Orchard Documentation

repository·main·Indexed 19 days ago

https://github.com/openai/orchard

An orchestration system for Tart designed to manage clusters of bare-metal Apple Silicon machines and virtual machines (VMs). Orchard provides a CLI and REST API to manage the Orchard Controller and Workers, including capabilities for provisioning VMs, managing service accounts, and configuring network security and TLS certificates.

Tokens
12.5K
Snippets
77
Records
85
Agent score
66%

What's inside Orchard

  1. Install and run Orchard in local development mode

    main

    To quickly set up a local Orchard environment, install the CLI via Homebrew and run the development command. This starts both the Orchard Controller and a single Orchard Worker on your local machine. You can then interact with the cluster via the orchard CLI or the built-in REST API.

    brew install openai/tools/orchard
    orchard dev
  2. Format port-forwarding specifications

    main

    Port-forwarding specifications are defined using a colon-delimited string format (localPort:remotePort).

    • Single port (remotePort): If only one port is provided (e.g., 8080), it is treated as the remotePort, and the localPort defaults to 0.
    • Two ports (localPort:remotePort): If two ports are provided (e.g., 8080:9000), the first is the localPort and the second is the remotePort.

    Constraints:

    • Ports must be integers in the range [1, 65535].
    • Invalid formats or out-of-range ports will return an ErrInvalidPortSpec error.
    # Example: Remote port only (local port defaults to 0)
    8080
    
    # Example: Local port and remote port
    8080:9000
  3. Use synthetic mode for load testing

    main

    The --synthetic flag (hidden) allows you to run a worker without instantiating real Tart VMs. Instead, it uses synthetic in-memory VMs and a TCP echo server to emulate a VM's TCP/IP stack. This is suitable for load testing the Controller and networking logic without the overhead of real virtualization.

    orchard worker run <CONTROLLER_URL> --bootstrap-token <TOKEN> --synthetic
  4. Initialize controller certificates and SSH host keys

    main

    The controller initialization process manages the TLS certificates and SSH host keys required for the Orchard controller to operate securely. The system follows a specific precedence order when locating these credentials:

    1. User-specified paths: If provided via CLI flags, these take highest priority.
    2. Data directory: If no flags are provided, the system attempts to load existing credentials from the Orchard data directory.
    3. Automatic generation: If no credentials exist in the data directory, the system generates new self-signed certificates (ECDSA P384) and new SSH host keys (Ed25519) and saves them to the data directory.

    TLS Certificate Requirements

    If you provide custom certificates, you must specify both the certificate and the key. Providing only one will result in an error.

    SSH Host Key Requirements

    You can provide a custom SSH host key via a file path. The system will parse the provided file as an SSH private key.

    # Note: Exact CLI flag names are not explicitly defined in this file, 
    # but the logic uses the following conceptual flags:
    # --controller-cert <path>
    # --controller-key <path>
    # --ssh-host-key <path>
  5. Retrieve specific VM resource fields using path syntax

    main

    You can use a path-based syntax to retrieve the value of a specific field within a VM instead of the full table. This is useful for automation or scripts where you only need one specific attribute (e.g., the status).

    To use this, append the field path to the VM name using a forward slash /.

    Usage: orchard get vm <NAME>/<FIELD_PATH>

    Example: To get the status of a VM named macos: orchard get vm macos/status

    orchard get vm macos/status
  6. Use the Orchard CLI

    main

    The orchard command is the primary entrypoint for managing Orchard resources and performing administrative tasks. It is organized into functional groups: 'Working With Resources' for standard lifecycle and access operations, and 'Administrative Tasks' for system-level management.

    To see all available commands, run orchard --help.

    # General usage pattern
    orchard <command> [flags]
  7. Use the Orchard CLI

    main

    Orchard is a command-line tool. The binary is initialized with a root command that supports signal-interruptible execution. When running commands via the CLI, you can interrupt the process using standard OS interrupt signals (e.g., Ctrl+C), which will trigger a graceful shutdown of the command context.

    # Example of running the orchard binary (assuming it is in your PATH)
    $ orchard --help
  8. Workaround for macOS 15 (Sequoia) Local Network permissions

    main

    macOS 15 (Sequoia) requires a GUI pop-up for 'Local Network' permissions on every host running an Orchard Worker. To avoid this, use one of the following two methods:

    Option 1: Use the --user flag with root

    Run the worker as root and provide the name of your regular, non-privileged user via the --user flag. This starts a privileged orchard localnetworkhelper process to establish connections and then drops privileges to the specified user.

    sudo orchard worker run --user <your-username>

    Option 2: Configure network privacy preferences

    Manually allow all IPv4 private address space in the macOS network privacy settings, then reboot your machine.

    sudo defaults write com.apple.network.local-network AllowedEthernetLocalNetworkAddresses -array "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
    sudo defaults write com.apple.network.local-network AllowedWiFiLocalNetworkAddresses -array "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
  9. Use NewPortSpec to parse port strings

    main

    The NewPortSpec function parses a raw string into a PortSpec struct. It supports the localPort:remotePort or remotePort formats.

    Returns:

    • *PortSpec: A struct containing LocalPort and RemotePort as uint16.
    • error: Returns ErrInvalidPortSpec if the string is malformed or the port numbers are outside the valid range [1, 65535].
    // Example usage
    spec, err := NewPortSpec("8080:9000")
    if err != nil {
        // handle error (e.g., ErrInvalidPortSpec)
    }
    fmt.Printf("Local: %d, Remote: %d\n", spec.LocalPort, spec.RemotePort)
  10. Access Orchard Services

    main

    The Client struct provides entry points to various service namespaces. Use these methods to access specific API domains:

    • Workers(): Returns a *WorkersService.
    • VMs(): Returns a *VMsService.
    • ServiceAccounts(): Returns a *ServiceAccountsService.
    • Controller(): Returns a *ControllerService.
    • ClusterSettings(): Returns a *ClusterSettingsService.
    • RPC(): Returns an *RPCService.
    // Example: Accessing the VMs service
    vmService := cl.VMs()
    // Now use vmService to call VM-related methods
  11. Verify Client Connectivity

    main

    The Check(ctx) method performs a simple GET / request to verify that the client can communicate with the Orchard API.

    err := cl.Check(ctx)
    if err != nil {
    	fmt.Printf("Connection failed: %v\n", err)
    } else {
    	fmt.Println("Connected successfully!")
    }