Admin Bot
16ddd6d4ad
CI / CI (pull_request) Successful in 2m8s
New X-Resource: sandbox on X-Service: sessions
POST ?session_id= → CreateOrResume
1. Ensure PVC workspace-session-<id> (Longhorn 1Gi)
2. If pod already Running → return DNS (resume path, idempotent)
3. Ensure pi-session-sandbox NetworkPolicy (shared, created once)
4. Create Pod pi-session-<id> + Service pi-session-<id>:8787
5. Wait up to 30s for Pod Ready
6. Fire-and-forget: merge pod_name/pvc_name/svc_dns/last_active_at
into session memory_entity summary
DELETE ?session_id= → delete Pod + Service + PVC
Idle reaper goroutine (5min interval, configurable via
SANDBOX_REAPER_INTERVAL_MINUTES): lists pi-session-* pods,
deletes Succeeded/Failed ones, preserves PVCs for resume.
Security: runAsNonRoot/1000, readOnlyRootFilesystem, drop ALL
caps, RuntimeDefault seccomp, automountServiceAccountToken:false.
Resources: 500m/512Mi req, 1/1Gi limit.
NetworkPolicy: egress → DNS + api:8080 only; ingress ← poimen-frontend.
RBAC: Role session-sandbox-manager + RoleBinding in poimen ns.
7 unit tests — all pass (mock k8s server).
Image: forgejo.riotpiao.com/riotpiao-poimen/poimen-pi-session-runtime:latest
63 lines
1.6 KiB
YAML
63 lines
1.6 KiB
YAML
# RBAC for api-gateway image promotion.
|
|
# Grants the api-gateway ServiceAccount get+patch on ArgoCD Applications
|
|
# so it can update kustomize.images / helm.parameters after a container push.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: image-promoter
|
|
labels:
|
|
app: api-gateway
|
|
rules:
|
|
- apiGroups: ["argoproj.io"]
|
|
resources: ["applications"]
|
|
verbs: ["get", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: image-promoter-api-gateway
|
|
labels:
|
|
app: api-gateway
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: api-gateway
|
|
namespace: api
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: image-promoter
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
# Role + RoleBinding for pi-session sandbox manager (§4.15.4).
|
|
# api-gateway SA needs get/create/delete for pods, pvcs, services,
|
|
# and networkpolicies in the poimen namespace.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: session-sandbox-manager
|
|
namespace: poimen
|
|
labels:
|
|
app: api-gateway
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods", "persistentvolumeclaims", "services"]
|
|
verbs: ["get", "list", "create", "delete"]
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["networkpolicies"]
|
|
verbs: ["get", "create", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: session-sandbox-manager-api-gateway
|
|
namespace: poimen
|
|
labels:
|
|
app: api-gateway
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: api-gateway
|
|
namespace: api
|
|
roleRef:
|
|
kind: Role
|
|
name: session-sandbox-manager
|
|
apiGroup: rbac.authorization.k8s.io
|