add rays new deployment and fix gateway
This commit is contained in:
sirius0xdev
parent
b101ed43ab
commit
1f38305394
5 changed files with 437 additions and 2 deletions
|
|
@ -5,7 +5,7 @@ resources:
|
|||
- hermes-secret.yaml
|
||||
- configmap.yaml
|
||||
- rays-hermes-secret.yaml
|
||||
- rays-deployment.yaml
|
||||
- api-server-configmap.yaml
|
||||
- hermes-webui-service.yaml
|
||||
- hermes-service.yaml
|
||||
- new-deployment-rays.yaml
|
||||
|
|
|
|||
217
apps/base/customer1/hermes-agent/new-deployment-rays.yaml
Normal file
217
apps/base/customer1/hermes-agent/new-deployment-rays.yaml
Normal file
|
|
@ -0,0 +1,217 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: rays-hermes-agent
|
||||
namespace: customer1
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: rays-hermes-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: rays-hermes-agent
|
||||
spec:
|
||||
# 1. Pod-level security context to ensure volumes inherit the right group
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
# 2. Define our shared bridge volumes
|
||||
volumes:
|
||||
- name: hermes-home
|
||||
persistentVolumeClaim:
|
||||
claimName: rays-hermes-agent-pvc
|
||||
- name: hermes-agent-src
|
||||
emptyDir: {}
|
||||
- name: hermes-workspace
|
||||
emptyDir: {}
|
||||
- name: hermes-webui-app
|
||||
emptyDir: {}
|
||||
- name: hermes-configmap
|
||||
configMap:
|
||||
name: hermes-config
|
||||
|
||||
initContainers:
|
||||
# 3. K8s workaround: Copy the agent source code into the shared emptyDir
|
||||
- name: copy-agent-source
|
||||
image: nousresearch/hermes-agent:latest
|
||||
command:
|
||||
- "sh"
|
||||
- "-c"
|
||||
- |
|
||||
cp -a /opt/hermes/. /shared-src/ && chown -R 1024:1000 /shared-src /shared-home
|
||||
|
||||
if [ -f /tmp/hermes/config.yaml ]; then
|
||||
cp -f /tmp/hermes/config.yaml /shared-home/config.yaml
|
||||
fi
|
||||
|
||||
mkdir -p /shared-home/.local/bin
|
||||
echo '#!/bin/sh' > /shared-home/.local/bin/gh
|
||||
echo 'exit 1' >> /shared-home/.local/bin/gh
|
||||
chmod +x /shared-home/.local/bin/gh
|
||||
|
||||
securityContext:
|
||||
runAsUser: 0 # Run as root briefly to copy and fix permissions
|
||||
runAsNonRoot: false
|
||||
volumeMounts:
|
||||
- name: hermes-agent-src
|
||||
mountPath: /shared-src
|
||||
- name: hermes-home
|
||||
mountPath: /shared-home
|
||||
- name: hermes-configmap
|
||||
mountPath: /tmp/hermes/config.yaml
|
||||
subPath: config.yaml
|
||||
containers:
|
||||
# ==========================================
|
||||
# CONTAINER 1: HERMES AGENT
|
||||
# ==========================================
|
||||
- name: rays-hermes-agent
|
||||
image: nousresearch/hermes-agent:latest
|
||||
args: ["gateway", "run"]
|
||||
ports:
|
||||
- containerPort: 8642
|
||||
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/home/hermes/.hermes/.local/bin:/opt/hermes/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
- name: HOME
|
||||
value: "/home/hermes/.hermes"
|
||||
- name: HERMES_HOME
|
||||
value: "/home/hermes/.hermes"
|
||||
- name: HERMES_UID
|
||||
value: "1024"
|
||||
- name: HERMES_GID
|
||||
value: "1000"
|
||||
|
||||
- name: TELEGRAM_BOT_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hermes-secrets
|
||||
key: TELEGRAM_BOT_TOKEN
|
||||
|
||||
- name: XAI_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: xai-apikey
|
||||
key: XAI_API_KEY
|
||||
|
||||
- name: TELEGRAM_ALLOWED_USERS
|
||||
value: "7105451284"
|
||||
|
||||
# === Local vLLM (OpenAI-compatible) ===
|
||||
- name: OPENAI_BASE_URL
|
||||
value: "http://openclaw-brain-service.customer1.svc.cluster.local:8000/v1" # ← adjust if your service name differs
|
||||
|
||||
- name: HERMES_MODEL_PROVIDER
|
||||
value: xai
|
||||
|
||||
- name: HERMES_MODEL
|
||||
value: grok-4.20-0309-reasoning
|
||||
|
||||
- name: OPENAI_API_KEY
|
||||
value: "dummy"
|
||||
|
||||
|
||||
|
||||
volumeMounts:
|
||||
- name: hermes-home
|
||||
mountPath: /home/hermes/.hermes
|
||||
- name: hermes-agent-src
|
||||
mountPath: /opt/hermes
|
||||
|
||||
securityContext:
|
||||
runAsUser: 1024
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: true
|
||||
|
||||
# ==========================================
|
||||
# CONTAINER 2: HERMES WEBUI
|
||||
# ==========================================
|
||||
- name: hermes-webui
|
||||
image: ghcr.io/nesquena/hermes-webui:latest
|
||||
ports:
|
||||
- containerPort: 8787
|
||||
|
||||
env:
|
||||
- name: HOME
|
||||
value: "/home/hermeswebui/.hermes"
|
||||
- name: HERMES_HOME
|
||||
value: "/home/hermeswebui/.hermes"
|
||||
- name: HERMES_WEBUI_HOST
|
||||
value: "0.0.0.0"
|
||||
- name: HERMES_WEBUI_PORT
|
||||
value: "8787"
|
||||
- name: HERMES_WEBUI_STATE_DIR
|
||||
value: "/home/hermeswebui/.hermes/webui"
|
||||
- name: WANTED_UID
|
||||
value: "1024"
|
||||
- name: WANTED_GID
|
||||
value: "1000"
|
||||
- name: HERMES_SKIP_CHMOD
|
||||
value: "1"
|
||||
|
||||
volumeMounts:
|
||||
- name: hermes-home
|
||||
mountPath: /home/hermeswebui/.hermes
|
||||
# This is where the WebUI looks for the agent source code to run `uv pip install`
|
||||
- name: hermes-agent-src
|
||||
mountPath: /home/hermeswebui/.hermes/hermes-agent
|
||||
- name: hermes-workspace
|
||||
mountPath: /workspace
|
||||
- name: hermes-webui-app
|
||||
mountPath: /app
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: 500Mi
|
||||
cpu: "100m"
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: "500m"
|
||||
|
||||
securityContext:
|
||||
runAsUser: 1024
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: true
|
||||
readOnlyRootFilesystem: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: rays-hermes-agent-pvc
|
||||
namespace: customer1
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 25Gi
|
||||
|
||||
---
|
||||
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: rays-hermes-webui-service
|
||||
namespace: customer1
|
||||
annotations:
|
||||
tailscale.com/expose: "true"
|
||||
tailscale.com/hostname: "rays-hermes-webui"
|
||||
tailscale.com/tags: "tag:k8s-operator"
|
||||
tailscale.com/ports: "http:8787"
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: hermes-agent
|
||||
ports:
|
||||
- port: 8787
|
||||
targetPort: 8787
|
||||
name: http
|
||||
|
|
@ -14,6 +14,7 @@ spec:
|
|||
app: hermes-agent
|
||||
spec:
|
||||
# 1. Pod-level security context to ensure volumes inherit the right group
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
|
|
|
|||
|
|
@ -38,7 +38,7 @@ spec:
|
|||
- --tensor-parallel-size=1
|
||||
- --tokenizer-mode=hf
|
||||
- --gpu-memory-utilization=0.95
|
||||
- --max-model-len=131072
|
||||
- --max-model-len=237864
|
||||
- --enable-auto-tool-choice
|
||||
- --kv-cache-dtype=fp8
|
||||
- --max-num-batched-tokens=32768
|
||||
|
|
|
|||
217
rays-new-deployment.yaml
Normal file
217
rays-new-deployment.yaml
Normal file
|
|
@ -0,0 +1,217 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: rays-hermes-agent
|
||||
namespace: customer1
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: rays-hermes-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: rays-hermes-agent
|
||||
spec:
|
||||
# 1. Pod-level security context to ensure volumes inherit the right group
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
# 2. Define our shared bridge volumes
|
||||
volumes:
|
||||
- name: hermes-home
|
||||
persistentVolumeClaim:
|
||||
claimName: rays-hermes-agent-pvc
|
||||
- name: hermes-agent-src
|
||||
emptyDir: {}
|
||||
- name: hermes-workspace
|
||||
emptyDir: {}
|
||||
- name: hermes-webui-app
|
||||
emptyDir: {}
|
||||
- name: hermes-configmap
|
||||
configMap:
|
||||
name: hermes-config
|
||||
|
||||
initContainers:
|
||||
# 3. K8s workaround: Copy the agent source code into the shared emptyDir
|
||||
- name: copy-agent-source
|
||||
image: nousresearch/hermes-agent:latest
|
||||
command:
|
||||
- "sh"
|
||||
- "-c"
|
||||
- |
|
||||
cp -a /opt/hermes/. /shared-src/ && chown -R 1024:1000 /shared-src /shared-home
|
||||
|
||||
if [ -f /tmp/hermes/config.yaml ]; then
|
||||
cp -f /tmp/hermes/config.yaml /shared-home/config.yaml
|
||||
fi
|
||||
|
||||
mkdir -p /shared-home/.local/bin
|
||||
echo '#!/bin/sh' > /shared-home/.local/bin/gh
|
||||
echo 'exit 1' >> /shared-home/.local/bin/gh
|
||||
chmod +x /shared-home/.local/bin/gh
|
||||
|
||||
securityContext:
|
||||
runAsUser: 0 # Run as root briefly to copy and fix permissions
|
||||
runAsNonRoot: false
|
||||
volumeMounts:
|
||||
- name: hermes-agent-src
|
||||
mountPath: /shared-src
|
||||
- name: hermes-home
|
||||
mountPath: /shared-home
|
||||
- name: hermes-configmap
|
||||
mountPath: /tmp/hermes/config.yaml
|
||||
subPath: config.yaml
|
||||
containers:
|
||||
# ==========================================
|
||||
# CONTAINER 1: HERMES AGENT
|
||||
# ==========================================
|
||||
- name: rays-hermes-agent
|
||||
image: nousresearch/hermes-agent:latest
|
||||
args: ["gateway", "run"]
|
||||
ports:
|
||||
- containerPort: 8642
|
||||
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/home/hermes/.hermes/.local/bin:/opt/hermes/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
- name: HOME
|
||||
value: "/home/hermes/.hermes"
|
||||
- name: HERMES_HOME
|
||||
value: "/home/hermes/.hermes"
|
||||
- name: HERMES_UID
|
||||
value: "1024"
|
||||
- name: HERMES_GID
|
||||
value: "1000"
|
||||
|
||||
- name: TELEGRAM_BOT_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hermes-secrets
|
||||
key: TELEGRAM_BOT_TOKEN
|
||||
|
||||
- name: XAI_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: xai-apikey
|
||||
key: XAI_API_KEY
|
||||
|
||||
- name: TELEGRAM_ALLOWED_USERS
|
||||
value: "7105451284"
|
||||
|
||||
# === Local vLLM (OpenAI-compatible) ===
|
||||
- name: OPENAI_BASE_URL
|
||||
value: "http://openclaw-brain-service.customer1.svc.cluster.local:8000/v1" # ← adjust if your service name differs
|
||||
|
||||
- name: HERMES_MODEL_PROVIDER
|
||||
value: xai
|
||||
|
||||
- name: HERMES_MODEL
|
||||
value: grok-4.20-0309-reasoning
|
||||
|
||||
- name: OPENAI_API_KEY
|
||||
value: "dummy"
|
||||
|
||||
|
||||
|
||||
volumeMounts:
|
||||
- name: hermes-home
|
||||
mountPath: /home/hermes/.hermes
|
||||
- name: hermes-agent-src
|
||||
mountPath: /opt/hermes
|
||||
|
||||
securityContext:
|
||||
runAsUser: 1024
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: true
|
||||
|
||||
# ==========================================
|
||||
# CONTAINER 2: HERMES WEBUI
|
||||
# ==========================================
|
||||
- name: hermes-webui
|
||||
image: ghcr.io/nesquena/hermes-webui:latest
|
||||
ports:
|
||||
- containerPort: 8787
|
||||
|
||||
env:
|
||||
- name: HOME
|
||||
value: "/home/hermeswebui/.hermes"
|
||||
- name: HERMES_HOME
|
||||
value: "/home/hermeswebui/.hermes"
|
||||
- name: HERMES_WEBUI_HOST
|
||||
value: "0.0.0.0"
|
||||
- name: HERMES_WEBUI_PORT
|
||||
value: "8787"
|
||||
- name: HERMES_WEBUI_STATE_DIR
|
||||
value: "/home/hermeswebui/.hermes/webui"
|
||||
- name: WANTED_UID
|
||||
value: "1024"
|
||||
- name: WANTED_GID
|
||||
value: "1000"
|
||||
- name: HERMES_SKIP_CHMOD
|
||||
value: "1"
|
||||
|
||||
volumeMounts:
|
||||
- name: hermes-home
|
||||
mountPath: /home/hermeswebui/.hermes
|
||||
# This is where the WebUI looks for the agent source code to run `uv pip install`
|
||||
- name: hermes-agent-src
|
||||
mountPath: /home/hermeswebui/.hermes/hermes-agent
|
||||
- name: hermes-workspace
|
||||
mountPath: /workspace
|
||||
- name: hermes-webui-app
|
||||
mountPath: /app
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: 500Mi
|
||||
cpu: "100m"
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: "500m"
|
||||
|
||||
securityContext:
|
||||
runAsUser: 1024
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: true
|
||||
readOnlyRootFilesystem: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: rays-hermes-agent-pvc
|
||||
namespace: customer1
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 25Gi
|
||||
|
||||
---
|
||||
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: rays-hermes-webui-service
|
||||
namespace: customer1
|
||||
annotations:
|
||||
tailscale.com/expose: "true"
|
||||
tailscale.com/hostname: "rays-hermes-webui"
|
||||
tailscale.com/tags: "tag:k8s-operator"
|
||||
tailscale.com/ports: "http:8787"
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: hermes-agent
|
||||
ports:
|
||||
- port: 8787
|
||||
targetPort: 8787
|
||||
name: http
|
||||
Loading…
Add table
Reference in a new issue