feat: migrate AKernel deployment to Python YuanRong CLI

[mhsong1998-dot]

Summary

Migrate master, frontend, node, and standalone startup from the legacy Go launcher to the Python openYuanRong CLI. Preserve fixed deployment paths, role-specific logs, external sandboxd resource collection, distinct Pod/bridge addresses, DataSystem timeouts, checkpoint storage, and YR_RRT_CONTROL_SOCKET_PATH.

The branch is rebased onto main at 79e2f0c and contains one signed commit. The conflict resolution keeps the current YR_IMAGE_PROCESS_CONFIG startup contract and inherited-image-entrypoint support from main.

Startup behavior

• Launch openYuanRong with /opt/openyuanrong/bin/python /opt/openyuanrong/bin/yr ... start; master/frontend add --master, and every role keeps foreground supervision.
• Track foreground sandboxd with Type=simple.
• Wait in ExecStartPost until sandbox0 has an IPv4 address or the bounded timeout expires, including the period before the interface exists.
• Put DataSystem health and ready files under its configured log directory, which the Python CLI creates before launching the worker.
• Keep the chart's default OSS configuration. This PR does not change the deployment-wide storage backend. During image assembly it applies two narrow hardening edits to the installed CLI: log inherited environment keys instead of values, and omit component environment values from the persisted session file.

Validation

Static checks

• make SHELL=/bin/bash deploy-script-check
• helm lint deploy/akernel/charts/core
• git diff --check

Image and standalone

Built current head 7f09b8f.

• Product image: swr.cn-north-4.myhuaweicloud.com/openyuanrong/cluster-all-in-one:pr19-7f09b8f
• Digest: sha256:d9ce21731bac9886341acb4e710eca779642502ae9fe08dc716d48a8438c4cbf
• Manifest: single linux/amd64 Docker v2 manifest.
• The built image contains openyuanrong-core 0.10.2rc2; all 27 dependency constraints match the previously validated runtime.
• Standalone on predecessor 8c73329 started with both sandboxd.service and yuanrong.service active, Python yr processes present, and sandbox0 at 10.88.0.1/16.
• basic_usage, command_stdin, named_sandbox, and pty passed. The node sandbox list was empty after cleanup.

Componentized CCE deployment

Validated predecessor 8c73329 in cn-north-4/akernel-cce, namespace akernel, Helm release akernel-core revision 59. Current head differs only in the constraints filename/comment and matching Dockerfile COPY path; the current-head image build above verifies that path.

• Master, frontend, four nodes, etcd, and Traefik are Ready. The six product Pods use predecessor digest sha256:8299c9e345f72253b0cb59d738defb31a48a453a41e7f10fb4bb9332f86d7dfc and have zero restarts after the final clean startup.
• Process inspection confirms master/frontend and all nodes run the Python yr CLI.
• Both sandboxd.service and yuanrong.service are active on all four nodes; every node has a live sandbox0 IPv4 address.
• DataSystem health and ready files exist under the configured log directory. Its six cluster records exactly match the current master, frontend, and node Pod IPs.
• Persistent DataSystem topology from earlier validation rollouts contained stale Pod IPs. With no active sandboxes, only the /datasystem/ runtime prefix was cleared before the final clean startup; other YuanRong metadata was preserved.

Python examples

Ran every one of the 14 original files under sdk/python/examples using client image swr.cn-north-4.myhuaweicloud.com/openyuanrong/akernel-sdk-client:pr19-8c73329.

• Passed: basic_usage, command_stdin, failover_reload, named_sandbox, network_policy, pty, reverse_tunnel, and storage_sandbox.
• custom_image, dockerfile_launch, and port_forwarding reached their default Docker Hub images and failed because CCE node connections to index.docker.io:443 timed out. The corresponding examples passed when only those image references were switched to mirrored SWR images; all nine dockerfile_launch sections passed.
• gpu_sandbox reached scheduling and returned ERR_RESOURCE_NOT_ENOUGH; the cluster has no matching accelerator card.
• sandbox_runtime passed its default and runsc cases, then stopped at Kata because this image intentionally has Kata disabled.
• s3_rootfs_and_mounts reached the temporary MinIO fixture, but the image-manager path converted the requested S3 source to source_type=oss, so the mount daemon exited. This is an independent storage-provider propagation issue and no deployment-default change is included here.

All temporary Jobs, Services, ConfigMaps, Secrets, standalone resources, and the MinIO fixture were deleted. All four node sandbox lists are empty, and the final product deployment remains healthy on pr19-8c73329.

[tianyuzhou95]

One remaining process issue before merge: the current commit body contains only the Signed-off-by trailer. The repository's AGENTS.md requires a Conventional Commit with a prose body explaining what changed and why, followed by the DCO sign-off. Please amend the commit message accordingly.

Also, GitHub currently reports no checks for this branch. The validation documented in the PR is extensive, but there is no automated status attached to the commit. Please ensure the expected CI checks are configured and passing before merge, or explicitly confirm that this repository does not currently provide PR checks.

[mhsong1998-dot]

Process items are addressed in current HEAD 1e30b39: the branch contains one lowercase Conventional Commit with a prose body, and its author, committer, and Signed-off-by trailer all match mhsong1998-dot. GitHub created CI run 32334113441 for this head, but currently marks it action_required, so a maintainer must approve the fork workflow before the checks can execute. The previously approved head passed all eight CI jobs.