Skip to content

Commit cb2107c

Browse files
thc1006thc1006
committed
新增 Network Intent Controller 的部署腳本、RBAC 設定及服務定義，並更新相關的 Kustomization 配置
1 parent 17f3a80 commit cb2107c

7 files changed

Lines changed: 501 additions & 99 deletions

File tree

‎README.md‎

Lines changed: 110 additions & 97 deletions
Large diffs are not rendered by default.

‎deployments/kustomize/base/llm-processor/deployment.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ spec:
3535
prometheus.io/scrape: "true"
3636
prometheus.io/port: "8080"
3737
prometheus.io/path: "/metrics"
38+
# ServiceMonitor compatible - metrics endpoint available for Prometheus operator
3839
spec:
3940
serviceAccountName: llm-processor
4041
securityContext:
@@ -59,6 +60,8 @@ spec:
5960
# Service Configuration
6061
- name: PORT
6162
value: "8080"
63+
- name: HTTP_MAX_BODY
64+
value: "1048576"
6265
- name: LOG_LEVEL
6366
value: "info"
6467
- name: SERVICE_VERSION
@@ -83,8 +86,8 @@ spec:
8386
value: "mistral"
8487
- name: LLM_MODEL_NAME
8588
value: "mistral-8x22b"
86-
- name: LLM_TIMEOUT
87-
value: "60s"
89+
- name: LLM_TIMEOUT_SECS
90+
value: "15"
8891
- name: LLM_MAX_TOKENS
8992
value: "2048"
9093

‎deployments/kustomize/base/network-intent-controller/deploy.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/bin/bash
2+
3+
# Deploy Network Intent Controller
4+
# This script deploys the network-intent-controller to a Kubernetes cluster
5+
6+
set -e
7+
8+
echo "========================================"
9+
echo "Network Intent Controller Deployment"
10+
echo "========================================"
11+
echo ""
12+
13+
# Check if kubectl is installed
14+
if ! command -v kubectl &> /dev/null; then
15+
echo "Error: kubectl is not installed"
16+
exit 1
17+
fi
18+
19+
# Check if we can connect to a cluster
20+
if ! kubectl cluster-info &> /dev/null; then
21+
echo "Error: Cannot connect to Kubernetes cluster"
22+
echo "Please ensure your kubeconfig is properly configured"
23+
exit 1
24+
fi
25+
26+
# Create namespace if it doesn't exist
27+
echo "1. Creating namespace 'nephoran-system' if it doesn't exist..."
28+
kubectl create namespace nephoran-system --dry-run=client -o yaml | kubectl apply -f -
29+
30+
# Deploy the controller
31+
echo ""
32+
echo "2. Deploying network-intent-controller..."
33+
kubectl apply -k .
34+
35+
# Wait for deployment to be ready
36+
echo ""
37+
echo "3. Waiting for deployment to be ready..."
38+
kubectl -n nephoran-system wait --for=condition=available --timeout=120s deployment/network-intent-controller
39+
40+
# Check the status
41+
echo ""
42+
echo "4. Deployment Status:"
43+
kubectl -n nephoran-system get deployment network-intent-controller
44+
45+
echo ""
46+
echo "5. Pods Status:"
47+
kubectl -n nephoran-system get pods -l app=network-intent-controller
48+
49+
echo ""
50+
echo "========================================"
51+
echo "Deployment Complete!"
52+
echo "========================================"
53+
echo ""
54+
echo "To view logs:"
55+
echo " kubectl -n nephoran-system logs -l app=network-intent-controller"
56+
echo ""
57+
echo "To view metrics:"
58+
echo " kubectl -n nephoran-system port-forward svc/network-intent-controller-metrics 8080:8080"
59+
echo " Then visit: http://localhost:8080/metrics"
60+
echo ""

‎deployments/kustomize/base/network-intent-controller/deployment.yaml‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: network-intent-controller
5+
labels:
6+
app: network-intent-controller
7+
component: controller
8+
version: v2.0.0
9+
app.kubernetes.io/name: network-intent-controller
10+
app.kubernetes.io/component: controller
11+
app.kubernetes.io/part-of: nephoran-intent-operator
12+
app.kubernetes.io/version: v2.0.0
13+
annotations:
14+
deployment.kubernetes.io/revision: "1"
15+
nephoran.com/component: "network-intent-controller"
16+
nephoran.com/enhanced: "true"
17+
spec:
18+
replicas: 1
19+
strategy:
20+
type: RollingUpdate
21+
rollingUpdate:
22+
maxSurge: 1
23+
maxUnavailable: 0
24+
selector:
25+
matchLabels:
26+
app: network-intent-controller
27+
template:
28+
metadata:
29+
labels:
30+
app: network-intent-controller
31+
component: controller
32+
version: v2.0.0
33+
annotations:
34+
prometheus.io/scrape: "true"
35+
prometheus.io/port: "8080"
36+
prometheus.io/path: "/metrics"
37+
# ServiceMonitor compatible - metrics endpoint available for Prometheus operator
38+
spec:
39+
serviceAccountName: network-intent-controller
40+
securityContext:
41+
runAsNonRoot: true
42+
runAsUser: 65532
43+
runAsGroup: 65532
44+
fsGroup: 65532
45+
seccompProfile:
46+
type: RuntimeDefault
47+
containers:
48+
- name: controller
49+
image: ghcr.io/thc1006/nephoran-intent-operator/network-intent-controller:v2.0.0
50+
imagePullPolicy: Always
51+
command: ["/network-intent-controller"]
52+
args:
53+
- "--health-probe-bind-address=:8081"
54+
- "--metrics-bind-address=:8080"
55+
- "--leader-elect"
56+
- "--zap-log-level=info"
57+
ports:
58+
- name: http
59+
containerPort: 8080
60+
protocol: TCP
61+
- name: webhook
62+
containerPort: 9443
63+
protocol: TCP
64+
- name: health
65+
containerPort: 8081
66+
protocol: TCP
67+
env:
68+
# Controller Configuration
69+
- name: ENABLE_NETWORK_INTENT
70+
value: "true"
71+
- name: ENABLE_LLM_INTENT
72+
value: "false"
73+
- name: LOG_LEVEL
74+
value: "info"
75+
- name: SERVICE_VERSION
76+
value: "v2.0.0"
77+
- name: POD_NAME
78+
valueFrom:
79+
fieldRef:
80+
fieldPath: metadata.name
81+
- name: POD_NAMESPACE
82+
valueFrom:
83+
fieldRef:
84+
fieldPath: metadata.namespace
85+
- name: POD_IP
86+
valueFrom:
87+
fieldRef:
88+
fieldPath: status.podIP
89+
90+
# Metrics and Monitoring
91+
- name: METRICS_ENABLED
92+
value: "true"
93+
- name: TRACING_ENABLED
94+
value: "true"
95+
- name: JAEGER_ENDPOINT
96+
value: "http://jaeger-collector.monitoring.svc.cluster.local:14268/api/traces"
97+
98+
# Git Information (injected at build time)
99+
- name: GIT_COMMIT
100+
value: "$(GIT_COMMIT)"
101+
- name: GIT_BRANCH
102+
value: "$(GIT_BRANCH)"
103+
104+
# Health Checks
105+
livenessProbe:
106+
httpGet:
107+
path: /healthz
108+
port: health
109+
scheme: HTTP
110+
initialDelaySeconds: 15
111+
periodSeconds: 20
112+
timeoutSeconds: 5
113+
failureThreshold: 3
114+
successThreshold: 1
115+
116+
readinessProbe:
117+
httpGet:
118+
path: /readyz
119+
port: health
120+
scheme: HTTP
121+
initialDelaySeconds: 5
122+
periodSeconds: 10
123+
timeoutSeconds: 3
124+
failureThreshold: 3
125+
successThreshold: 1
126+
127+
# Startup Probe for slow-starting containers
128+
startupProbe:
129+
httpGet:
130+
path: /healthz
131+
port: health
132+
scheme: HTTP
133+
initialDelaySeconds: 10
134+
periodSeconds: 5
135+
timeoutSeconds: 3
136+
failureThreshold: 30
137+
successThreshold: 1
138+
139+
# Resource Requirements
140+
resources:
141+
requests:
142+
cpu: 100m
143+
memory: 128Mi
144+
ephemeral-storage: 512Mi
145+
limits:
146+
cpu: 500m
147+
memory: 512Mi
148+
ephemeral-storage: 1Gi
149+
150+
# Security Context
151+
securityContext:
152+
allowPrivilegeEscalation: false
153+
readOnlyRootFilesystem: true
154+
capabilities:
155+
drop:
156+
- ALL
157+
runAsNonRoot: true
158+
runAsUser: 65532
159+
runAsGroup: 65532
160+
161+
# Volume Mounts
162+
volumeMounts:
163+
- name: tmp
164+
mountPath: /tmp
165+
readOnly: false
166+
- name: webhook-certs
167+
mountPath: /tmp/k8s-webhook-server/serving-certs
168+
readOnly: true
169+
170+
# Pod-level configurations
171+
restartPolicy: Always
172+
terminationGracePeriodSeconds: 10
173+
174+
# Volumes
175+
volumes:
176+
- name: tmp
177+
emptyDir:
178+
sizeLimit: 100Mi
179+
- name: webhook-certs
180+
secret:
181+
secretName: network-intent-controller-webhook-certs
182+
optional: true

‎deployments/kustomize/base/network-intent-controller/kustomization.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
metadata:
5+
name: network-intent-controller
6+
labels:
7+
app.kubernetes.io/name: network-intent-controller
8+
app.kubernetes.io/component: controller
9+
app.kubernetes.io/part-of: nephoran-intent-operator
10+
11+
namespace: nephoran-system
12+
13+
resources:
14+
- deployment.yaml
15+
- rbac.yaml
16+
- service.yaml
17+
18+
labels:
19+
- pairs:
20+
app: network-intent-controller
21+
component: controller
22+
23+
images:
24+
- name: ghcr.io/thc1006/nephoran-intent-operator/network-intent-controller
25+
newTag: v2.0.0
26+
27+
# Configuration options
28+
configurations: []
29+
30+
# Patches for environment-specific customizations
31+
patches: []
32+
33+
# Generate ConfigMap or Secret from files
34+
configMapGenerator: []
35+
secretGenerator: []

‎deployments/kustomize/base/network-intent-controller/rbac.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: network-intent-controller
5+
labels:
6+
app: network-intent-controller
7+
component: controller
8+
app.kubernetes.io/name: network-intent-controller
9+
app.kubernetes.io/component: controller
10+
app.kubernetes.io/part-of: nephoran-intent-operator
11+
---
12+
apiVersion: rbac.authorization.k8s.io/v1
13+
kind: ClusterRole
14+
metadata:
15+
name: network-intent-controller-role
16+
labels:
17+
app: network-intent-controller
18+
component: controller
19+
app.kubernetes.io/name: network-intent-controller
20+
app.kubernetes.io/component: controller
21+
app.kubernetes.io/part-of: nephoran-intent-operator
22+
rules:
23+
# NetworkIntent CRD permissions
24+
- apiGroups: ["nephoran.com"]
25+
resources: ["networkintents"]
26+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
27+
- apiGroups: ["nephoran.com"]
28+
resources: ["networkintents/status"]
29+
verbs: ["get", "update", "patch"]
30+
- apiGroups: ["nephoran.com"]
31+
resources: ["networkintents/finalizers"]
32+
verbs: ["update"]
33+
34+
# Event permissions for status updates
35+
- apiGroups: [""]
36+
resources: ["events"]
37+
verbs: ["create", "patch"]
38+
39+
# ConfigMap permissions for leader election
40+
- apiGroups: [""]
41+
resources: ["configmaps"]
42+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
43+
- apiGroups: ["coordination.k8s.io"]
44+
resources: ["leases"]
45+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
46+
47+
# Pod permissions for controller runtime
48+
- apiGroups: [""]
49+
resources: ["pods"]
50+
verbs: ["get", "list", "watch"]
51+
- apiGroups: [""]
52+
resources: ["nodes"]
53+
verbs: ["get", "list", "watch"]
54+
55+
# Secret permissions if needed for authentication
56+
- apiGroups: [""]
57+
resources: ["secrets"]
58+
verbs: ["get", "list", "watch"]
59+
60+
# Webhook permissions
61+
- apiGroups: ["admissionregistration.k8s.io"]
62+
resources: ["validatingadmissionwebhooks", "mutatingadmissionwebhooks"]
63+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
64+
---
65+
apiVersion: rbac.authorization.k8s.io/v1
66+
kind: ClusterRoleBinding
67+
metadata:
68+
name: network-intent-controller-binding
69+
labels:
70+
app: network-intent-controller
71+
component: controller
72+
app.kubernetes.io/name: network-intent-controller
73+
app.kubernetes.io/component: controller
74+
app.kubernetes.io/part-of: nephoran-intent-operator
75+
roleRef:
76+
apiGroup: rbac.authorization.k8s.io
77+
kind: ClusterRole
78+
name: network-intent-controller-role
79+
subjects:
80+
- kind: ServiceAccount
81+
name: network-intent-controller
82+
namespace: nephoran-system

0 commit comments

Comments
 (0)