cf8832c79c
- 19 agent definition files with role, responsibilities, secrets, tools, constraints - k8s manifests: namespace, ServiceAccounts, RBAC, NetworkPolicies, Job template, dispatcher CronJob - dispatcher: Python CronJob that claims Vikunja Todo tasks and spawns agent Jobs - container: Dockerfile + entrypoint bootstrapping OpenBao auth and opencode runtime - Separate Dockerfile.dispatcher for the lightweight dispatcher image
68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
---
|
|
# Dispatcher CronJob — runs every 2 minutes, claims unclaimed tasks from Vikunja
|
|
# and spawns agent Jobs for each
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: dispatcher
|
|
namespace: autojanet
|
|
labels:
|
|
autojanet/role: dispatcher
|
|
spec:
|
|
schedule: "*/2 * * * *"
|
|
concurrencyPolicy: Forbid # never run two dispatchers simultaneously
|
|
successfulJobsHistoryLimit: 5
|
|
failedJobsHistoryLimit: 5
|
|
jobTemplate:
|
|
spec:
|
|
ttlSecondsAfterFinished: 600
|
|
template:
|
|
metadata:
|
|
labels:
|
|
autojanet/role: dispatcher
|
|
spec:
|
|
serviceAccountName: dispatcher
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: dispatcher
|
|
image: registry.ctz.fyi/autojanet/dispatcher:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: OPENBAO_ADDR
|
|
value: "http://openbao.openbao.svc.cluster.local:8200"
|
|
- name: OPENBAO_ROLE_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: dispatcher-approle
|
|
key: role_id
|
|
- name: OPENBAO_SECRET_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: dispatcher-approle
|
|
key: secret_id
|
|
- name: VIKUNJA_BASE_URL
|
|
value: "https://tasks.ctz.fyi"
|
|
- name: VIKUNJA_PROJECT_ID
|
|
value: "78"
|
|
- name: VIKUNJA_TODO_BUCKET_ID
|
|
value: "116"
|
|
- name: VIKUNJA_IN_PROGRESS_BUCKET_ID
|
|
value: "117"
|
|
- name: K8S_NAMESPACE
|
|
value: "autojanet"
|
|
- name: AGENT_IMAGE
|
|
value: "registry.ctz.fyi/autojanet/agent:latest"
|
|
resources:
|
|
requests:
|
|
cpu: "100m"
|
|
memory: "128Mi"
|
|
limits:
|
|
cpu: "500m"
|
|
memory: "256Mi"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|