添加qiming-rcoder模块

qiming-rcoder/k8s/manifests/overlays/prod/clusterrolebinding.yaml

@@ -0,0 +1,17 @@
+# ============================================================
+# ClusterRoleBinding - Prod 环境专用
+# 把 base 里共享的 ClusterRole 绑定到 prod namespace 的 ServiceAccount
+# 集群级资源独立命名，避免与 dev 冲突
+# ============================================================
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: rcoder-pods-crb-prod
+subjects:
+- kind: ServiceAccount
+  name: rcoder-pods-sa
+  namespace: nuwax-rcoder-prod
+roleRef:
+  kind: ClusterRole
+  name: rcoder-pods-clusterrole
+  apiGroup: rbac.authorization.k8s.io

qiming-rcoder/k8s/manifests/overlays/prod/credentials.yaml

@@ -0,0 +1,16 @@
+# ============================================================
+# 存储层凭据 Secret - Prod 环境
+# ⚠️ 上线前必须替换为真实强密码，并同步修改 juicefs-secret.yaml 的 metaurl / MINIO_ACCESS_KEY 等字段
+# 推荐做法：不把真实密码提交到 git，改用 SealedSecret / ExternalSecret / 部署时注入
+# ============================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rcoder-credentials
+  namespace: nuwax-rcoder-prod
+type: Opaque
+stringData:
+  POSTGRES_USER: "juicefs"
+  POSTGRES_PASSWORD: "prodPg2024"
+  MINIO_ROOT_USER: "minioadmin"
+  MINIO_ROOT_PASSWORD: "prodMinio2024"

qiming-rcoder/k8s/manifests/overlays/prod/juicefs-secret.yaml

@@ -0,0 +1,29 @@
+# ============================================================
+# JuiceFS Secret - Prod 环境专用
+# ⚠️ 上线前必须把 metaurl/access-key/secret-key/MINIO_* 的明文密码
+#    替换为 credentials.yaml 中设置的真实密码，保持两处一致。
+# ============================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: juicefs-secret
+  namespace: nuwax-rcoder-prod
+type: Opaque
+stringData:
+  # JuiceFS CE 必需字段（小写键名）
+  name: "rcoder-juicefs"
+  metaurl: "postgres://juicefs:prodPg2024@postgresql.nuwax-rcoder-prod:5432/juicefs"
+  storage: "minio"
+  bucket: "http://minio-service.nuwax-rcoder-prod:9000/juicefs"
+  access-key: "minioadmin"
+  secret-key: "prodMinio2024"
+
+  # 兼容字段（保留给现有脚本/日志使用）
+  METAURL: "postgres://juicefs:prodPg2024@postgresql.nuwax-rcoder-prod:5432/juicefs"
+  MINIO_ACCESS_KEY: "minioadmin"
+  MINIO_SECRET_KEY: "prodMinio2024"
+  MINIO_ADDRESS: "minio-service.nuwax-rcoder-prod:9000"
+
+  # 其他配置
+  APPEND_FSYNC: "1"
+  CACHE_SIZE: "1024"

qiming-rcoder/k8s/manifests/overlays/prod/juicefs-storageclass.yaml

@@ -0,0 +1,24 @@
+# ============================================================
+# JuiceFS StorageClass - Prod 环境专用
+# 集群级资源独立命名，避免与 dev 冲突
+# ============================================================
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: juicefs-sc-prod
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+provisioner: csi.juicefs.com
+parameters:
+  csi.storage.k8s.io/provisioner-secret-name: juicefs-secret
+  csi.storage.k8s.io/provisioner-secret-namespace: nuwax-rcoder-prod
+  csi.storage.k8s.io/controller-expand-secret-name: juicefs-secret
+  csi.storage.k8s.io/controller-expand-secret-namespace: nuwax-rcoder-prod
+  csi.storage.k8s.io/node-publish-secret-name: juicefs-secret
+  csi.storage.k8s.io/node-publish-secret-namespace: nuwax-rcoder-prod
+  juicefs/controllerQuotaSet: "false"
+  juicefs/mountImage: "juicedata/mount:ce-v1.3.1"
+  juicefs/mountOptions: "cache-size=1024,allow-other"
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+volumeBindingMode: Immediate

qiming-rcoder/k8s/manifests/overlays/prod/kustomization.yaml

@@ -0,0 +1,87 @@
+# Production environment overlay
+# 使用方式: kubectl apply -k manifests/overlays/prod
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: nuwax-rcoder-prod
+
+resources:
+  - ../../base
+  # prod 独立的集群级资源（避免与 dev 冲突）
+  - juicefs-storageclass.yaml
+  - clusterrolebinding.yaml
+  # prod 独立的 namespace 内资源
+  - rcoder-configmap.yaml
+  - credentials.yaml
+  - juicefs-secret.yaml
+
+# 生产环境标签（含义同 dev 注释）
+labels:
+  - pairs:
+      environment: production
+    includeSelectors: false
+    includeTemplates: true
+
+# 生产环境副本数
+replicas:
+  - name: rcoder
+    count: 2
+
+# 生产环境镜像 tag
+images:
+  - name: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder
+    newName: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/nuwax-test/rcoder-k8s
+    newTag: latest
+  - name: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner
+    newName: nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/nuwax-test/rcoder-computer-agent-runner
+    newTag: latest
+
+patches:
+  # NodePort: 30081（prod 专用，与 dev 30080 错开）
+  - patch: |-
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: rcoder
+      spec:
+        ports:
+          - port: 8087
+            targetPort: 8087
+            nodePort: 30081
+    target:
+      kind: Service
+      name: rcoder
+
+  # PVC 指向 prod 专属 StorageClass
+  - patch: |-
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: rcoder-workspace
+      spec:
+        storageClassName: juicefs-sc-prod
+    target:
+      kind: PersistentVolumeClaim
+      name: rcoder-workspace
+
+  # rcoder deployment 指向 prod 环境的 namespace 和 StorageClass
+  - patch: |-
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: rcoder
+      spec:
+        template:
+          spec:
+            containers:
+            - name: rcoder
+              env:
+              - name: RCODER_K8S_NAMESPACE
+                value: nuwax-rcoder-prod
+              - name: RCODER_K8S_STORAGE_CLASS
+                value: juicefs-sc-prod
+    target:
+      kind: Deployment
+      name: rcoder
+

qiming-rcoder/k8s/manifests/overlays/prod/rcoder-configmap.yaml

@@ -0,0 +1,71 @@
+# ============================================================
+# RCoder ConfigMap - Prod 环境专用
+# storage_class 指向 juicefs-sc-prod
+# ============================================================
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rcoder-config
+data:
+  config.yml: |
+    # RCoder 配置文件
+    default_agent: "Claude"
+
+    projects_dir: "/app/project_workspace"
+    port: 8087
+
+    cleanup_config:
+      enabled: true
+      idle_timeout_seconds: 600
+      cleanup_interval_seconds: 300
+      docker_stop_timeout_seconds: 30
+
+    proxy_config:
+      listen_port: 8088
+      default_backend_port: 8087
+      backend_host: "127.0.0.1"
+      port_param: "port"
+      health_check:
+        enabled: true
+        interval_seconds: 5
+        timeout_seconds: 1
+        healthy_threshold: 2
+        unhealthy_threshold: 3
+
+    docker_config:
+      multi_image_config:
+        global_defaults:
+          registry_prefix: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev"
+        services:
+          rcoder:
+            service_type: "RCoder"
+            arm64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest"
+            amd64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest"
+            default_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder:latest"
+            image_tag_prefix: "rcoder"
+            enabled: true
+          computer-agent-runner:
+            service_type: "ComputerAgentRunner"
+            arm64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner:latest"
+            amd64_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner:latest"
+            default_image: "nuwax-docker-images-registry.cn-hangzhou.cr.aliyuncs.com/dev/rcoder-agent-runner:latest"
+            image_tag_prefix: "rcoder-computer-agent-runner"
+            enabled: true
+        selection_strategy: "ServiceOnly"
+        cache_config:
+          enabled: true
+          ttl_seconds: 3600
+          max_entries: 50
+
+      network_base_name: "agent-network"
+      network_mode: "bridge"
+      work_dir: "/app"
+      auto_cleanup: true
+      container_ttl_seconds: 3600
+
+    api_key_auth:
+      enabled: false
+      api_key: "YOUR_API_KEY_HERE"
+
+    kubernetes_config:
+      storage_class: "juicefs-sc-prod"