Use Cloud Native API Gateway to access ACS Agent Sandbox

Prepare a Sandbox template

Sandbox templates are provided by SandboxSet resources in the cluster. After you create a SandboxSet, ack-sandbox-manager watches this resource and synchronizes it as a template that can be queried and used through the management API. The following example creates a Sandbox template and warm pool named code-interpreter. You can deploy this template by using kubectl, the console YAML editor, or other methods.

apiVersion: agents.kruise.io/v1alpha1
kind: SandboxSet
metadata:
  name: code-interpreter
  namespace: default
spec:
  runtimes:
    - name: csi
    - name: agent-runtime
  replicas: 1
  template:
    metadata:
      labels:
        alibabacloud.com/acs: "true"
        alibabacloud.com/compute-class: agent-sandbox
        alibabacloud.com/compute-qos: default
    spec:
      automountServiceAccountToken: false
      containers:
        - name: sandbox
          image: registry-cn-hangzhou-vpc.ack.aliyuncs.com/acs/code-interpreter:v1.6
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: "1"
              memory: 1Gi
            requests:
              cpu: "1"
              memory: 1Gi
              ephemeral-storage: 30Gi
      terminationGracePeriodSeconds: 30

Create a Sandbox

Call the ack-sandbox-manager management API through Cloud-native API Gateway to create a Sandbox. The following example uses the code-interpreter template created in the previous step and synchronized to ack-sandbox-manager.

Run the following command to view the available Sandbox templates:

curl -sS \
  -H "Host: your.domain.com" \
  "http://${APIG_ENDPOINT}/kruise/api/templates"

After the response contains code-interpreter, run the following command to create a Sandbox:

curl -sS \
  -H "Host: your.domain.com" \
  -H "content-type: application/json" \
  -d '{"templateID":"code-interpreter"}' \
  "http://${APIG_ENDPOINT}/kruise/api/sandboxes"

Record the sandboxID from the response. You will use this ID to access and delete the Sandbox later.

Access a Sandbox

Use the sandboxID returned when creating the Sandbox to access the Sandbox.

SANDBOX_ID=<sandboxID returned when creating the Sandbox>

Run the following command to access the health check endpoint in the Sandbox:

curl -sS -i \
  -H "Host: your.domain.com" \
  -H "e2b-sandbox-id: ${SANDBOX_ID}" \
  -H "e2b-sandbox-port: 49999" \
  "http://${APIG_ENDPOINT}/health"

Run the following command to execute code in the Sandbox:

curl -sS -i \
  -H "Host: your.domain.com" \
  -H "e2b-sandbox-id: ${SANDBOX_ID}" \
  -H "e2b-sandbox-port: 49999" \
  -H "content-type: application/json" \
  -d '{"code":"print(\"hello from apig\")"}' \
  "http://${APIG_ENDPOINT}/execute"

A 200 OK response that contains hello from apig indicates that the code was executed successfully.

Delete a Sandbox

If you no longer need a Sandbox, call the management API through Cloud-native API Gateway to delete it.

SANDBOX_ID=<sandboxID returned when creating the Sandbox>

curl -sS -i -X DELETE \
  -H "Host: your.domain.com" \
  "http://${APIG_ENDPOINT}/kruise/api/sandboxes/${SANDBOX_ID}"

A 204 No Content response indicates that the delete request has been accepted by the management API. After deletion, accessing the Sandbox typically returns 502 with API Error: healthy sandbox ... not found, indicating that the gateway can no longer route traffic to the Sandbox.

Deletion involves asynchronous cleanup, and Sandbox resources may still be releasing in the background for a short period. This does not affect the fact that the gateway has already stopped forwarding traffic to the Sandbox.

Bind with Certificate

If you choose HTTPS when installing ack-sandbox-manager (ingress.tls=true), a certificate to access ACS Sandbox domain is necessary. Please create TLS Secret in sandbox-system.

For more information about detailed configurations about domain and certificates, see Create an Agent Sandbox.

To create a self-signed certificate, run:

DEMO_DOMAIN=your.domain.com
TMP_DIR=$(mktemp -d)

openssl req -x509 -newkey rsa:2048 -sha256 -days 365 -nodes \
  -subj "/CN=${DEMO_DOMAIN}" \
  -addext "subjectAltName=DNS:${DEMO_DOMAIN},DNS:*.${DEMO_DOMAIN}" \
  -keyout "${TMP_DIR}/privkey.pem" \
  -out "${TMP_DIR}/fullchain.pem"

kubectl -n sandbox-system create secret tls sandbox-manager-tls \
  --cert="${TMP_DIR}/fullchain.pem" \
  --key="${TMP_DIR}/privkey.pem" \
  --dry-run=client -o yaml | kubectl apply -f -

Please use real certificates and sparse domain and wildcard subdomains to gateway entrance in productions.

In test environment, use APIG to verify HTTPS entrance:

curl -k -sS -i \
  --connect-to "your.domain.com:443:${APIG_ENDPOINT}:443" \
  "https://your.domain.com/kruise/api/templates"

Directly access the domain after configuration:

curl -k -sS -i "https://your.domain.com/kruise/api/templates"