feat(devspace): DevSpace + Sandbox + StatefulSet + TopoLVM inception mount (proven on a real cluster) - #23
Merged
Merged
Conversation
…mount — proven on a real cluster
Integrates the demonstrated dev-environment patterns and proves real k8s dispatch end to end.
tools/devspace.py:
- devspace_manifests: Nocalhost-style isolated DevSpace — Namespace + ResourceQuota +
default-deny NetworkPolicy + the agent-machine's persistent INCEPTION MOUNT (a TopoLVM
PVC at /var/lib/sourceos/inception). Tenancy-labelled (tenant/user/space), grant-labelled.
- sandbox_manifests: Signadot / Nocalhost-MeshSpace sandbox — a fork Deployment + Istio
VirtualService routing `x-sandbox-routing-key` to the fork, else the baseline (share the
stack, don't duplicate it).
- agent_machine_statefulset: the agent-machine as a STATEFUL app — StatefulSet + headless
Service + per-replica TopoLVM inception mount via volumeClaimTemplates. (We weren't using
StatefulSets before; Jobs/Deployments can't give stable identity + per-replica storage.)
- DevSpacePlane: the User->Space->App tenancy model.
Real-cluster proof (kind on podman): the governed spine dispatched a real Job that printed
"hello-from-real-mesh"; the inception mount persisted across pods (wrote in pod #1, read the
same bytes in pod #2). Two real bugs the cluster caught + fixed in executor.py:
- image "": get(k, default) returns "" for a present-but-empty key -> Job invalid. Use or-default.
- a DevSpace ResourceQuota requires pod resource limits -> always set requests+limits defaults.
Also: K8sAdapter mounts the inception PVC when workload.inception_pvc is set; sourceosctl gains
--inception.
deploy/topolvm/ (StorageClass topolvm-provisioner + install runbook — production storage).
docs/PATTERN_INTEGRATION.md: every demonstrated pattern (Nocalhost, Signadot, ShellHub, Edge/Fog
K3s twin, 7-layer PaaS, IBM PE/Eclipse) mapped to our capability, honestly graded.
Tests: +6 devspace +1 executor inception = 105 tools tests green. Wired validate + CapD links.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Integrates the demonstrated dev-environment patterns and proves real k8s dispatch end to end on an ephemeral kind-on-podman cluster.
tools/devspace.py/var/lib/sourceos/inception). Tenancy- and grant-labelled.x-sandbox-routing-keyto the fork, else the baseline. Share the stack, don't duplicate it.volumeClaimTemplates. (We weren't using StatefulSets; Jobs/Deployments can't give stable identity + per-replica storage.)DevSpacePlane— the User→Space→App tenancy model.Proven on a real cluster
Jobthat printedhello-from-real-mesh(grant-labelled, in a tenancy-isolated DevSpace).agent-state-INCEPTION-PROOFin pod chore(ci): harden supply chain — pin actions to SHA + least-privilege permissions #1, read the same bytes back in pod chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 #2 (PVC Bound).executor.py:image: ""(present-but-empty key defeatsdict.get(k, default)→ invalid Job → use or-default); and a DevSpace ResourceQuota requires pod resource limits → always set request/limit defaults.Storage
deploy/topolvm/— thetopolvm-provisionerStorageClass + install runbook (node-local, topology-aware LVM volumes; the Edge/Fog design's storage). Local proof uses kind'sstandardclass; production is a one-field swap.Evaluation
docs/PATTERN_INTEGRATION.md— every demonstrated pattern (Nocalhost, Signadot, ShellHub, Edge/Fog K3s twin, 7-layer PaaS, IBM Parallel Environment/Eclipse) mapped to our capability, honestly graded.Tests
+6 devspace, +1 executor inception = 105 tools tests green;
validatepasses. Wired validate REQUIRED + DevSpace CapD links.Next unit (named in the register): parallel/MPI jobs (Indexed Job + real SLURM) + connector-call-as-dispatch — the IBM Parallel Environment codification.