rock
b6e317b34c
Adds the pi coding-agent sandbox's cluster side: - `k8s/infra/poimen/pi-agent-workspace-pv.yaml` — static hostPath PV + PVC for the sandbox /workspace (Longhorn cannot attach new volumes in this cluster; this gives real persistence and survived a pod delete/recreate test: marker file + 38 KB session.jsonl intact, the session answered from its own history afterwards). - `k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml` — the sandbox's API-key Secret, SOPS-encrypted (recipient from .sops.yaml, payload only: `encrypted_regex ^(data|stringData)$`), registered in the ksops generator. Round-trip verified against the live Secret. - `terraform/files/coredns/Corefile` — `rewrite name pi.riotpiao.com ingress-nginx-controller...` so the hostname resolves in-cluster. Note: the keys currently in that Secret are the ones leaked earlier and must be rotated; re-encrypt with `sops -e -i` after rotating.Reviewed-on: #54 Co-authored-by: rock <[email protected]>
58 lines
1.2 KiB
YAML
58 lines
1.2 KiB
YAML
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata:
|
|
finalizers:
|
|
- kubernetes.io/pv-protection
|
|
labels:
|
|
app: pi-coding-agent-sandbox
|
|
part-of: poimen-toolkit
|
|
name: pi-agent-workspace-pv
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: '-1'
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
capacity:
|
|
storage: 10Gi
|
|
claimRef:
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
name: pi-agent-workspace
|
|
namespace: poimen-sandbox
|
|
hostPath:
|
|
path: /var/lib/pi-agent-sandbox
|
|
type: DirectoryOrCreate
|
|
nodeAffinity:
|
|
required:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: In
|
|
values:
|
|
- talos-cp-2
|
|
persistentVolumeReclaimPolicy: Retain
|
|
volumeMode: Filesystem
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
annotations:
|
|
pv.kubernetes.io/bind-completed: 'yes'
|
|
argocd.argoproj.io/sync-wave: '-1'
|
|
finalizers:
|
|
- kubernetes.io/pvc-protection
|
|
labels:
|
|
app: pi-coding-agent-sandbox
|
|
part-of: poimen-toolkit
|
|
name: pi-agent-workspace
|
|
namespace: poimen-sandbox
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
storageClassName: ''
|
|
volumeMode: Filesystem
|
|
volumeName: pi-agent-workspace-pv
|