Orchard Documentation
repository·main·Indexed 19 days ago
https://github.com/openai/orchardAn orchestration system for Tart designed to manage clusters of bare-metal Apple Silicon machines and virtual machines (VMs). Orchard provides a CLI and REST API to manage the Orchard Controller and Workers, including capabilities for provisioning VMs, managing service accounts, and configuring network security and TLS certificates.
What's inside Orchard
- Orchard is an orchestration system for Tart. It allows you to create a cluster of bare-metal Apple Silicon machines and manage dozens of virtual machines (VMs) efficiently.
Install and run Orchard in local development mode
mainTo quickly set up a local Orchard environment, install the CLI via Homebrew and run the development command. This starts both the Orchard Controller and a single Orchard Worker on your local machine. You can then interact with the cluster via the
orchardCLI or the built-in REST API.brew install openai/tools/orchard orchard devFormat port-forwarding specifications
mainPort-forwarding specifications are defined using a colon-delimited string format (
localPort:remotePort).- Single port (
remotePort): If only one port is provided (e.g.,8080), it is treated as theremotePort, and thelocalPortdefaults to0. - Two ports (
localPort:remotePort): If two ports are provided (e.g.,8080:9000), the first is thelocalPortand the second is theremotePort.
Constraints:
- Ports must be integers in the range
[1, 65535]. - Invalid formats or out-of-range ports will return an
ErrInvalidPortSpecerror.
# Example: Remote port only (local port defaults to 0) 8080 # Example: Local port and remote port 8080:9000- Single port (
Use synthetic mode for load testing
mainThe
--syntheticflag (hidden) allows you to run a worker without instantiating real Tart VMs. Instead, it uses synthetic in-memory VMs and a TCP echo server to emulate a VM's TCP/IP stack. This is suitable for load testing the Controller and networking logic without the overhead of real virtualization.orchard worker run <CONTROLLER_URL> --bootstrap-token <TOKEN> --syntheticInitialize controller certificates and SSH host keys
mainThe controller initialization process manages the TLS certificates and SSH host keys required for the Orchard controller to operate securely. The system follows a specific precedence order when locating these credentials:
- User-specified paths: If provided via CLI flags, these take highest priority.
- Data directory: If no flags are provided, the system attempts to load existing credentials from the Orchard data directory.
- Automatic generation: If no credentials exist in the data directory, the system generates new self-signed certificates (ECDSA P384) and new SSH host keys (Ed25519) and saves them to the data directory.
TLS Certificate Requirements
If you provide custom certificates, you must specify both the certificate and the key. Providing only one will result in an error.
SSH Host Key Requirements
You can provide a custom SSH host key via a file path. The system will parse the provided file as an SSH private key.
# Note: Exact CLI flag names are not explicitly defined in this file, # but the logic uses the following conceptual flags: # --controller-cert <path> # --controller-key <path> # --ssh-host-key <path>Retrieve specific VM resource fields using path syntax
mainYou can use a path-based syntax to retrieve the value of a specific field within a VM instead of the full table. This is useful for automation or scripts where you only need one specific attribute (e.g., the status).
To use this, append the field path to the VM name using a forward slash
/.Usage:
orchard get vm <NAME>/<FIELD_PATH>Example: To get the status of a VM named
macos:orchard get vm macos/statusorchard get vm macos/statusUse the Orchard CLI
mainThe
orchardcommand is the primary entrypoint for managing Orchard resources and performing administrative tasks. It is organized into functional groups: 'Working With Resources' for standard lifecycle and access operations, and 'Administrative Tasks' for system-level management.To see all available commands, run
orchard --help.# General usage pattern orchard <command> [flags]Use the Orchard CLI
mainOrchard is a command-line tool. The binary is initialized with a root command that supports signal-interruptible execution. When running commands via the CLI, you can interrupt the process using standard OS interrupt signals (e.g.,
Ctrl+C), which will trigger a graceful shutdown of the command context.# Example of running the orchard binary (assuming it is in your PATH) $ orchard --helpWorkaround for macOS 15 (Sequoia) Local Network permissions
mainmacOS 15 (Sequoia) requires a GUI pop-up for 'Local Network' permissions on every host running an Orchard Worker. To avoid this, use one of the following two methods:
Option 1: Use the
--userflag with rootRun the worker as
rootand provide the name of your regular, non-privileged user via the--userflag. This starts a privilegedorchard localnetworkhelperprocess to establish connections and then drops privileges to the specified user.sudo orchard worker run --user <your-username>Option 2: Configure network privacy preferences
Manually allow all IPv4 private address space in the macOS network privacy settings, then reboot your machine.
sudo defaults write com.apple.network.local-network AllowedEthernetLocalNetworkAddresses -array "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" sudo defaults write com.apple.network.local-network AllowedWiFiLocalNetworkAddresses -array "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"Use NewPortSpec to parse port strings
mainThe
NewPortSpecfunction parses a raw string into aPortSpecstruct. It supports thelocalPort:remotePortorremotePortformats.Returns:
*PortSpec: A struct containingLocalPortandRemotePortasuint16.error: ReturnsErrInvalidPortSpecif the string is malformed or the port numbers are outside the valid range[1, 65535].
// Example usage spec, err := NewPortSpec("8080:9000") if err != nil { // handle error (e.g., ErrInvalidPortSpec) } fmt.Printf("Local: %d, Remote: %d\n", spec.LocalPort, spec.RemotePort)Access Orchard Services
mainThe
Clientstruct provides entry points to various service namespaces. Use these methods to access specific API domains:Workers(): Returns a*WorkersService.VMs(): Returns a*VMsService.ServiceAccounts(): Returns a*ServiceAccountsService.Controller(): Returns a*ControllerService.ClusterSettings(): Returns a*ClusterSettingsService.RPC(): Returns an*RPCService.
// Example: Accessing the VMs service vmService := cl.VMs() // Now use vmService to call VM-related methodsVerify Client Connectivity
mainThe
Check(ctx)method performs a simpleGET /request to verify that the client can communicate with the Orchard API.err := cl.Check(ctx) if err != nil { fmt.Printf("Connection failed: %v\n", err) } else { fmt.Println("Connected successfully!") }