homelab/k8s/apps/agent-pod/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: agent-pod
  namespace: agent-pod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: agent-pod
  template:
    metadata:
      labels:
        app: agent-pod
    spec:
      # api.riotpiao.com has no in-cluster DNS record (only resolves from the
      # home network's own resolver) -- pin it to ingress-nginx-controller's
      # ClusterIP so pi's models.json baseUrl works unchanged. TLS still
      # terminates correctly since SNI/Host still say api.riotpiao.com.
      hostAliases:
        - ip: "10.101.128.185"
          hostnames:
            - "api.riotpiao.com"
      containers:
        # hub.js runs in the same container as pi (not a sidecar) so it can
        # spawn `pi -p --mode json` directly via child_process -- a separate
        # container can't exec into another container's filesystem/PATH.
        # It IS the container's long-running process now; no more `sleep
        # infinity` placeholder.
        #
        # Also builds the agent-manager fork (github.com/Riotpiaole/
        # agent-manager, add-headless-spawn branch) from source and drops
        # coordinator.js in beside hub.js -- neither is the container's
        # foreground process. hub.js keeps that role unchanged; running
        # multiple repos' pipelines concurrently in this one pod means
        # `kubectl exec <pod> -- node /root/coordinator.js --repo X --tasks
        # Y &` once per repo, each an independent process inside the same
        # container, each spawning its own agent-manager-tracked sessions
        # on the container's local tmux server -- `kubectl exec -it <pod>
        # -- agent-manager` attaches its TUI live against those same
        # sessions, no cross-machine visibility problem since spawner,
        # tmux server, and viewer are all colocated here.
        #
        # No prebuilt Linux binary is shipped for agent-manager: the local
        # .bin/ build is macOS arm64 (wrong OS/arch for this container
        # anyway) and it's 27MB, well over a ConfigMap's ~1MiB cap. Debian's
        # `apt-get golang-go` is far too old for this fork's go 1.26.5
        # requirement, so the real Go toolchain is fetched directly from
        # go.dev instead.
        - name: pi
          image: node:22-slim
          command:
            - sh
            - -c
            - |
              set -e
              apt-get update && apt-get install -y git curl jq openssh-client tmux
              ssh-keygen -y -f /root/.ssh/id_forgejo > /root/.ssh/id_forgejo.pub
              eval "$(ssh-agent -s)"
              ssh-add /root/.ssh/id_forgejo
              npm install -g @earendil-works/[email protected]
              npm install --prefix /root ws

              curl -fsSL "https://go.dev/dl/go1.26.5.linux-$(dpkg --print-architecture).tar.gz" | tar -C /usr/local -xz
              export PATH="$PATH:/usr/local/go/bin"
              git clone --branch add-headless-spawn --depth 1 \
                https://github.com/Riotpiaole/agent-manager.git /root/agent-manager-src
              (cd /root/agent-manager-src && go build -o /usr/local/bin/agent-manager .)

              node /root/hub.js
          env:
            - name: PI_BIN
              value: pi
            - name: AGENT_MANAGER_BIN
              value: /usr/local/bin/agent-manager
            - name: HUB_WORK_DIR
              value: /root/agent-harness-work
          ports:
            - containerPort: 9090
          resources:
            requests:
              cpu: "4"
              memory: 8Gi
            limits:
              cpu: "8"
              memory: 16Gi
          volumeMounts:
            - name: pi-config
              mountPath: /root/.pi/agent/settings.json
              subPath: settings.json
            - name: pi-models
              mountPath: /root/.pi/agent/models.json
              subPath: models.json
            - name: pi-skills
              mountPath: /root/.pi/agent/skills
            - name: hub-src
              mountPath: /root/hub.js
              subPath: hub.js
            - name: coordinator-src
              mountPath: /root/coordinator.js
              subPath: coordinator.js
            - name: ssh-key
              mountPath: /root/.ssh/id_forgejo
              subPath: id_forgejo
            - name: ssh-config
              mountPath: /root/.ssh/config
              subPath: config
      volumes:
        - name: pi-config
          configMap:
            name: pi-config
        - name: pi-models
          secret:
            secretName: pi-models
        - name: pi-skills
          configMap:
            name: pi-skills
            items:
              - key: planner-SKILL.md
                path: planner/SKILL.md
              - key: investigator-SKILL.md
                path: investigator/SKILL.md
              - key: info-collector-SKILL.md
                path: info-collector/SKILL.md
              - key: implementer-SKILL.md
                path: implementer/SKILL.md
              - key: judge-SKILL.md
                path: judge/SKILL.md
              - key: resolver-SKILL.md
                path: resolver/SKILL.md
              - key: brave-search-SKILL.md
                path: brave-search/SKILL.md
        - name: hub-src
          configMap:
            name: hub-src
        - name: coordinator-src
          configMap:
            name: coordinator-src
        - name: ssh-key
          secret:
            secretName: agent-pod-ssh-key
            defaultMode: 0600
        - name: ssh-config
          configMap:
            name: agent-pod-ssh-config