(value string) *string {
+	if value == "" {
+		return nil
+	}
+	return &value
+}
@@ -0,0 +1,71 @@
+package kubernetes
+
+import (
+	"testing"
+
+	executionv1alpha1 "git.ddupan.top/panxiao81/ayatori/api/execution/v1alpha1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestBuildJob(t *testing.T) {
+	literal := "world"
+	cpuRequest := resource.MustParse("100m")
+	memoryLimit := resource.MustParse("128Mi")
+	//nolint:modernize // ObjectMeta is promoted through embedded TypeMeta; embedlit produces invalid Go here.
+	job := &executionv1alpha1.Job{
+		ObjectMeta: metav1.ObjectMeta{Name: "hello", Namespace: "ci", UID: types.UID("job-uid")},
+		Spec: executionv1alpha1.JobSpec{Task: executionv1alpha1.TaskSpec{
+			Image: "alpine:3.22", Command: []string{"echo"}, Args: []string{"hello"},
+			Env: []executionv1alpha1.EnvVar{
+				{Name: "TARGET", Value: &literal},
+				{Name: "TOKEN", ValueFrom: &executionv1alpha1.EnvVarSource{
+					//nolint:modernize // LocalObjectReference is an embedded Kubernetes API field.
+					SecretKeyRef: &corev1.SecretKeySelector{LocalObjectReference: corev1.LocalObjectReference{Name: "token"}, Key: "value"},
+				}},
+			},
+		}},
+	}
+	parameters := &executionv1alpha1.KubernetesExecutionParameters{Spec: executionv1alpha1.KubernetesExecutionParametersSpec{
+		ServiceAccountName: "runner", RuntimeClassName: "runc", ImagePullPolicy: corev1.PullIfNotPresent,
+		Scheduling: executionv1alpha1.KubernetesSchedulingParameters{NodeSelector: map[string]string{"role": "execution"}},
+	}}
+	resources := executionv1alpha1.ExecutionResourceRequirements{
+		Requests: executionv1alpha1.ResourceValues{CPU: &cpuRequest},
+		Limits:   executionv1alpha1.ResourceValues{Memory: &memoryLimit},
+	}
+
+	backend := BuildJob(job, parameters, resources)
+	pod := backend.Spec.Template.Spec
+	if backend.Spec.BackoffLimit == nil || *backend.Spec.BackoffLimit != 0 {
+		t.Fatalf("backoffLimit = %v, want 0", backend.Spec.BackoffLimit)
+	}
+	if pod.RestartPolicy != corev1.RestartPolicyNever || pod.ServiceAccountName != "runner" {
+		t.Fatalf("unexpected pod execution policy: %#v", pod)
+	}
+	if pod.RuntimeClassName == nil || *pod.RuntimeClassName != "runc" {
+		t.Fatalf("runtimeClassName = %v, want runc", pod.RuntimeClassName)
+	}
+	container := pod.Containers[0]
+	if container.Resources.Requests.Cpu().Cmp(cpuRequest) != 0 || container.Resources.Limits.Memory().Cmp(memoryLimit) != 0 {
+		t.Fatalf("resources were not mapped: %#v", container.Resources)
+	}
+	if container.Env[1].ValueFrom == nil || container.Env[1].ValueFrom.SecretKeyRef.Name != "token" {
+		t.Fatalf("secret reference was not preserved: %#v", container.Env[1])
+	}
+	if backend.Labels[JobUIDLabel] != "job-uid" || backend.OwnerReferences[0].UID != job.UID {
+		t.Fatalf("ownership identity was not preserved: %#v", backend.ObjectMeta)
+	}
+}
+
+func TestValidateOwnership(t *testing.T) {
+	job := &executionv1alpha1.Job{}
+	job.UID = types.UID("expected")
+	backend := BuildJob(job, &executionv1alpha1.KubernetesExecutionParameters{}, executionv1alpha1.ExecutionResourceRequirements{})
+	backend.Labels[JobUIDLabel] = "different"
+	if err := ValidateOwnership(job, backend); err == nil {
+		t.Fatal("ValidateOwnership() succeeded for a different Job UID")
+	}
+}