mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
52c5e2f723dbdb893f63243a17c1aa93d8228cf5
pikasTech-unidesk/config/selfmedia.yaml
T

277 lines
8.9 KiB
YAML
Raw Blame History

version: 1
kind: selfmedia-platform-delivery
metadata:
id: selfmedia-factory
owner: unidesk
repository: pikainc/selfmedia
description: 自媒体工厂在 NC01 的构建、GitOps、运行时与一次性切换真相。
defaults:
targetId: NC01
delivery:
targets:
NC01:
node: NC01
lane: selfmedia
route: NC01:k3s
ci:
namespace: selfmedia-ci
pipeline: selfmedia-nc01-pac
pipelineRunPrefix: selfmedia-nc01
serviceAccountName: selfmedia-nc01-tekton-runner
serviceAccountAutomount: false
roleBindingName: selfmedia-nc01-tekton-runner
workspaceSize: 16Gi
pipelineTimeout: 2h0m0s
toolImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
source:
repository: pikainc/selfmedia
worktreeRemote: https://github.com/pikainc/selfmedia.git
branch: master
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
build:
dockerfile: deploy/Dockerfile
imageRepository: 127.0.0.1:5000/selfmedia/newsroom
networkMode: host
proxy:
http: http://127.0.0.1:10808
https: http://127.0.0.1:10808
all: http://127.0.0.1:10808
noProxy:
- localhost
- 127.0.0.1
- "::1"
- 127.0.0.1:5000
- localhost:5000
- .svc
- .svc.cluster.local
- .cluster.local
- hyueapi.com
- .hyueapi.com
gitops:
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
branch: nc01-selfmedia-gitops
manifestPath: deploy/gitops/nc01/resources.yaml
releaseStatePath: deploy/gitops-state/nc01/release.json
credentialSecretName: pac-gitea-selfmedia-nc01
credentialTokenKey: token
credentialUsername: unidesk-admin
author:
name: SelfMedia NC01 CI
email: selfmedia-nc01-ci@unidesk.local
deployment:
version: selfmedia.pikapython.com/v1
kind: SelfMediaDeployment
metadata:
name: selfmedia-nc01
owner: unidesk
target:
id: NC01
route: NC01:k3s
namespace: selfmedia
publicHost: 152.53.229.148
runtime:
replicas: 1
serviceAccountName: selfmedia
imagePullPolicy: IfNotPresent
command:
- /usr/bin/tini
- --
- bun
- scripts/selfmedia-cli.ts
- server
- foreground
service:
name: selfmedia
type: ClusterIP
port: 4317
targetPort: 4317
health:
path: /healthz
startupFailureThreshold: 30
startupPeriodSeconds: 5
readinessPeriodSeconds: 10
livenessPeriodSeconds: 20
resources:
requests:
cpu: 250m
memory: 768Mi
limits:
cpu: "4"
memory: 6Gi
securityContext:
runAsUser: 10001
runAsGroup: 10001
fsGroup: 10001
runAsNonRoot: true
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
seccompProfile: RuntimeDefault
dropCapabilities:
- ALL
writablePaths:
tmp:
mountPath: /tmp
sizeLimit: 2Gi
codexHome:
mountPath: /home/codex/.codex
sizeLimit: 2Gi
cache:
mountPath: /home/codex/.cache
sizeLimit: 2Gi
toolCache:
mountPath: /app/.tools/cache
sizeLimit: 1Gi
publicExposure:
enabled: true
mode: hostPort-http-edge
address: http://152.53.229.148:4317
hostPort: 4317
edge:
name: selfmedia-public-edge
image: caddy:2.10.2-alpine
containerPort: 8080
upstream: selfmedia.selfmedia.svc.cluster.local:4317
resources:
requests:
cpu: 20m
memory: 32Mi
limits:
cpu: 200m
memory: 128Mi
storage:
media:
claimName: selfmedia-data
storageClassName: local-path
accessModes:
- ReadWriteOnce
size: 40Gi
mounts:
data:
mountPath: /app/data
subPath: data
state:
mountPath: /app/.state
subPath: state
logs:
mountPath: /app/logs
subPath: logs
codexSessions:
claimName: selfmedia-codex-sessions
storageClassName: local-path
accessModes:
- ReadWriteOnce
size: 5Gi
mounts:
sessions:
mountPath: /home/codex/.codex/sessions
subPath: sessions
state:
mountPath: /home/codex/.codex/state
subPath: state
secrets:
access:
sourceRef: /root/.unidesk/.env/selfmedia-access.env
target:
secretName: selfmedia-access
readOnly: true
files:
- targetKey: admin-username
mountPath: /run/secrets/selfmedia-access/admin-username
- targetKey: admin-password
mountPath: /run/secrets/selfmedia-access/admin-password
- targetKey: api-key
mountPath: /run/secrets/selfmedia-access/api-key
- targetKey: session-secret
mountPath: /run/secrets/selfmedia-access/session-secret
runtime:
sourceRef: ~/.env/TOKEN
target:
secretName: selfmedia-runtime
targetKey: TOKEN
mountPath: /home/codex/.env/TOKEN
codex:
sources:
- sourceRef: ~/.codex/config.toml.pika
targetKey: config.toml
- sourceRef: ~/.codex/auth.json.pika
targetKey: auth.json
target:
secretName: selfmedia-codex
files:
- targetKey: config.toml
mountPath: /home/codex/.codex/config.toml.pika
- targetKey: auth.json
mountPath: /home/codex/.codex/auth.json.pika
networkPolicy:
enabled: true
dnsNamespace: kube-system
dnsPort: 53
blockedCidrs:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.169.254/32
- 152.53.229.148/32
codex:
package: "@openai/codex"
version: 0.144.1
executable: codex
home: /home/codex
codexHome: /home/codex/.codex
sessionsPath: /home/codex/.codex/sessions
supervisorStatePath: /home/codex/.codex/state/selfmedia-supervisor.json
resumeArgs:
- resume
- --last
sourcePath: /app
skillsPath: /home/codex/.codex/skills
cutover:
targets:
NC01:
mode: host-process-to-kubernetes
source:
workspace: /root/selfmedia
publicAddress: http://152.53.229.148:4317
healthUrl: http://127.0.0.1:4317/healthz
stopCommand:
- bun
- scripts/selfmedia-cli.ts
- server
- stop
startCommand:
- bun
- scripts/selfmedia-cli.ts
- server
- start
dataPaths:
- data
- .state
- logs
excludes:
- .state/server.json
destination:
route: NC01:k3s
namespace: selfmedia
application: selfmedia-nc01
publicAddress: http://152.53.229.148:4317
healthUrl: http://152.53.229.148:4317/healthz
dataClaim: selfmedia-data
codexClaim: selfmedia-codex-sessions
prepare:
requiresFinalConfirmation: true
phases:
- 校验源服务健康、Secret presence/fingerprint 与目标 PVC
- 在线种子复制并记录文件数和字节数
- 停止旧服务、执行最终增量并确认宿主 4317 已释放
- 允许 Argo 首次同步并验证公网健康
rollback:
phases:
- 暂停 selfmedia-nc01 Argo 自动同步
- 缩容 selfmedia 与 selfmedia-public-edge
- 确认宿主 4317 已释放
- 启动旧服务并验证原公网地址
dataPolicy: 回滚默认不反向覆盖旧数据，需单独的数据恢复决策。
Reference in New Issue View Git Blame Copy Permalink