添加qiming-rcoder模块

qiming-rcoder/k8s/manifests/base/rcoder/kustomization.yaml

@@ -0,0 +1,15 @@
+# RCoder application layer - 应用层配置
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# 注意:
+#   - rcoder-configmap.yaml 由各环境 overlay 提供（storage_class 需随环境变化）
+#   - ClusterRoleBinding 由各环境 overlay 提供（避免集群级命名冲突）
+
+resources:
+  - serviceaccount.yaml
+  - rcoder-deployment.yaml
+  - rcoder-service.yaml
+  - rcoder-networkpolicy.yaml
+  - rcoder-pdb.yaml

qiming-rcoder/k8s/manifests/base/rcoder/rcoder-deployment.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rcoder
+  namespace: nuwax-rcoder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rcoder
+      component: rcoder-main
+  template:
+    metadata:
+      labels:
+        app: rcoder
+        component: rcoder-main
+    spec:
+      # Graceful shutdown: allow 60s for containers to clean up
+      terminationGracePeriodSeconds: 60
+      serviceAccountName: rcoder-pods-sa
+      containers:
+      - name: rcoder
+        image: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest
+        # IfNotPresent: 节点已缓存就直接用，避免每次启动都去 registry 验 token/manifest
+        # 缺点: latest tag 内容更新后需 kubectl rollout restart 才会拉新 image
+        imagePullPolicy: IfNotPresent
+        command: ["/app/bin/rcoder"]
+        args: ["--port", "8087"]
+        ports:
+        - containerPort: 8087
+        env:
+        - name: CONTAINER_RUNTIME
+          value: "kubernetes"
+        - name: RCODER_K8S_NAMESPACE
+          value: "nuwax-rcoder"
+        - name: RUST_LOG
+          value: "info"
+        # JuiceFS 存储配置 (StorageClass 名称由各环境 overlay 覆盖)
+        - name: RCODER_K8S_STORAGE_CLASS
+          value: "juicefs-sc-placeholder"
+        - name: RCODER_DOCKER_IMAGE
+          value: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest"
+        - name: RCODER_DOCKER_IMAGE_COMPUTER
+          value: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner:latest"
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "500m"
+          limits:
+            memory: "2Gi"
+            cpu: "2000m"
+        # Health probes for K8s liveness/readiness detection
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8087
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8087
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 2
+        volumeMounts:
+        - name: rcoder-config
+          mountPath: /app/config.yml
+          subPath: config.yml
+        - name: project-workspace
+          mountPath: /app/project_workspace
+          subPath: project_workspace
+        - name: project-workspace
+          mountPath: /app/computer-project-workspace
+          subPath: computer_workspace
+      volumes:
+      - name: rcoder-config
+        configMap:
+          name: rcoder-config
+      - name: project-workspace
+        persistentVolumeClaim:
+          claimName: rcoder-workspace

qiming-rcoder/k8s/manifests/base/rcoder/rcoder-networkpolicy.yaml

@@ -0,0 +1,70 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rcoder-network-policy
+  namespace: nuwax-rcoder
+spec:
+  podSelector:
+    matchLabels:
+      app: rcoder
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # 允许来自同 namespace 的流量
+  - from:
+    - podSelector: {}
+    ports:
+    - protocol: TCP
+      port: 8087
+    - protocol: TCP
+      port: 8088
+  egress:
+  # DNS 解析
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+  # K8s API Server
+  - to:
+    - namespaceSelector: {}
+      podSelector:
+        matchLabels:
+          kubernetes.io/service-name: kubernetes
+    ports:
+    - protocol: TCP
+      port: 443
+  # PostgreSQL 访问
+  - to:
+    - podSelector:
+        matchLabels:
+          app: postgresql
+    ports:
+    - protocol: TCP
+      port: 5432
+  # MinIO 访问
+  - to:
+    - podSelector:
+        matchLabels:
+          app: minio
+    ports:
+    - protocol: TCP
+      port: 9000
+    - protocol: TCP
+      port: 9001
+  # Agent Pod gRPC 访问 (rcoder -> agent 通信)
+  # 用 managed-by: rcoder-runtime 标签同时匹配两类动态创建的 pod：
+  #   - service_type=rcoder (legacy /chat 创建的 rcoder-agent pod)
+  #   - service_type=computer-agent-runner (/computer/chat 创建的 computer-agent-runner pod)
+  - to:
+    - podSelector:
+        matchLabels:
+          managed-by: rcoder-runtime
+    ports:
+    - protocol: TCP
+      port: 50051
+    - protocol: TCP
+      port: 8086

qiming-rcoder/k8s/manifests/base/rcoder/rcoder-pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: rcoder-pdb
+  namespace: nuwax-rcoder
+spec:
+  maxUnavailable: 0
+  selector:
+    matchLabels:
+      app: rcoder

qiming-rcoder/k8s/manifests/base/rcoder/rcoder-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rcoder
+  namespace: nuwax-rcoder
+spec:
+  type: NodePort
+  # 用 component=rcoder-main 把动态创建的 rcoder-agent / computer-agent-runner pod
+  # （它们也带 app=rcoder 标签）排除在外，避免 NodePort 把流量路由到不监听 8087 的 agent pod
+  selector:
+    app: rcoder
+    component: rcoder-main
+  ports:
+  # nodePort 由各环境 overlay 指定（避免同集群下 dev/prod 冲突）
+  - port: 8087
+    targetPort: 8087

qiming-rcoder/k8s/manifests/base/rcoder/serviceaccount.yaml

@@ -0,0 +1,35 @@
+# ServiceAccount + ClusterRole for RCoder to manage Pods
+# 注意: ClusterRoleBinding 由各环境 overlay 提供（避免集群级命名冲突）
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rcoder-pods-sa
+  namespace: nuwax-rcoder
+---
+# ClusterRole for Pod management（集群共享，dev/prod 可复用同一个 ClusterRole）
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rcoder-pods-clusterrole
+rules:
+# Pod 管理
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
+# Pod 日志
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list"]
+# Pod 执行命令（用于调试）
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["create"]
+# Pod 状态
+- apiGroups: [""]
+  resources: ["pods/status"]
+  verbs: ["get"]
+# PVC 管理（动态创建/删除工作空间存储）
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "create", "delete"]