OpenAI Codex 落地企业私有环境：与 Dell 合力打通混合部署最后一公里

# codex-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: codex-onprem
  labels:
    app.kubernetes.io/part-of: codex
    data-classification: restricted   # 标记为受限数据区域
---
apiVersion: resource.k8s.io/v1alpha1
kind: ResourceQuota
metadata:
  name: codex-gpu-quota
  namespace: codex-onprem
spec:
  hard:
    requests.nvidia.com/gpu: "4"      # 最多占用 4 块 A100
    limits.nvidia.com/gpu: "4"
    requests.memory: "256Gi"
    limits.memory: "512Gi"

kubectl apply -f codex-namespace.yaml

# codex-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: codex-server
  namespace: codex-onprem
spec:
  replicas: 2
  selector:
    matchLabels:
      app: codex-server
  template:
    metadata:
      labels:
        app: codex-server
    spec:
      containers:
        - name: codex-engine
          image: openai/codex-server:v1.0-onprem  # 本地部署专用镜像
          resources:
            requests:
              nvidia.com/gpu: "2"
              memory: "128Gi"
            limits:
              nvidia.com/gpu: "2"
              memory: "256Gi"
          env:
            - name: CODEX_MODE
              value: "onprem"
            - name: DATA_RESIDENCY
              value: "local-only"          # 禁止任何数据外传
            - name: AUDIT_LOG_PATH
              value: "/var/log/codex/audit.json"
            - name: CONTEXT_STORE
              value: "/data/codebase-index"  # 本地代码仓索引路径
          volumeMounts:
            - name: gpu-driver
              mountPath: /usr/local/nvidia
            - name: model-weights
              mountPath: /data/model
            - name: codebase-index
              mountPath: /data/codebase-index
            - name: audit-log
              mountPath: /var/log/codex
      volumes:
        - name: gpu-driver
          hostPath:
            path: /usr/local/nvidia
        - name: model-weights
          persistentVolumeClaim:
            claimName: codex-model-pvc     # 模型权重持久化存储
        - name: codebase-index
          persistentVolumeClaim:
            claimName: codex-index-pvc      # 代码索引持久化存储
        - name: audit-log
          hostPath:
            path: /var/log/codex-onprem
      # 网络策略：禁止容器访问外部网络
      # 需配合 NetworkPolicy 一起生效

# codex-network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: codex-egress-lockdown
  namespace: codex-onprem
spec:
  podSelector:
    matchLabels:
      app: codex-server
  policyTypes:
    - Egress
  egress:
    # 只允许访问本地代码仓服务与内部 DNS
    - to:
        - ipBlock:
            cidr: 10.0.0.0/8          # 企业内网范围
      ports:
        - port: 443
          protocol: TCP
        - port: 53
          protocol: TCP
        - port: 53
          protocol: UDP
    # 允许访问同命名空间内的服务间通信
    - to:
        - namespaceSelector:
            matchLabels:
              app.kubernetes.io/part-of: codex

kubectl apply -f codex-network-policy.yaml

# dev_client.py — 开发者本地调用示例
import requests

CODEX_LOCAL_URL = "https://codex-internal.corp.example.com/v1/complete"

def complete_code(prompt: str, max_tokens: int = 512) -> str:
    """调用本地部署的 Codex，数据不出内网"""
    resp = requests.post(
        CODEX_LOCAL_URL,
        json={
            "prompt": prompt,
            "max_tokens": max_tokens,
            "model": "codex-onprem-v1",
        },
        headers={"Authorization": "Bearer <internal-token>"},
        timeout=30,
    )
    resp.raise_for_status()
    return resp.json()["completion"]

# 示例：补全一个内部支付服务的异常处理逻辑
snippet = '''
def process_refund(order_id: str, amount: float):
    """处理退款，需调用内部 PaymentGateway 服务"""
    gateway = PaymentGatewayClient(endpoint="http://paygw.internal:8080")
'''

result = complete_code(snippet)
print(result)