envFrom:
  - secretRef:
      name: vllm-env

driver:
  enabled: false
toolkit:
  enabled: false
cdi:
  enabled: false
dcgmExporter:
  enabled: false
migManager:
  enabled: false
ccManager:
  enabled: false
operator:
  runtimeClass: docker
node-feature-discovery:
  image:
    repository: m.daocloud.io/registry.k8s.io/nfd/node-feature-discovery

helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
helm repo update nvidia
helm upgrade --install gpu-operator nvidia/gpu-operator \
  --version v26.7.1 \
  -n gpu-operator --create-namespace \
  -f config/gpu-operator-values.yaml

apiVersion: v1
kind: Pod
metadata:
  name: gpu-operator-smi
  namespace: gpu-operator
spec:
  restartPolicy: Never
  nodeName: prod102
  containers:
    - name: smi
      image: docker.m.daocloud.io/vllm/vllm-openai:latest
      imagePullPolicy: IfNotPresent
      command: ["nvidia-smi", "-L"]
      resources:
        limits:
          nvidia.com/gpu: "1"

helm list -n gpu-operator
kubectl -n gpu-operator get pods
kubectl get node prod102 -o jsonpath='{.status.allocatable.nvidia\.com/gpu}{"\n"}'

startupProbe:
  httpGet:
    path: /health
    port: 8000
  periodSeconds: 10
  failureThreshold: 36
livenessProbe:
  httpGet:
    path: /health
    port: 8000
  initialDelaySeconds: 120
  periodSeconds: 10
  failureThreshold: 5
readinessProbe:
  httpGet:
    path: /health
    port: 8000
  initialDelaySeconds: 60
  periodSeconds: 5
  failureThreshold: 3

apiVersion: apps/v1
kind: Deployment
metadata:
  name: vllm
  namespace: llm
  labels:
    app: vllm
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: vllm
  template:
    metadata:
      labels:
        app: vllm
      annotations:
        llm.local/compose-service: "vllm"
    spec:
      nodeName: prod102
      enableServiceLinks: false
      hostAliases:
        - ip: 10.0.1.47
          hostnames: ["host.docker.internal"]
      containers:
        - name: vllm
          image: docker.m.daocloud.io/vllm/vllm-openai:latest
          imagePullPolicy: IfNotPresent
          command: ["vllm", "serve"]
          args:
            - "/model"
            - "--trust-remote-code"
            - "--dtype"
            - "bfloat16"
            - "--tensor-parallel-size"
            - "1"
            - "--enable-auto-tool-choice"
            - "--tool-call-parser"
            - "qwen3_xml"
            - "--reasoning-parser"
            - "qwen3"
            - "--max-model-len"
            - "65536"
            - "--gpu-memory-utilization"
            - "0.70"
            - "--max-num-seqs"
            - "8"
            - "--served-model-name"
            - "qwen3.6-27b"
            - "--enable-prefix-caching"
            - "--host"
            - "0.0.0.0"
            - "--port"
            - "8000"
          envFrom:
            - secretRef:
                name: vllm-env
          ports:
            - containerPort: 8000
              hostPort: 8000
              protocol: TCP
          startupProbe:
            httpGet:
              path: /health
              port: 8000
            periodSeconds: 10
            failureThreshold: 36
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 120
            periodSeconds: 10
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 60
            periodSeconds: 5
            failureThreshold: 3
          volumeMounts:
            - name: vol0
              mountPath: "/model"
            - name: dshm
              mountPath: "/dev/shm"
      volumes:
        - name: vol0
          hostPath:
            path: "/models/Qwen3.6-27B"
            type: Directory
        - name: dshm
          emptyDir:
            medium: Memory
            sizeLimit: 8Gi
---
apiVersion: v1
kind: Service
metadata:
  name: vllm
  namespace: llm
spec:
  selector:
    app: vllm
  ports:
    - name: p8000
      port: 8000
      targetPort: 8000
      protocol: TCP

kubectl -n llm get deploy vllm -o jsonpath='{range .spec.template.spec.volumes[*]}{.name}{" "}{.hostPath.path}{"\n"}{end}'
kubectl -n llm exec deploy/vllm -- ls /model/config.json

mkdir -p /usr/cluster/vault/data
chown 100:1000 /usr/cluster/vault/data
chmod 770 /usr/cluster/vault/data
chmod 700 /usr/cluster/vault

server:
  image:
    repository: docker.m.daocloud.io/hashicorp/vault
    tag: "1.21.2"
    pullPolicy: IfNotPresent
  authDelegator:
    enabled: true
  dataStorage:
    enabled: false
  standalone:
    enabled: true
    config: |
      ui = true
      disable_mlock = true
      listener "tcp" {
        tls_disable = 1
        address = "[::]:8200"
        cluster_address = "[::]:8201"
      }
      storage "file" {
        path = "/vault/data"
      }
  volumes:
    - name: vault-data
      hostPath:
        path: /usr/cluster/vault/data
        type: DirectoryOrCreate
  volumeMounts:
    - name: vault-data
      mountPath: /vault/data
  service:
    type: ClusterIP
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 512Mi
injector:
  enabled: false
csi:
  enabled: false
ui:
  enabled: true
  serviceType: ClusterIP

helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update hashicorp
cp config/vault-values.yaml /usr/cluster/vault/values.yaml
helm upgrade --install vault hashicorp/vault \
  --version 0.32.0 \
  -n vault --create-namespace \
  -f /usr/cluster/vault/values.yaml

kubectl -n vault exec vault-0 -- vault operator init \
  -key-shares=1 -key-threshold=1 -format=json > /usr/cluster/vault/init.json
chmod 600 /usr/cluster/vault/init.json

kubectl -n vault exec vault-0 -- vault status

helm upgrade --install external-secrets /usr/cluster/k8s/charts/external-secrets-2.12.0.tgz \
  -n external-secrets --create-namespace \
  --set installCRDs=true \
  --set image.repository=ghcr.dockerproxy.net/external-secrets/external-secrets \
  --set image.tag=v2.12.0 \
  --set webhook.image.repository=ghcr.dockerproxy.net/external-secrets/external-secrets \
  --set webhook.image.tag=v2.12.0 \
  --set certController.image.repository=ghcr.dockerproxy.net/external-secrets/external-secrets \
  --set certController.image.tag=v2.12.0

path "secret/data/apps/*" {
  capabilities = ["read"]
}
path "secret/metadata/apps/*" {
  capabilities = ["read", "list"]
}

vault auth enable kubernetes
vault write auth/kubernetes/config \
  kubernetes_host=https://kubernetes.default.svc.cluster.local:443 \
  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
  token_reviewer_jwt=@/var/run/secrets/kubernetes.io/serviceaccount/token
vault policy write read-apps policy.hcl
vault write auth/kubernetes/role/external-secrets \
  bound_service_account_names=external-secrets \
  bound_service_account_namespaces=external-secrets \
  policies=read-apps \
  ttl=1h

apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault
spec:
  provider:
    vault:
      server: http://vault.vault.svc.cluster.local:8200
      path: secret
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets

#!/usr/bin/env python3
"""初始化 Vault、解封，并把四个命名空间里已有的 Opaque Secret 抄进 KV v2。

现网已经完成。再次执行时如果 init.json 已存在，只做解封和补齐，不会重新 init。
脚本不打印口令、令牌和 Secret 的值。
"""
import base64
import json
import os
import subprocess

KUBECTL = ["kubectl", "-n", "vault"]
INIT_PATH = "/usr/cluster/vault/init.json"
NAMESPACES = ["llm", "dify", "langfuse", "observability"]


def run(args, input_bytes=None, check=True):
    result = subprocess.run(args, input=input_bytes, capture_output=True)
    if check and result.returncode != 0:
        raise SystemExit(result.stderr.decode("utf-8", "replace")[-800:])
    return result


def status():
    result = run(KUBECTL + ["exec", "vault-0", "--", "vault", "status", "-format=json"], check=False)
    return json.loads(result.stdout.decode())


def ensure_init():
    current = status()
    if current.get("initialized"):
        if not os.path.exists(INIT_PATH):
            raise SystemExit("Vault 已初始化，但本机没有 " + INIT_PATH)
        print("already initialized")
        return
    result = run(
        KUBECTL
        + ["exec", "vault-0", "--", "vault", "operator", "init", "-key-shares=1", "-key-threshold=1", "-format=json"]
    )
    with open(INIT_PATH, "w", encoding="utf-8") as handle:
        handle.write(result.stdout.decode())
    os.chmod(INIT_PATH, 0o600)
    print("init file written")


def unseal():
    if not status().get("sealed"):
        print("already unsealed")
        return
    key = json.load(open(INIT_PATH, encoding="utf-8"))["unseal_keys_b64"][0]
    run(KUBECTL + ["exec", "vault-0", "--", "vault", "operator", "unseal", key])
    if status().get("sealed"):
        raise SystemExit("unseal failed")
    print("unsealed")


def vault_cmd(*args):
    script = "export VAULT_ADDR=http://127.0.0.1:8200; export VAULT_TOKEN=$(cat /tmp/vt); vault " + " ".join(
        json.dumps(arg) for arg in args
    )
    return run(KUBECTL + ["exec", "vault-0", "--", "sh", "-c", script])


def with_token():
    token = json.load(open(INIT_PATH, encoding="utf-8"))["root_token"]
    run(
        KUBECTL + ["exec", "-i", "vault-0", "--", "sh", "-c", "cat > /tmp/vt && chmod 600 /tmp/vt"],
        input_bytes=token.encode(),
    )


def enable_kv():
    listed = json.loads(vault_cmd("secrets", "list", "-format=json").stdout.decode())
    if "secret/" not in listed:
        vault_cmd("secrets", "enable", "-path=secret", "kv-v2")
        print("kv v2 enabled")
    else:
        print("kv v2 present")


def import_secrets():
    copied = 0
    for ns in NAMESPACES:
        raw = json.loads(run(["kubectl", "-n", ns, "get", "secret", "-o", "json"]).stdout)
        for item in raw["items"]:
            name = item["metadata"]["name"]
            if item.get("type") != "Opaque" or name.startswith("sh.helm.release"):
                continue
            data = item.get("data") or {}
            if not data:
                print(f"SKIP {ns}/{name} empty")
                continue
            payload = {}
            for key, value in data.items():
                blob = base64.b64decode(value)
                try:
                    payload[key] = blob.decode("utf-8")
                except UnicodeDecodeError:
                    payload[key] = blob.decode("latin-1")
            local = f"/tmp/vault-payload-{ns}-{name}.json"
            with open(local, "w", encoding="utf-8") as handle:
                json.dump(payload, handle, ensure_ascii=False)
            os.chmod(local, 0o600)
            run(KUBECTL + ["cp", local, "vault-0:/tmp/payload.json"])
            os.remove(local)
            vault_cmd("kv", "put", "-mount=secret", f"apps/{ns}/{name}", "@/tmp/payload.json")
            run(KUBECTL + ["exec", "vault-0", "--", "rm", "-f", "/tmp/payload.json"])
            print(f"PUT {ns}/{name} keys={len(payload)}")
            copied += 1
    print(f"COPIED {copied}")


def main():
    ensure_init()
    unseal()
    with_token()
    try:
        enable_kv()
        import_secrets()
    finally:
        run(KUBECTL + ["exec", "vault-0", "--", "rm", "-f", "/tmp/vt"], check=False)


if __name__ == "__main__":
    main()

#!/bin/bash
# 从 /usr/cluster/vault/init.json 读取解封密钥。不要把密钥打到终端。
set -eu
export KUBECONFIG=/root/.kube/config
key=$(python3 -c 'import json; print(json.load(open("/usr/cluster/vault/init.json"))["unseal_keys_b64"][0], end="")')
kubectl -n vault exec vault-0 -- vault operator unseal "$key" >/tmp/vault-unseal.out
rm -f /tmp/vault-unseal.out
kubectl -n vault exec vault-0 -- vault status -format=json \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print("initialized", d.get("initialized"), "sealed", d.get("sealed"))'

{
  "model_uid": "bge-m3",
  "model_name": "bge-m3",
  "model_type": "embedding",
  "model_engine": "sentence_transformers",
  "n_gpu": 1,
  "gpu_idx": [0],
  "download_hub": "modelscope",
  "replica": 1
}

{
  "enabled": true,
  "launch": { "model_uid": "bge-m3", "model_name": "bge-m3" }
}

#!/usr/bin/env python3
"""把 bge-m3 和 bge-reranker-v2-m3 拉起来，并写入 Xinference 自启动。

已经在跑的模型不会重复启动。登录口令是现网管理员口令。
"""
import json
import sqlite3
import urllib.request

BASE = "http://127.0.0.1:9997"
PASSWORD = "Xinf-bge-2026"
SPECS = [
    {
        "model_uid": "bge-m3",
        "model_name": "bge-m3",
        "model_type": "embedding",
        "model_engine": "sentence_transformers",
        "n_gpu": 1,
        "gpu_idx": [0],
        "download_hub": "modelscope",
        "replica": 1,
    },
    {
        "model_uid": "bge-reranker-v2-m3",
        "model_name": "bge-reranker-v2-m3",
        "model_type": "rerank",
        "model_engine": "sentence_transformers",
        "n_gpu": 1,
        "gpu_idx": [0],
        "download_hub": "modelscope",
        "replica": 1,
    },
]


def call(method, path, token=None, payload=None, timeout=900):
    headers = {}
    data = None
    if payload is not None:
        data = json.dumps(payload).encode()
        headers["Content-Type"] = "application/json"
    if token:
        headers["Authorization"] = "Bearer " + token
    req = urllib.request.Request(BASE + path, data=data, headers=headers, method=method)
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        body = resp.read().decode()
        return json.loads(body) if body else {}


def main():
    user = sqlite3.connect("/usr/cluster/dify/xinference/auth/auth.db").execute(
        "select username from users"
    ).fetchone()[0]
    token = call("POST", "/token", payload={"username": user, "password": PASSWORD})["access_token"]
    running = call("GET", "/v1/models", token=token).get("data") or []
    ids = {item.get("id") for item in running}
    print("before", sorted(ids), flush=True)
    for spec in SPECS:
        uid = spec["model_uid"]
        if uid not in ids:
            print("launch", uid, flush=True)
            print("launched", call("POST", "/v1/models?wait_ready=true", token=token, payload=spec), flush=True)
        else:
            print("already", uid, flush=True)
        call("POST", "/v1/autostart/models", token=token, payload={"enabled": True, "launch": spec})
        print("autostart", uid, flush=True)
    after = call("GET", "/v1/models", token=token).get("data") or []
    for item in after:
        print("model", item.get("id"), item.get("model_type") or item.get("type"), flush=True)


if __name__ == "__main__":
    main()

kubectl -n gpu-operator get pods
kubectl get node prod102 -o jsonpath='{.status.allocatable.nvidia\.com/gpu}{"\n"}'
kubectl -n llm get pod -l app=vllm
kubectl -n vault get pod
kubectl get externalsecret -A
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8000/health
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8200/ui/

#!/bin/bash
# 对照记录。prod102 上 gpu-operator 已经是 deployed，再执行会停在下面的判断。
# 不要打开 driver、toolkit、dcgmExporter、migManager、ccManager。
set -eu
export KUBECONFIG=/root/.kube/config

if [ "$(hostname)" = "prod102" ] && helm status gpu-operator -n gpu-operator >/dev/null 2>&1; then
  echo "prod102 上 GPU Operator 已经在跑。这份脚本是对照记录，停在这里。"
  exit 1
fi

helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
helm repo update nvidia
helm upgrade --install gpu-operator nvidia/gpu-operator \
  --version v26.7.1 \
  -n gpu-operator --create-namespace \
  -f "$(dirname "$0")/../config/gpu-operator-values.yaml"

apiVersion: v1
kind: ConfigMap
metadata:
  name: vault-ui-proxy
  namespace: vault
data:
  default.conf: |
    server {
      listen 8200;
      location / {
        proxy_pass http://vault-ui.vault.svc.cluster.local:8200;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto http;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-ui-proxy
  namespace: vault
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vault-ui-proxy
  template:
    metadata:
      labels:
        app: vault-ui-proxy
    spec:
      nodeName: prod102
      containers:
        - name: proxy
          image: nginx:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8200
              hostPort: 8200
          volumeMounts:
            - name: conf
              mountPath: /etc/nginx/conf.d
      volumes:
        - name: conf
          configMap:
            name: vault-ui-proxy

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: vllm-env
  namespace: llm
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: vllm-env
    creationPolicy: Merge
    deletionPolicy: Retain
  dataFrom:
    - extract:
        key: apps/llm/vllm-env

#!/bin/bash
# 对照记录。prod102 上 Vault 1.21.2 已经在跑，再执行会停在下面的判断。
set -eu
export KUBECONFIG=/root/.kube/config

if [ "$(hostname)" = "prod102" ] && kubectl -n vault get pod vault-0 >/dev/null 2>&1; then
  echo "prod102 上 Vault 已经在跑。这份脚本是对照记录，停在这里。"
  exit 1
fi

mkdir -p /usr/cluster/vault/data
chown 100:1000 /usr/cluster/vault/data
chmod 770 /usr/cluster/vault/data
chmod 700 /usr/cluster/vault

helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update hashicorp
helm upgrade --install vault hashicorp/vault \
  --version 0.32.0 \
  -n vault --create-namespace \
  -f /usr/cluster/vault/values.yaml

echo "等 vault-0 进入 Running 之后，再执行 02-初始化并导入密钥.py"

#!/bin/bash
# 安装 External Secrets Operator，并让它按 Vault 里的 KV 刷新现有 Secret。
# prod102 上已经装过。再执行前先看命名空间 external-secrets 是否已有 Pod。
set -eu
export KUBECONFIG=/root/.kube/config
CHART=/usr/cluster/k8s/charts/external-secrets-2.12.0.tgz

if [ ! -f "$CHART" ]; then
  echo "缺少 $CHART"
  exit 1
fi

helm upgrade --install external-secrets "$CHART" \
  -n external-secrets --create-namespace \
  --set installCRDs=true \
  --set image.repository=ghcr.dockerproxy.net/external-secrets/external-secrets \
  --set image.tag=v2.12.0 \
  --set webhook.image.repository=ghcr.dockerproxy.net/external-secrets/external-secrets \
  --set webhook.image.tag=v2.12.0 \
  --set certController.image.repository=ghcr.dockerproxy.net/external-secrets/external-secrets \
  --set certController.image.tag=v2.12.0 \
  --set image.pullPolicy=IfNotPresent \
  --set webhook.image.pullPolicy=IfNotPresent \
  --set certController.image.pullPolicy=IfNotPresent

kubectl -n external-secrets rollout status deploy/external-secrets --timeout=180s
kubectl apply -f "$(dirname "$0")/../config/cluster-secret-store.yaml"
echo "ClusterSecretStore 已提交。各 Secret 的 ExternalSecret 由 04-生成ExternalSecret.py 写出。"

#!/usr/bin/env python3
"""为四个命名空间里非空的 Opaque Secret 生成 ExternalSecret。

目标 Secret 名保持原样，Deployment 的 envFrom 不用改，Pod 也不会因此滚动。
"""
import json
import subprocess

NAMESPACES = ["llm", "dify", "langfuse", "observability"]
HEADER = """apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {name}
  namespace: {ns}
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: {name}
    creationPolicy: Merge
    deletionPolicy: Retain
  dataFrom:
    - extract:
        key: apps/{ns}/{name}
"""


def main():
    docs = []
    for ns in NAMESPACES:
        raw = subprocess.check_output(["kubectl", "-n", ns, "get", "secret", "-o", "json"])
        for item in json.loads(raw)["items"]:
            name = item["metadata"]["name"]
            if item.get("type") != "Opaque" or name.startswith("sh.helm.release"):
                continue
            if not item.get("data"):
                print(f"SKIP {ns}/{name} empty")
                continue
            docs.append(HEADER.format(ns=ns, name=name).strip())
            print(f"ADD {ns}/{name}")
    path = "/tmp/external-secrets-all.yaml"
    with open(path, "w", encoding="utf-8") as handle:
        handle.write("\n---\n".join(docs) + "\n")
    subprocess.check_call(["kubectl", "apply", "-f", path])
    print(f"APPLIED {len(docs)}")


if __name__ == "__main__":
    main()

#!/bin/bash
set -eu
export KUBECONFIG=/root/.kube/config
kubectl apply -f "$(dirname "$0")/../config/vault-ui-proxy.yaml"
kubectl -n vault rollout status deploy/vault-ui-proxy --timeout=120s
curl -s -o /dev/null -m 10 -w "vault_ui %{http_code}\n" http://127.0.0.1:8200/ui/