mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 接入 selfmedia 受控交付

Browse Source
This commit is contained in:
Codex
2026-07-13 07:56:37 +02:00
parent 48aa08bf73
commit 80ca187cb3
17 changed files with 1845 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/platform-infra/gitea.yaml
+20
View File
@@ -332,6 +332,26 @@ sourceAuthority:
readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
configRef: config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01.git.readUrl
disposition: replaced-by-gitea
- key: selfmedia-nc01
targetId: NC01
upstream:
repository: pikainc/selfmedia
cloneUrl: https://github.com/pikainc/selfmedia.git
branch: master
visibility: private
gitea:
owner: mirrors
name: pikainc-selfmedia
mirrorMode: controlled-push
publicRead: false
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
gitops:
branch: nc01-selfmedia-gitops
flushDisposition: gitea-writeback
snapshot:
naming: gitea-actions-immutable-source
prefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
legacyGitMirror: null
targets:
- id: JD01
config/platform-infra/pipelines-as-code.yaml
+76
View File
@@ -130,6 +130,41 @@ repositories:
variables:
NODE: NC01
LANE: v03
- id: selfmedia-nc01
name: selfmedia-nc01
namespace: selfmedia-ci
providerType: gitea
url: https://gitea.pikapython.com/mirrors/pikainc-selfmedia
cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
owner: mirrors
repo: pikainc-selfmedia
secretName: pac-gitea-selfmedia-nc01
tokenKey: token
webhookSecretKey: webhook.secret
concurrencyLimit: 1
params:
git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
source_branch: master
source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
node: NC01
pipeline_name: selfmedia-nc01-pac
pipeline_run_prefix: selfmedia-nc01
service_account: selfmedia-nc01-tekton-runner
pipeline_timeout: 2h0m0s
image_repository: 127.0.0.1:5000/selfmedia/newsroom
registry_probe_base: http://127.0.0.1:5000
gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
gitops_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
gitops_branch: nc01-selfmedia-gitops
gitops_username: unidesk-admin
gitops_secret_name: pac-gitea-selfmedia-nc01
gitops_manifest_path: deploy/gitops/nc01/resources.yaml
runtime_namespace: selfmedia
runtime_deployment: selfmedia
runtime_service: selfmedia
runtime_service_port: "4317"
health_path: /healthz
health_url: http://selfmedia.selfmedia.svc.cluster.local:4317/healthz
consumers:
- extends: templates.consumers.agentrunV02
variables:
@@ -211,6 +246,47 @@ consumers:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
fsGroup: 1000
- id: selfmedia-nc01
repositoryRef: selfmedia-nc01
node: NC01
lane: selfmedia
namespace: selfmedia-ci
pipeline: selfmedia-nc01-pac
pipelineRunPrefix: selfmedia-nc01
argoNamespace: argocd
argoApplication: selfmedia-nc01
closeoutGitOpsMirrorFlush: false
argoBootstrap:
project: default
repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
targetRevision: nc01-selfmedia-gitops
path: deploy/gitops/nc01
destinationNamespace: selfmedia
automated: true
repositoryCredential:
secretName: argocd-repo-selfmedia-nc01
username: unidesk-admin
deliveryProvenance:
required: true
markerValue: admission-pac-v2:selfmedia-nc01
executionServiceAccountName: selfmedia-nc01-tekton-runner
gitOps:
repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
targetRevision: nc01-selfmedia-gitops
runnerServiceAccount:
name: selfmedia-nc01-tekton-runner
automountServiceAccountToken: false
roleBindingName: selfmedia-nc01-tekton-runner
sourceArtifact:
mode: embedded-pipeline-spec
renderer: selfmedia-runtime
configRef: config/selfmedia.yaml#delivery.targets.NC01
pipelineRunPath: .tekton/selfmedia-nc01-pac.yaml
maxKeepRuns: 8
taskRunTemplate:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
fsGroup: 1000
templates:
repositories:
agentrunV02:
config/secrets-distribution.yaml
+43
View File
@@ -119,6 +119,25 @@ sources:
- DATABASE_URL
createIfMissing:
enabled: false
externalFiles:
- sourceRef: ~/.env/TOKEN
type: raw-file
required: true
createIfMissing:
enabled: true
randomBase64Url:
bytes: 32
prefix: smt_
- sourceRef: ~/.codex/config.toml.pika
type: raw-file
required: true
createIfMissing:
enabled: false
- sourceRef: ~/.codex/auth.json.pika
type: raw-file
required: true
createIfMissing:
enabled: false
targets:
- id: platform-infra-g14
@@ -141,8 +160,32 @@ targets:
namespace: hwlab-v03
scope: hwlab
enabled: true
- id: selfmedia-nc01
route: NC01:k3s
namespace: selfmedia
scope: selfmedia
enabled: true
kubernetesSecrets:
- name: selfmedia-runtime
targetId: selfmedia-nc01
secretName: selfmedia-runtime
type: Opaque
data:
- sourceRef: ~/.env/TOKEN
sourceKey: contents
targetKey: TOKEN
- name: selfmedia-codex
targetId: selfmedia-nc01
secretName: selfmedia-codex
type: Opaque
data:
- sourceRef: ~/.codex/config.toml.pika
sourceKey: contents
targetKey: config.toml
- sourceRef: ~/.codex/auth.json.pika
sourceKey: contents
targetKey: auth.json
- name: sub2rank-runtime
targetId: sub2rank-nc01
secretName: sub2rank-secrets
config/selfmedia.yaml
+262
View File
@@ -0,0 +1,262 @@
version: 1
kind: selfmedia-platform-delivery
metadata:
id: selfmedia-factory
owner: unidesk
repository: pikainc/selfmedia
description: 自媒体工厂在 NC01 的构建、GitOps、运行时与一次性切换真相。
defaults:
targetId: NC01
delivery:
targets:
NC01:
node: NC01
lane: selfmedia
route: NC01:k3s
ci:
namespace: selfmedia-ci
pipeline: selfmedia-nc01-pac
pipelineRunPrefix: selfmedia-nc01
serviceAccountName: selfmedia-nc01-tekton-runner
serviceAccountAutomount: false
roleBindingName: selfmedia-nc01-tekton-runner
workspaceSize: 16Gi
pipelineTimeout: 2h0m0s
toolImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
source:
repository: pikainc/selfmedia
worktreeRemote: https://github.com/pikainc/selfmedia.git
branch: master
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
build:
dockerfile: deploy/Dockerfile
imageRepository: 127.0.0.1:5000/selfmedia/newsroom
networkMode: host
proxy:
http: http://127.0.0.1:10808
https: http://127.0.0.1:10808
all: http://127.0.0.1:10808
noProxy:
- localhost
- 127.0.0.1
- "::1"
- 127.0.0.1:5000
- localhost:5000
- .svc
- .svc.cluster.local
- .cluster.local
- hyueapi.com
- .hyueapi.com
gitops:
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
branch: nc01-selfmedia-gitops
manifestPath: deploy/gitops/nc01/resources.yaml
releaseStatePath: deploy/gitops-state/nc01/release.json
credentialSecretName: pac-gitea-selfmedia-nc01
credentialTokenKey: token
credentialUsername: unidesk-admin
author:
name: SelfMedia NC01 CI
email: selfmedia-nc01-ci@unidesk.local
deployment:
version: selfmedia.pikapython.com/v1
kind: SelfMediaDeployment
metadata:
name: selfmedia-nc01
owner: unidesk
target:
id: NC01
route: NC01:k3s
namespace: selfmedia
publicHost: 152.53.229.148
runtime:
replicas: 1
serviceAccountName: selfmedia
imagePullPolicy: IfNotPresent
command:
- /usr/bin/tini
- --
- bun
- scripts/selfmedia-cli.ts
- server
- foreground
service:
name: selfmedia
type: ClusterIP
port: 4317
targetPort: 4317
health:
path: /healthz
startupFailureThreshold: 30
startupPeriodSeconds: 5
readinessPeriodSeconds: 10
livenessPeriodSeconds: 20
resources:
requests:
cpu: 250m
memory: 768Mi
limits:
cpu: "4"
memory: 6Gi
securityContext:
runAsUser: 10001
runAsGroup: 10001
fsGroup: 10001
runAsNonRoot: true
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
seccompProfile: RuntimeDefault
dropCapabilities:
- ALL
writablePaths:
tmp:
mountPath: /tmp
sizeLimit: 2Gi
codexHome:
mountPath: /home/codex/.codex
sizeLimit: 2Gi
cache:
mountPath: /home/codex/.cache
sizeLimit: 2Gi
toolCache:
mountPath: /app/.tools/cache
sizeLimit: 1Gi
publicExposure:
enabled: true
mode: hostPort-http-edge
address: http://152.53.229.148:4317
hostPort: 4317
edge:
name: selfmedia-public-edge
image: caddy:2.10.2-alpine
containerPort: 8080
upstream: selfmedia.selfmedia.svc.cluster.local:4317
resources:
requests:
cpu: 20m
memory: 32Mi
limits:
cpu: 200m
memory: 128Mi
storage:
media:
claimName: selfmedia-data
storageClassName: local-path
accessModes:
- ReadWriteOnce
size: 40Gi
mounts:
data:
mountPath: /app/data
subPath: data
state:
mountPath: /app/.state
subPath: state
logs:
mountPath: /app/logs
subPath: logs
codexSessions:
claimName: selfmedia-codex-sessions
storageClassName: local-path
accessModes:
- ReadWriteOnce
size: 5Gi
mounts:
sessions:
mountPath: /home/codex/.codex/sessions
subPath: sessions
state:
mountPath: /home/codex/.codex/state
subPath: state
secrets:
runtime:
sourceRef: ~/.env/TOKEN
target:
secretName: selfmedia-runtime
targetKey: TOKEN
mountPath: /home/codex/.env/TOKEN
codex:
sources:
- sourceRef: ~/.codex/config.toml.pika
targetKey: config.toml
- sourceRef: ~/.codex/auth.json.pika
targetKey: auth.json
target:
secretName: selfmedia-codex
files:
- targetKey: config.toml
mountPath: /home/codex/.codex/config.toml.pika
- targetKey: auth.json
mountPath: /home/codex/.codex/auth.json.pika
networkPolicy:
enabled: true
dnsNamespace: kube-system
dnsPort: 53
blockedCidrs:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.169.254/32
- 152.53.229.148/32
codex:
package: "@openai/codex"
version: 0.144.1
executable: codex
home: /home/codex
codexHome: /home/codex/.codex
sessionsPath: /home/codex/.codex/sessions
supervisorStatePath: /home/codex/.codex/state/selfmedia-supervisor.json
resumeArgs:
- resume
- --last
sourcePath: /app
skillsPath: /home/codex/.codex/skills
cutover:
targets:
NC01:
mode: host-process-to-kubernetes
source:
workspace: /root/selfmedia
publicAddress: http://152.53.229.148:4317
healthUrl: http://127.0.0.1:4317/healthz
stopCommand:
- bun
- scripts/selfmedia-cli.ts
- server
- stop
startCommand:
- bun
- scripts/selfmedia-cli.ts
- server
- start
dataPaths:
- data
- .state
- logs
excludes:
- .state/server.json
destination:
route: NC01:k3s
namespace: selfmedia
application: selfmedia-nc01
publicAddress: http://152.53.229.148:4317
healthUrl: http://152.53.229.148:4317/healthz
dataClaim: selfmedia-data
codexClaim: selfmedia-codex-sessions
prepare:
requiresFinalConfirmation: true
phases:
- 校验源服务健康、Secret presence/fingerprint 与目标 PVC
- 在线种子复制并记录文件数和字节数
- 停止旧服务、执行最终增量并确认宿主 4317 已释放
- 允许 Argo 首次同步并验证公网健康
rollback:
phases:
- 暂停 selfmedia-nc01 Argo 自动同步
- 缩容 selfmedia 与 selfmedia-public-edge
- 确认宿主 4317 已释放
- 启动旧服务并验证原公网地址
dataPolicy: 回滚默认不反向覆盖旧数据，需单独的数据恢复决策。