132 lines
3.3 KiB
Markdown
132 lines
3.3 KiB
Markdown
# SkillPack
|
|
|
|
#sympozium #crd #skillpack
|
|
|
|
## Definicja
|
|
|
|
`SkillPack` to CRD bundlujący **Markdown instrukcje + opcjonalny sidecar kontener + RBAC**. Skills montowane są jako pliki w podzie agenta.
|
|
|
|
**Plik:** `api/v1alpha1/skillpack_types.go`
|
|
|
|
## Dwuwarstwowa architektura skilli
|
|
|
|
### Warstwa 1: Instrukcje (Markdown)
|
|
Każdy skill to plik Markdown montowany w `/skills/` - agent czyta go jako instrukcje do LLM.
|
|
|
|
### Warstwa 2: Sidecar (opcjonalny)
|
|
Sidecar to kontener z narzędziami (kubectl, helm, git) + auto-provisioned RBAC.
|
|
|
|
## Spec
|
|
|
|
```yaml
|
|
apiVersion: sympozium.ai/v1alpha1
|
|
kind: SkillPack
|
|
metadata:
|
|
name: k8s-ops
|
|
spec:
|
|
category: kubernetes
|
|
version: "1.0.0"
|
|
|
|
skills:
|
|
- name: k8s-ops
|
|
description: "Kubernetes operations"
|
|
content: |
|
|
# Kubernetes Operations
|
|
You have access to kubectl via the execute_command tool...
|
|
requires:
|
|
bins: [kubectl]
|
|
tools: [execute_command]
|
|
|
|
sidecar:
|
|
image: ghcr.io/sympozium-ai/sympozium/skill-k8s-ops:v0.0.25
|
|
command: ["sleep", "infinity"]
|
|
mountWorkspace: true
|
|
env:
|
|
- name: KUBECONFIG
|
|
value: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
resources:
|
|
cpu: "100m"
|
|
memory: "128Mi"
|
|
|
|
rbac: # Namespace-scoped RBAC
|
|
- apiGroups: ["", "apps"]
|
|
resources: ["pods", "deployments"]
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
clusterRBAC: # Cluster-scoped RBAC
|
|
- apiGroups: [""]
|
|
resources: ["nodes", "namespaces"]
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
secretRef: github-token # Sekrety montowane w sidecarze
|
|
secretMountPath: /secrets/github
|
|
|
|
hostAccess: # Dostęp do hosta (np. node-probe)
|
|
enabled: false
|
|
hostNetwork: false
|
|
hostPID: false
|
|
privileged: false
|
|
mounts:
|
|
- hostPath: /var/log
|
|
mountPath: /host-logs
|
|
readOnly: true
|
|
|
|
requiresServer: false # Czy wymaga Deployment zamiast Job
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
```
|
|
|
|
## Status
|
|
|
|
```yaml
|
|
status:
|
|
phase: Ready
|
|
configMapName: skillpack-k8s-ops
|
|
skillCount: 1
|
|
```
|
|
|
|
## Cykl życia
|
|
|
|
```
|
|
SkillPack CR utworzony
|
|
↓
|
|
SkillPackReconciler → Generuje ConfigMap z Markdown contentem
|
|
↓
|
|
SympoziumInstance referencjonuje skill
|
|
↓
|
|
AgentRun tworzony → AgentRunReconciler:
|
|
1. Czyta SkillPack → wyciąga sidecar spec
|
|
2. Tworzy Role + RoleBinding (namespace RBAC)
|
|
3. Tworzy ClusterRole + ClusterRoleBinding (cluster RBAC)
|
|
4. Dodaje sidecar kontener do pod spec
|
|
5. Montuje ConfigMap jako /skills/ volume
|
|
↓
|
|
Po zakończeniu AgentRun:
|
|
- Namespace RBAC: garbage-collected via ownerReference
|
|
- Cluster RBAC: cleaned up by controller via label selector
|
|
```
|
|
|
|
## Parametryzacja
|
|
|
|
SkillPacks mogą być parametryzowane per-instancja:
|
|
|
|
```yaml
|
|
# W SympoziumInstance
|
|
skills:
|
|
- skillPackRef: github-gitops
|
|
params:
|
|
REPO: my-org/my-repo
|
|
BRANCH: main
|
|
```
|
|
|
|
Parametry injektowane jako `SKILL_REPO`, `SKILL_BRANCH` env vars w sidecarze.
|
|
|
|
## RequiresServer
|
|
|
|
Gdy `sidecar.requiresServer: true`, AgentRun tworzony jest w trybie `server` (Deployment + Service zamiast Job). Przykład: skill `web-endpoint`.
|
|
|
|
---
|
|
|
|
Powiązane: [[Skill Sidecars i auto-RBAC]] | [[Efemeryczny RBAC per-run]] | [[SympoziumInstance]]
|