gongzhiyongandClaude Opus 4.8
aa4679f610
让 k8s 拉起链路在仓内"可部署即可用"(此前线上实测全缺):
- Dockerfile.orchestrator:装 `kubectl`(pin AKS 1.34;linux/amd64)。launcher 靠 shell
`kubectl apply/delete` 建/删 agent Pod + 每-swarm key Secret,镜像无 kubectl 则 k8s 后端必失败。
- k8s/rbac/orchestrator-role.yaml:加 `secrets`(create/delete/list/get)——否则建不了模型 key
Secret、agent keyless。并注明 Role 命名空间须与 AGENT_POD_NAMESPACE 一致。
- k8s/orchestrator-deployment.yaml:
- pod 模板加 `azure.workload.identity/use: "true"`(AKS webhook 注入 token,配合已注解的
SA + UAMI 读 heicode-vault)。
- 接入拉起 env:`AGENT_LAUNCH_BACKEND=kubernetes`、`AGENT_POD_IMAGE=heicode.azurecr.io/swarm-agent:latest`、
`AGENT_POD_NAMESPACE=swarm-system`(同 RBAC ns)、`ORCHESTRATOR_PUBLIC_URL=ws://orchestrator-service...:8000`、
`AGENT_OPENAI_API_BASE=https://code.heicode.cc/v1`、`SECRET_RESOLVER=azkv`。
- image 指向 ACR(`heicode.azurecr.io/swarm-orchestrator`,tag 部署时 pin)。
校验:两个 manifest YAML 解析通过(label/env/secrets 均在);test-agent-launcher / test-swarm-guard /
test-contract-freeze 全绿。无明文密钥。
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
32 lines
1.3 KiB
Docker
32 lines
1.3 KiB
Docker
FROM python:3.11-slim
|
|
|
|
# kubectl — the kubernetes launch backend (agent_swarm#16/#56) shells out to `kubectl apply/delete`
|
|
# to create/teardown agent Pods + per-swarm key Secrets. Without it the k8s backend fails (0 agents).
|
|
# Pinned to the cluster minor (AKS 1.34) per kubectl skew policy. (linux/amd64 — AKS default node arch.)
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl ca-certificates \
|
|
&& KUBECTL_VERSION="$(curl -fsSL https://dl.k8s.io/release/stable-1.34.txt)" \
|
|
&& curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" -o /usr/local/bin/kubectl \
|
|
&& chmod +x /usr/local/bin/kubectl \
|
|
&& kubectl version --client=true 2>/dev/null \
|
|
&& apt-get clean && rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
# Install dependencies
|
|
COPY orchestrator/requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
# Copy orchestrator code
|
|
COPY orchestrator/ ./orchestrator/
|
|
|
|
# orchestrator/quality.py imports benchmark.fixtures / benchmark.metrics at startup,
|
|
# so the package must be present in the image (agent_swarm#44). stdlib-only — no extra pip.
|
|
COPY benchmark/ ./benchmark/
|
|
|
|
# Expose port
|
|
EXPOSE 8000
|
|
|
|
# Run orchestrator
|
|
CMD ["python", "-m", "uvicorn", "orchestrator.main:app", "--host", "0.0.0.0", "--port", "8000"]
|