mirrors/pikasTech-agentrun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: runner proxy and transient env secret

Browse Source
This commit is contained in:
Codex
2026-06-09 22:49:53 +08:00
parent 3daaa32427
commit e8b0b7896a
4 changed files with 297 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/runner/k8s-job.ts
+77 -4
View File
@@ -5,6 +5,34 @@ import { backendProfileSpec } from "../common/backend-profiles.js";
const defaultBootRepoUrl = "http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/agentrun.git";
const defaultResourceBinPath = "/usr/local/bin";
const defaultCodexShellSandbox = "danger-full-access";
const defaultRunnerEgressProxyUrl = "http://g14-provider-egress-proxy.unidesk.svc.cluster.local:18789";
const defaultRunnerNoProxy = [
"localhost",
"127.0.0.1",
"::1",
"agentrun-mgr",
"agentrun-mgr.agentrun-v01",
"agentrun-mgr.agentrun-v01.svc",
"agentrun-mgr.agentrun-v01.svc.cluster.local",
"agentrun-v01-postgres",
"agentrun-v01-postgres.agentrun-v01",
"agentrun-v01-postgres.agentrun-v01.svc",
"agentrun-v01-postgres.agentrun-v01.svc.cluster.local",
"g14-provider-egress-proxy",
"g14-provider-egress-proxy.unidesk",
"g14-provider-egress-proxy.unidesk.svc",
"g14-provider-egress-proxy.unidesk.svc.cluster.local",
"g14-tcp-egress-gateway",
"g14-tcp-egress-gateway.unidesk",
"g14-tcp-egress-gateway.unidesk.svc",
"g14-tcp-egress-gateway.unidesk.svc.cluster.local",
"hyueapi.com",
".hyueapi.com",
"10.42.0.0/16",
"10.43.0.0/16",
".svc",
".cluster.local",
].join(",");
export interface RunnerJobRenderOptions {
run: RunRecord;
@@ -35,6 +63,12 @@ export interface RunnerTransientEnv {
name: string;
value: string;
sensitive?: boolean;
secretRef?: RunnerTransientEnvSecretRef;
}
export interface RunnerTransientEnvSecretRef {
name: string;
key: string;
}
interface CredentialProjection {
@@ -170,7 +204,7 @@ export function renderRunnerJobManifest(options: RunnerJobRenderOptions): { mani
function runnerEnv(options: RunnerJobRenderOptions, context: { namespace: string; jobName: string; runnerId: string; attemptId: string; sourceCommit: string; secretRefs: CredentialProjection[]; toolCredentials: ToolCredentialProjection[]; sessionPvc: RunnerSessionPvcOptions | undefined }): JsonRecord[] {
const selectedSecret = context.secretRefs.find((item) => item.profile === options.run.backendProfile);
const codexHome = selectedSecret?.runtimeMountPath ?? defaultRuntimeHome(options.run.backendProfile);
return [
return dedupeEnvVars([
{ name: "AGENTRUN_MGR_URL", value: options.managerUrl },
{ name: "AGENTRUN_RUN_ID", value: options.run.id },
{ name: "AGENTRUN_COMMAND_ID", value: options.commandId },
@@ -202,9 +236,10 @@ function runnerEnv(options: RunnerJobRenderOptions, context: { namespace: string
{ name: "AGENTRUN_SESSION_PVC_MOUNT_PATH", value: context.sessionPvc.mountPath },
{ name: "AGENTRUN_CODEX_ROLLOUT_SUBDIR", value: context.sessionPvc.codexRolloutSubdir },
] : []),
...runnerEgressProxyEnvVars(),
...toolCredentialEnvVars(context.toolCredentials),
...transientEnvVars(options.transientEnv ?? []),
];
]);
}
function codexShellSandbox(policy: ExecutionPolicy): string {
@@ -225,7 +260,45 @@ function toolCredentialEnvVars(items: ToolCredentialProjection[]): JsonRecord[]
}
function transientEnvVars(items: RunnerTransientEnv[]): JsonRecord[] {
return items.map((item) => ({ name: item.name, value: item.value }));
return items.map((item) => {
if (item.secretRef) {
return {
name: item.name,
valueFrom: {
secretKeyRef: {
name: item.secretRef.name,
key: item.secretRef.key,
},
},
};
}
return { name: item.name, value: item.value };
});
}
function runnerEgressProxyEnvVars(): JsonRecord[] {
return [
{ name: "HTTP_PROXY", value: defaultRunnerEgressProxyUrl },
{ name: "HTTPS_PROXY", value: defaultRunnerEgressProxyUrl },
{ name: "ALL_PROXY", value: defaultRunnerEgressProxyUrl },
{ name: "NO_PROXY", value: defaultRunnerNoProxy },
{ name: "http_proxy", value: defaultRunnerEgressProxyUrl },
{ name: "https_proxy", value: defaultRunnerEgressProxyUrl },
{ name: "all_proxy", value: defaultRunnerEgressProxyUrl },
{ name: "no_proxy", value: defaultRunnerNoProxy },
];
}
function dedupeEnvVars(items: JsonRecord[]): JsonRecord[] {
const order: string[] = [];
const byName = new Map<string, JsonRecord>();
for (const item of items) {
const name = typeof item.name === "string" ? item.name : "";
if (!name) continue;
if (!byName.has(name)) order.push(name);
byName.set(name, item);
}
return order.map((name) => byName.get(name)).filter((item): item is JsonRecord => item !== undefined);
}
function summarizeTransientEnv(items: RunnerTransientEnv[]): JsonRecord {
@@ -263,7 +336,7 @@ function redactTransientEnvInManifest(manifest: JsonRecord, items: RunnerTransie
for (const container of containers) {
const env = Array.isArray(container.env) ? container.env as JsonRecord[] : [];
for (const entry of env) {
if (typeof entry.name === "string" && names.has(entry.name)) entry.value = "REDACTED";
if (typeof entry.name === "string" && names.has(entry.name) && entry.value !== undefined) entry.value = "REDACTED";
}
}
return copy;