mirror of
https://github.com/google/ax.git
synced 2026-10-21 05:49:14 +08:00
JBD
dc4f36cdba
AX is undergoing a significant redesign, moving away from a single CLI with an embedded Python harness toward a general-purpose orchestration layer for agentic tasks. The repository is reorganized around three binaries: ax-server exposes a gRPC API for submitting Task manifests, ax-controller runs as a horizontally scaled reconciler that consumes work from Redis Streams, and ax-task-runner executes tasks inside sandboxed workers. Task state now lives in Redis rather than Kubernetes CRDs so the system can handle millions of short-lived tasks without straining etcd. The legacy Python harness, ATE client, SQL event log, and skill examples are removed, and new design, concepts, manifest, networking, runner, and sandbox docs plus Kubernetes deploy manifests describe the new architecture.
118 lines
3.4 KiB
YAML
118 lines
3.4 KiB
YAML
# Copyright 2026 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: ax-system
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: ax-controller
|
|
namespace: ax-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: ax-controller
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: ax-controller
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: ax-controller
|
|
namespace: ax-system
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: ax-controller
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: ax-controller
|
|
namespace: ax-system
|
|
labels:
|
|
app.kubernetes.io/name: ax-controller
|
|
app.kubernetes.io/part-of: ax
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: ax-controller
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: ax-controller
|
|
spec:
|
|
serviceAccountName: ax-controller
|
|
containers:
|
|
- name: controller
|
|
image: ko://github.com/google/ax/cmd/ax-controller
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- "--redis-addr=ax-redis.ax-system.svc.cluster.local:6379"
|
|
- "--substrate-endpoint=api.ate-system.svc.cluster.local:443"
|
|
- "--substrate-authority=api.ate-system.svc"
|
|
- "--substrate-token-file=/var/run/secrets/ateapi/token"
|
|
- "--substrate-ca-file=/run/servicedns-ca/trust-bundle.pem"
|
|
- "--template=default-template"
|
|
- "--template-atespace=ax-system"
|
|
env:
|
|
- name: ATENET_ROUTER_ADDR
|
|
value: "atenet-router.ate-system.svc.cluster.local:80"
|
|
resources:
|
|
requests:
|
|
cpu: "100m"
|
|
memory: "128Mi"
|
|
limits:
|
|
cpu: "500m"
|
|
memory: "512Mi"
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
volumeMounts:
|
|
- mountPath: /var/run/secrets/ateapi
|
|
name: ate-token
|
|
readOnly: true
|
|
- mountPath: /run/servicedns-ca
|
|
name: servicedns-ca
|
|
readOnly: true
|
|
volumes:
|
|
- name: ate-token
|
|
projected:
|
|
defaultMode: 420
|
|
sources:
|
|
- serviceAccountToken:
|
|
audience: api.ate-system.svc
|
|
expirationSeconds: 7200
|
|
path: token
|
|
- name: servicedns-ca
|
|
projected:
|
|
defaultMode: 420
|
|
sources:
|
|
- clusterTrustBundle:
|
|
labelSelector:
|
|
matchLabels:
|
|
podcert.ate.dev/canarying: live
|
|
path: trust-bundle.pem
|
|
signerName: servicedns.podcert.ate.dev/identity
|