gongzhiyongandClaude Opus 4.8
aa4679f610
让 k8s 拉起链路在仓内"可部署即可用"(此前线上实测全缺):
- Dockerfile.orchestrator:装 `kubectl`(pin AKS 1.34;linux/amd64)。launcher 靠 shell
`kubectl apply/delete` 建/删 agent Pod + 每-swarm key Secret,镜像无 kubectl 则 k8s 后端必失败。
- k8s/rbac/orchestrator-role.yaml:加 `secrets`(create/delete/list/get)——否则建不了模型 key
Secret、agent keyless。并注明 Role 命名空间须与 AGENT_POD_NAMESPACE 一致。
- k8s/orchestrator-deployment.yaml:
- pod 模板加 `azure.workload.identity/use: "true"`(AKS webhook 注入 token,配合已注解的
SA + UAMI 读 heicode-vault)。
- 接入拉起 env:`AGENT_LAUNCH_BACKEND=kubernetes`、`AGENT_POD_IMAGE=heicode.azurecr.io/swarm-agent:latest`、
`AGENT_POD_NAMESPACE=swarm-system`(同 RBAC ns)、`ORCHESTRATOR_PUBLIC_URL=ws://orchestrator-service...:8000`、
`AGENT_OPENAI_API_BASE=https://code.heicode.cc/v1`、`SECRET_RESOLVER=azkv`。
- image 指向 ACR(`heicode.azurecr.io/swarm-orchestrator`,tag 部署时 pin)。
校验:两个 manifest YAML 解析通过(label/env/secrets 均在);test-agent-launcher / test-swarm-guard /
test-contract-freeze 全绿。无明文密钥。
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
116 lines
4.4 KiB
YAML
116 lines
4.4 KiB
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: orchestrator-service
|
|
namespace: swarm-system
|
|
labels:
|
|
app: orchestrator
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 8000
|
|
targetPort: 8000
|
|
name: http
|
|
selector:
|
|
app: orchestrator
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: orchestrator
|
|
namespace: swarm-system
|
|
labels:
|
|
app: orchestrator
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: orchestrator
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: orchestrator
|
|
# Required for the AKS workload-identity webhook to inject AZURE_FEDERATED_TOKEN_FILE etc.
|
|
# into the pod, so the orchestrator can read the per-user model key from heicode-vault via
|
|
# its UAMI (SA swarm-orchestrator is annotated with azure.workload.identity/client-id). #56
|
|
azure.workload.identity/use: "true"
|
|
spec:
|
|
serviceAccountName: swarm-orchestrator
|
|
containers:
|
|
- name: orchestrator
|
|
image: heicode.azurecr.io/swarm-orchestrator:latest # deploy pins the tag (e.g. :<gitsha>)
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 8000
|
|
name: http
|
|
env:
|
|
# Default: in-cluster plaintext Redis (StatefulSet redis-service).
|
|
- name: REDIS_HOST
|
|
value: "redis-service"
|
|
- name: REDIS_PORT
|
|
value: "6379"
|
|
- name: REDIS_DB
|
|
value: "0"
|
|
# To use a managed Redis (e.g. Azure Redis Enterprise heicode-rd)
|
|
# instead of the in-cluster StatefulSet, point REDIS_HOST at it, enable
|
|
# cluster mode (Enterprise uses clusteringPolicy=OSSCluster), and inject
|
|
# the access key from a Secret (never inline a password):
|
|
# - name: REDIS_HOST
|
|
# value: "heicode-rd.southeastasia.redis.azure.net"
|
|
# - name: REDIS_PORT
|
|
# value: "10000"
|
|
# - name: REDIS_CLUSTER # required for OSSCluster endpoints
|
|
# value: "1"
|
|
# - name: REDIS_SSL # "1" only if the DB clientProtocol=Encrypted
|
|
# value: "0"
|
|
# - name: REDIS_PASSWORD
|
|
# valueFrom:
|
|
# secretKeyRef: { name: swarm-integration, key: redis_password }
|
|
# Or supply a single credentialed URL: REDIS_URL=rediss://:<key>@host:10000/0
|
|
# (also set REDIS_CLUSTER=1 for an OSSCluster endpoint).
|
|
- name: LOG_LEVEL
|
|
value: "INFO"
|
|
# ── Swarm agent launch (agent_swarm#16/#56): make the runtime actually spawn agents ──
|
|
# Without AGENT_LAUNCH_BACKEND the launcher is a no-op (0 agents → run hangs).
|
|
- name: AGENT_LAUNCH_BACKEND
|
|
value: "kubernetes"
|
|
- name: AGENT_POD_IMAGE
|
|
value: "heicode.azurecr.io/swarm-agent:latest" # build: az acr build -r heicode -t swarm-agent:latest -f Dockerfile.agent .
|
|
# Agent Pods + per-swarm key Secrets are created here — MUST match the RBAC Role's ns
|
|
# (k8s/rbac/orchestrator-role.yaml is in swarm-system).
|
|
- name: AGENT_POD_NAMESPACE
|
|
value: "swarm-system"
|
|
# In-cluster Service DNS the launched agents connect back to (Service: orchestrator-service).
|
|
- name: ORCHESTRATOR_PUBLIC_URL
|
|
value: "ws://orchestrator-service.swarm-system.svc.cluster.local:8000"
|
|
# HM model gateway (OpenAI-compatible). code.heicode.cc is the official address (#56).
|
|
- name: AGENT_OPENAI_API_BASE
|
|
value: "https://code.heicode.cc/v1"
|
|
# Resolve per-user model key from heicode-vault via the pod's workload identity (#56).
|
|
# (Redundant when AZURE_FEDERATED_TOKEN_FILE is injected, but explicit is clearer.)
|
|
- name: SECRET_RESOLVER
|
|
value: "azkv"
|
|
resources:
|
|
requests:
|
|
memory: "256Mi"
|
|
cpu: "200m"
|
|
limits:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|