部署 Go 动态 Runner Pod canary #110

2026-09-20T21:01:02Z

panxiao81 commented

2026-09-20 21:01:02 +00:00

变更

将 webhook/Python controller 与独立 Pod worker 合并为单副本 Go controller
首轮仅启用 scheduler + pod-worker，single-flight 严格限制同时一条任务
使用 SPIFFE mTLS facade、ClusterIP Service 和动态 ClusterStaticEntry
通过 ESO 投影 scheduler credential 与 assignment capability key
固定 controller/runner canary 镜像 digest，不启用 OpenSandbox VM

验证

yamllint 通过
kubectl kustomize 通过
生产 API server-side dry-run 通过
两个镜像已推送 Zot，含 SBOM/provenance

风险与回滚

facade registry 仍为进程内状态，保持单副本 Recreate
lifecycle reconciler 尚未完成，首次测试后人工核对终态 Pod/ClusterStaticEntry
异常时回滚前一 main manifests，已领取任务先核对 Gitea 状态

## 变更 - 将 webhook/Python controller 与独立 Pod worker 合并为单副本 Go controller - 首轮仅启用 scheduler + pod-worker，single-flight 严格限制同时一条任务 - 使用 SPIFFE mTLS facade、ClusterIP Service 和动态 ClusterStaticEntry - 通过 ESO 投影 scheduler credential 与 assignment capability key - 固定 controller/runner canary 镜像 digest，不启用 OpenSandbox VM ## 验证 - yamllint 通过 - kubectl kustomize 通过 - 生产 API server-side dry-run 通过 - 两个镜像已推送 Zot，含 SBOM/provenance ## 风险与回滚 - facade registry 仍为进程内状态，保持单副本 Recreate - lifecycle reconciler 尚未完成，首次测试后人工核对终态 Pod/ClusterStaticEntry - 异常时回滚前一 main manifests，已领取任务先核对 Gitea 状态

panxiao81 added 1 commit 2026-09-20 21:01:03 +00:00

部署 Go 动态 Runner Pod canary

yaml / yaml (pull_request) Successful in 18s

Details

68191e0ff4

panxiao81 merged commit 0663642583 into main

2026-09-20 21:01:36 +00:00

panxiao81 deleted branch deploy/go-runner-pod-canary

2026-09-20 21:01:36 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#110