From 1f38305394154a2681366ae399f5ad7bf62831dc Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Fri, 8 May 2026 04:27:47 +0000 Subject: [PATCH] add rays new deployment and fix gateway --- .../customer1/hermes-agent/kustomization.yaml | 2 +- .../hermes-agent/new-deployment-rays.yaml | 217 ++++++++++++++++++ .../hermes-agent/new-deployment.yaml | 1 + .../gpus/base/vllm-servers/rtx6000-vllm.yaml | 2 +- rays-new-deployment.yaml | 217 ++++++++++++++++++ 5 files changed, 437 insertions(+), 2 deletions(-) create mode 100644 apps/base/customer1/hermes-agent/new-deployment-rays.yaml create mode 100644 rays-new-deployment.yaml diff --git a/apps/base/customer1/hermes-agent/kustomization.yaml b/apps/base/customer1/hermes-agent/kustomization.yaml index dee3256..6dd3bb0 100644 --- a/apps/base/customer1/hermes-agent/kustomization.yaml +++ b/apps/base/customer1/hermes-agent/kustomization.yaml @@ -5,7 +5,7 @@ resources: - hermes-secret.yaml - configmap.yaml - rays-hermes-secret.yaml - - rays-deployment.yaml - api-server-configmap.yaml - hermes-webui-service.yaml - hermes-service.yaml + - new-deployment-rays.yaml diff --git a/apps/base/customer1/hermes-agent/new-deployment-rays.yaml b/apps/base/customer1/hermes-agent/new-deployment-rays.yaml new file mode 100644 index 0000000..da38535 --- /dev/null +++ b/apps/base/customer1/hermes-agent/new-deployment-rays.yaml @@ -0,0 +1,217 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rays-hermes-agent + namespace: customer1 +spec: + replicas: 1 + selector: + matchLabels: + app: rays-hermes-agent + template: + metadata: + labels: + app: rays-hermes-agent + spec: + # 1. Pod-level security context to ensure volumes inherit the right group + shareProcessNamespace: true + securityContext: + fsGroup: 1000 + + # 2. Define our shared bridge volumes + volumes: + - name: hermes-home + persistentVolumeClaim: + claimName: rays-hermes-agent-pvc + - name: hermes-agent-src + emptyDir: {} + - name: hermes-workspace + emptyDir: {} + - name: hermes-webui-app + emptyDir: {} + - name: hermes-configmap + configMap: + name: hermes-config + + initContainers: + # 3. K8s workaround: Copy the agent source code into the shared emptyDir + - name: copy-agent-source + image: nousresearch/hermes-agent:latest + command: + - "sh" + - "-c" + - | + cp -a /opt/hermes/. /shared-src/ && chown -R 1024:1000 /shared-src /shared-home + + if [ -f /tmp/hermes/config.yaml ]; then + cp -f /tmp/hermes/config.yaml /shared-home/config.yaml + fi + + mkdir -p /shared-home/.local/bin + echo '#!/bin/sh' > /shared-home/.local/bin/gh + echo 'exit 1' >> /shared-home/.local/bin/gh + chmod +x /shared-home/.local/bin/gh + + securityContext: + runAsUser: 0 # Run as root briefly to copy and fix permissions + runAsNonRoot: false + volumeMounts: + - name: hermes-agent-src + mountPath: /shared-src + - name: hermes-home + mountPath: /shared-home + - name: hermes-configmap + mountPath: /tmp/hermes/config.yaml + subPath: config.yaml + containers: + # ========================================== + # CONTAINER 1: HERMES AGENT + # ========================================== + - name: rays-hermes-agent + image: nousresearch/hermes-agent:latest + args: ["gateway", "run"] + ports: + - containerPort: 8642 + + env: + - name: PATH + value: "/home/hermes/.hermes/.local/bin:/opt/hermes/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + - name: HOME + value: "/home/hermes/.hermes" + - name: HERMES_HOME + value: "/home/hermes/.hermes" + - name: HERMES_UID + value: "1024" + - name: HERMES_GID + value: "1000" + + - name: TELEGRAM_BOT_TOKEN + valueFrom: + secretKeyRef: + name: hermes-secrets + key: TELEGRAM_BOT_TOKEN + + - name: XAI_API_KEY + valueFrom: + secretKeyRef: + name: xai-apikey + key: XAI_API_KEY + + - name: TELEGRAM_ALLOWED_USERS + value: "7105451284" + + # === Local vLLM (OpenAI-compatible) === + - name: OPENAI_BASE_URL + value: "http://openclaw-brain-service.customer1.svc.cluster.local:8000/v1" # ← adjust if your service name differs + + - name: HERMES_MODEL_PROVIDER + value: xai + + - name: HERMES_MODEL + value: grok-4.20-0309-reasoning + + - name: OPENAI_API_KEY + value: "dummy" + + + + volumeMounts: + - name: hermes-home + mountPath: /home/hermes/.hermes + - name: hermes-agent-src + mountPath: /opt/hermes + + securityContext: + runAsUser: 1024 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: true + + # ========================================== + # CONTAINER 2: HERMES WEBUI + # ========================================== + - name: hermes-webui + image: ghcr.io/nesquena/hermes-webui:latest + ports: + - containerPort: 8787 + + env: + - name: HOME + value: "/home/hermeswebui/.hermes" + - name: HERMES_HOME + value: "/home/hermeswebui/.hermes" + - name: HERMES_WEBUI_HOST + value: "0.0.0.0" + - name: HERMES_WEBUI_PORT + value: "8787" + - name: HERMES_WEBUI_STATE_DIR + value: "/home/hermeswebui/.hermes/webui" + - name: WANTED_UID + value: "1024" + - name: WANTED_GID + value: "1000" + - name: HERMES_SKIP_CHMOD + value: "1" + + volumeMounts: + - name: hermes-home + mountPath: /home/hermeswebui/.hermes + # This is where the WebUI looks for the agent source code to run `uv pip install` + - name: hermes-agent-src + mountPath: /home/hermeswebui/.hermes/hermes-agent + - name: hermes-workspace + mountPath: /workspace + - name: hermes-webui-app + mountPath: /app + + resources: + requests: + memory: 500Mi + cpu: "100m" + limits: + memory: 1Gi + cpu: "500m" + + securityContext: + runAsUser: 1024 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: true + readOnlyRootFilesystem: false + seccompProfile: + type: RuntimeDefault +--- + +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: rays-hermes-agent-pvc + namespace: customer1 +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 25Gi + +--- + + +apiVersion: v1 +kind: Service +metadata: + name: rays-hermes-webui-service + namespace: customer1 + annotations: + tailscale.com/expose: "true" + tailscale.com/hostname: "rays-hermes-webui" + tailscale.com/tags: "tag:k8s-operator" + tailscale.com/ports: "http:8787" +spec: + type: ClusterIP + selector: + app: hermes-agent + ports: + - port: 8787 + targetPort: 8787 + name: http diff --git a/apps/base/customer1/hermes-agent/new-deployment.yaml b/apps/base/customer1/hermes-agent/new-deployment.yaml index a09dce7..92b84f2 100644 --- a/apps/base/customer1/hermes-agent/new-deployment.yaml +++ b/apps/base/customer1/hermes-agent/new-deployment.yaml @@ -14,6 +14,7 @@ spec: app: hermes-agent spec: # 1. Pod-level security context to ensure volumes inherit the right group + shareProcessNamespace: true securityContext: fsGroup: 1000 diff --git a/infrastructure/gpus/base/vllm-servers/rtx6000-vllm.yaml b/infrastructure/gpus/base/vllm-servers/rtx6000-vllm.yaml index b993e20..1062754 100644 --- a/infrastructure/gpus/base/vllm-servers/rtx6000-vllm.yaml +++ b/infrastructure/gpus/base/vllm-servers/rtx6000-vllm.yaml @@ -38,7 +38,7 @@ spec: - --tensor-parallel-size=1 - --tokenizer-mode=hf - --gpu-memory-utilization=0.95 - - --max-model-len=131072 + - --max-model-len=237864 - --enable-auto-tool-choice - --kv-cache-dtype=fp8 - --max-num-batched-tokens=32768 diff --git a/rays-new-deployment.yaml b/rays-new-deployment.yaml new file mode 100644 index 0000000..da38535 --- /dev/null +++ b/rays-new-deployment.yaml @@ -0,0 +1,217 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rays-hermes-agent + namespace: customer1 +spec: + replicas: 1 + selector: + matchLabels: + app: rays-hermes-agent + template: + metadata: + labels: + app: rays-hermes-agent + spec: + # 1. Pod-level security context to ensure volumes inherit the right group + shareProcessNamespace: true + securityContext: + fsGroup: 1000 + + # 2. Define our shared bridge volumes + volumes: + - name: hermes-home + persistentVolumeClaim: + claimName: rays-hermes-agent-pvc + - name: hermes-agent-src + emptyDir: {} + - name: hermes-workspace + emptyDir: {} + - name: hermes-webui-app + emptyDir: {} + - name: hermes-configmap + configMap: + name: hermes-config + + initContainers: + # 3. K8s workaround: Copy the agent source code into the shared emptyDir + - name: copy-agent-source + image: nousresearch/hermes-agent:latest + command: + - "sh" + - "-c" + - | + cp -a /opt/hermes/. /shared-src/ && chown -R 1024:1000 /shared-src /shared-home + + if [ -f /tmp/hermes/config.yaml ]; then + cp -f /tmp/hermes/config.yaml /shared-home/config.yaml + fi + + mkdir -p /shared-home/.local/bin + echo '#!/bin/sh' > /shared-home/.local/bin/gh + echo 'exit 1' >> /shared-home/.local/bin/gh + chmod +x /shared-home/.local/bin/gh + + securityContext: + runAsUser: 0 # Run as root briefly to copy and fix permissions + runAsNonRoot: false + volumeMounts: + - name: hermes-agent-src + mountPath: /shared-src + - name: hermes-home + mountPath: /shared-home + - name: hermes-configmap + mountPath: /tmp/hermes/config.yaml + subPath: config.yaml + containers: + # ========================================== + # CONTAINER 1: HERMES AGENT + # ========================================== + - name: rays-hermes-agent + image: nousresearch/hermes-agent:latest + args: ["gateway", "run"] + ports: + - containerPort: 8642 + + env: + - name: PATH + value: "/home/hermes/.hermes/.local/bin:/opt/hermes/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + - name: HOME + value: "/home/hermes/.hermes" + - name: HERMES_HOME + value: "/home/hermes/.hermes" + - name: HERMES_UID + value: "1024" + - name: HERMES_GID + value: "1000" + + - name: TELEGRAM_BOT_TOKEN + valueFrom: + secretKeyRef: + name: hermes-secrets + key: TELEGRAM_BOT_TOKEN + + - name: XAI_API_KEY + valueFrom: + secretKeyRef: + name: xai-apikey + key: XAI_API_KEY + + - name: TELEGRAM_ALLOWED_USERS + value: "7105451284" + + # === Local vLLM (OpenAI-compatible) === + - name: OPENAI_BASE_URL + value: "http://openclaw-brain-service.customer1.svc.cluster.local:8000/v1" # ← adjust if your service name differs + + - name: HERMES_MODEL_PROVIDER + value: xai + + - name: HERMES_MODEL + value: grok-4.20-0309-reasoning + + - name: OPENAI_API_KEY + value: "dummy" + + + + volumeMounts: + - name: hermes-home + mountPath: /home/hermes/.hermes + - name: hermes-agent-src + mountPath: /opt/hermes + + securityContext: + runAsUser: 1024 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: true + + # ========================================== + # CONTAINER 2: HERMES WEBUI + # ========================================== + - name: hermes-webui + image: ghcr.io/nesquena/hermes-webui:latest + ports: + - containerPort: 8787 + + env: + - name: HOME + value: "/home/hermeswebui/.hermes" + - name: HERMES_HOME + value: "/home/hermeswebui/.hermes" + - name: HERMES_WEBUI_HOST + value: "0.0.0.0" + - name: HERMES_WEBUI_PORT + value: "8787" + - name: HERMES_WEBUI_STATE_DIR + value: "/home/hermeswebui/.hermes/webui" + - name: WANTED_UID + value: "1024" + - name: WANTED_GID + value: "1000" + - name: HERMES_SKIP_CHMOD + value: "1" + + volumeMounts: + - name: hermes-home + mountPath: /home/hermeswebui/.hermes + # This is where the WebUI looks for the agent source code to run `uv pip install` + - name: hermes-agent-src + mountPath: /home/hermeswebui/.hermes/hermes-agent + - name: hermes-workspace + mountPath: /workspace + - name: hermes-webui-app + mountPath: /app + + resources: + requests: + memory: 500Mi + cpu: "100m" + limits: + memory: 1Gi + cpu: "500m" + + securityContext: + runAsUser: 1024 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: true + readOnlyRootFilesystem: false + seccompProfile: + type: RuntimeDefault +--- + +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: rays-hermes-agent-pvc + namespace: customer1 +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 25Gi + +--- + + +apiVersion: v1 +kind: Service +metadata: + name: rays-hermes-webui-service + namespace: customer1 + annotations: + tailscale.com/expose: "true" + tailscale.com/hostname: "rays-hermes-webui" + tailscale.com/tags: "tag:k8s-operator" + tailscale.com/ports: "http:8787" +spec: + type: ClusterIP + selector: + app: hermes-agent + ports: + - port: 8787 + targetPort: 8787 + name: http