mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
merge(plane-on-kubernetes): groups 1-2 -- cluster profile, no host literals, delivery through the S3 store
Kind proofs: records 01 and 02. Task 2.6 (receiver removal) is paused while the safety net and the decision engine come first. deployment.md conflicts resolved in the plain-language style; corrects the RuntimeClass claim (Substrate runs runsc inside its worker pod). Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
+9
-6
@@ -7,12 +7,15 @@ single-node kind cluster. ax is the only executor; `ousast plane run` submits, r
|
||||
|
||||
ops/ax/up.sh # idempotent: kind + registry, Substrate, ax, gVisor worker pool, egress gateway,
|
||||
# receiver Service, runner image (digest pinned), ax CLI, smoke Task
|
||||
ousast plane doctor # kind, Substrate, ax controller, runner image
|
||||
ousast plane doctor # the profile's cluster (ops/k8s/profiles/kind.toml), Substrate, ax, runner image, memory store
|
||||
ops/ax/smoke-run.sh # end to end: repo-facts on ax, artifacts back on the host, attribution table
|
||||
ops/ax/down.sh # deletes the cluster and its registry
|
||||
|
||||
Tools live in `~/go/bin` (kind, ax, ko, kubectl-ate) and `~/.local/bin` (kubectl); sources and rendered files
|
||||
in `~/.cache/ousast/ax-src/` (the runner digest pin is `runner-image` there).
|
||||
in `~/.cache/ousast/ax-src/`. The cluster's context, registry and pool sizes come from the kind profile
|
||||
(`ops/k8s/profiles/kind.toml`); `up.sh` writes the runner's digest pin to that profile's images file
|
||||
(`ops/k8s/profiles/kind-images.json`), which the templates are re-pinned from and which is committed with them.
|
||||
`up.sh` and `smoke-run.sh` run the checkout's code with `OUSAST_PYTHON` (default `.venv/bin/python`).
|
||||
|
||||
## How a Run executes
|
||||
|
||||
@@ -192,16 +195,16 @@ assume this laptop and must change first (checked 2026-10-02):
|
||||
|
||||
| Assumption | Where | Needed in a real cluster |
|
||||
|---|---|---|
|
||||
| Artifact receiver runs on the developer host, reached through the `ousast-receiver` Service with an EndpointSlice to the kind gateway `172.19.0.1:18090` | `egress.py`, `receiver-service.yaml.tmpl` | the receiver as an in-cluster Deployment (or object storage, e.g. Substrate's S3-compatible store), with the reconciler reading from it |
|
||||
| Registry `localhost:5001`, rewritten by Substrate for kind | `up.sh` (`KO_DOCKER_REPO`), `doctor.py:45` (hard-coded check), the runner digest pin, the `image` of every template under `plane/tasks/` | a registry the workers can pull from; keep digest pins (Substrate rejects tags); `--runner-image FILE` re-pins generated Tasks |
|
||||
| kubectl context `kind-$KIND_CLUSTER_NAME` | `doctor.py:39`, `egress.py:115` and `:148`, `router.py:145`, `up.sh:24` | one configurable context (for example `OUSAST_KUBE_CONTEXT`); not yet configurable |
|
||||
| Artifact receiver runs on the developer host, reached through the `ousast-receiver` Service with an EndpointSlice to the kind network's gateway address on `OUSAST_ARTIFACT_PORT` | `egress.py`, `receiver-service.yaml.tmpl` | the receiver as an in-cluster Deployment (or object storage, e.g. Substrate's S3-compatible store), with the reconciler reading from it |
|
||||
| The kind-local registry (`registry` in `ops/k8s/profiles/kind.toml`), rewritten by Substrate for kind | `up.sh` (`KO_DOCKER_REPO`), the profile's images file, the `image` of every template under `plane/tasks/` | the `k3s` profile's registry; keep digest pins (Substrate rejects tags); `--runner-image FILE` re-pins generated Tasks |
|
||||
| kubectl context | `kube_context` in the profile, read by `doctor.py`, `egress.py`, `router.py` (plane-on-kubernetes 1.2); `up.sh` reads the same profile | the `k3s` profile's context; nothing else changes |
|
||||
| ax's snapshot bucket: `AX_SNAPSHOTS_BUCKET` in ax's `deploy/ax-server.yaml` points at the ax authors' GCS bucket | ax deploy manifest | your own bucket, set before deploying ax |
|
||||
| Egress gateway applied by hand (agentgateway variant, no Rust build) | this README | the Substrate-installed gateway; per-task EgressPolicies work unchanged |
|
||||
| Worker pool of 2 x 1 CPU / 1.5 GiB for the 7 GB host | `workerpool.yaml.tmpl` | sized to the cluster; `--workers` to match |
|
||||
| Plane memory store and results under `~/ousast-results/` on the host | `reconciler.py` (`OUSAST_RESULTS`), `memory.py` (`OUSAST_MEMORY`) | a persistent volume or bucket shared by the reconciler; the `s3://` store already works against any reachable S3-compatible server |
|
||||
|
||||
The provider key already travels only in the start request through `atenet-router`, which works the same through
|
||||
a port-forward to any cluster.
|
||||
the kube-context tunnel to any cluster.
|
||||
|
||||
## What a larger ax deployment needs
|
||||
|
||||
|
||||
Executable
+81
@@ -0,0 +1,81 @@
|
||||
#!/usr/bin/env bash
|
||||
# Placement probe (plane-on-kubernetes task 1.5, design open question 2): does Agent Substrate place an actor on a
|
||||
# worker that fits its memory request, or on any free worker of the sandbox class?
|
||||
#
|
||||
# Applies a second WorkerPool `probe-pool` (1 replica, 2 CPU / 3Gi) from ops/ax/workerpool.yaml.tmpl with the worker
|
||||
# image the existing pool already built (no ko build), scales the default pool to one worker so the 7 GB host holds
|
||||
# both, then runs one model-free repo-facts Task asking 2560Mi (limit 3Gi) and one asking 256Mi, recording after
|
||||
# each resume which worker holds the actor (`kubectl ate get workers -o json`). Everything it created is removed
|
||||
# on exit and the default pool is scaled back. Usage: ops/ax/probe-placement.sh OUT_DIR (the JSON evidence lands there).
|
||||
set -euo pipefail
|
||||
export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
|
||||
OUT="${1:?usage: probe-placement.sh OUT_DIR}"
|
||||
mkdir -p "$OUT"
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
||||
PY="${OUSAST_PYTHON:-$REPO_ROOT/.venv/bin/python}"
|
||||
profile() { PYTHONPATH="$REPO_ROOT/src" "$PY" -m openultrasast.plane.profile --profile "${OUSAST_PLANE_PROFILE:-kind}" --print "$@"; }
|
||||
CTX="$(profile kube_context)"
|
||||
RUNNER_IMAGE="$(profile images.runner)"
|
||||
DEFAULT_REPLICAS="$(profile pools.default.replicas)"
|
||||
K() { kubectl --context "$CTX" -n ax-system "$@"; }
|
||||
log() { printf '%s %s\n' "$(date +%H:%M:%S)" "$*" | tee -a "$OUT/probe.log"; }
|
||||
|
||||
cleanup() {
|
||||
rc=$?
|
||||
log "cleanup (exit $rc): delete the probe tasks and probe-pool, scale ousast-pool back to $DEFAULT_REPLICAS"
|
||||
for t in ousast-probe-big ousast-probe-small; do ax delete task "$t" >/dev/null 2>&1 || true; done
|
||||
K delete workerpool probe-pool --ignore-not-found >/dev/null 2>&1 || true
|
||||
K patch workerpool ousast-pool --type merge -p "{\"spec\":{\"replicas\":$DEFAULT_REPLICAS}}" >/dev/null 2>&1 || true
|
||||
echo "probe exit $rc"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
workers() { kubectl ate --context "$CTX" get workers -o json > "$OUT/$1.json"; kubectl ate --context "$CTX" get workers | tee -a "$OUT/probe.log"; }
|
||||
|
||||
export POOL_NAME=probe-pool POOL_REPLICAS=1 POOL_CPU=2 POOL_MEMORY=3Gi
|
||||
WORKER_IMAGE="$(K get workerpool ousast-pool -o jsonpath='{.spec.workerImage}')" # already built and pulled by the node
|
||||
SUBSTRATE_VERSION="$(kubectl --context "$CTX" get nodes -o jsonpath='{.items[0].metadata.labels.ate\.dev/substrate-version}')"
|
||||
export WORKER_IMAGE SUBSTRATE_VERSION
|
||||
log "default pool to 1 replica (room for a 3Gi worker on this host)"
|
||||
K patch workerpool ousast-pool --type merge -p '{"spec":{"replicas":1}}'
|
||||
for i in $(seq 1 60); do [ "$(K get pods -l ate.dev/worker-pool=ousast-pool --no-headers 2>/dev/null | wc -l)" = 1 ] && break; sleep 2; done
|
||||
log "apply probe-pool: $POOL_REPLICAS x $POOL_CPU CPU / $POOL_MEMORY, image $WORKER_IMAGE"
|
||||
envsubst < "$(dirname "$0")/workerpool.yaml.tmpl" | tee "$OUT/probe-pool.yaml" | K apply -f -
|
||||
K wait --for=condition=Ready pod -l ate.dev/worker-pool=probe-pool --timeout=600s
|
||||
workers workers-before
|
||||
|
||||
task() { # name, request memory, limit memory
|
||||
cat > "$OUT/$1.yaml" <<EOF
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Workspace
|
||||
metadata: {name: $1-ws, atespace: default}
|
||||
spec:
|
||||
files:
|
||||
- {path: "hello.py", content: "def hello():\n return greet()\n"}
|
||||
---
|
||||
apiVersion: ax.io/v1alpha1
|
||||
kind: Task
|
||||
metadata: {name: $1, atespace: default}
|
||||
spec:
|
||||
image: "$RUNNER_IMAGE"
|
||||
command: ["repo-facts"]
|
||||
env: [{name: OUSAST_OUTPUT_DIR, value: "/workspace/.ousast-out/probe"}]
|
||||
resources: {requests: {cpu: "250m", memory: "$2"}, limits: {cpu: "1", memory: "$3"}}
|
||||
workspaces: [{name: $1-ws, path: "/workspace"}]
|
||||
EOF
|
||||
ax delete task "$1" >/dev/null 2>&1 || true
|
||||
log "apply $1 (requests $2, limits $3)"
|
||||
ax apply -f "$OUT/$1.yaml"
|
||||
for i in 1 2 3 4 5 6 7 8 9; do
|
||||
if ax resume task "$1" 2>&1 | tee -a "$OUT/probe.log"; then break; fi # the first resume may wait for the golden snapshot
|
||||
sleep 20
|
||||
done
|
||||
sleep 15
|
||||
ax get task "$1" | tee "$OUT/$1.status.yaml" | grep -E "phase|message" || true
|
||||
workers "workers-$1"
|
||||
ax delete task "$1" >/dev/null 2>&1 || true
|
||||
for i in $(seq 1 30); do kubectl ate --context "$CTX" get workers | grep -q " 1/1000 " || break; sleep 2; done
|
||||
}
|
||||
task ousast-probe-big 2560Mi 3Gi
|
||||
task ousast-probe-small 256Mi 512Mi
|
||||
log "done; evidence under $OUT"
|
||||
+9
-5
@@ -1,14 +1,18 @@
|
||||
#!/usr/bin/env bash
|
||||
# Render the end-to-end smoke Run with the current runner digest and execute it through the reconciler on ax.
|
||||
# Render the end-to-end smoke Run with the profile's runner digest and execute it through the reconciler on ax.
|
||||
# The profile (OUSAST_PLANE_PROFILE, default kind; ops/k8s/profiles/) names the images file up.sh wrote.
|
||||
set -euo pipefail
|
||||
export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
|
||||
SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}"
|
||||
RUNNER_IMAGE="$(cat "$SRC/runner-image")"; export RUNNER_IMAGE
|
||||
REPO="$(cd "$(dirname "$0")/../.." && pwd)"
|
||||
PY="${OUSAST_PYTHON:-$REPO/.venv/bin/python}"
|
||||
RUNNER_IMAGE="$(PYTHONPATH="$REPO/src" "$PY" -m openultrasast.plane.profile --profile "${OUSAST_PLANE_PROFILE:-kind}" --print images.runner)"
|
||||
export RUNNER_IMAGE
|
||||
# Actors reach the receiver by its Service name through the egress gateway (ops/ax/receiver-service.yaml.tmpl,
|
||||
# applied by up.sh, endpoint this host at OUSAST_ARTIFACT_PORT): the runner dials the Service's ClusterIP on port
|
||||
# 80 with that name as Host; the reconciler looks the ClusterIP up unless OUSAST_ARTIFACT_DIAL is set.
|
||||
export OUSAST_ARTIFACT_PORT="${OUSAST_ARTIFACT_PORT:-18090}"
|
||||
envsubst < "$(dirname "$0")/smoke-run.yaml.tmpl" > "$SRC/smoke-run.yaml"
|
||||
REPO="$(cd "$(dirname "$0")/../.." && pwd)"
|
||||
"$REPO/.venv/bin/ousast" plane run "$SRC/smoke-run.yaml" "$@"
|
||||
"$REPO/.venv/bin/ousast" plane status ax-e2e-smoke
|
||||
ousast() { PYTHONPATH="$REPO/src" "$PY" -m openultrasast.cli "$@"; } # this checkout's code, whatever python runs it
|
||||
ousast plane run "$SRC/smoke-run.yaml" "$@"
|
||||
ousast plane status ax-e2e-smoke
|
||||
|
||||
+30
-12
@@ -1,13 +1,21 @@
|
||||
#!/usr/bin/env bash
|
||||
# Bring up ax on this host: kind cluster + local registry, Agent Substrate, the ax control plane, one smoke
|
||||
# Task. Idempotent enough to rerun; `down.sh` removes everything. Requires docker, go, kubectl, kind, ko, ax.
|
||||
# Task. Idempotent: every step is skipped when already done; `down.sh` removes everything. Requires docker, go,
|
||||
# kubectl, kind, ko, ax. The cluster's context, the registry and the pool sizes come from the kind profile
|
||||
# (ops/k8s/profiles/kind.toml; OUSAST_PLANE_PROFILE selects another file with exec = "local"). This script may
|
||||
# name the kind cluster because it creates it; the code reads the profile (tests/test_plane_literals.py).
|
||||
set -euo pipefail
|
||||
trap 'rc=$?; echo "up.sh FAILED at line $LINENO (exit $rc)"' ERR
|
||||
trap 'echo "up.sh exit $?"' EXIT
|
||||
export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
|
||||
export GOTOOLCHAIN=auto
|
||||
export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-ousast}"
|
||||
export KO_DOCKER_REPO="${KO_DOCKER_REPO:-localhost:5001}"
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
||||
PY="${OUSAST_PYTHON:-$REPO_ROOT/.venv/bin/python}"
|
||||
profile() { PYTHONPATH="$REPO_ROOT/src" "$PY" -m openultrasast.plane.profile --profile "${OUSAST_PLANE_PROFILE:-kind}" --print "$@"; }
|
||||
CTX="$(profile kube_context)" # kind names its context kind-<cluster>
|
||||
export KIND_CLUSTER_NAME="${CTX#kind-}"
|
||||
export KO_DOCKER_REPO="${KO_DOCKER_REPO:-$(profile registry)}"
|
||||
IMAGES_FILE="$(profile images)" # the digest pins the reconciler and the templates read
|
||||
SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}"
|
||||
|
||||
for t in docker go kubectl kind ko ax; do
|
||||
@@ -19,9 +27,8 @@ clone substrate https://github.com/agent-substrate/substrate.git
|
||||
clone ax https://github.com/google/ax.git
|
||||
step() { printf '\n== %s (%s)\n' "$1" "$(date +%H:%M:%S)"; }
|
||||
|
||||
step "kind cluster '$KIND_CLUSTER_NAME' + registry $KO_DOCKER_REPO"
|
||||
step "kind cluster '$KIND_CLUSTER_NAME' (context $CTX) + registry $KO_DOCKER_REPO"
|
||||
# Each step is skipped when already done: the substrate helper DELETES an existing cluster before creating one.
|
||||
CTX="kind-$KIND_CLUSTER_NAME"
|
||||
ready() { kubectl --context "$CTX" -n "$1" get pods --no-headers 2>/dev/null | awk '$2 ~ /^[0-9]+\/[0-9]+$/ {n++; split($2,a,"/"); if (a[1]!=a[2] && $3!="Completed") bad++} END {exit !(n>0 && bad==0)}'; }
|
||||
if kind get clusters 2>/dev/null | grep -qx "$KIND_CLUSTER_NAME"; then
|
||||
echo "cluster exists; kept"
|
||||
@@ -56,25 +63,36 @@ KIND_GATEWAY="$(docker network inspect kind --format '{{range .IPAM.Config}}{{if
|
||||
export KIND_GATEWAY OUSAST_ARTIFACT_PORT="${OUSAST_ARTIFACT_PORT:-18090}" # the reconciler's fixed receiver port
|
||||
envsubst < "$(dirname "$0")/receiver-service.yaml.tmpl" | kubectl --context "$CTX" apply -f -
|
||||
|
||||
step "worker pool (gVisor)"
|
||||
step "worker pool (gVisor): pools.default of the profile"
|
||||
# `ko apply` builds the worker image from the Substrate checkout (several GB of Go caches): only when the pool
|
||||
# is absent. A size change in the profile is applied with `kubectl patch` or by deleting the pool first.
|
||||
export POOL_NAME=ousast-pool POOL_REPLICAS="$(profile pools.default.replicas)" POOL_CPU="$(profile pools.default.cpu)" POOL_MEMORY="$(profile pools.default.memory)"
|
||||
export WORKER_IMAGE="ko://github.com/agent-substrate/substrate/cmd/ateom-gvisor"
|
||||
SUBSTRATE_VERSION="$(kubectl --context "$CTX" get nodes -o jsonpath='{.items[0].metadata.labels.ate\.dev/substrate-version}')"
|
||||
export SUBSTRATE_VERSION
|
||||
envsubst < "$(dirname "$0")/workerpool.yaml.tmpl" > "$SRC/workerpool.yaml"
|
||||
(cd "$SRC/substrate" && KO_DOCKER_REPO="$KO_DOCKER_REPO" ko apply -f "$SRC/workerpool.yaml")
|
||||
kubectl --context "$CTX" -n ax-system wait --for=condition=Ready pod -l ate.dev/worker-pool=ousast-pool --timeout=600s \
|
||||
if kubectl --context "$CTX" -n ax-system get workerpool "$POOL_NAME" >/dev/null 2>&1; then
|
||||
echo "pool $POOL_NAME exists ($(kubectl --context "$CTX" -n ax-system get workerpool "$POOL_NAME" -o jsonpath='{.status.readyReplicas}/{.spec.replicas}') ready); kept"
|
||||
else
|
||||
(cd "$SRC/substrate" && KO_DOCKER_REPO="$KO_DOCKER_REPO" ko apply -f "$SRC/workerpool.yaml")
|
||||
fi
|
||||
kubectl --context "$CTX" -n ax-system wait --for=condition=Ready pod -l "ate.dev/worker-pool=$POOL_NAME" --timeout=600s \
|
||||
|| kubectl --context "$CTX" -n ax-system get pods
|
||||
|
||||
step "runner image $KO_DOCKER_REPO/ousast-runner"
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
||||
docker build -q -f "$REPO_ROOT/plane/Dockerfile.runner" -t "$KO_DOCKER_REPO/ousast-runner:dev" "$REPO_ROOT"
|
||||
docker push -q "$KO_DOCKER_REPO/ousast-runner:dev"
|
||||
RUNNER_IMAGE="$(docker inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$KO_DOCKER_REPO/ousast-runner:dev" | grep "^$KO_DOCKER_REPO/ousast-runner@" | head -1)"
|
||||
[ -n "$RUNNER_IMAGE" ] || { echo "no digest for the runner image" >&2; exit 2; }
|
||||
export RUNNER_IMAGE; echo "$RUNNER_IMAGE" > "$SRC/runner-image" # the reconciler reads this pin
|
||||
echo "runner image $RUNNER_IMAGE"
|
||||
export RUNNER_IMAGE
|
||||
printf '{\n "runner": "%s"\n}\n' "$RUNNER_IMAGE" > "$IMAGES_FILE" # the profile's images file: commit it with the templates
|
||||
echo "runner image $RUNNER_IMAGE -> $IMAGES_FILE"
|
||||
echo "re-pin the templates with: ousast plane workspaces ... --runner-image $IMAGES_FILE (or ousast plane repin, task 4.3)"
|
||||
|
||||
step "ax CLI from the deployed checkout (a release CLI skews from the server)"
|
||||
(cd "$SRC/ax" && go install ./cmd/ax)
|
||||
if [ -x "$HOME/go/bin/ax" ] && [ "$HOME/go/bin/ax" -nt "$SRC/ax/.git/HEAD" ]; then echo "ax CLI newer than the checkout; kept"; else
|
||||
(cd "$SRC/ax" && go install ./cmd/ax)
|
||||
fi
|
||||
|
||||
step "smoke task"
|
||||
ax delete task ousast-smoke >/dev/null 2>&1 || true
|
||||
|
||||
@@ -1,23 +1,26 @@
|
||||
# Warm gVisor workers for ax tasks on this host (Agent Substrate WorkerPool). ax's per-task ActorTemplates
|
||||
# set no workerSelector, so every pool of the matching sandbox class is eligible. Two workers of 1 CPU /
|
||||
# 1.5 GiB fit the 7 GB host beside the control planes; an actor occupies a whole worker.
|
||||
# Warm gVisor workers for ax tasks (Agent Substrate WorkerPool), rendered by ops/ax/up.sh (and by
|
||||
# ops/ax/probe-placement.sh for the placement probe) from the profile's pool: POOL_NAME, POOL_REPLICAS, POOL_CPU,
|
||||
# POOL_MEMORY (ops/k8s/profiles/<profile>.toml, [pools.default]) and WORKER_IMAGE (ko:// for a build, or a
|
||||
# digest-pinned reference of a built worker image). ax's per-task ActorTemplates set no workerSelector, so every
|
||||
# pool of the matching sandbox class is eligible. An actor occupies a whole worker. Replaced by the renderer of
|
||||
# plane-on-kubernetes task 6.1 (ops/k8s/base/workerpool-*.yaml.tmpl).
|
||||
apiVersion: ate.dev/v1alpha1
|
||||
kind: WorkerPool
|
||||
metadata:
|
||||
name: ousast-pool
|
||||
name: ${POOL_NAME}
|
||||
namespace: ax-system
|
||||
labels:
|
||||
workload: ousast
|
||||
spec:
|
||||
replicas: 2
|
||||
workerImage: ko://github.com/agent-substrate/substrate/cmd/ateom-gvisor
|
||||
replicas: ${POOL_REPLICAS}
|
||||
workerImage: ${WORKER_IMAGE}
|
||||
template:
|
||||
nodeSelector:
|
||||
ate.dev/substrate-version: "${SUBSTRATE_VERSION}"
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1536Mi
|
||||
cpu: "${POOL_CPU}"
|
||||
memory: ${POOL_MEMORY}
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 1536Mi
|
||||
memory: ${POOL_MEMORY}
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
# The k3s profile: the plane on the maintainer's production cluster (plane-on-kubernetes design section 1;
|
||||
# requirements "Target Environment"). Documented values, not secrets: the kubeconfig for the context, the GHCR
|
||||
# pull secret's content and the store's keys live outside this file. Every field is overridable by OUSAST_<FIELD>,
|
||||
# a pool by OUSAST_POOL_<NAME>_<FIELD>. Nothing has been applied to a k3s cluster yet; docs/deployment.md says
|
||||
# which items are planned.
|
||||
|
||||
exec = "remote" # the same CLI from a laptop or a CI job, through the cluster's kube context
|
||||
kube_context = "ousast-k3s" # the maintainer's context name for the k3s cluster
|
||||
registry = "ghcr.io/norandom" # images built by GitHub Actions from tagged commits (design section 8)
|
||||
images = "images.json" # the release asset {"runner": "ghcr.io/norandom/ousast-runner@sha256:...", "engine": ...}
|
||||
router_url = "" # empty: port-forward to atenet-router through the kube context (ax-tunnel)
|
||||
ax_server = "" # empty: the ax CLI's own tunnel through the kube context (ax-tunnel)
|
||||
memory = "s3://sast-memory" # the memory store; S3_ENDPOINT and the keys come from the CI secrets or .env
|
||||
atespace = "default"
|
||||
snapshots_bucket = "s3://ax-snapshots" # ax's AX_SNAPSHOTS_BUCKET, ours (rendered into the ax-server patch)
|
||||
image_pull_secret = "ghcr-pull" # only needed while the GHCR packages are private
|
||||
|
||||
[pools.default] # production sizing: four verify-class workers; the HPA (design section 5) scales it
|
||||
replicas = 4
|
||||
cpu = "1"
|
||||
memory = "1536Mi"
|
||||
|
||||
[pools.engine] # two engine workers sized from the measured 2.1 GiB peak under a 3 GiB limit
|
||||
replicas = 2
|
||||
cpu = "2"
|
||||
memory = "4Gi"
|
||||
@@ -0,0 +1,3 @@
|
||||
{
|
||||
"runner": "localhost:5001/ousast-runner@sha256:d2a55293999cc34581ef1f02a1ffb0c2dd8fc0cbe001ac952df81600e868f019"
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
# The kind profile: the plane on this laptop's single-node kind cluster, which ops/ax/up.sh creates and which is
|
||||
# the development default (plane-on-kubernetes design section 1). Values only; a credential never goes here
|
||||
# (keys stay in the environment or .env). Every field is overridable by OUSAST_<FIELD> in the environment, a pool
|
||||
# by OUSAST_POOL_<NAME>_<FIELD>. This file may name the kind cluster; the code must not (tests/test_plane_literals.py).
|
||||
|
||||
exec = "local" # the reconciler runs on this host against the cluster below
|
||||
kube_context = "kind-ousast" # kind's context for KIND_CLUSTER_NAME=ousast
|
||||
registry = "localhost:5001" # the kind-local registry up.sh creates (Substrate rewrites it for the node)
|
||||
images = "kind-images.json" # digest-pinned image references, written by up.sh after each build
|
||||
router_url = "" # empty: port-forward to atenet-router through the kube context (ax-tunnel)
|
||||
ax_server = "" # empty: the ax CLI's own tunnel through the kube context (ax-tunnel)
|
||||
memory = "s3://sast-memory" # the memory store; S3_ENDPOINT and the keys come from .env
|
||||
atespace = "default"
|
||||
snapshots_bucket = "s3://ax-snapshots" # ax's AX_SNAPSHOTS_BUCKET, ours (rendered into the ax-server patch)
|
||||
image_pull_secret = "" # the kind registry needs none
|
||||
|
||||
[pools.default] # ousast-pool: two gVisor workers fit the 7 GB host beside the control planes
|
||||
replicas = 2
|
||||
cpu = "1"
|
||||
memory = "1536Mi"
|
||||
|
||||
[pools.engine] # engine-pool (design section 4): one worker for the Joern engine task
|
||||
replicas = 1
|
||||
cpu = "2"
|
||||
memory = "4Gi"
|
||||
Reference in New Issue
Block a user