feat(web): web client renderer for Centaur

.github/workflows/publish-images.yml

@@ -42,10 +42,18 @@ jobs:
             image: centaur-api
             dockerfile: services/api/Dockerfile
             target: ""
+          - service: api-rs
+            image: centaur-api-rs
+            dockerfile: services/api-rs/Dockerfile
+            target: ""
           - service: slackbot
             image: centaur-slackbot
             dockerfile: services/slackbot/Dockerfile
             target: ""
+          - service: web
+            image: centaur-web
+            dockerfile: services/web/Dockerfile
+            target: ""
           - service: agent
             image: centaur-agent
             dockerfile: services/sandbox/Dockerfile

Justfile

@@ -31,7 +31,7 @@ build:
       just _build-all-sequential
     else
       pids=()
-      for recipe in _build-api _build-api-rs _build-iron-proxy _build-slackbot _build-slackbotv2 _build-agent; do
+      for recipe in _build-api _build-api-rs _build-iron-proxy _build-slackbot _build-slackbotv2 _build-web _build-agent; do
         just "$recipe" &
         pids+=("$!")
       done
@@ -48,6 +48,7 @@ _build-all-sequential:
     just _build-iron-proxy
     just _build-slackbot
     just _build-slackbotv2
+    just _build-web
     just _build-agent
 
 build-one service:
@@ -59,6 +60,7 @@ build-one service:
       iron-proxy) just _build-iron-proxy ;;
       slackbot) just _build-slackbot ;;
       slackbotv2) just _build-slackbotv2 ;;
+      web) just _build-web ;;
       agent|sandbox) just _build-agent ;;
       agent-thin|sandbox-thin) just _build-agent-thin ;;
       *) echo "unknown service: {{service}}" >&2; exit 2 ;;
@@ -79,6 +81,9 @@ _build-slackbot:
 _build-slackbotv2:
     docker build -t centaur-slackbotv2:latest -f services/slackbotv2/Dockerfile .
 
+_build-web:
+    docker build -t centaur-web:latest -f services/web/Dockerfile .
+
 _build-agent:
     docker build --target "{{agent_build_target}}" -t "{{agent_image}}" -f "{{agent_dockerfile}}" .
 
@@ -91,7 +96,7 @@ _build-agent-thin:
 _push-registry:
     #!/usr/bin/env bash
     set -euo pipefail
-    for img in centaur-api centaur-api-rs centaur-iron-proxy centaur-slackbot centaur-slackbotv2 centaur-agent; do
+    for img in centaur-api centaur-api-rs centaur-iron-proxy centaur-slackbot centaur-slackbotv2 centaur-web centaur-agent; do
       target="{{registry}}/library/${img}:latest"
       echo "pushing ${img}:latest -> ${target}..."
       docker tag "${img}:latest" "${target}"
@@ -104,7 +109,7 @@ _push-registry:
 _import-k3s:
     #!/usr/bin/env bash
     set -euo pipefail
-    for img in centaur-api centaur-api-rs centaur-iron-proxy centaur-slackbot centaur-slackbotv2 centaur-agent; do
+    for img in centaur-api centaur-api-rs centaur-iron-proxy centaur-slackbot centaur-slackbotv2 centaur-web centaur-agent; do
       echo "importing ${img}:latest into k3s containerd..."
       docker save "${img}:latest" | {{k3s_ctr}} images import -
     done
@@ -126,6 +131,7 @@ deploy:
           --set ironProxy.image.repository=ghcr.io/paradigmxyz/centaur/centaur-iron-proxy
           --set slackbot.image.repository=ghcr.io/paradigmxyz/centaur/centaur-slackbot
           --set slackbotv2.image.repository=ghcr.io/paradigmxyz/centaur/centaur-slackbotv2
+          --set web.image.repository=ghcr.io/paradigmxyz/centaur/centaur-web
           --set sandbox.image.repository=ghcr.io/paradigmxyz/centaur/centaur-agent
         )
         ;;

contrib/chart/templates/networkpolicy.yaml

@@ -1,5 +1,6 @@
 {{- if .Values.networkPolicy.enabled }}
 {{- $ingressSourceNamespaces := default .Values.networkPolicy.ingressControllerNamespaces .Values.networkPolicy.ingressSourceNamespaces }}
+{{- $webIngressSourceNamespaces := default $ingressSourceNamespaces .Values.networkPolicy.webIngressSourceNamespaces }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -105,6 +106,11 @@ spec:
         - podSelector:
             matchLabels:
 {{ include "centaur.componentSelectorLabels" (dict "root" . "component" "slackbotv2") | nindent 14 }}
+{{- end }}
+{{- if .Values.web.enabled }}
+        - podSelector:
+            matchLabels:
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "web") | nindent 14 }}
 {{- end }}
         # Sandboxes call back into the control plane. agent-k8s labels its pods
         # centaur.ai/managed-by=api-rs (MANAGED_BY_VALUE in centaur-sandbox-agent-k8s),
@@ -236,12 +242,20 @@ spec:
             matchLabels:
 {{ include "centaur.componentSelectorLabels" (dict "root" . "component" "slackbot") | nindent 14 }}
 {{- end }}
+{{- if .Values.apiRs.enabled }}
         - podSelector:
             matchLabels:
-{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "iron-proxy") | nindent 14 }}
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "api-rs") | nindent 14 }}
+{{- end }}
         - podSelector:
             matchLabels:
-              centaur.ai/managed: "true"
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "iron-proxy") | nindent 14 }}
+        - podSelector:
+            matchExpressions:
+              - key: centaur.ai/sandbox-id
+                operator: Exists
+              - key: centaur.ai/iron-proxy
+                operator: DoesNotExist
         - podSelector:
             matchLabels:
               centaur.ai/iron-proxy: "true"
@@ -298,6 +312,40 @@ spec:
           port: {{ .Values.networkPolicy.apiServerPort }}
 ---
 {{- end }}
+{{- if .Values.web.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "centaur.componentName" (dict "root" . "component" "web") }}
+  labels:
+{{ include "centaur.componentLabels" (dict "root" . "component" "web") | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "web") | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+{{- range $webIngressSourceNamespaces }}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ . | quote }}
+{{- end }}
+      ports:
+        - protocol: TCP
+          port: 3003
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "api-rs") | nindent 14 }}
+      ports:
+        - protocol: TCP
+          port: {{ .Values.apiRs.port }}
+---
+{{- end }}
 {{- if .Values.slackbot.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -382,6 +430,11 @@ spec:
         - podSelector:
             matchLabels:
 {{ include "centaur.componentSelectorLabels" (dict "root" . "component" "slackbot") | nindent 14 }}
+{{- end }}
+{{- if .Values.apiRs.enabled }}
+        - podSelector:
+            matchLabels:
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "api-rs") | nindent 14 }}
 {{- end }}
         - podSelector:
             matchLabels:
@@ -536,8 +589,11 @@ metadata:
 {{ include "centaur.labels" . | nindent 4 }}
 spec:
   podSelector:
-    matchLabels:
-      centaur.ai/managed: "true"
+    matchExpressions:
+      - key: centaur.ai/sandbox-id
+        operator: Exists
+      - key: centaur.ai/iron-proxy
+        operator: DoesNotExist
   policyTypes:
     - Egress
   egress:
@@ -548,4 +604,12 @@ spec:
       ports:
         - protocol: TCP
           port: 8000
+    - to:
+        - podSelector:
+            matchLabels:
+              centaur.ai/iron-proxy: "true"
+              centaur.ai/sandbox-id: api
+      ports:
+        - protocol: TCP
+          port: {{ .Values.ironProxy.service.proxyPort }}
 {{- end }}

contrib/chart/templates/services.yaml

@@ -46,6 +46,22 @@ spec:
       targetPort: 3001
 ---
 {{- end }}
+{{- if .Values.web.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "centaur.componentName" (dict "root" . "component" "web") }}
+  labels:
+{{ include "centaur.componentLabels" (dict "root" . "component" "web") | nindent 4 }}
+spec:
+  selector:
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "web") | nindent 4 }}
+  ports:
+    - name: http
+      port: 3003
+      targetPort: 3003
+---
+{{- end }}
 {{- if .Values.runnerAccess.enabled }}
 apiVersion: v1
 kind: Service

contrib/chart/templates/workloads.yaml

@@ -460,6 +460,76 @@ spec:
 {{- end }}
 ---
 {{- end }}
+{{- if .Values.web.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "centaur.componentName" (dict "root" . "component" "web") }}
+  labels:
+{{ include "centaur.componentLabels" (dict "root" . "component" "web") | nindent 4 }}
+spec:
+  replicas: {{ .Values.web.replicaCount }}
+  selector:
+    matchLabels:
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "web") | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/secret-env: {{ toJson (dict "secretManager" .Values.secretManager "firewallCa" .Values.firewall.ca) | sha256sum }}
+        checksum/infra-secrets: {{ include "centaur.infraSecretsChecksum" . }}
+      labels:
+{{ include "centaur.componentSelectorLabels" (dict "root" . "component" "web") | nindent 8 }}
+    spec:
+      automountServiceAccountToken: false
+      {{- with .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: web
+          image: {{ printf "%s:%s" .Values.web.image.repository .Values.web.image.tag | quote }}
+          imagePullPolicy: {{ .Values.web.image.pullPolicy }}
+          env:
+            - name: CENTAUR_API_RS_URL
+              value: {{ printf "http://%s:%v" (include "centaur.componentName" (dict "root" . "component" "api-rs")) .Values.apiRs.port | quote }}
+{{- if .Values.api.enabled }}
+            - name: CENTAUR_CONTROL_API_URL
+              value: {{ printf "http://%s:%v" (include "centaur.componentName" (dict "root" . "component" "api")) 8000 | quote }}
+{{- end }}
+            - name: CENTAUR_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "centaur.secretEnvName" . }}
+                  key: {{ printf "%sSLACKBOT_API_KEY" .Values.secretManager.envPrefix }}
+{{- if .Values.web.idleTimeoutMs }}
+            - name: SESSION_IDLE_TIMEOUT_MS
+              value: {{ .Values.web.idleTimeoutMs | quote }}
+{{- end }}
+{{- if .Values.web.maxDurationMs }}
+            - name: SESSION_MAX_DURATION_MS
+              value: {{ .Values.web.maxDurationMs | quote }}
+{{- end }}
+{{- range $name, $value := .Values.web.extraEnv }}
+            - name: {{ $name }}
+              value: {{ $value | quote }}
+{{- end }}
+          ports:
+            - containerPort: 3003
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 3003
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3003
+          securityContext:
+{{ toYaml .Values.containerSecurityContext | nindent 12 }}
+          resources:
+{{ toYaml .Values.web.resources | nindent 12 }}
+---
+{{- end }}
 {{- if .Values.slackbot.enabled }}
 apiVersion: apps/v1
 kind: Deployment

contrib/chart/values.dev.yaml

@@ -21,10 +21,6 @@ slackbotv2:
   image:
     pullPolicy: IfNotPresent
 
-apiRs:
-  image:
-    pullPolicy: IfNotPresent
-
 api:
   image:
     pullPolicy: IfNotPresent
@@ -33,19 +29,31 @@ api:
   egressDiscovery:
     enabled: false
 
+apiRs:
+  enabled: true
+  image:
+    pullPolicy: IfNotPresent
+
+web:
+  enabled: true
+  image:
+    pullPolicy: IfNotPresent
+
 ironProxy:
   image:
     pullPolicy: IfNotPresent
-  manager:
-    secretSource: onepassword
+  secretSource: env
 
 tokenBroker:
-  enabled: true
+  enabled: false
 
 sandbox:
   image:
     pullPolicy: IfNotPresent
 
+agentSandbox:
+  enabled: true
+
 # Run the tool-server sidecar by default in dev so local clusters mirror
 # production sandbox topology.
 toolServer:

contrib/chart/values.schema.json

@@ -223,6 +223,10 @@
           "type": "array",
           "items": { "type": "string" }
         },
+        "webIngressSourceNamespaces": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
         "apiIngressSourceNamespaces": {
           "type": "array",
           "items": { "type": "string" }

contrib/chart/values.yaml

@@ -293,6 +293,18 @@ slackbotv2:
   extraEnv: {}
   resources: {}
 
+web:
+  enabled: false
+  replicaCount: 1
+  image:
+    repository: centaur-web
+    tag: latest
+    pullPolicy: Always
+  idleTimeoutMs: ""
+  maxDurationMs: ""
+  extraEnv: {}
+  resources: {}
+
 postgres:
   enabled: true
   image:
@@ -337,6 +349,7 @@ runnerAccess:
 networkPolicy:
   enabled: true
   ingressSourceNamespaces: []
+  webIngressSourceNamespaces: []
   apiIngressSourceNamespaces: []
   ingressControllerNamespaces:
     - kube-system