重构为直接 OpenSandbox 生命周期调度

src/gitea_dynamic_runner/controller.py

@@ -1,63 +1,54 @@
 #!/usr/bin/env python3
-"""Gitea workflow_job webhook to NATS JetStream producer."""
+"""Gitea workflow_job webhook to the OpenSandbox Lifecycle API."""
+
+from __future__ import annotations
 
 import hashlib
 import hmac
 import json
 import logging
 import os
-import ssl
 from pathlib import Path
 
-import nats
 from aiohttp import web
-from nats.js.api import DiscardPolicy, RetentionPolicy, StorageType, StreamConfig
-from nats.js.errors import NotFoundError
 
-from .models import IdentityBinding, RunnerRequest
+from .models import RunnerRequest
+from .opensandbox import OpenSandboxClient
+from .opensandbox_worker import OpenSandboxScheduler, RegistrationTokens
 
 
 LOG = logging.getLogger(__name__)
-SUBJECT_PREFIX = os.environ.get("NATS_SUBJECT_PREFIX", "ci.runner")
-STREAM = os.environ.get("NATS_STREAM", "CI_RUNNER")
-NATS_URL = os.environ.get("NATS_URL", "tls://nats.ad.ddupan.top:4222")
-NATS_USER = os.environ.get("NATS_USER", "ci-producer")
-NATS_PASSWORD_FILE = Path(os.environ.get("NATS_PASSWORD_FILE", "/run/secrets/nats/password"))
-NATS_CA_FILE = os.environ.get("NATS_CA_FILE", "/etc/ssl/certs/ca-certificates.crt")
-WEBHOOK_SECRET_FILE = Path(os.environ.get("WEBHOOK_SECRET_FILE", "/run/secrets/gitea/webhook-secret"))
+WEBHOOK_SECRET_FILE = Path(
+    os.environ.get("WEBHOOK_SECRET_FILE", "/run/secrets/gitea/webhook-secret")
+)
+REGISTRATION_TOKEN_FILE = Path(
+    os.environ.get(
+        "REGISTRATION_TOKEN_FILE", "/run/secrets/gitea/registration-token"
+    )
+)
+OPENSANDBOX_API = os.environ.get(
+    "OPENSANDBOX_API", "http://10.60.0.13:8080"
+)
+OPENSANDBOX_API_KEY_FILE = Path(
+    os.environ.get(
+        "OPENSANDBOX_API_KEY_FILE",
+        "/run/secrets/opensandbox/api-key",
+    )
+)
 
 
 def accepts(payload: object) -> tuple[bool, str | None]:
-    """Compatibility helper for callers that only need acceptance and identity."""
     request = RunnerRequest.from_webhook(payload)
     return (request is not None, str(request.job_id) if request else None)
 
 
 def valid_signature(body: bytes, signature: str) -> bool:
-    expected = hmac.new(WEBHOOK_SECRET_FILE.read_bytes().strip(), body, hashlib.sha256).hexdigest()
+    expected = hmac.new(
+        WEBHOOK_SECRET_FILE.read_bytes().strip(), body, hashlib.sha256
+    ).hexdigest()
     return hmac.compare_digest(signature.removeprefix("sha256="), expected)
 
 
-async def ensure_stream(js: object) -> None:
-    config = StreamConfig(
-        name=STREAM,
-        subjects=[f"{SUBJECT_PREFIX}.>"],
-        retention=RetentionPolicy.WORK_QUEUE,
-        storage=StorageType.FILE,
-        discard=DiscardPolicy.OLD,
-        max_age=24 * 60 * 60,
-        max_msgs=10_000,
-        max_bytes=256 * 1024 * 1024,
-        duplicate_window=24 * 60 * 60,
-    )
-    try:
-        await js.stream_info(STREAM)
-    except NotFoundError:
-        await js.add_stream(config=config)
-    else:
-        await js.update_stream(config=config)
-
-
 async def webhook(request: web.Request) -> web.Response:
     body = await request.read()
     if not valid_signature(body, request.headers.get("X-Gitea-Signature", "")):
@@ -70,49 +61,28 @@ async def webhook(request: web.Request) -> web.Response:
     LOG.info("workflow_job webhook received %s", context)
 
     runner_request = RunnerRequest.from_webhook(payload)
-    if runner_request is not None:
-        subject = f"{SUBJECT_PREFIX}.{runner_request.backend}"
-        await request.app["js"].publish(
-            subject,
-            runner_request.to_json(),
-            headers={"Nats-Msg-Id": f"gitea-workflow-job-{runner_request.job_id}-queued"},
-        )
-        LOG.info(
-            "runner request published subject=%s job_id=%d run_id=%d backend=%s "
-            "repository=%s job_name=%r labels=%s",
-            subject,
-            runner_request.job_id,
-            runner_request.run_id,
-            runner_request.backend,
-            runner_request.repository,
-            runner_request.job_name,
-            runner_request.labels,
-        )
-        return web.Response(status=202, text="queued\n")
+    if runner_request is None:
+        LOG.info("workflow_job webhook ignored %s", context)
+        return web.Response(status=204)
 
-    binding = IdentityBinding.from_webhook(payload)
-    if binding is not None:
-        subject = f"{SUBJECT_PREFIX}.{binding.backend}.binding"
-        await request.app["js"].publish(
-            subject,
-            binding.to_json(),
-            headers={"Nats-Msg-Id": f"gitea-workflow-job-{binding.job_id}-in-progress"},
-        )
-        LOG.info(
-            "identity binding published subject=%s job_id=%d run_id=%d backend=%s "
-            "runner_name=%s repository=%s job_name=%r",
-            subject,
-            binding.job_id,
-            binding.run_id,
-            binding.backend,
-            binding.runner_name,
-            binding.repository,
-            binding.job_name,
-        )
-        return web.Response(status=202, text="binding queued\n")
+    scheduler: OpenSandboxScheduler = request.app["scheduler"]
+    try:
+        sandbox_id = await scheduler.create(runner_request)
+    except ValueError as error:
+        LOG.info("duplicate workflow_job webhook ignored: %s", error)
+        return web.Response(status=202, text="already scheduled\n")
+    except Exception:
+        LOG.exception("failed to create OpenSandbox runner %s", context)
+        raise web.HTTPServiceUnavailable(text="sandbox unavailable\n")
+    return web.Response(status=202, text=f"sandbox={sandbox_id}\n")
 
-    LOG.warning("workflow_job webhook ignored %s", context)
-    return web.Response(status=204)
+
+async def registration_token(request: web.Request) -> web.Response:
+    scheduler: OpenSandboxScheduler = request.app["scheduler"]
+    value = await scheduler.tokens.consume(request.match_info["nonce"])
+    if value is None:
+        raise web.HTTPNotFound()
+    return web.Response(body=value, headers={"Cache-Control": "no-store"})
 
 
 def _webhook_context(payload: object) -> str:
@@ -131,37 +101,42 @@ def _webhook_context(payload: object) -> str:
 
 
 async def health(request: web.Request) -> web.Response:
-    connected = request.app["nc"].is_connected
-    return web.Response(text="ok\n" if connected else "disconnected\n", status=200 if connected else 503)
-
-
-async def nats_context(app: web.Application):
-    tls = ssl.create_default_context(cafile=NATS_CA_FILE)
-    nc = await nats.connect(
-        NATS_URL,
-        user=NATS_USER,
-        password=NATS_PASSWORD_FILE.read_text().strip(),
-        tls=tls,
-        name="microvm-runner-controller",
+    client: OpenSandboxClient = request.app["opensandbox_client"]
+    return web.Response(
+        text="ok\n" if client.session is not None else "disconnected\n",
+        status=200 if client.session is not None else 503,
     )
-    app["nc"] = nc
-    app["js"] = nc.jetstream()
-    await ensure_stream(app["js"])
-    yield
-    await nc.drain()
+
+
+async def opensandbox_context(app: web.Application):
+    tokens = RegistrationTokens(REGISTRATION_TOKEN_FILE.read_bytes())
+    async with OpenSandboxClient(
+        api_url=OPENSANDBOX_API,
+        api_key_file=OPENSANDBOX_API_KEY_FILE,
+    ) as client:
+        scheduler = OpenSandboxScheduler(client, tokens)
+        app["opensandbox_client"] = client
+        app["scheduler"] = scheduler
+        yield
+        await scheduler.close()
 
 
 def create_app() -> web.Application:
     app = web.Application(client_max_size=1024 * 1024)
-    app.cleanup_ctx.append(nats_context)
+    app.cleanup_ctx.append(opensandbox_context)
     app.router.add_post("/webhook", webhook)
+    app.router.add_get("/token/{nonce}", registration_token)
     app.router.add_get("/healthz", health)
     return app
 
 
 def main() -> None:
     logging.basicConfig(level=os.environ.get("LOG_LEVEL", "INFO"))
-    web.run_app(create_app(), host=os.environ.get("LISTEN", "0.0.0.0"), port=int(os.environ.get("PORT", "8787")))
+    web.run_app(
+        create_app(),
+        host=os.environ.get("LISTEN", "0.0.0.0"),
+        port=int(os.environ.get("PORT", "8787")),
+    )
 
 
 if __name__ == "__main__":