Codex
355 lines
12 KiB
YAML
355 lines
12 KiB
YAML
version: 1
|
|
kind: selfmedia-platform-delivery
|
|
metadata:
|
|
id: selfmedia-factory
|
|
owner: unidesk
|
|
repository: pikainc/selfmedia
|
|
description: 自媒体工厂在 NC01 的构建、GitOps、运行时与一次性切换真相。
|
|
defaults:
|
|
targetId: NC01
|
|
delivery:
|
|
targets:
|
|
NC01:
|
|
node: NC01
|
|
lane: selfmedia
|
|
route: NC01:k3s
|
|
ci:
|
|
namespace: selfmedia-ci
|
|
pipeline: selfmedia-nc01-pac
|
|
pipelineRunPrefix: selfmedia-nc01
|
|
serviceAccountName: selfmedia-nc01-tekton-runner
|
|
serviceAccountAutomount: false
|
|
roleBindingName: selfmedia-nc01-tekton-runner
|
|
parameterBinding: repository
|
|
workspaceSize: 16Gi
|
|
pipelineTimeout: 2h0m0s
|
|
toolImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
|
|
buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
|
|
source:
|
|
repository: pikainc/selfmedia
|
|
worktreeRemote: https://github.com/pikainc/selfmedia.git
|
|
branch: master
|
|
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
|
|
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
|
|
build:
|
|
dockerfile: deploy/Dockerfile
|
|
imageRepository: 127.0.0.1:5000/selfmedia/newsroom
|
|
networkMode: host
|
|
envReuse:
|
|
enabled: true
|
|
mode: buildkit-state-host-path
|
|
statePath: /var/lib/unidesk/selfmedia-ci/buildkit-state
|
|
identityFiles:
|
|
- bun.lock
|
|
- web/bun.lock
|
|
- config/tools.yaml
|
|
- deploy/Dockerfile
|
|
- deploy/scripts/install-open-source-tools.ts
|
|
- scripts/src/io.ts
|
|
- scripts/src/tool-runner.ts
|
|
- scripts/src/tools-config.ts
|
|
- scripts/src/tools-install.ts
|
|
- scripts/src/types.ts
|
|
semanticPackageManifests:
|
|
policyFile: config/env-identity.yaml
|
|
renderer: deploy/scripts/render-install-manifests.ts
|
|
proxy:
|
|
http: http://127.0.0.1:10808
|
|
https: http://127.0.0.1:10808
|
|
all: http://127.0.0.1:10808
|
|
noProxy:
|
|
- localhost
|
|
- 127.0.0.1
|
|
- "::1"
|
|
- 127.0.0.1:5000
|
|
- localhost:5000
|
|
- .svc
|
|
- .svc.cluster.local
|
|
- .cluster.local
|
|
- hyueapi.com
|
|
- .hyueapi.com
|
|
gitops:
|
|
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
|
|
writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
|
|
branch: nc01-selfmedia-gitops
|
|
manifestPath: deploy/gitops/nc01/resources.yaml
|
|
releaseStatePath: deploy/gitops-state/nc01/release.json
|
|
credentialSecretName: pac-gitea-selfmedia-nc01
|
|
credentialTokenKey: token
|
|
credentialUsername: unidesk-admin
|
|
author:
|
|
name: SelfMedia NC01 CI
|
|
email: selfmedia-nc01-ci@unidesk.local
|
|
deployment:
|
|
version: selfmedia.pikapython.com/v1
|
|
kind: SelfMediaDeployment
|
|
metadata:
|
|
name: selfmedia-nc01
|
|
owner: unidesk
|
|
target:
|
|
id: NC01
|
|
route: NC01:k3s
|
|
namespace: selfmedia
|
|
publicHost: 152.53.229.148
|
|
runtime:
|
|
replicas: 1
|
|
serviceAccountName: selfmedia
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- /usr/bin/tini
|
|
- --
|
|
- bun
|
|
- scripts/selfmedia-cli.ts
|
|
- server
|
|
- foreground
|
|
service:
|
|
name: selfmedia
|
|
type: ClusterIP
|
|
port: 4317
|
|
targetPort: 4317
|
|
health:
|
|
path: /healthz
|
|
startupFailureThreshold: 30
|
|
startupPeriodSeconds: 5
|
|
readinessPeriodSeconds: 10
|
|
livenessPeriodSeconds: 20
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 768Mi
|
|
limits:
|
|
cpu: "4"
|
|
memory: 6Gi
|
|
securityContext:
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
runAsNonRoot: true
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
seccompProfile: RuntimeDefault
|
|
dropCapabilities:
|
|
- ALL
|
|
writablePaths:
|
|
tmp:
|
|
mountPath: /tmp
|
|
sizeLimit: 2Gi
|
|
codexHome:
|
|
mountPath: /home/codex/.codex
|
|
sizeLimit: 2Gi
|
|
cache:
|
|
mountPath: /home/codex/.cache
|
|
sizeLimit: 2Gi
|
|
toolCache:
|
|
mountPath: /app/.tools/cache
|
|
sizeLimit: 1Gi
|
|
publicExposure:
|
|
enabled: true
|
|
mode: hostPort-http-edge
|
|
address: http://152.53.229.148:4317
|
|
hostPort: 4317
|
|
edge:
|
|
name: selfmedia-public-edge
|
|
image: caddy:2.10.2-alpine
|
|
containerPort: 8080
|
|
upstream: selfmedia.selfmedia.svc.cluster.local:4317
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
storage:
|
|
media:
|
|
claimName: selfmedia-data
|
|
storageClassName: local-path
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 40Gi
|
|
mounts:
|
|
data:
|
|
mountPath: /app/data
|
|
subPath: data
|
|
state:
|
|
mountPath: /app/.state
|
|
subPath: state
|
|
logs:
|
|
mountPath: /app/logs
|
|
subPath: logs
|
|
codexSessions:
|
|
claimName: selfmedia-codex-sessions
|
|
storageClassName: local-path
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 5Gi
|
|
mounts:
|
|
sessions:
|
|
mountPath: /home/codex/.codex/sessions
|
|
subPath: sessions
|
|
state:
|
|
mountPath: /home/codex/.codex/state
|
|
subPath: state
|
|
secrets:
|
|
access:
|
|
sourceRef: /root/.unidesk/.env/selfmedia-access.env
|
|
target:
|
|
secretName: selfmedia-access
|
|
readOnly: true
|
|
files:
|
|
- targetKey: admin-username
|
|
mountPath: /run/secrets/selfmedia-access/admin-username
|
|
- targetKey: admin-password
|
|
mountPath: /run/secrets/selfmedia-access/admin-password
|
|
- targetKey: api-key
|
|
mountPath: /run/secrets/selfmedia-access/api-key
|
|
- targetKey: session-secret
|
|
mountPath: /run/secrets/selfmedia-access/session-secret
|
|
runtime:
|
|
sourceRef: ~/.env/TOKEN
|
|
target:
|
|
secretName: selfmedia-runtime
|
|
targetKey: TOKEN
|
|
mountPath: /home/codex/.env/TOKEN
|
|
codex:
|
|
sources:
|
|
- sourceRef: ~/.codex/config.toml.pika
|
|
targetKey: config.toml
|
|
- sourceRef: ~/.codex/auth.json.pika
|
|
targetKey: auth.json
|
|
target:
|
|
secretName: selfmedia-codex
|
|
files:
|
|
- targetKey: config.toml
|
|
mountPath: /home/codex/.codex/config.toml.pika
|
|
- targetKey: auth.json
|
|
mountPath: /home/codex/.codex/auth.json.pika
|
|
networkPolicy:
|
|
enabled: true
|
|
dnsNamespace: kube-system
|
|
dnsPort: 53
|
|
blockedCidrs:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- 169.254.169.254/32
|
|
- 152.53.229.148/32
|
|
codex:
|
|
package: "@openai/codex"
|
|
version: 0.144.1
|
|
executable: codex
|
|
home: /home/codex
|
|
codexHome: /home/codex/.codex
|
|
sessionsPath: /home/codex/.codex/sessions
|
|
supervisorStatePath: /home/codex/.codex/state/selfmedia-supervisor.json
|
|
resumeArgs:
|
|
- resume
|
|
- --last
|
|
sourcePath: /app
|
|
skillsPath: /home/codex/.codex/skills
|
|
NC01_PRODUCTION:
|
|
extends: NC01
|
|
node: NC01
|
|
lane: selfmedia-production
|
|
ci:
|
|
namespace: selfmedia-ci
|
|
pipeline: selfmedia-production-nc01-pac
|
|
pipelineRunPrefix: selfmedia-production-nc01
|
|
serviceAccountName: selfmedia-production-nc01-tekton-runner
|
|
roleBindingName: selfmedia-production-nc01-tekton-runner
|
|
parameterBinding: literal
|
|
source:
|
|
branch: release
|
|
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-release-nc01
|
|
build:
|
|
imageRepository: 127.0.0.1:5000/selfmedia/newsroom-production
|
|
envReuse:
|
|
statePath: /var/lib/unidesk/selfmedia-production-ci/buildkit-state
|
|
gitops:
|
|
branch: nc01-selfmedia-production-gitops
|
|
manifestPath: deploy/gitops/nc01-production/resources.yaml
|
|
releaseStatePath: deploy/gitops-state/nc01-production/release.json
|
|
credentialSecretName: pac-gitea-selfmedia-nc01
|
|
author:
|
|
name: SelfMedia NC01 Production CI
|
|
email: selfmedia-production-nc01-ci@unidesk.local
|
|
deployment:
|
|
metadata:
|
|
name: selfmedia-production-nc01
|
|
target:
|
|
id: NC01_PRODUCTION
|
|
namespace: selfmedia-production
|
|
runtime:
|
|
serviceAccountName: selfmedia-production
|
|
service:
|
|
name: selfmedia-production
|
|
publicExposure:
|
|
address: http://152.53.229.148:4319
|
|
hostPort: 4319
|
|
edge:
|
|
name: selfmedia-production-public-edge
|
|
upstream: selfmedia-production.selfmedia-production.svc.cluster.local:4317
|
|
storage:
|
|
media:
|
|
claimName: selfmedia-production-data
|
|
codexSessions:
|
|
claimName: selfmedia-production-codex-sessions
|
|
secrets:
|
|
access:
|
|
target:
|
|
secretName: selfmedia-production-access
|
|
runtime:
|
|
target:
|
|
secretName: selfmedia-production-runtime
|
|
codex:
|
|
target:
|
|
secretName: selfmedia-production-codex
|
|
codex:
|
|
supervisorStatePath: /home/codex/.codex/state/selfmedia-production-supervisor.json
|
|
cutover:
|
|
targets:
|
|
NC01:
|
|
mode: host-process-to-kubernetes
|
|
source:
|
|
workspace: /root/selfmedia
|
|
publicAddress: http://152.53.229.148:4317
|
|
healthUrl: http://127.0.0.1:4317/healthz
|
|
stopCommand:
|
|
- bun
|
|
- scripts/selfmedia-cli.ts
|
|
- server
|
|
- stop
|
|
startCommand:
|
|
- bun
|
|
- scripts/selfmedia-cli.ts
|
|
- server
|
|
- start
|
|
dataPaths:
|
|
- data
|
|
- .state
|
|
- logs
|
|
excludes:
|
|
- .state/server.json
|
|
destination:
|
|
route: NC01:k3s
|
|
namespace: selfmedia
|
|
application: selfmedia-nc01
|
|
publicAddress: http://152.53.229.148:4317
|
|
healthUrl: http://152.53.229.148:4317/healthz
|
|
dataClaim: selfmedia-data
|
|
codexClaim: selfmedia-codex-sessions
|
|
prepare:
|
|
requiresFinalConfirmation: true
|
|
phases:
|
|
- 校验源服务健康、Secret presence/fingerprint 与目标 PVC
|
|
- 在线种子复制并记录文件数和字节数
|
|
- 停止旧服务、执行最终增量并确认宿主 4317 已释放
|
|
- 允许 Argo 首次同步并验证公网健康
|
|
rollback:
|
|
phases:
|
|
- 暂停 selfmedia-nc01 Argo 自动同步
|
|
- 缩容 selfmedia 与 selfmedia-public-edge
|
|
- 确认宿主 4317 已释放
|
|
- 启动旧服务并验证原公网地址
|
|
dataPolicy: 回滚默认不反向覆盖旧数据，需单独的数据恢复决策。
|