From 0e3564bf7282a5aff1c9befdf1ca3f1c07b02e19 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Fri, 18 Sep 2026 01:10:07 +0000 Subject: [PATCH] =?UTF-8?q?feat:=20=E9=83=A8=E7=BD=B2=20OpenSandbox=20API?= =?UTF-8?q?=20=E4=B8=8E=E5=8F=8C=E8=BF=90=E8=A1=8C=E6=97=B6=20Pool?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- clusters/sandbox/apps/opensandbox-pools.yaml | 17 +++ clusters/sandbox/apps/opensandbox.yaml | 18 +++ clusters/sandbox/kustomization.yaml | 2 + .../kustomization.yaml | 4 + platform/sandbox-opensandbox-pools/pools.yaml | 123 ++++++++++++++++++ platform/sandbox-opensandbox/README.md | 19 +++ platform/sandbox-opensandbox/helmrelease.yaml | 31 +++++ .../sandbox-opensandbox/kustomization.yaml | 7 + platform/sandbox-opensandbox/namespaces.yaml | 10 ++ platform/sandbox-opensandbox/repository.yaml | 11 ++ platform/sandbox-opensandbox/values.yaml | 62 +++++++++ 11 files changed, 304 insertions(+) create mode 100644 clusters/sandbox/apps/opensandbox-pools.yaml create mode 100644 clusters/sandbox/apps/opensandbox.yaml create mode 100644 platform/sandbox-opensandbox-pools/kustomization.yaml create mode 100644 platform/sandbox-opensandbox-pools/pools.yaml create mode 100644 platform/sandbox-opensandbox/README.md create mode 100644 platform/sandbox-opensandbox/helmrelease.yaml create mode 100644 platform/sandbox-opensandbox/kustomization.yaml create mode 100644 platform/sandbox-opensandbox/namespaces.yaml create mode 100644 platform/sandbox-opensandbox/repository.yaml create mode 100644 platform/sandbox-opensandbox/values.yaml diff --git a/clusters/sandbox/apps/opensandbox-pools.yaml b/clusters/sandbox/apps/opensandbox-pools.yaml new file mode 100644 index 0000000..30b6c23 --- /dev/null +++ b/clusters/sandbox/apps/opensandbox-pools.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: opensandbox-pools + namespace: flux-system +spec: + dependsOn: + - name: opensandbox + interval: 10m + path: ./platform/sandbox-opensandbox-pools + prune: true + sourceRef: + kind: GitRepository + name: flux-system + timeout: 20m + wait: true diff --git a/clusters/sandbox/apps/opensandbox.yaml b/clusters/sandbox/apps/opensandbox.yaml new file mode 100644 index 0000000..56d8b15 --- /dev/null +++ b/clusters/sandbox/apps/opensandbox.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: opensandbox + namespace: flux-system +spec: + dependsOn: + - name: kata + - name: spire-agents + interval: 10m + path: ./platform/sandbox-opensandbox + prune: true + sourceRef: + kind: GitRepository + name: flux-system + timeout: 20m + wait: true diff --git a/clusters/sandbox/kustomization.yaml b/clusters/sandbox/kustomization.yaml index fa2ce88..518b1e1 100644 --- a/clusters/sandbox/kustomization.yaml +++ b/clusters/sandbox/kustomization.yaml @@ -7,3 +7,5 @@ resources: - apps/spire-bootstrap.yaml - apps/spire-agents.yaml - apps/kata.yaml + - apps/opensandbox.yaml + - apps/opensandbox-pools.yaml diff --git a/platform/sandbox-opensandbox-pools/kustomization.yaml b/platform/sandbox-opensandbox-pools/kustomization.yaml new file mode 100644 index 0000000..3d484c8 --- /dev/null +++ b/platform/sandbox-opensandbox-pools/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - pools.yaml diff --git a/platform/sandbox-opensandbox-pools/pools.yaml b/platform/sandbox-opensandbox-pools/pools.yaml new file mode 100644 index 0000000..bc900b6 --- /dev/null +++ b/platform/sandbox-opensandbox-pools/pools.yaml @@ -0,0 +1,123 @@ +--- +apiVersion: sandbox.opensandbox.io/v1alpha1 +kind: Pool +metadata: + name: ci-pod + namespace: opensandbox +spec: + template: + metadata: + labels: + ci.ddupan.top/backend: pod + spec: + containers: + - name: sandbox + image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/code-interpreter:v1.1.0 + command: [/opt/opensandbox/task-executor] + args: [-listen-addr=0.0.0.0:5758, -log-dir=/tmp] + env: + - name: SANDBOX_MAIN_CONTAINER + value: sandbox + - name: EXECD_ENVS + value: /opt/opensandbox/.env + - name: EXECD + value: /opt/opensandbox/execd + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: "2" + memory: 4Gi + volumeMounts: + - name: opensandbox-bin + mountPath: /opt/opensandbox + - name: sandbox-storage + mountPath: /var/lib/sandbox + initContainers: + - name: task-executor-installer + image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0 + command: [/bin/sh, -c] + args: [cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor] + volumeMounts: + - name: opensandbox-bin + mountPath: /opt/opensandbox + - name: execd-installer + image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22 + command: [/bin/sh, -c] + args: [cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh] + volumeMounts: + - name: opensandbox-bin + mountPath: /opt/opensandbox + volumes: + - name: opensandbox-bin + emptyDir: {} + - name: sandbox-storage + emptyDir: {} + capacitySpec: + bufferMax: 1 + bufferMin: 0 + poolMax: 4 + poolMin: 0 +--- +apiVersion: sandbox.opensandbox.io/v1alpha1 +kind: Pool +metadata: + name: ci-vm + namespace: opensandbox +spec: + template: + metadata: + labels: + ci.ddupan.top/backend: vm + spec: + runtimeClassName: kata-clh-runtime-rs + containers: + - name: sandbox + image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/code-interpreter:v1.1.0 + command: [/opt/opensandbox/task-executor] + args: [-listen-addr=0.0.0.0:5758, -log-dir=/tmp] + env: + - name: SANDBOX_MAIN_CONTAINER + value: sandbox + - name: EXECD_ENVS + value: /opt/opensandbox/.env + - name: EXECD + value: /opt/opensandbox/execd + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "4" + memory: 8Gi + volumeMounts: + - name: opensandbox-bin + mountPath: /opt/opensandbox + - name: sandbox-storage + mountPath: /var/lib/sandbox + initContainers: + - name: task-executor-installer + image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0 + command: [/bin/sh, -c] + args: [cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor] + volumeMounts: + - name: opensandbox-bin + mountPath: /opt/opensandbox + - name: execd-installer + image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22 + command: [/bin/sh, -c] + args: [cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh] + volumeMounts: + - name: opensandbox-bin + mountPath: /opt/opensandbox + volumes: + - name: opensandbox-bin + emptyDir: {} + - name: sandbox-storage + emptyDir: {} + capacitySpec: + bufferMax: 1 + bufferMin: 0 + poolMax: 2 + poolMin: 0 diff --git a/platform/sandbox-opensandbox/README.md b/platform/sandbox-opensandbox/README.md new file mode 100644 index 0000000..1bdec09 --- /dev/null +++ b/platform/sandbox-opensandbox/README.md @@ -0,0 +1,19 @@ +# OpenSandbox + +Flux installs the upstream all-in-one OpenSandbox chart pinned to +`helm/opensandbox/0.2.2` (`8f01e935`). The API is cluster-internal and intentionally runs a +single replica until shared server state and HA behaviour have been validated. + +`ci-pod` uses `runc`; `ci-vm` uses the separately managed +`kata-clh-runtime-rs` RuntimeClass. Both Pools start at zero and create capacity +on demand. They currently use the upstream interpreter image to validate the +Lifecycle API and Pool allocation independently of the CI scheduler cutover. + +The dynamic runner worker, runner image, guest-local SPIRE Agent and Docker +sidecar are introduced only after this layer is Ready. In particular, do not +mount the host SPIFFE CSI socket into `ci-vm`: Unix sockets do not cross the +Kata VM boundary. + +Smoke test both backends through the same API by creating sandboxes with +`extensions.poolRef` set to `ci-pod` and `ci-vm`, then confirm their +BatchSandboxes, Pods and VMMs disappear after deletion. diff --git a/platform/sandbox-opensandbox/helmrelease.yaml b/platform/sandbox-opensandbox/helmrelease.yaml new file mode 100644 index 0000000..451e817 --- /dev/null +++ b/platform/sandbox-opensandbox/helmrelease.yaml @@ -0,0 +1,31 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: opensandbox + namespace: opensandbox-system +spec: + chart: + spec: + chart: ./kubernetes/charts/opensandbox + interval: 1h + reconcileStrategy: Revision + sourceRef: + kind: GitRepository + name: opensandbox + driftDetection: + mode: enabled + install: + strategy: + name: RetryOnFailure + retryInterval: 5m + interval: 30m + releaseName: opensandbox + targetNamespace: opensandbox-system + timeout: 15m + upgrade: + strategy: + name: RetryOnFailure + retryInterval: 5m + valuesFrom: + - kind: ConfigMap + name: opensandbox-values diff --git a/platform/sandbox-opensandbox/kustomization.yaml b/platform/sandbox-opensandbox/kustomization.yaml new file mode 100644 index 0000000..c283edb --- /dev/null +++ b/platform/sandbox-opensandbox/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespaces.yaml + - repository.yaml + - values.yaml + - helmrelease.yaml diff --git a/platform/sandbox-opensandbox/namespaces.yaml b/platform/sandbox-opensandbox/namespaces.yaml new file mode 100644 index 0000000..b41233e --- /dev/null +++ b/platform/sandbox-opensandbox/namespaces.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: opensandbox-system +--- +apiVersion: v1 +kind: Namespace +metadata: + name: opensandbox diff --git a/platform/sandbox-opensandbox/repository.yaml b/platform/sandbox-opensandbox/repository.yaml new file mode 100644 index 0000000..cb4c596 --- /dev/null +++ b/platform/sandbox-opensandbox/repository.yaml @@ -0,0 +1,11 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: opensandbox + namespace: opensandbox-system +spec: + interval: 1h + ref: + tag: helm/opensandbox/0.2.2 + timeout: 60s + url: https://github.com/alibaba/OpenSandbox.git diff --git a/platform/sandbox-opensandbox/values.yaml b/platform/sandbox-opensandbox/values.yaml new file mode 100644 index 0000000..327342c --- /dev/null +++ b/platform/sandbox-opensandbox/values.yaml @@ -0,0 +1,62 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: opensandbox-values + namespace: opensandbox-system +data: + values.yaml: | + opensandbox-controller: + controller: + logLevel: info + replicaCount: 1 + metrics: + enabled: true + secure: false + port: 8080 + resources: + requests: + cpu: 25m + memory: 64Mi + limits: + cpu: 500m + memory: 256Mi + + opensandbox-server: + server: + replicaCount: 1 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: "1" + memory: 1Gi + configToml: | + [server] + host = "0.0.0.0" + port = 80 + api_key = "" + + [log] + level = "INFO" + + [runtime] + type = "kubernetes" + execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22" + + [kubernetes] + kubeconfig_path = "" + namespace = "opensandbox" + informer_enabled = true + informer_resync_seconds = 300 + informer_watch_timeout_seconds = 60 + snapshot_create_timeout_seconds = 900 + workload_provider = "batchsandbox" + batchsandbox_template_file = "/etc/opensandbox/example.batchsandbox-template.yaml" + + [egress] + image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.6" + mode = "dns+nft" + + opensandbox-node-agent: + enabled: false