Kubernetes Manifests & Workload Scripts

perfkitbenchmarker/data/k8s_agents/README.md

@@ -0,0 +1,48 @@
+# Kubernetes Agent Sandbox Resources
+
+Static data files consumed by the benchmark framework during deployment
+and execution. Organized into three subdirectories:
+
+## Directory Structure
+
+```
+k8s_agents/
+|-- config/                          # Benchmark and variant configurations
+|   |-- agentic_benchmark_config.yaml   # Shared config with YAML anchors
+|   +-- variants/                       # 11 optimization variant configs
+|       |-- baseline.yaml
+|       |-- c4a_arm.yaml
+|       |-- ...
+|       |-- variant_reference_guide.md  # Detailed variant documentation
+|       +-- tuning/                     # Kubelet, scheduler, swap, THP configs
+|-- manifests/                       # Jinja2 K8s manifest templates
+|   |-- adk-agent.yaml.j2              # ADK Agent Deployment + RBAC
+|   |-- sandbox-templates.yaml.j2      # SandboxTemplate + WarmPool (Python, Chromium)
+|   |-- sandbox-router.yaml.j2         # Sandbox Router Deployment
+|   |-- psi-reader.yaml.j2             # PSI Reader DaemonSet
+|   |-- snapshot-crds.yaml.j2          # PodSnapshot StorageConfig + Policy
+|   +-- snapshot-sandbox-template.yaml.j2  # Snapshot-specific SandboxTemplate
++-- workloads/                       # Benchmark workload scripts
+    +-- startup_scripts/                 # Startup scripts for snapshot benchmarks
+        |-- README.md
+        |-- pip_fastapi.sh
+        +-- npm_vite.sh
+```
+
+## Manifests
+
+Jinja2 templates rendered by `gke_deploy_utils.py` during the prepare
+stage. Template variables use `__ name __` syntax (double underscores
+with spaces) and are substituted at render time with cluster-specific
+values (namespace, image paths, project, region).
+
+## Variant Configs
+
+Each variant YAML contains all 7 benchmark keys with cluster and
+node pool specifications. See `variants/variant_reference_guide.md`
+for detailed descriptions of what each variant tests and its expected
+impact on each benchmark.
+
+## Startup Scripts
+
+The `workloads/startup_scripts/` directory contains pluggable bash scripts used exclusively by the Pod Snapshot benchmark. They simulate an AI agent initializing a fresh environment (installing dependencies, starting servers) before a snapshot is taken. Users select which script to run via the `--k8s_snapshot_preload_mode` flag to test different memory and I/O footprints (e.g., lightweight Python vs. heavyweight Node.js).

perfkitbenchmarker/data/k8s_agents/manifests/adk-agent.yaml.j2

@@ -0,0 +1,122 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: adk-agent-sa
+  namespace: {{ ns }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: adk-agent-sandbox-role
+rules:
+  - apiGroups: ["agents.x-k8s.io"]
+    resources: ["sandboxes"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["agents.x-k8s.io"]
+    resources: ["sandboxwarmpool", "sandboxwarmpools"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxclaims"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "pods/exec", "services", "configmaps"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/portforward"]
+    verbs: ["create"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: adk-agent-sandbox-binding
+  namespace: {{ ns }}
+subjects:
+  - kind: ServiceAccount
+    name: adk-agent-sa
+    namespace: {{ ns }}
+roleRef:
+  kind: ClusterRole
+  name: adk-agent-sandbox-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adk-agent
+  namespace: {{ ns }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: adk-agent
+  template:
+    metadata:
+      labels:
+        app: adk-agent
+    spec:
+      serviceAccountName: adk-agent-sa
+      containers:
+      - name: adk-agent
+        imagePullPolicy: Always
+        image: {{ adk_image }}
+        resources:
+          limits:
+            memory: "16384Mi"
+            cpu: "6000m"
+          requests:
+            memory: "512Mi"
+            cpu: "1000m"
+        ports:
+        - containerPort: 8080
+        #livenessProbe:
+        #  httpGet:
+        #    path: /healthz
+        #    port: 8080
+        #  initialDelaySeconds: 15
+        #  periodSeconds: 30
+        #  timeoutSeconds: 10
+        #  failureThreshold: 6
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        env:
+          - name: PORT
+            value: "8080"
+          - name: GOOGLE_CLOUD_PROJECT
+            value: "{{ project }}"
+          - name: GOOGLE_CLOUD_LOCATION
+            value: "{{ region }}"
+          - name: GOOGLE_GENAI_USE_VERTEXAI
+            value: "true"
+          - name: CLUSTER_NAME
+            value: "{{ cluster }}"
+          - name: AGENTIC_NAMESPACE
+            value: "{{ ns }}"
+          - name: SANDBOX_ROUTER_URL
+            value: "http://sandbox-router-svc.{{ ns }}.svc.cluster.local:8080"
+          - name: SANDBOX_IO_WORKERS
+            value: "200"
+          - name: FASTAPI_WORKERS
+            value: "200"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adk-agent
+  namespace: {{ ns }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+  selector:
+    app: adk-agent

perfkitbenchmarker/data/k8s_agents/manifests/psi-reader.yaml.j2

@@ -0,0 +1,56 @@
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: psi-reader
+  namespace: {{ ns }}
+  labels:
+    app: psi-reader
+spec:
+  selector:
+    matchLabels:
+      app: psi-reader
+  template:
+    metadata:
+      labels:
+        app: psi-reader
+    spec:
+      nodeSelector:
+        pkb_nodepool: sandbox
+      tolerations:
+      - key: "sandbox.gke.io/runtime"
+        operator: "Equal"
+        value: "gvisor"
+        effect: "NoSchedule"
+      - key: "dedicated"
+        operator: "Equal"
+        value: "agentic-sandbox"
+        effect: "NoSchedule"
+      hostPID: true
+      containers:
+      - name: reader
+        image: busybox:1.36
+        command: ["sleep", "infinity"]
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: cgroup
+          mountPath: /host/sys/fs/cgroup
+          readOnly: true
+        - name: proc
+          mountPath: /host/proc
+          readOnly: true
+        resources:
+          requests:
+            cpu: "10m"
+            memory: "16Mi"
+          limits:
+            cpu: "50m"
+            memory: "32Mi"
+      volumes:
+      - name: cgroup
+        hostPath:
+          path: /sys/fs/cgroup
+      - name: proc
+        hostPath:
+          path: /proc

perfkitbenchmarker/data/k8s_agents/manifests/sandbox-router.yaml.j2

@@ -0,0 +1,69 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sandbox-router-svc
+  namespace: {{ ns }}
+spec:
+  type: ClusterIP
+  selector:
+    app: sandbox-router
+  ports:
+  - name: http
+    protocol: TCP
+    port: 8080
+    targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sandbox-router-deployment
+  namespace: {{ ns }}
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: sandbox-router
+  template:
+    metadata:
+      labels:
+        app: sandbox-router
+    spec:
+      serviceAccountName: adk-agent-sa
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: sandbox-router
+      containers:
+      - name: router
+        image: {{ router_image }}
+        ports:
+        - containerPort: 8080
+        env:
+        - name: ALLOW_UNAUTHENTICATED_ROUTER
+          value: "true"
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        resources:
+          requests:
+            cpu: "250m"
+            memory: "512Mi"
+          limits:
+            cpu: "1000m"
+            memory: "1Gi"
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000