From 8244cdad7967cec3e798b489f79e8eb5cb95292b Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Mon, 21 Sep 2026 09:11:29 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=B8=BA=20sandbox=20=E6=9A=B4=E9=9C=B2?= =?UTF-8?q?=20Runner=20facade?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/dynamic-runner/README.md | 6 +++--- platform/dynamic-runner/deployment.yaml | 2 +- platform/dynamic-runner/service.yaml | 3 ++- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md index 2679f83..ee9e137 100644 --- a/platform/dynamic-runner/README.md +++ b/platform/dynamic-runner/README.md @@ -32,9 +32,9 @@ OpenSandbox chart 所有权边界。 `FetchTask`；所有 Ready 实例都可通过 backend metadata 恢复 claim 并服务 facade。 - executor 镜像使用 digest；Pod 以 UID 2000 运行，SPIRE `ClusterStaticEntry` 同时绑定 具体 Pod UID 与 `unix:uid:2000`。 -- facade 只有 ClusterIP，executor 通过 - `dynamic-runner-controller.dynamic-runner.svc:8443` 访问；双方使用 Workload API - X509-SVID mTLS，不再保留公网 webhook/token endpoint。 +- facade 通过仅内网可路由的 `192.168.10.127:30443` NodePort 提供给 sandbox executor； + 双方使用 Workload API X509-SVID mTLS，并按 SPIFFE ID 而不是 IP/DNS 名验证服务端。 + 该入口不经过公网或 Cloudflare Tunnel。 - controller 的 SPIFFE ID 固定为 `spiffe://ddupan.top/ns/dynamic-runner/sa/dynamic-runner-controller`。 - NATS 保留既有最小权限分离：`ci-producer` 仅 publish，`ci-worker` 仅 pull/ACK。 diff --git a/platform/dynamic-runner/deployment.yaml b/platform/dynamic-runner/deployment.yaml index 04f95dc..c9201c9 100644 --- a/platform/dynamic-runner/deployment.yaml +++ b/platform/dynamic-runner/deployment.yaml @@ -63,7 +63,7 @@ spec: - name: RUNNER_FACADE_LISTEN value: :8443 - name: RUNNER_FACADE_URL - value: https://dynamic-runner-controller.dynamic-runner.svc:8443 + value: https://192.168.10.127:30443 - name: RUNNER_FACADE_SPIFFE_ID value: spiffe://ddupan.top/ns/dynamic-runner/sa/dynamic-runner-controller - name: SPIFFE_ENDPOINT_SOCKET diff --git a/platform/dynamic-runner/service.yaml b/platform/dynamic-runner/service.yaml index bcef3db..e527f30 100644 --- a/platform/dynamic-runner/service.yaml +++ b/platform/dynamic-runner/service.yaml @@ -4,10 +4,11 @@ metadata: name: dynamic-runner-controller namespace: dynamic-runner spec: - type: ClusterIP + type: NodePort selector: app.kubernetes.io/name: dynamic-runner-controller ports: - name: facade port: 8443 targetPort: facade + nodePort: 30443 -- 2.54.0