Codex
254 lines
11 KiB
TypeScript
254 lines
11 KiB
TypeScript
import { stableHash } from "../common/validation.js";
|
||
import type { BackendProfile, ExecutionPolicy, JsonRecord, JsonValue, RunRecord, SecretRef } from "../common/types.js";
|
||
import { backendProfileSpec } from "../common/backend-profiles.js";
|
||
|
||
export interface RunnerJobRenderOptions {
|
||
run: RunRecord;
|
||
commandId: string;
|
||
managerUrl: string;
|
||
image: string;
|
||
namespace?: string;
|
||
attemptId?: string;
|
||
runnerId?: string;
|
||
sourceCommit?: string;
|
||
serviceAccountName?: string;
|
||
imagePullPolicy?: string;
|
||
backoffLimit?: number;
|
||
ttlSecondsAfterFinished?: number;
|
||
transientEnv?: RunnerTransientEnv[];
|
||
dryRun?: boolean;
|
||
}
|
||
|
||
export interface RunnerTransientEnv {
|
||
name: string;
|
||
value: string;
|
||
sensitive?: boolean;
|
||
}
|
||
|
||
interface CredentialProjection {
|
||
profile: BackendProfile | string;
|
||
secretRef: SecretRef;
|
||
volumeName: string;
|
||
runtimeMountPath: string;
|
||
projectionMountPath: string;
|
||
}
|
||
|
||
export function renderRunnerJobDryRun(options: RunnerJobRenderOptions): JsonRecord {
|
||
const render = renderRunnerJobManifest({ ...options, dryRun: true });
|
||
const manifest = redactTransientEnvInManifest(render.manifest, options.transientEnv ?? []);
|
||
return {
|
||
dryRun: true,
|
||
mutation: false,
|
||
action: "render-kubernetes-job",
|
||
jobIdentity: {
|
||
kind: "Job",
|
||
namespace: render.namespace,
|
||
name: render.jobName,
|
||
serviceAccountName: render.serviceAccountName,
|
||
},
|
||
runner: {
|
||
runId: options.run.id,
|
||
commandId: options.commandId,
|
||
attemptId: render.attemptId,
|
||
runnerId: render.runnerId,
|
||
backendProfile: options.run.backendProfile,
|
||
managerUrl: options.managerUrl,
|
||
sourceCommit: render.sourceCommit,
|
||
},
|
||
secretRefs: render.secretRefs.map((item) => ({ profile: item.profile, name: item.secretRef.name, namespace: item.secretRef.namespace ?? render.namespace, keys: item.secretRef.keys ?? [], mountPath: item.runtimeMountPath, projectionPath: item.projectionMountPath, writableCopy: true, valuesPrinted: false })),
|
||
transientEnv: summarizeTransientEnv(options.transientEnv ?? []),
|
||
retention: {
|
||
ttlSecondsAfterFinished: render.ttlSecondsAfterFinished,
|
||
},
|
||
pollCommands: {
|
||
run: `./scripts/agentrun runs show ${options.run.id} --manager-url ${options.managerUrl}`,
|
||
events: `./scripts/agentrun runs events ${options.run.id} --manager-url ${options.managerUrl} --after-seq 0 --limit 100`,
|
||
},
|
||
warnings: render.warnings,
|
||
manifest,
|
||
};
|
||
}
|
||
|
||
export function renderRunnerJobManifest(options: RunnerJobRenderOptions): { manifest: JsonRecord; namespace: string; jobName: string; runnerId: string; attemptId: string; sourceCommit: string; serviceAccountName: string; secretRefs: CredentialProjection[]; warnings: string[]; ttlSecondsAfterFinished: number } {
|
||
const namespace = options.namespace ?? "agentrun-v01";
|
||
const attemptId = options.attemptId ?? `attempt_${Date.now().toString(36)}`;
|
||
const runnerId = options.runnerId ?? `runner_${shortHash(`${options.run.id}:${attemptId}:${options.commandId}`)}`;
|
||
const sourceCommit = options.sourceCommit ?? process.env.AGENTRUN_SOURCE_COMMIT ?? "unknown";
|
||
const serviceAccountName = options.serviceAccountName ?? "agentrun-v01-runner";
|
||
const ttlSecondsAfterFinished = options.ttlSecondsAfterFinished ?? 86_400;
|
||
const jobName = `agentrun-v01-runner-${shortDnsHash(options.run.id, attemptId)}`;
|
||
const secretRefs = credentialProjections(options.run, namespace);
|
||
const warnings: string[] = [];
|
||
if (secretRefs.length === 0) warnings.push("run executionPolicy.secretScope 未声明 provider SecretRef；runner 将按 secret-unavailable 上报，而不会降级直连外部凭据");
|
||
const env = runnerEnv(options, { namespace, jobName, runnerId, attemptId, sourceCommit, secretRefs });
|
||
const manifest: JsonRecord = {
|
||
apiVersion: "batch/v1",
|
||
kind: "Job",
|
||
metadata: {
|
||
name: jobName,
|
||
namespace,
|
||
labels: labels(options.run, jobName),
|
||
annotations: {
|
||
"agentrun.pikastech.local/run-id": options.run.id,
|
||
"agentrun.pikastech.local/command-id": options.commandId,
|
||
"agentrun.pikastech.local/dry-run-render": String(options.dryRun === true),
|
||
},
|
||
},
|
||
spec: {
|
||
backoffLimit: options.backoffLimit ?? 0,
|
||
ttlSecondsAfterFinished,
|
||
template: {
|
||
metadata: {
|
||
labels: labels(options.run, jobName),
|
||
annotations: {
|
||
"agentrun.pikastech.local/run-id": options.run.id,
|
||
"agentrun.pikastech.local/command-id": options.commandId,
|
||
},
|
||
},
|
||
spec: {
|
||
serviceAccountName,
|
||
automountServiceAccountToken: false,
|
||
restartPolicy: "Never",
|
||
containers: [
|
||
{
|
||
name: "runner",
|
||
image: options.image,
|
||
imagePullPolicy: options.imagePullPolicy ?? "IfNotPresent",
|
||
command: ["bun", "src/runner/main.ts"],
|
||
env,
|
||
volumeMounts: [
|
||
{ name: "runner-home", mountPath: "/home/agentrun" },
|
||
...secretRefs.map((item) => ({ name: item.volumeName, mountPath: item.projectionMountPath, readOnly: true })),
|
||
],
|
||
resources: {
|
||
requests: { cpu: "250m", memory: "512Mi" },
|
||
limits: { cpu: "2", memory: "4Gi" },
|
||
},
|
||
securityContext: {
|
||
allowPrivilegeEscalation: false,
|
||
readOnlyRootFilesystem: false,
|
||
capabilities: { drop: ["ALL"] },
|
||
},
|
||
},
|
||
],
|
||
volumes: [{ name: "runner-home", emptyDir: {} }, ...secretRefs.map(secretVolume)],
|
||
},
|
||
},
|
||
},
|
||
};
|
||
return { manifest, namespace, jobName, runnerId, attemptId, sourceCommit, serviceAccountName, secretRefs, warnings, ttlSecondsAfterFinished };
|
||
}
|
||
|
||
function runnerEnv(options: RunnerJobRenderOptions, context: { namespace: string; jobName: string; runnerId: string; attemptId: string; sourceCommit: string; secretRefs: CredentialProjection[] }): JsonRecord[] {
|
||
const selectedSecret = context.secretRefs.find((item) => item.profile === options.run.backendProfile);
|
||
const codexHome = selectedSecret?.runtimeMountPath ?? defaultRuntimeHome(options.run.backendProfile);
|
||
return [
|
||
{ name: "AGENTRUN_MGR_URL", value: options.managerUrl },
|
||
{ name: "AGENTRUN_RUN_ID", value: options.run.id },
|
||
{ name: "AGENTRUN_COMMAND_ID", value: options.commandId },
|
||
{ name: "AGENTRUN_ATTEMPT_ID", value: context.attemptId },
|
||
{ name: "AGENTRUN_RUNNER_ID", value: context.runnerId },
|
||
{ name: "AGENTRUN_BACKEND_PROFILE", value: options.run.backendProfile },
|
||
{ name: "AGENTRUN_EXECUTION_POLICY_JSON", value: JSON.stringify(options.run.executionPolicy) },
|
||
{ name: "AGENTRUN_SESSION_REF_JSON", value: JSON.stringify(options.run.sessionRef ?? null) },
|
||
{ name: "AGENTRUN_RESOURCE_BUNDLE_JSON", value: JSON.stringify(options.run.resourceBundleRef ?? null) },
|
||
{ name: "AGENTRUN_WORKSPACE_ROOT", value: "/home/agentrun/workspaces" },
|
||
{ name: "AGENTRUN_SOURCE_COMMIT", value: context.sourceCommit },
|
||
{ name: "AGENTRUN_RUNTIME_NAMESPACE", value: context.namespace },
|
||
{ name: "AGENTRUN_K8S_JOB_NAME", value: context.jobName },
|
||
{ name: "AGENTRUN_LOG_PATH", value: "/tmp/agentrun-runner.jsonl" },
|
||
{ name: "AGENTRUN_RUNNER_IDLE_TIMEOUT_MS", value: "600000" },
|
||
{ name: "HOME", value: "/home/agentrun" },
|
||
{ name: "CODEX_HOME", value: codexHome },
|
||
...(selectedSecret ? [{ name: "AGENTRUN_CODEX_SECRET_HOME", value: selectedSecret.projectionMountPath }] : []),
|
||
...transientEnvVars(options.transientEnv ?? []),
|
||
];
|
||
}
|
||
|
||
function transientEnvVars(items: RunnerTransientEnv[]): JsonRecord[] {
|
||
return items.map((item) => ({ name: item.name, value: item.value }));
|
||
}
|
||
|
||
function summarizeTransientEnv(items: RunnerTransientEnv[]): JsonRecord {
|
||
return {
|
||
count: items.length,
|
||
names: items.map((item) => item.name),
|
||
valuesPrinted: false,
|
||
};
|
||
}
|
||
|
||
function redactTransientEnvInManifest(manifest: JsonRecord, items: RunnerTransientEnv[]): JsonRecord {
|
||
if (items.length === 0) return manifest;
|
||
const names = new Set(items.map((item) => item.name));
|
||
const copy = JSON.parse(JSON.stringify(manifest)) as JsonRecord;
|
||
const spec = copy.spec as JsonRecord | undefined;
|
||
const template = spec?.template as JsonRecord | undefined;
|
||
const podSpec = template?.spec as JsonRecord | undefined;
|
||
const containers = Array.isArray(podSpec?.containers) ? podSpec.containers as JsonRecord[] : [];
|
||
for (const container of containers) {
|
||
const env = Array.isArray(container.env) ? container.env as JsonRecord[] : [];
|
||
for (const entry of env) {
|
||
if (typeof entry.name === "string" && names.has(entry.name)) entry.value = "REDACTED";
|
||
}
|
||
}
|
||
return copy;
|
||
}
|
||
|
||
function credentialProjections(run: RunRecord, namespace: string): CredentialProjection[] {
|
||
const policy: ExecutionPolicy = run.executionPolicy;
|
||
const credentials = (policy.secretScope.providerCredentials ?? []).filter((item) => item.profile === run.backendProfile);
|
||
return credentials.map((item, index) => ({
|
||
profile: item.profile,
|
||
secretRef: item.secretRef.namespace ? item.secretRef : { ...item.secretRef, namespace },
|
||
volumeName: sanitizeVolumeName(`${String(item.profile)}-${index}`),
|
||
runtimeMountPath: normalizeMountPath(item.secretRef.mountPath, String(item.profile)),
|
||
projectionMountPath: `/var/run/agentrun/secrets/${sanitizeVolumeName(`${String(item.profile)}-${index}`)}`,
|
||
}));
|
||
}
|
||
|
||
function secretVolume(item: CredentialProjection): JsonRecord {
|
||
const secret: JsonRecord = {
|
||
secretName: item.secretRef.name,
|
||
defaultMode: 256,
|
||
};
|
||
const keys = item.secretRef.keys ?? [];
|
||
if (keys.length > 0) secret.items = keys.map((key) => ({ key, path: key, mode: 256 }));
|
||
return { name: item.volumeName, secret };
|
||
}
|
||
|
||
function normalizeMountPath(value: string | undefined, profile: string): string {
|
||
const spec = backendProfileSpec(profile);
|
||
const suffix = spec ? spec.profile : sanitizeVolumeName(profile);
|
||
if (!value || value === "~/.codex") return defaultRuntimeHome(suffix);
|
||
if (value.startsWith("~/")) return `/home/agentrun/${value.slice(2)}-${suffix}`;
|
||
return value;
|
||
}
|
||
|
||
function defaultRuntimeHome(profile: string): string {
|
||
return `/home/agentrun/.codex-${sanitizeVolumeName(profile)}`;
|
||
}
|
||
|
||
function labels(run: RunRecord, jobName: string): JsonRecord {
|
||
return {
|
||
"app.kubernetes.io/name": "agentrun-runner",
|
||
"app.kubernetes.io/component": "runner",
|
||
"app.kubernetes.io/part-of": "agentrun",
|
||
"agentrun.pikastech.local/lane": "v0.1",
|
||
"agentrun.pikastech.local/run-hash": shortHash(run.id),
|
||
"job-name": jobName,
|
||
};
|
||
}
|
||
|
||
function shortDnsHash(...parts: string[]): string {
|
||
return shortHash(parts.join(":"));
|
||
}
|
||
|
||
function shortHash(value: JsonValue): string {
|
||
return stableHash(value).slice(0, 12);
|
||
}
|
||
|
||
function sanitizeVolumeName(value: string): string {
|
||
const sanitized = value.toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "");
|
||
return sanitized.length > 0 ? sanitized.slice(0, 40) : "credential";
|
||
}
|