Skip to content

feat(minikube): add minikube delete and debug commands #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Aiden2014 wants to merge 5 commits into
base: main
Choose a base branch
from
Open

feat(minikube): add minikube delete and debug commands #40

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
312a3b7
fix(deployment): module controller quick starter
Aiden2014 Jul 9, 2025
2010235
feat(minikube): add minikube delete and debug commands
Aiden2014 Jul 10, 2025
cb471ed
feat(minikube): add minikube debug commands and update delete process
Aiden2014 Jul 10, 2025
95a955f
feat(minikube): update minikube build and deploy process for module-c…
Aiden2014 Jul 10, 2025
ea98ef8
fix(module-controller): update imagePullPolicy comment for clarity
Aiden2014 Jul 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,17 @@ buildx: fmt vet
build: fmt vet
docker build -t serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/module_controller:latest .

.PHONY: minikube-delete
minikube-delete: ## Delete module-controller deployment from minikube
kubectl delete deployments.apps/module-controller || true
kubectl wait --for=delete pod -l app=module-controller --timeout=90s
Comment on lines +35 to +38
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

kubectl wait will error when no pods remain
If kubectl delete finds nothing, the subsequent kubectl wait --for=delete aborts with NotFound, breaking the target. Swallow the error or use --ignore-not-found.

-kubectl wait --for=delete pod -l app=module-controller --timeout=90s
+kubectl wait --for=delete pod -l app=module-controller --timeout=90s || true
🤖 Prompt for AI Agents 
In the Makefile at lines 35 to 38, the kubectl wait command errors if no pods
remain after deletion, causing the target to fail. Modify the kubectl wait
command to include the --ignore-not-found flag to prevent errors when no pods
are found, ensuring the target completes successfully even if no pods exist.


.PHONY: minikube-debug
minikube-debug: fmt vet minikube-delete ## Build and deploy debug version using minikube
minikube image rm serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/module-controller-v2:latest
minikube image build -f debug.Dockerfile -t serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/module-controller-v2:latest .
kubectl apply -f example/quick-start/module-controller-test.yaml

##@ Deployment

ifndef ignore-not-found
Expand Down Expand Up @@ -74,3 +85,4 @@ $(CONTROLLER_GEN): $(LOCALBIN)
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
$(ENVTEST): $(LOCALBIN)
test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest

3 changes: 1 addition & 2 deletions debug.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,5 +42,4 @@ EXPOSE 8080
EXPOSE 7777
EXPOSE 2345

#ENTRYPOINT ["dlv --listen=:2345 --headless=true --api-version=2 --accept-multiclient exec ./module_controller"]
CMD ["/bin/sh", "-c", "tail -f /dev/null"]
ENTRYPOINT ["dlv", "--listen=:2345", "--headless=true", "--api-version=2", "--accept-multiclient", "exec", "./module_controller"]
37 changes: 22 additions & 15 deletions example/quick-start/base.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,26 @@
apiVersion: v1
kind: Pod
apiVersion: apps/v1
kind: Deployment
metadata:
name: base
labels:
app: base
spec:
containers:
- name: base
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/base-web:1.3.3 # 已经打包好的镜像，源码在 https://github.com/koupleless/samples/blob/main/springboot-samples/web/tomcat/Dockerfile
imagePullPolicy: Always
ports:
replicas: 1
selector:
matchLabels:
app: base
template:
metadata:
labels:
app: base
spec:
containers:
- name: base
containerPort: 8080
- name: arklet
containerPort: 1238
env:
- name: MODULE_CONTROLLER_ADDRESS
value: { YOUR_MODULE_CONTROLLER_IP }
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/base-web:1.4.0 # 已经打包好的镜像, 镜像来源 https://github.com/koupleless/samples/blob/main/springboot-samples/web/tomcat/Dockerfile
imagePullPolicy: Always
ports:
- name: base
containerPort: 8080
- name: arklet
containerPort: 1238
env:
- name: MODULE_CONTROLLER_ADDRESS # 在 base-web 的 koupleless runtime 里是 `koupleless.arklet.http.heartbeat.endpoint`
value: {YOUR_MODULE_CONTROLLER_IP_AND_PORT} # 127.0.0.1:7777
49 changes: 28 additions & 21 deletions example/quick-start/module-controller-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,31 @@
apiVersion: v1
kind: Pod
apiVersion: apps/v1
kind: Deployment
metadata:
name: module-controller
labels:
app: module-controller
spec:
serviceAccountName: virtual-kubelet # 上一步中配置好的 Service Account
containers:
- name: module-controller
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/module-controller-v2:v2.1.2 # 已经打包好的镜像
imagePullPolicy: Always
resources:
limits:
cpu: "1000m"
memory: "400Mi"
ports:
- name: httptunnel
containerPort: 7777
- name: debug
containerPort: 2345
env:
- name: ENABLE_HTTP_TUNNEL
value: "true"
replicas: 1
selector:
matchLabels:
app: module-controller
template:
metadata:
labels:
app: module-controller
spec:
serviceAccountName: virtual-kubelet # 上一步中配置好的 Service Account
containers:
- name: module-controller
Comment on lines +16 to +17
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Add securityContext to drop root privileges and disable privilege escalation

By default the container will run as UID 0 with allowPrivilegeEscalation = true, which violates hardening guidance and triggered the CKV_K8S_20 / CKV_K8S_23 findings.
Add an explicit securityContext:

         - name: module-controller
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ "ALL" ]

This single change neutralises both Checkov findings and narrows the blast-radius if the process is compromised.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
containers:
- name: module-controller
containers:
- name: module-controller
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop: [ "ALL" ]
🤖 Prompt for AI Agents 
In example/quick-start/module-controller-test.yaml around lines 16 to 17, the
container lacks a securityContext that drops root privileges and disables
privilege escalation, causing security findings CKV_K8S_20 and CKV_K8S_23. Add a
securityContext block under the container definition that sets runAsNonRoot to
true, runAsUser to a non-root UID (e.g., 1000), and allowPrivilegeEscalation to
false to comply with security best practices and fix the findings.

image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/module-controller-v2:latest # 自己构建打包好的镜像
imagePullPolicy: Never
resources:
limits:
cpu: "1000m"
memory: "400Mi"
Comment on lines +21 to +24
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add resource requests alongside limits for reliable scheduling

Only limits are specified; without requests the scheduler will assume 0 CPU / 0 Mi, leading to noisy-neighbor issues and unpredictable QoS.

           resources:
-            limits:
-              cpu: "1000m"
-              memory: "400Mi"
+            requests:
+              cpu: "200m"
+              memory: "200Mi"
+            limits:
+              cpu: "1000m"
+              memory: "400Mi"

Tune the numbers to your actual baseline consumption.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
resources:
limits:
cpu: "1000m"
memory: "400Mi"
resources:
requests:
cpu: "200m"
memory: "200Mi"
limits:
cpu: "1000m"
memory: "400Mi"
🤖 Prompt for AI Agents 
In example/quick-start/module-controller-test.yaml around lines 21 to 24,
resource limits are specified but resource requests are missing. Add a
resources.requests section alongside the existing limits with appropriate cpu
and memory values that reflect the baseline consumption to ensure reliable
scheduling and avoid noisy-neighbor issues.

ports:
- name: httptunnel
containerPort: 7777
- name: debug
containerPort: 2345
env:
- name: ENABLE_HTTP_TUNNEL
value: "true"
45 changes: 26 additions & 19 deletions example/quick-start/module-controller.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,29 @@
apiVersion: v1
kind: Pod
apiVersion: apps/v1
kind: Deployment
metadata:
name: module-controller
labels:
app: module-controller
spec:
serviceAccountName: virtual-kubelet # 上一步中配置好的 Service Account
containers:
- name: module-controller
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/release/module-controller-v2:v2.1.2 # 已经打包好的镜像
imagePullPolicy: Always
resources:
limits:
cpu: "1000m"
memory: "400Mi"
ports:
- name: httptunnel
containerPort: 7777
env:
- name: ENABLE_HTTP_TUNNEL
value: "true"
replicas: 1
selector:
matchLabels:
app: module-controller
template:
metadata:
labels:
app: module-controller
spec:
serviceAccountName: virtual-kubelet # 上一步中配置好的 Service Account
containers:
- name: module-controller
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/release/module-controller-v2:v2.1.4 # 已经打包好的镜像
imagePullPolicy: Always
resources:
limits:
cpu: "1000m"
memory: "400Mi"
Comment on lines +20 to +23
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Specify resources.requests to avoid CPU / memory throttling surprises

Only limits are declared; requests default to 0, which can lead to poor scheduling and unexpected throttling. Define sane requests matching expected baseline consumption.

           resources:
+            requests:
+              cpu: 200m
+              memory: 200Mi
             limits:
               cpu: "1000m"
               memory: "400Mi"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
resources:
limits:
cpu: "1000m"
memory: "400Mi"
resources:
requests:
cpu: 200m
memory: 200Mi
limits:
cpu: "1000m"
memory: "400Mi"
🤖 Prompt for AI Agents 
In example/quick-start/module-controller.yaml around lines 20 to 23, the
resource specification only includes limits for CPU and memory but lacks
requests, which can cause scheduling issues and throttling. Add a
resources.requests section with appropriate CPU and memory values that reflect
the expected baseline usage to ensure stable resource allocation and avoid
surprises.

Comment on lines +16 to +23
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Add securityContext to harden the container

Checkov flags (CKV_K8S_20, CKV_K8S_23) point out that the container may run as root and allow privilege escalation. Explicitly disabling those behaviours is a baseline hardening step.

         - name: module-controller
           image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/release/module-controller-v2:v2.1.4 # 已经打包好的镜像
           imagePullPolicy: Always
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - "ALL"
           resources:
             limits:
               cpu: "1000m"
               memory: "400Mi"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
containers:
- name: module-controller
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/release/module-controller-v2:v2.1.4 # 已经打包好的镜像
imagePullPolicy: Always
resources:
limits:
cpu: "1000m"
memory: "400Mi"
containers:
- name: module-controller
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/release/module-controller-v2:v2.1.4 # 已经打包好的镜像
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- "ALL"
resources:
limits:
cpu: "1000m"
memory: "400Mi"
🤖 Prompt for AI Agents 
In example/quick-start/module-controller.yaml around lines 16 to 23, the
container lacks a securityContext to prevent running as root and privilege
escalation. Add a securityContext section under the container spec that sets
runAsNonRoot to true, runAsUser to a non-root UID (e.g., 1000), and disables
privilege escalation by setting allowPrivilegeEscalation to false. This will
harden the container by enforcing non-root execution and preventing privilege
escalation.

ports:
- name: httptunnel
containerPort: 7777
env:
- name: ENABLE_HTTP_TUNNEL
value: "true"
31 changes: 20 additions & 11 deletions example/quick-start/module.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,26 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: biz1
name: biz1-web-single-host
labels:
virtual-kubelet.koupleless.io/component: module-deployment
spec:
replicas: 1
selector:
matchLabels:
module: biz1
virtual-kubelet.koupleless.io/component: module
module.koupleless.io/name: biz1-web-single-host
module.koupleless.io/version: 0.0.1-SNAPSHOT
template:
metadata:
labels:
module: biz1
virtual-kubelet.koupleless.io/component: module
module.koupleless.io/name: biz1-web-single-host
module.koupleless.io/version: 0.0.1-SNAPSHOT
spec:
containers:
- name: biz1
image: https://serverless-opensource.oss-cn-shanghai.aliyuncs.com/module-packages/stable/biz1-web-single-host-0.0.1-SNAPSHOT-ark-biz.jar
- name: biz1-web-single-host # this name must same with the biz name defined in the jar
image: https://koupleless-dosc.oss-cn-hongkong.aliyuncs.com/biz1-web-single-host-0.0.1-SNAPSHOT-ark-biz.jar
env:
Comment on lines +22 to 24
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Jul 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

image field is not a valid OCI image reference

Kubernetes expects an image reference like registry/namespace/repo:tag.
A raw HTTPS URL pointing at a .jar will fail to pull.

-          image: https://koupleless-dosc.oss-cn-hongkong.aliyuncs.com/biz1-web-single-host-0.0.1-SNAPSHOT-ark-biz.jar
+          image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/biz1-web-single-host:0.0.1-SNAPSHOT
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: biz1-web-single-host # this name must same with the biz name defined in the jar
image: https://koupleless-dosc.oss-cn-hongkong.aliyuncs.com/biz1-web-single-host-0.0.1-SNAPSHOT-ark-biz.jar
env:
- name: biz1-web-single-host # this name must same with the biz name defined in the jar
image: serverless-registry.cn-shanghai.cr.aliyuncs.com/opensource/test/biz1-web-single-host:0.0.1-SNAPSHOT
env:
🤖 Prompt for AI Agents 
In example/quick-start/module.yaml around lines 22 to 24, the image field is
incorrectly set to a raw HTTPS URL pointing to a .jar file, which is not a valid
OCI image reference for Kubernetes. Replace the image value with a proper OCI
image reference format like registry/namespace/repo:tag that points to a
container image stored in a container registry.

- name: BIZ_VERSION
value: 0.0.1-SNAPSHOT
Expand All @@ -26,18 +29,24 @@ spec:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
# these labels in vnode generated in base `https://github.com/koupleless/runtime/blob/main/arklet-core/src/main/java/com/alipay/sofa/koupleless/arklet/core/hook/base/BaseMetadataHookImpl.java`
# you can define your own labels by implementing your own BaseMetadataHookImpl
- key: base.koupleless.io/name
operator: In
values:
- base
- key: base.koupleless.io/version
operator: In
values:
- 1.0.0
- TO_BE_IMPLEMENTED
- key: base.koupleless.io/cluster-name
operator: In
values:
- default
podAntiAffinity: # 打散调度核心配置
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
virtual-kubelet.koupleless.io/component: module
module.koupleless.io/name: biz1-web-single-host
module.koupleless.io/version: 0.0.1-SNAPSHOT
topologyKey: topology.kubernetes.io/zone
tolerations:
- key: "schedule.koupleless.io/virtual-node"
operator: "Equal"
Expand All @@ -46,4 +55,4 @@ spec:
- key: "schedule.koupleless.io/node-env"
operator: "Equal"
value: "dev"
effect: "NoExecute"
effect: "NoExecute"