添加qiming-rcoder模块

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/clusterrole.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.rcoder.clusterRole.create }}
+# 集群级 ClusterRole —— 多 release 共享同一个 (规则与 namespace 无关, 重复 apply 幂等)
+# 与 Kustomize 并存时, 把 .Values.rcoder.clusterRole.create 置 false, 让 Kustomize 持有所有权
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "rcoder.clusterRoleName" . }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}
+  annotations:
+    # 避免多 release 互相 helm uninstall 时删除共享 ClusterRole
+    "helm.sh/resource-policy": keep
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["pods/status"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+{{- end }}

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/clusterrolebinding.yaml

@@ -0,0 +1,15 @@
+# 集群级 ClusterRoleBinding —— 每个 release 独立, 解决同集群多 release 冲突
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "rcoder.clusterRoleBindingName" . }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: rcoder-pods-sa
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "rcoder.clusterRoleName" . }}
+  apiGroup: rbac.authorization.k8s.io

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/configmap.yaml

@@ -0,0 +1,70 @@
+# ConfigMap: 渲染 config.yml —— 保持与 k8s/manifests/overlays 下 rcoder-configmap.yaml 结构对齐
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rcoder-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}
+data:
+  config.yml: |
+    default_agent: {{ .Values.config.defaultAgent | quote }}
+
+    projects_dir: {{ .Values.config.projectsDir | quote }}
+    port: {{ .Values.config.port }}
+
+    cleanup_config:
+      enabled: {{ .Values.config.cleanup.enabled }}
+      idle_timeout_seconds: {{ .Values.config.cleanup.idleTimeoutSeconds }}
+      cleanup_interval_seconds: {{ .Values.config.cleanup.cleanupIntervalSeconds }}
+      docker_stop_timeout_seconds: {{ .Values.config.cleanup.dockerStopTimeoutSeconds }}
+
+    proxy_config:
+      listen_port: {{ .Values.config.proxy.listenPort }}
+      default_backend_port: {{ .Values.config.proxy.defaultBackendPort }}
+      backend_host: {{ .Values.config.proxy.backendHost | quote }}
+      port_param: {{ .Values.config.proxy.portParam | quote }}
+      health_check:
+        enabled: {{ .Values.config.proxy.healthCheck.enabled }}
+        interval_seconds: {{ .Values.config.proxy.healthCheck.intervalSeconds }}
+        timeout_seconds: {{ .Values.config.proxy.healthCheck.timeoutSeconds }}
+        healthy_threshold: {{ .Values.config.proxy.healthCheck.healthyThreshold }}
+        unhealthy_threshold: {{ .Values.config.proxy.healthCheck.unhealthyThreshold }}
+
+    docker_config:
+      multi_image_config:
+        global_defaults:
+          registry_prefix: {{ include "rcoder.registryPrefix" . | quote }}
+        services:
+          rcoder:
+            service_type: "RCoder"
+            arm64_image: {{ include "rcoder.image" . | quote }}
+            amd64_image: {{ include "rcoder.image" . | quote }}
+            default_image: {{ include "rcoder.image" . | quote }}
+            image_tag_prefix: "rcoder"
+            enabled: true
+          computer-agent-runner:
+            service_type: "ComputerAgentRunner"
+            arm64_image: {{ include "rcoder.agentRunnerImage" . | quote }}
+            amd64_image: {{ include "rcoder.agentRunnerImage" . | quote }}
+            default_image: {{ include "rcoder.agentRunnerImage" . | quote }}
+            image_tag_prefix: "rcoder-computer-agent-runner"
+            enabled: true
+        selection_strategy: "ServiceOnly"
+        cache_config:
+          enabled: {{ .Values.config.dockerConfig.cache.enabled }}
+          ttl_seconds: {{ .Values.config.dockerConfig.cache.ttlSeconds }}
+          max_entries: {{ .Values.config.dockerConfig.cache.maxEntries }}
+
+      network_base_name: {{ .Values.config.dockerConfig.networkBaseName | quote }}
+      network_mode: {{ .Values.config.dockerConfig.networkMode | quote }}
+      work_dir: {{ .Values.config.dockerConfig.workDir | quote }}
+      auto_cleanup: {{ .Values.config.dockerConfig.autoCleanup }}
+      container_ttl_seconds: {{ .Values.config.dockerConfig.containerTtlSeconds }}
+
+    api_key_auth:
+      enabled: {{ .Values.config.apiKeyAuth.enabled }}
+      api_key: {{ .Values.config.apiKeyAuth.apiKey | quote }}
+
+    kubernetes_config:
+      storage_class: {{ include "rcoder.storageClassName" . | quote }}

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/deployment.yaml

@@ -0,0 +1,65 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rcoder
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.rcoder.replicas }}
+  selector:
+    matchLabels:
+      {{- include "rcoder.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "rcoder.labels" . | nindent 8 }}
+        {{- include "rcoder.selectorLabels" . | nindent 8 }}
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.rcoder.terminationGracePeriodSeconds }}
+      serviceAccountName: rcoder-pods-sa
+      {{- include "rcoder.imagePullSecrets" . | nindent 6 }}
+      containers:
+        - name: rcoder
+          image: {{ include "rcoder.image" . }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          command: ["/app/bin/rcoder"]
+          args: ["--port", "{{ .Values.rcoder.service.port }}"]
+          ports:
+            - containerPort: {{ .Values.rcoder.service.port }}
+          env:
+            - name: CONTAINER_RUNTIME
+              value: "kubernetes"
+            - name: RCODER_K8S_NAMESPACE
+              value: {{ .Release.Namespace | quote }}
+            - name: RUST_LOG
+              value: {{ .Values.rcoder.rustLog | quote }}
+            - name: RCODER_K8S_STORAGE_CLASS
+              value: {{ include "rcoder.storageClassName" . | quote }}
+            - name: RCODER_DOCKER_IMAGE
+              value: {{ include "rcoder.image" . | quote }}
+            - name: RCODER_DOCKER_IMAGE_COMPUTER
+              value: {{ include "rcoder.agentRunnerImage" . | quote }}
+          resources:
+            {{- toYaml .Values.rcoder.resources | nindent 12 }}
+          livenessProbe:
+            {{- toYaml .Values.rcoder.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.rcoder.readinessProbe | nindent 12 }}
+          volumeMounts:
+            - name: rcoder-config
+              mountPath: /app/config.yml
+              subPath: config.yml
+            - name: project-workspace
+              mountPath: /app/project_workspace
+              subPath: project_workspace
+            - name: project-workspace
+              mountPath: /app/computer-project-workspace
+              subPath: computer_workspace
+      volumes:
+        - name: rcoder-config
+          configMap:
+            name: rcoder-config
+        - name: project-workspace
+          persistentVolumeClaim:
+            claimName: rcoder-workspace

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/networkpolicy.yaml

@@ -0,0 +1,62 @@
+{{- if .Values.rcoder.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rcoder-network-policy
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app: rcoder
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # 同 namespace 入站流量
+    - from:
+        - podSelector: {}
+      ports:
+        - { protocol: TCP, port: {{ .Values.rcoder.service.port }} }
+        - { protocol: TCP, port: {{ .Values.config.proxy.listenPort }} }
+  egress:
+    # DNS
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - { protocol: UDP, port: 53 }
+    # K8s API Server
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              kubernetes.io/service-name: kubernetes
+      ports:
+        - { protocol: TCP, port: 443 }
+    # PostgreSQL
+    - to:
+        - podSelector:
+            matchLabels:
+              app: postgresql
+      ports:
+        - { protocol: TCP, port: {{ .Values.postgresql.service.port }} }
+    # MinIO
+    - to:
+        - podSelector:
+            matchLabels:
+              app: minio
+      ports:
+        - { protocol: TCP, port: {{ .Values.minio.service.apiPort }} }
+        - { protocol: TCP, port: {{ .Values.minio.service.consolePort }} }
+    # 动态 agent pod (rcoder -> agent gRPC/HTTP)
+    - to:
+        - podSelector:
+            matchLabels:
+              managed-by: rcoder-runtime
+      ports:
+        - { protocol: TCP, port: 50051 }
+        - { protocol: TCP, port: 8086 }
+{{- end }}

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/pdb.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.rcoder.pdb.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: rcoder-pdb
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}
+spec:
+  maxUnavailable: {{ .Values.rcoder.pdb.maxUnavailable }}
+  selector:
+    matchLabels:
+      app: rcoder
+{{- end }}

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rcoder
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.rcoder.service.type }}
+  # component=rcoder-main 把动态创建的 rcoder-agent / computer-agent-runner pod
+  # (它们也带 app=rcoder 标签) 排除在外, 避免 NodePort 把流量路由到不监听 8087 的 agent pod
+  selector:
+    {{- include "rcoder.selectorLabels" . | nindent 4 }}
+  ports:
+    - port: {{ .Values.rcoder.service.port }}
+      targetPort: {{ .Values.rcoder.service.port }}
+      {{- if eq .Values.rcoder.service.type "NodePort" }}
+      nodePort: {{ .Values.rcoder.service.nodePort }}
+      {{- end }}

qiming-rcoder/k8s/helm/rcoder/templates/rcoder/serviceaccount.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rcoder-pods-sa
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rcoder.labels" . | nindent 4 }}