添加qiming-rcoder模块

2026-06-01 13:54:52 +08:00
parent 8092c4b1f8
commit 4b1a580132
539 changed files with 151650 additions and 0 deletions
--- a/qiming-rcoder/k8s/manifests/overlays/dev/clusterrolebinding.yaml
+++ b/qiming-rcoder/k8s/manifests/overlays/dev/clusterrolebinding.yaml
@@ -0,0 +1,17 @@
+# ============================================================
+# ClusterRoleBinding - Dev 环境专用
+# 把 base 里共享的 ClusterRole 绑定到 dev namespace 的 ServiceAccount
+# 集群级资源独立命名，避免与 prod 冲突
+# ============================================================
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: rcoder-pods-crb-dev
+subjects:
+- kind: ServiceAccount
+  name: rcoder-pods-sa
+  namespace: nuwax-rcoder-dev
+roleRef:
+  kind: ClusterRole
+  name: rcoder-pods-clusterrole
+  apiGroup: rbac.authorization.k8s.io
--- a/qiming-rcoder/k8s/manifests/overlays/dev/credentials.yaml
+++ b/qiming-rcoder/k8s/manifests/overlays/dev/credentials.yaml
@@ -0,0 +1,16 @@
+# ============================================================
+# 存储层凭据 Secret - Dev 环境
+# 维护 PostgreSQL / MinIO 账号密码
+# 注意：同步维护 juicefs-secret.yaml 里的 metaurl / MINIO_ACCESS_KEY 等字段
+# ============================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rcoder-credentials
+  namespace: nuwax-rcoder-dev
+type: Opaque
+stringData:
+  POSTGRES_USER: "juicefs"
+  POSTGRES_PASSWORD: "juicefs_password"
+  MINIO_ROOT_USER: "minioadmin"
+  MINIO_ROOT_PASSWORD: "minioadmin"
--- a/qiming-rcoder/k8s/manifests/overlays/dev/juicefs-secret.yaml
+++ b/qiming-rcoder/k8s/manifests/overlays/dev/juicefs-secret.yaml
@@ -0,0 +1,28 @@
+# ============================================================
+# JuiceFS Secret - Dev 环境专用
+# 覆盖 base 中的 juicefs-secret
+# ============================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: juicefs-secret
+  namespace: nuwax-rcoder-dev
+type: Opaque
+stringData:
+  # JuiceFS CE 必需字段（小写键名）
+  name: "rcoder-juicefs"
+  metaurl: "postgres://juicefs:juicefs_password@postgresql.nuwax-rcoder-dev:5432/juicefs"
+  storage: "minio"
+  bucket: "http://minio-service.nuwax-rcoder-dev:9000/juicefs"
+  access-key: "minioadmin"
+  secret-key: "minioadmin"
+
+  # 兼容字段（保留给现有脚本/日志使用）
+  METAURL: "postgres://juicefs:juicefs_password@postgresql.nuwax-rcoder-dev:5432/juicefs"
+  MINIO_ACCESS_KEY: "minioadmin"
+  MINIO_SECRET_KEY: "minioadmin"
+  MINIO_ADDRESS: "minio-service.nuwax-rcoder-dev:9000"
+
+  # 其他配置
+  APPEND_FSYNC: "1"
+  CACHE_SIZE: "1024"
--- a/qiming-rcoder/k8s/manifests/overlays/dev/juicefs-storageclass.yaml
+++ b/qiming-rcoder/k8s/manifests/overlays/dev/juicefs-storageclass.yaml
@@ -0,0 +1,24 @@
+# ============================================================
+# JuiceFS StorageClass - Dev 环境专用
+# 集群级资源独立命名，避免与 prod 冲突
+# ============================================================
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: juicefs-sc-dev
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+provisioner: csi.juicefs.com
+parameters:
+  csi.storage.k8s.io/provisioner-secret-name: juicefs-secret
+  csi.storage.k8s.io/provisioner-secret-namespace: nuwax-rcoder-dev
+  csi.storage.k8s.io/controller-expand-secret-name: juicefs-secret
+  csi.storage.k8s.io/controller-expand-secret-namespace: nuwax-rcoder-dev
+  csi.storage.k8s.io/node-publish-secret-name: juicefs-secret
+  csi.storage.k8s.io/node-publish-secret-namespace: nuwax-rcoder-dev
+  juicefs/controllerQuotaSet: "false"
+  juicefs/mountImage: "juicedata/mount:ce-v1.3.1"
+  juicefs/mountOptions: "cache-size=1024,allow-other"
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+volumeBindingMode: Immediate
--- a/qiming-rcoder/k8s/manifests/overlays/dev/kustomization.yaml
+++ b/qiming-rcoder/k8s/manifests/overlays/dev/kustomization.yaml
@@ -0,0 +1,90 @@
+# Dev environment overlay
+# 使用方式: kubectl apply -k manifests/overlays/dev
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: nuwax-rcoder-dev
+
+resources:
+  - ../../base
+  # dev 独立的集群级资源（避免与 prod 冲突）
+  - juicefs-storageclass.yaml
+  - clusterrolebinding.yaml
+  # dev 独立的 namespace 内资源
+  - rcoder-configmap.yaml
+  - credentials.yaml
+  - juicefs-secret.yaml
+
+# 开发环境标签
+# - includeSelectors 必须保持 false：否则 environment label 会被注入到
+#   NetworkPolicy 的 egress podSelector，误伤 K8s API Server 和动态创建的 Agent Runner Pod。
+# - includeTemplates: true 让 Pod 模板也带上 environment label，方便 kubectl 按环境筛选。
+labels:
+  - pairs:
+      environment: dev
+    includeSelectors: false
+    includeTemplates: true
+
+# 开发环境副本数
+replicas:
+  - name: rcoder
+    count: 1
+
+# 开发环境镜像 tag
+images:
+  - name: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder
+    newName: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/nuwax-test/rcoder-k8s
+    newTag: latest
+  - name: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner
+    newName: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/nuwax-test/rcoder-computer-agent-runner
+    newTag: latest
+
+patches:
+  # NodePort: 30080（dev 专用）
+  - patch: |-
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: rcoder
+      spec:
+        ports:
+          - port: 8087
+            targetPort: 8087
+            nodePort: 30080
+    target:
+      kind: Service
+      name: rcoder
+
+  # PVC 指向 dev 专属 StorageClass
+  - patch: |-
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: rcoder-workspace
+      spec:
+        storageClassName: juicefs-sc-dev
+    target:
+      kind: PersistentVolumeClaim
+      name: rcoder-workspace
+
+  # rcoder deployment 指向 dev 环境的 namespace 和 StorageClass
+  - patch: |-
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: rcoder
+      spec:
+        template:
+          spec:
+            containers:
+            - name: rcoder
+              env:
+              - name: RCODER_K8S_NAMESPACE
+                value: nuwax-rcoder-dev
+              - name: RCODER_K8S_STORAGE_CLASS
+                value: juicefs-sc-dev
+    target:
+      kind: Deployment
+      name: rcoder
+
--- a/qiming-rcoder/k8s/manifests/overlays/dev/rcoder-configmap.yaml
+++ b/qiming-rcoder/k8s/manifests/overlays/dev/rcoder-configmap.yaml
@@ -0,0 +1,71 @@
+# ============================================================
+# RCoder ConfigMap - Dev 环境专用
+# storage_class 指向 juicefs-sc-dev
+# ============================================================
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rcoder-config
+data:
+  config.yml: |
+    # RCoder 配置文件
+    default_agent: "Claude"
+
+    projects_dir: "/app/project_workspace"
+    port: 8087
+
+    cleanup_config:
+      enabled: true
+      idle_timeout_seconds: 600
+      cleanup_interval_seconds: 300
+      docker_stop_timeout_seconds: 30
+
+    proxy_config:
+      listen_port: 8088
+      default_backend_port: 8087
+      backend_host: "127.0.0.1"
+      port_param: "port"
+      health_check:
+        enabled: true
+        interval_seconds: 5
+        timeout_seconds: 1
+        healthy_threshold: 2
+        unhealthy_threshold: 3
+
+    docker_config:
+      multi_image_config:
+        global_defaults:
+          registry_prefix: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev"
+        services:
+          rcoder:
+            service_type: "RCoder"
+            arm64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest"
+            amd64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest"
+            default_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest"
+            image_tag_prefix: "rcoder"
+            enabled: true
+          computer-agent-runner:
+            service_type: "ComputerAgentRunner"
+            arm64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner:latest"
+            amd64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner:latest"
+            default_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner:latest"
+            image_tag_prefix: "rcoder-computer-agent-runner"
+            enabled: true
+        selection_strategy: "ServiceOnly"
+        cache_config:
+          enabled: true
+          ttl_seconds: 3600
+          max_entries: 50
+
+      network_base_name: "agent-network"
+      network_mode: "bridge"
+      work_dir: "/app"
+      auto_cleanup: true
+      container_ttl_seconds: 3600
+
+    api_key_auth:
+      enabled: false
+      api_key: "YOUR_API_KEY_HERE"
+
+    kubernetes_config:
+      storage_class: "juicefs-sc-dev"