woggioni-opencode-agent/kaya-rbcs
1
0
Fork 0
Code Actions Packages Releases Activity

Compare commits

base: woggioni-opencode-agent/kaya-rbcs:release/0.0.1
Branches Tags
woggioni-opencode-agent/kaya-rbcs:main
woggioni-opencode-agent/kaya-rbcs:release/0.0.3 woggioni-opencode-agent/kaya-rbcs:release/0.0.2 woggioni-opencode-agent/kaya-rbcs:release/0.0.1
...
compare: woggioni-opencode-agent/kaya-rbcs:main
Branches Tags
woggioni-opencode-agent/kaya-rbcs:main
woggioni-opencode-agent/kaya-rbcs:release/0.0.3 woggioni-opencode-agent/kaya-rbcs:release/0.0.2 woggioni-opencode-agent/kaya-rbcs:release/0.0.1
3 Commits
release/0.0.1 ... main
Author SHA1 Message Date
woggioni-opencode-agent c7d75f6899 Support standard GRANIAN_* env vars and the rloop event loop
CI / Build and push docker image (push) Successful in 2m52s
Details 
- Launcher now only injects --interface/--host/--port when the matching
  GRANIAN_* env var is unset, so every granian option (GRANIAN_LOOP,
  GRANIAN_WORKERS, GRANIAN_HTTP, GRANIAN_HOST, GRANIAN_PORT, ...) can be
  configured via granian's standard GRANIAN_* environment variables
- Add the rloop event loop as a runtime dependency so GRANIAN_LOOP=rloop
  works out of the box (previously failed with a missing 'rloop' package)
 2026-08-03 05:28:04 +00:00
woggioni-opencode-agent 96cf433793 Add Kubernetes manifests to deploy rbcs and kaya-rbcs in the rbcs namespace 
- memcached (1Gi) shared by both cache servers via a single service
- rbcs (java) and kaya-rbcs deployments with identical resource limits (1 cpu / 512Mi)
- strict network policies whitelisting only the required communications
- manually-triggered benchmark jobs running 'client benchmark -s 256 -e 10000'
  against the rbcs and rbcs-kaya services
 2026-08-02 23:10:55 +00:00
woggioni-opencode-agent 752406db22 Use BuildKit cache mounts and multi-stage build for the Docker image
CI / Build and push docker image (push) Successful in 2m33s
Details 
Split the Dockerfile into a builder stage (apk + pip cache mounts) and a
slim runtime stage, mirroring reimpasto. apk and pip package caches now
persist across builds and never land in the image layers.
 2026-08-02 15:48:47 +00:00
9 changed files with 527 additions and 30 deletions
Expand all files Collapse all files
Dockerfile
+36 -21
View File
@@ -1,32 +1,47 @@
# syntax=docker/dockerfile:1
# Multi-stage production build for the kaya-rbcs app on the Kaya framework.
# Base: alpine:3.24 (python3 = 3.14). Deps are installed into a venv in the
# builder; apk and pip caches use BuildKit cache mounts so they persist across
# builds and never land in the image layers. Requires BuildKit (default for
# `docker build` / `docker buildx` on modern daemons).
# --- Builder ---------------------------------------------------------------
FROM alpine:3.24 AS builder
RUN --mount=type=cache,target=/var/cache/apk \
apk add python3
WORKDIR /build
COPY requirements.txt ./
RUN --mount=type=cache,target=/root/.cache/pip \
python3 -m venv /opt/venv \
&& /opt/venv/bin/pip install -r requirements.txt
COPY pyproject.toml README.md ./
COPY src ./src
RUN --mount=type=cache,target=/root/.cache/pip \
/opt/venv/bin/pip install --no-deps .
# --- Runtime ---------------------------------------------------------------
FROM alpine:3.24 FROM alpine:3.24
ENV PYTHONDONTWRITEBYTECODE=1 \ RUN --mount=type=cache,target=/var/cache/apk \
apk add python3 ca-certificates tzdata \
&& addgroup -S rbcs && adduser -S -G rbcs rbcs
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:${PATH}" \
PYTHONUNBUFFERED=1 \ PYTHONUNBUFFERED=1 \
PIP_DISABLE_PIP_VERSION_CHECK=1 \ PYTHONDONTWRITEBYTECODE=1 \
PIP_NO_CACHE_DIR=1 \
RBCS_HOST=0.0.0.0 \ RBCS_HOST=0.0.0.0 \
RBCS_PORT=8080 \ RBCS_PORT=8080 \
RBCS_MEMCACHE_HOST=memcached \ RBCS_MEMCACHE_HOST=memcached \
RBCS_MEMCACHE_PORT=11211 RBCS_MEMCACHE_PORT=11211
RUN apk add --no-cache python3
WORKDIR /opt/kaya-rbcs
COPY requirements.txt ./
RUN python3 -m venv /opt/venv \
&& /opt/venv/bin/pip install -r requirements.txt
COPY pyproject.toml README.md ./
COPY src ./src
RUN /opt/venv/bin/pip install --no-deps .
RUN addgroup -S rbcs \
&& adduser -S -G rbcs rbcs \
&& chown -R rbcs:rbcs /opt/kaya-rbcs /opt/venv
ENV PATH="/opt/venv/bin:${PATH}"
USER rbcs USER rbcs
EXPOSE 8080 EXPOSE 8080
README.md
+29
View File
@@ -52,6 +52,35 @@ Configuration is read from environment variables:
| `RBCS_DIGEST` | *(unset)* | Hash the key with this algorithm (e.g. `sha256`) | | `RBCS_DIGEST` | *(unset)* | Hash the key with this algorithm (e.g. `sha256`) |
| `RBCS_MAX_AGE` | `7d` | Value TTL (`s`/`m`/`h`/`d`) | | `RBCS_MAX_AGE` | `7d` | Value TTL (`s`/`m`/`h`/`d`) |
### Configuring Granian
The server runs on [Granian](https://github.com/emmett-framework/granian) via
its RSGI interface. Any granian option can be configured with its standard
`GRANIAN_*` environment variables (see `granian --help`), for example:
```bash
GRANIAN_LOOP=rloop GRANIAN_WORKERS=4 GRANIAN_HTTP=2 rbcs-server
```
Every granian CLI option has a matching `GRANIAN_*` variable
(`GRANIAN_LOOP`, `GRANIAN_WORKERS`, `GRANIAN_HTTP`, `GRANIAN_TASK_IMPL`,
`GRANIAN_RUNTIME_THREADS`, `GRANIAN_BLOCKING_THREADS`, `GRANIAN_LOG_LEVEL`,
`GRANIAN_METRICS`, `GRANIAN_WS`, ...).
When a `GRANIAN_*` variable and the corresponding `RBCS_*` variable are both
set, the granian one wins:
- `GRANIAN_HOST` overrides `RBCS_HOST` (default `127.0.0.1`)
- `GRANIAN_PORT` overrides `RBCS_PORT` (default `8080`)
- `GRANIAN_INTERFACE` overrides the default `rsgi` interface
The Docker image ships the `rloop` event loop, so `GRANIAN_LOOP=rloop` works
out of the box:
```bash
docker run -e GRANIAN_LOOP=rloop -e RBCS_MEMCACHE_HOST=memcached kaya-rbcs
```
The app is also a plain ASGI application, so it can be served by any ASGI The app is also a plain ASGI application, so it can be served by any ASGI
server, e.g. `daphne kaya_rbcs.app:app`. server, e.g. `daphne kaya_rbcs.app:app`.
k8s/benchmark-jobs.yaml
+130
View File
@@ -0,0 +1,130 @@
# Manually-triggered benchmark jobs comparing rbcs (java) vs rbcs-kaya (kaya-rbcs).
# Create them with:
# kubectl create -f k8s/benchmark-jobs.yaml
# (or `kubectl apply` — they only run when created, not on updates).
apiVersion: v1
kind: ConfigMap
metadata:
name: rbcs-client-config
namespace: rbcs
data:
rbcs-client.xml: |
<?xml version="1.0" encoding="UTF-8"?>
<profiles xmlns="urn:net.woggioni.rbcs.client">
<profile name="rbcs"
base-url="http://rbcs:8080/"
max-connections="50"
enable-compression="false">
<no-auth/>
</profile>
<profile name="rbcs-kaya"
base-url="http://rbcs-kaya:8080/"
max-connections="50"
enable-compression="false">
<no-auth/>
</profile>
</profiles>
---
apiVersion: batch/v1
kind: Job
metadata:
name: benchmark-rbcs
namespace: rbcs
labels:
role: benchmark
target: rbcs
spec:
backoffLimit: 1
ttlSecondsAfterFinished: 3600
template:
metadata:
labels:
role: benchmark
target: rbcs
spec:
restartPolicy: Never
containers:
- name: client
image: gitea.woggioni.net/woggioni/rbcs:latest
args:
- client
- -p
- rbcs
- benchmark
- -s
- "256"
- -e
- "10000"
env:
- name: RBCS_CONFIGURATION_DIR
value: /etc/rbcs-config
volumeMounts:
- name: client-config
mountPath: /etc/rbcs-config
readOnly: true
resources:
requests:
cpu: "1"
memory: 512Mi
limits:
cpu: "1"
memory: 512Mi
volumes:
- name: client-config
configMap:
name: rbcs-client-config
items:
- key: rbcs-client.xml
path: rbcs-client.xml
---
apiVersion: batch/v1
kind: Job
metadata:
name: benchmark-kaya-rbcs
namespace: rbcs
labels:
role: benchmark
target: rbcs-kaya
spec:
backoffLimit: 1
ttlSecondsAfterFinished: 3600
template:
metadata:
labels:
role: benchmark
target: rbcs-kaya
spec:
restartPolicy: Never
containers:
- name: client
image: gitea.woggioni.net/woggioni/rbcs:latest
args:
- client
- -p
- rbcs-kaya
- benchmark
- -s
- "256"
- -e
- "10000"
env:
- name: RBCS_CONFIGURATION_DIR
value: /etc/rbcs-config
volumeMounts:
- name: client-config
mountPath: /etc/rbcs-config
readOnly: true
resources:
requests:
cpu: "1"
memory: 512Mi
limits:
cpu: "1"
memory: 512Mi
volumes:
- name: client-config
configMap:
name: rbcs-client-config
items:
- key: rbcs-client.xml
path: rbcs-client.xml
k8s/deploy.yaml
+182
View File
@@ -0,0 +1,182 @@
apiVersion: v1
kind: Namespace
metadata:
name: rbcs
labels:
kubernetes.io/metadata.name: rbcs
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: memcached
namespace: rbcs
labels:
app: memcached
spec:
replicas: 1
selector:
matchLabels:
app: memcached
template:
metadata:
labels:
app: memcached
spec:
containers:
- name: memcached
image: memcached:alpine
args: ["-m", "1024"]
ports:
- name: memcache
containerPort: 11211
resources:
requests:
cpu: "1"
memory: 1Gi
limits:
cpu: "1"
memory: 1Gi
---
apiVersion: v1
kind: Service
metadata:
name: memcached
namespace: rbcs
spec:
selector:
app: memcached
ports:
- port: 11211
targetPort: 11211
---
apiVersion: v1
kind: ConfigMap
metadata:
name: rbcs-server-config
namespace: rbcs
data:
rbcs-server.xml: |
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<rbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
xmlns:rbcs="urn:net.woggioni.rbcs.server"
xmlns:rbcs-memcache="urn:net.woggioni.rbcs.server.memcache"
xs:schemaLocation="urn:net.woggioni.rbcs.server.memcache jpms://net.woggioni.rbcs.server.memcache/net/woggioni/rbcs/server/memcache/schema/rbcs-memcache.xsd urn:net.woggioni.rbcs.server jpms://net.woggioni.rbcs.server/net/woggioni/rbcs/server/schema/rbcs-server.xsd">
<bind host="0.0.0.0" port="8080" incoming-connections-backlog-size="1024"/>
<cache xs:type="rbcs-memcache:memcacheCacheType" max-age="P1D" key-prefix="rbcs">
<server host="memcached" port="11211" max-connections="50" connection-timeout="PT10S"/>
</cache>
<authentication>
<none/>
</authentication>
</rbcs:server>
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: rbcs
namespace: rbcs
labels:
app: rbcs
spec:
replicas: 1
selector:
matchLabels:
app: rbcs
template:
metadata:
labels:
app: rbcs
spec:
containers:
- name: rbcs
image: gitea.woggioni.net/woggioni/rbcs:memcache
ports:
- name: http
containerPort: 8080
env:
- name: RBCS_CONFIGURATION_DIR
value: /etc/rbcs-config
volumeMounts:
- name: config
mountPath: /etc/rbcs-config
readOnly: true
resources:
requests:
cpu: "1"
memory: 512Mi
limits:
cpu: "1"
memory: 512Mi
volumes:
- name: config
configMap:
name: rbcs-server-config
items:
- key: rbcs-server.xml
path: rbcs-server.xml
---
apiVersion: v1
kind: Service
metadata:
name: rbcs
namespace: rbcs
spec:
selector:
app: rbcs
ports:
- port: 8080
targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: rbcs-kaya
namespace: rbcs
labels:
app: rbcs-kaya
spec:
replicas: 1
selector:
matchLabels:
app: rbcs-kaya
template:
metadata:
labels:
app: rbcs-kaya
spec:
containers:
- name: rbcs-kaya
image: gitea.woggioni.net/woggioni-opencode-agent/kaya-rbcs:0.0.2
ports:
- name: http
containerPort: 8080
env:
- name: RBCS_HOST
value: "0.0.0.0"
- name: RBCS_PORT
value: "8080"
- name: RBCS_MEMCACHE_HOST
value: memcached
- name: RBCS_MEMCACHE_PORT
value: "11211"
- name: RBCS_KEY_PREFIX
value: "kaya"
resources:
requests:
cpu: "1"
memory: 512Mi
limits:
cpu: "1"
memory: 512Mi
---
apiVersion: v1
kind: Service
metadata:
name: rbcs-kaya
namespace: rbcs
spec:
selector:
app: rbcs-kaya
ports:
- port: 8080
targetPort: 8080
k8s/network-policies.yaml
+134
View File
@@ -0,0 +1,134 @@
# Default deny: no traffic in or out of the namespace unless explicitly allowed below.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: rbcs
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
---
# Allow all pods to resolve services via cluster DNS.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-dns-egress
namespace: rbcs
spec:
podSelector: {}
policyTypes: [Egress]
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
---
# memcached: only the two cache servers may reach it; it needs no egress.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: memcached-allow
namespace: rbcs
spec:
podSelector:
matchLabels:
app: memcached
policyTypes: [Ingress, Egress]
ingress:
- from:
- podSelector:
matchExpressions:
- key: app
operator: In
values: [rbcs, rbcs-kaya]
ports:
- protocol: TCP
port: 11211
egress: []
---
# rbcs (java): reachable by benchmark client pods only; egress to memcached only.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: rbcs-allow
namespace: rbcs
spec:
podSelector:
matchLabels:
app: rbcs
policyTypes: [Ingress, Egress]
ingress:
- from:
- podSelector:
matchLabels:
role: benchmark
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: memcached
ports:
- protocol: TCP
port: 11211
---
# rbcs-kaya (kaya-rbcs): reachable by benchmark client pods only; egress to memcached only.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: rbcs-kaya-allow
namespace: rbcs
spec:
podSelector:
matchLabels:
app: rbcs-kaya
policyTypes: [Ingress, Egress]
ingress:
- from:
- podSelector:
matchLabels:
role: benchmark
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: memcached
ports:
- protocol: TCP
port: 11211
---
# Benchmark client pods: no ingress; egress only to the two cache servers.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: benchmark-allow
namespace: rbcs
spec:
podSelector:
matchLabels:
role: benchmark
policyTypes: [Ingress, Egress]
ingress: []
egress:
- to:
- podSelector:
matchExpressions:
- key: app
operator: In
values: [rbcs, rbcs-kaya]
ports:
- protocol: TCP
port: 8080
pyproject.toml
+1
View File
@@ -26,6 +26,7 @@ dependencies = [
server = [ server = [
"kaya-rsgi", "kaya-rsgi",
"granian", "granian",
"rloop",
] ]
dev = [ dev = [
"httpx", "httpx",
requirements.in
+1
View File
@@ -4,3 +4,4 @@ kaya-core
aiomcache aiomcache
kaya-rsgi kaya-rsgi
granian granian
rloop
requirements.txt
+2
View File
@@ -25,6 +25,8 @@ pwo==0.1.2
# via # via
# kaya-core # kaya-core
# kaya-rsgi # kaya-rsgi
rloop==0.3.1
# via -r requirements.in
typing-extensions==4.16.0 typing-extensions==4.16.0
# via # via
# kaya-core # kaya-core
src/kaya_rbcs/__main__.py
+12 -9
View File
@@ -1,3 +1,4 @@
import os
import sys import sys
from typing import List, NoReturn from typing import List, NoReturn
@@ -14,15 +15,17 @@ def main() -> NoReturn:
) from exc ) from exc
config = Config.from_env() config = Config.from_env()
args: List[str] = [ args: List[str] = []
'--interface', # Only inject our own values when the equivalent GRANIAN_* environment
'rsgi', # variable is not set, so every granian option stays configurable via
'--host', # granian's standard GRANIAN_* environment variables.
config.host, if not os.getenv('GRANIAN_INTERFACE'):
'--port', args += ['--interface', 'rsgi']
str(config.port), if not os.getenv('GRANIAN_HOST'):
'kaya_rbcs.app:app', args += ['--host', config.host]
] if not os.getenv('GRANIAN_PORT'):
args += ['--port', str(config.port)]
args.append('kaya_rbcs.app:app')
sys.argv = [sys.argv[0], *args] sys.argv = [sys.argv[0], *args]
entrypoint() # type: ignore[no-untyped-call] entrypoint() # type: ignore[no-untyped-call]
raise SystemExit(0) raise SystemExit(0)