This commit is contained in:
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: opensandbox-pools
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: opensandbox
|
||||
interval: 10m
|
||||
path: ./platform/sandbox-opensandbox-pools
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
timeout: 20m
|
||||
wait: true
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: opensandbox
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: kata
|
||||
- name: spire-agents
|
||||
interval: 10m
|
||||
path: ./platform/sandbox-opensandbox
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
timeout: 20m
|
||||
wait: true
|
||||
@@ -7,3 +7,5 @@ resources:
|
||||
- apps/spire-bootstrap.yaml
|
||||
- apps/spire-agents.yaml
|
||||
- apps/kata.yaml
|
||||
- apps/opensandbox.yaml
|
||||
- apps/opensandbox-pools.yaml
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- pools.yaml
|
||||
@@ -0,0 +1,123 @@
|
||||
---
|
||||
apiVersion: sandbox.opensandbox.io/v1alpha1
|
||||
kind: Pool
|
||||
metadata:
|
||||
name: ci-pod
|
||||
namespace: opensandbox
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
ci.ddupan.top/backend: pod
|
||||
spec:
|
||||
containers:
|
||||
- name: sandbox
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/code-interpreter:v1.1.0
|
||||
command: [/opt/opensandbox/task-executor]
|
||||
args: [-listen-addr=0.0.0.0:5758, -log-dir=/tmp]
|
||||
env:
|
||||
- name: SANDBOX_MAIN_CONTAINER
|
||||
value: sandbox
|
||||
- name: EXECD_ENVS
|
||||
value: /opt/opensandbox/.env
|
||||
- name: EXECD
|
||||
value: /opt/opensandbox/execd
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: sandbox-storage
|
||||
mountPath: /var/lib/sandbox
|
||||
initContainers:
|
||||
- name: task-executor-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0
|
||||
command: [/bin/sh, -c]
|
||||
args: [cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor]
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: execd-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
|
||||
command: [/bin/sh, -c]
|
||||
args: [cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh]
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
volumes:
|
||||
- name: opensandbox-bin
|
||||
emptyDir: {}
|
||||
- name: sandbox-storage
|
||||
emptyDir: {}
|
||||
capacitySpec:
|
||||
bufferMax: 1
|
||||
bufferMin: 0
|
||||
poolMax: 4
|
||||
poolMin: 0
|
||||
---
|
||||
apiVersion: sandbox.opensandbox.io/v1alpha1
|
||||
kind: Pool
|
||||
metadata:
|
||||
name: ci-vm
|
||||
namespace: opensandbox
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
ci.ddupan.top/backend: vm
|
||||
spec:
|
||||
runtimeClassName: kata-clh-runtime-rs
|
||||
containers:
|
||||
- name: sandbox
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/code-interpreter:v1.1.0
|
||||
command: [/opt/opensandbox/task-executor]
|
||||
args: [-listen-addr=0.0.0.0:5758, -log-dir=/tmp]
|
||||
env:
|
||||
- name: SANDBOX_MAIN_CONTAINER
|
||||
value: sandbox
|
||||
- name: EXECD_ENVS
|
||||
value: /opt/opensandbox/.env
|
||||
- name: EXECD
|
||||
value: /opt/opensandbox/execd
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: 8Gi
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: sandbox-storage
|
||||
mountPath: /var/lib/sandbox
|
||||
initContainers:
|
||||
- name: task-executor-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0
|
||||
command: [/bin/sh, -c]
|
||||
args: [cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor]
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: execd-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
|
||||
command: [/bin/sh, -c]
|
||||
args: [cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh]
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
volumes:
|
||||
- name: opensandbox-bin
|
||||
emptyDir: {}
|
||||
- name: sandbox-storage
|
||||
emptyDir: {}
|
||||
capacitySpec:
|
||||
bufferMax: 1
|
||||
bufferMin: 0
|
||||
poolMax: 2
|
||||
poolMin: 0
|
||||
@@ -0,0 +1,19 @@
|
||||
# OpenSandbox
|
||||
|
||||
Flux installs the upstream all-in-one OpenSandbox chart pinned to
|
||||
`helm/opensandbox/0.2.2` (`8f01e935`). The API is cluster-internal and intentionally runs a
|
||||
single replica until shared server state and HA behaviour have been validated.
|
||||
|
||||
`ci-pod` uses `runc`; `ci-vm` uses the separately managed
|
||||
`kata-clh-runtime-rs` RuntimeClass. Both Pools start at zero and create capacity
|
||||
on demand. They currently use the upstream interpreter image to validate the
|
||||
Lifecycle API and Pool allocation independently of the CI scheduler cutover.
|
||||
|
||||
The dynamic runner worker, runner image, guest-local SPIRE Agent and Docker
|
||||
sidecar are introduced only after this layer is Ready. In particular, do not
|
||||
mount the host SPIFFE CSI socket into `ci-vm`: Unix sockets do not cross the
|
||||
Kata VM boundary.
|
||||
|
||||
Smoke test both backends through the same API by creating sandboxes with
|
||||
`extensions.poolRef` set to `ci-pod` and `ci-vm`, then confirm their
|
||||
BatchSandboxes, Pods and VMMs disappear after deletion.
|
||||
@@ -0,0 +1,31 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: opensandbox
|
||||
namespace: opensandbox-system
|
||||
spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: ./kubernetes/charts/opensandbox
|
||||
interval: 1h
|
||||
reconcileStrategy: Revision
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: opensandbox
|
||||
driftDetection:
|
||||
mode: enabled
|
||||
install:
|
||||
strategy:
|
||||
name: RetryOnFailure
|
||||
retryInterval: 5m
|
||||
interval: 30m
|
||||
releaseName: opensandbox
|
||||
targetNamespace: opensandbox-system
|
||||
timeout: 15m
|
||||
upgrade:
|
||||
strategy:
|
||||
name: RetryOnFailure
|
||||
retryInterval: 5m
|
||||
valuesFrom:
|
||||
- kind: ConfigMap
|
||||
name: opensandbox-values
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespaces.yaml
|
||||
- repository.yaml
|
||||
- values.yaml
|
||||
- helmrelease.yaml
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: opensandbox-system
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: opensandbox
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: GitRepository
|
||||
metadata:
|
||||
name: opensandbox
|
||||
namespace: opensandbox-system
|
||||
spec:
|
||||
interval: 1h
|
||||
ref:
|
||||
tag: helm/opensandbox/0.2.2
|
||||
timeout: 60s
|
||||
url: https://github.com/alibaba/OpenSandbox.git
|
||||
@@ -0,0 +1,62 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: opensandbox-values
|
||||
namespace: opensandbox-system
|
||||
data:
|
||||
values.yaml: |
|
||||
opensandbox-controller:
|
||||
controller:
|
||||
logLevel: info
|
||||
replicaCount: 1
|
||||
metrics:
|
||||
enabled: true
|
||||
secure: false
|
||||
port: 8080
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
|
||||
opensandbox-server:
|
||||
server:
|
||||
replicaCount: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
configToml: |
|
||||
[server]
|
||||
host = "0.0.0.0"
|
||||
port = 80
|
||||
api_key = ""
|
||||
|
||||
[log]
|
||||
level = "INFO"
|
||||
|
||||
[runtime]
|
||||
type = "kubernetes"
|
||||
execd_image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22"
|
||||
|
||||
[kubernetes]
|
||||
kubeconfig_path = ""
|
||||
namespace = "opensandbox"
|
||||
informer_enabled = true
|
||||
informer_resync_seconds = 300
|
||||
informer_watch_timeout_seconds = 60
|
||||
snapshot_create_timeout_seconds = 900
|
||||
workload_provider = "batchsandbox"
|
||||
batchsandbox_template_file = "/etc/opensandbox/example.batchsandbox-template.yaml"
|
||||
|
||||
[egress]
|
||||
image = "sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.6"
|
||||
mode = "dns+nft"
|
||||
|
||||
opensandbox-node-agent:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user