marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: updating dependencies - shuffle-shared and singul

Browse Source
This commit is contained in:
Aditya
2026-02-09 18:06:21 +05:30
parent 15c18ef5db 4c19b37000
commit 11c660d3c6
32 changed files with 3454 additions and 589 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/main.go
+1
View File
@@ -5398,6 +5398,7 @@ func initHandlers() {
r.HandleFunc("/api/v1/_ah/health", shuffle.HealthCheckHandler)
r.HandleFunc("/api/v1/health", shuffle.RunOpsHealthCheck).Methods("GET", "OPTIONS")
r.HandleFunc("/api/v1/health/stats", shuffle.GetOpsDashboardStats).Methods("GET", "OPTIONS")
r.HandleFunc("/api/v1/health/opensearch-prefix", shuffle.HandleFixOpensearchPrefix).Methods("POST", "OPTIONS")
// Make user related locations
// Fix user changes with org
backend/go-app/walkoff.go
+2 -3
View File
@@ -1,7 +1,6 @@
package main
import (
"github.com/shuffle/shuffle-shared"
"bytes"
@@ -1266,7 +1265,7 @@ func executeWorkflow(resp http.ResponseWriter, request *http.Request) {
// Check for "wait" query if it's true
wait, waitok := request.URL.Query()["wait"]
if waitok && wait[0] == "true" {
returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1)
returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1, 15)
returnBytes, err := json.Marshal(returnBody)
if err != nil {
log.Printf("[ERROR] Failed to marshal retStruct in single execution: %s", err)
@@ -2728,7 +2727,7 @@ func executeSingleAction(resp http.ResponseWriter, request *http.Request) {
actionId = workflowExecution.Workflow.Actions[0].ID
}
returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1, actionId)
returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1, 15, actionId)
returnBytes, err := json.Marshal(returnBody)
if err != nil {
log.Printf("[ERROR] Failed to marshal retStruct in single execution: %s", err)
frontend/src/components/HealthPage.jsx
+52 -7
View File
@@ -24,6 +24,7 @@ const HealthPage = (props) => {
const [liveExecutionsRange, setLiveExecutionsRange] = useState('1h'); // Default to 1h
const [isHealthLoading, setIsHealthLoading] = useState(false); // Loading state for HealthBarChart
const [isLiveExecutionsLoading, setIsLiveExecutionsLoading] = useState(false); // Loading state for LiveExecutionsChart
const [isFixingOpensearchPrefix, setIsFixingOpensearchPrefix] = useState(false);
const isCloud = (window.location.host === "localhost:3002" || window.location.host === "shuffler.io") ? true : (import.meta.env.VITE_IS_SSR === "true");
@@ -364,19 +365,63 @@ const HealthPage = (props) => {
}
};
const handleFixOpensearchPrefix = async () => {
if (isFixingOpensearchPrefix) {
return;
}
setIsFixingOpensearchPrefix(true);
try {
const response = await fetch(`${globalUrl}/api/v1/health/opensearch-prefix`, {
method: "POST",
headers: {
"Content-Type": "application/json",
Accept: "application/json",
},
credentials: "include",
});
const data = await response.json();
if (!response.ok || !data.success) {
const reason = data && data.reason ? data.reason : "Failed to fix opensearch prefix";
throw new Error(reason);
}
const reindexed = data.reindexed ? data.reindexed.length : 0;
const aliasUpdates = data.alias_updates ? data.alias_updates.length : 0;
const deleted = data.deleted_indices ? data.deleted_indices.length : 0;
toast.success(`Fixed opensearch prefix (reindexed ${reindexed}, aliases ${aliasUpdates}, deleted ${deleted})`);
} catch (error) {
console.error("Error fixing opensearch prefix:", error);
toast.error(error.message || "Failed to fix opensearch prefix");
} finally {
setIsFixingOpensearchPrefix(false);
}
};
const healthBarData = updateChartData()
return (
<div style={{ paddingTop: 30, width: '100%', display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center' }}>
{/* Health Bar Chart Section */}
<ButtonGroup style={{ display: 'flex', margin: "auto", marginBottom: 10, width: 300, borderRadius: 30, background: "#000000" }}>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '24hr' ? '2px solid #FF8444' : 'none', background: "#000000", color: selectedRange === '24hr' ? '#FF8444' : '#cfd8dc', textTransform: 'none' }} onClick={() => filterDataByRange('24hr')} disabled={isHealthLoading}>24h</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '7day' ? '2px solid #FF8444' : 'none', background: "#000000", color: selectedRange === '7day' ? '#FF8444' : '#cfd8dc', textTransform: 'none' }} onClick={() => filterDataByRange('7day')} disabled={isHealthLoading}>7d</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '30d' ? '2px solid #FF8444' : 'none', background: "#000000", color: selectedRange === '30d' ? '#FF8444' : '#cfd8dc', textTransform: 'none' }} onClick={() => filterDataByRange('30d')} disabled={isHealthLoading}>30d</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '90d' ? '2px solid #FF8444' : 'none', background: "#000000", color: "grey", textTransform: 'none' }} onClick={() => filterDataByRange('90d')} disabled>90d</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '180d' ? '2px solid #FF8444' : 'none', background: "#000000", color: "grey", textTransform: 'none' }} onClick={() => filterDataByRange('180d')} disabled>180d</Button>
</ButtonGroup>
<div style={{ display: 'flex', alignItems: 'center', gap: 12, margin: "auto", marginBottom: 10 }}>
<ButtonGroup style={{ display: 'flex', width: 300, borderRadius: 30, background: "#000000" }}>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '24hr' ? '2px solid #FF8444' : 'none', background: "#000000", color: selectedRange === '24hr' ? '#FF8444' : '#cfd8dc', textTransform: 'none' }} onClick={() => filterDataByRange('24hr')} disabled={isHealthLoading}>24h</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '7day' ? '2px solid #FF8444' : 'none', background: "#000000", color: selectedRange === '7day' ? '#FF8444' : '#cfd8dc', textTransform: 'none' }} onClick={() => filterDataByRange('7day')} disabled={isHealthLoading}>7d</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '30d' ? '2px solid #FF8444' : 'none', background: "#000000", color: selectedRange === '30d' ? '#FF8444' : '#cfd8dc', textTransform: 'none' }} onClick={() => filterDataByRange('30d')} disabled={isHealthLoading}>30d</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '90d' ? '2px solid #FF8444' : 'none', background: "#000000", color: "grey", textTransform: 'none' }} onClick={() => filterDataByRange('90d')} disabled>90d</Button>
<Button variant="contained" style={{ flex: 1, borderBottom: selectedRange === '180d' ? '2px solid #FF8444' : 'none', background: "#000000", color: "grey", textTransform: 'none' }} onClick={() => filterDataByRange('180d')} disabled>180d</Button>
</ButtonGroup>
<Button
variant="contained"
style={{ background: '#1a1a1a', color: '#FF8444', textTransform: 'none' }}
onClick={handleFixOpensearchPrefix}
disabled={isFixingOpensearchPrefix}
>
{isFixingOpensearchPrefix ? 'Fixing Opensearch Prefix...' : 'Fix Opensearch Prefix'}
</Button>
</div>
{/* Loading Bar for HealthBarChart */}
{isHealthLoading && (
functions/kubernetes/charts/shuffle/Chart.yaml
+1 -1
View File
@@ -2,7 +2,7 @@ apiVersion: v2
name: shuffle
description: A Helm chart for deploying Shuffle on Kubernetes
type: application
version: 2.1.0 # Set during publishing in GitHub actions
version: 0.0.0 # Set during publishing in GitHub actions
appVersion: latest # Overwritten during publishing in GitHub actions
dependencies:
- name: common
functions/kubernetes/charts/shuffle/README.md
+504 -30
View File
@@ -105,6 +105,105 @@ SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uu
SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
```
## Shuffle Worker
By default, Orborus creates a Kubernetes Deployment and Service for Shuffle Worker.
The deployment can be customized to some degree using some of the `worker.*` helm variables. They are converted to Orborus env variables.
If you want full control, you can also deploy Shuffle Worker using helm by enabling `worker.enableHelmDeployment`.
This approach respects all of the `worker.*` helm variables.
You can then set `orborus.manageWorkerDeployments=false` to reduce the permissions assigned to the Shuffle Orborus Kubernetes service account.
## Shuffle Apps
By default, Shuffle Worker is responsible for creating Kubernetes Deployments and Services for each app.
Each app and version has their own Deployment and Service. Shuffle automatically deploys a set of apps.
Other apps are deployed on demand, when they are first used.
You can use some of the `app.*` helm variables to control some aspects of the deployment, e.g. resources and security context.
Helm variables are converted to env variables set on Orborus. Orborus in turn passes the env variables to Worker when creating the Deployment.
When `worker.enableHelmDeployment` is set, env variables for app configuration are set on the worker directly.
Configuration using env variables applies to ALL deployed apps. There is no way to assign different options (e.g. resources) to different apps, or scale apps individually.
If you want full control, you can deploy apps using helm. This has the following advantages:
- full control over the deployment using helm values
- granular control per app and version (e.g. have more replicas and resources for frequently used apps)
- avoid problems with on-demand started apps (see https://github.com/Shuffle/Shuffle/issues/1739)
To deploy apps using helm, set `apps.enabled=true`. By default, this deploys the `shuffle-tools`, `shuffle-subflow` and `http` apps.
You can also deploy your own apps. See the following values file for an example.
```yaml
app:
replicaCount: 1 # default to 1 replica per app
resources: {} # default resources for apps
# ... configure default options for all apps here
apps:
enabled: true # Deploy apps using helm.
# Configure default apps
shuffleTools:
enabled: true # default
shuffleSubflow:
enabled: true # default
http:
enabled: true # default
# optionally override defaults from app values:
replicaCount: 1
resources: {}
# Deploy additional apps (e.g. opensearch)
opensearch:
enabled: true # required to actually deploy the app
name: opensearch # required. The name and version must match the values of the `api.yaml` file of the app.
version: 1.1.0 # required.
# optionally change app configuration:
replicaCount: 3
resources: {}
```
The key of an app in the `apps` map does not matter, as long as it is unique. We are not using an array here, to allow overriding values in stage-specific value files or using the command line, e.g.
`helm upgrade ... --set apps.shuffleTools.replicas=3`.
You can override any value set in `app.*` (e.g. `app.image`, `app.replicaCount`, `app.resources`, `app.podSecurityContext`) for each app
(e.g. for the `shuffle-tools` app using `apps.shuffleTools.image`, `apps.shuffleTools.replicaCount`, ...).
It is possible to use a hybrid approach - deploy some apps using helm, while still allowing Worker to create additional apps on-demand.
If you do not want Worker to manage app deployments, set `worker.manageAppDeployments=true`. This effectively removes the required permissions from the Shuffle Worker Kubernetes Service Account.
You are required to deploy all apps that are in use by your Shuffle instance manually using Helm.
### Shuffle App Service Accounts
By default a shared `shuffle-app` service account is used for all apps.
If you are deploying apps using helm, you can choose to have a dedicated service account per app.
To enable it, set `apps.MY_APP.serviceAccount.create=true` and provide a name using `apps.MY_APP.serviceAccount.name`.
You can also set `apps.MY_APP.serviceAccount.create=false` while still providing a name to use an existing service account.
```yaml
apps:
myAppWithCustomServiceAccount:
enabled: true
name: my-custom-service-account
version: 1.0.0
serviceAccount:
create: true
name: shuffle-app-myapp
anotherAppWithExistingServiceAccount:
enabled: true
name: another-app
version: 1.0.0
serviceAccount:
create: false
name: existing-service-account-name
```
All service accounts use the `shuffle-app` role by default.
## OpenSearch
Shuffle uses OpenSearch as its database. This helm chart installs a single-node OpenSearch cluster using [the Bitnami Helm Chart](https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml).
@@ -116,7 +215,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
## Parameters
### Global parameters
##### Global parameters
| Name | Description | Value |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
@@ -126,7 +225,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` |
| `global.compatibility.omitEmptySeLinuxOptions` | If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object | `false` |
### Common parameters
##### Common parameters
| Name | Description | Value |
| ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
@@ -142,16 +241,17 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `diagnosticMode.command` | Command to override all containers in the chart release | `["sleep"]` |
| `diagnosticMode.args` | Args to override all containers in the chart release | `["infinity"]` |
### Shared Shuffle Parameters
##### Shared Shuffle Parameters
| Name | Description | Value |
| --------------------- | ------------------------------------------------------------- | --------------- |
| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` |
| `shuffle.org` | Default shuffle organization | `Shuffle` |
| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `""` |
| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` |
| Name | Description | Value |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------- |
| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` |
| `shuffle.org` | Default shuffle organization | `Shuffle` |
| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `docker.io` |
| `shuffle.appBaseImageName` | The base image used for shuffle apps. The final image for an app is <appRegistr>/<appBaseImageName>/<appName>:<appVersion> | `frikky` |
| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` |
### backend Parameters
##### backend Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
@@ -266,7 +366,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `backend.apps.downloadBranch` | The branch from which apps should be downloaded on startup. | `master` |
| `backend.apps.forceUpdate` | Force an update of apps on startup. | `false` |
### frontend Parameters
##### frontend Parameters
| Name | Description | Value |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
@@ -372,7 +472,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `frontend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `frontend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### orborus Parameters
##### orborus Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
@@ -475,15 +575,44 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `orborus.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `orborus.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `orborus.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| `orborus.executionConcurrency` | The maximum amount of concurrent workflow executions per worker | `25` |
| `orborus.manageWorkerDeployments` | Whether workers are deployed and managed by orborus. When disabled, every worker is expected to be already deployed (see worker.enableHelmDeployment). | `true` |
### worker Parameters
##### worker Parameters
| Name | Description | Value |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.enableHelmDeployment` | Deploy worker via helm. By default, workers are deployed by Orborus. | `false` |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.image.pullPolicy` | worker image pull policy. Only effective with worker.enableHelmDeployment. | `IfNotPresent` |
| `worker.image.pullSecrets` | worker image pull secrets. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.replicaCount` | Number of worker replicas to deploy. Only effective with worker.enableHelmDeployment. | `1` |
| `worker.containerPorts.http` | backend HTTP container port | `33333` |
| `worker.extraContainerPorts` | Optionally specify extra list of additional ports for worker containers. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.livenessProbe.enabled` | Enable livenessProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` |
| `worker.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
| `worker.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
| `worker.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
| `worker.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
| `worker.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `worker.readinessProbe.enabled` | Enable readinessProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` |
| `worker.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
| `worker.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `worker.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `worker.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `worker.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `worker.startupProbe.enabled` | Enable startupProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` |
| `worker.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
| `worker.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
| `worker.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
| `worker.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
| `worker.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `worker.customLivenessProbe` | Custom livenessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.customReadinessProbe` | Custom readinessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.customStartupProbe` | Custom startupProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.resourcesPreset` | Set worker container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if worker.resources is set (worker.resources is recommended for production). | `nano` |
| `worker.resources` | Set worker container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `worker.podSecurityContext.enabled` | Enable worker pods' Security Context | `true` |
@@ -501,6 +630,49 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `worker.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in worker container' Security Context | `false` |
| `worker.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in worker container | `["ALL"]` |
| `worker.containerSecurityContext.seccompProfile.type` | Set seccomp profile in worker container | `RuntimeDefault` |
| `worker.command` | Override default worker container command (useful when using custom images). Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.args` | Override default worker container args (useful when using custom images). Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.automountServiceAccountToken` | Mount Service Account token in worker pods. Only effective with worker.enableHelmDeployment. | `true` |
| `worker.hostAliases` | worker pods host aliases. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.deploymentAnnotations` | Annotations for worker deployment. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.podLabels` | Extra labels for worker pods. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.podAnnotations` | Annotations for worker pods. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.podAffinityPreset` | Pod affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `""` |
| `worker.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `soft` |
| `worker.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `""` |
| `worker.nodeAffinityPreset.key` | Node label key to match. Ignored if `worker.affinity` is set | `""` |
| `worker.nodeAffinityPreset.values` | Node label values to match. Ignored if `worker.affinity` is set | `[]` |
| `worker.affinity` | Affinity for worker pods assignment. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.nodeSelector` | Node labels for worker pods assignment. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.tolerations` | Tolerations for worker pods assignment. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.updateStrategy.type` | worker deployment strategy type. Only effective with worker.enableHelmDeployment. | `RollingUpdate` |
| `worker.priorityClassName` | worker pods' priorityClassName. Only effective with worker.enableHelmDeployment. | `""` |
| `worker.topologySpreadConstraints` | Topology Spread Constraints for worker pod assignment spread across your cluster among failure-domains. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.schedulerName` | Name of the k8s scheduler (other than default) for worker pods. Only effective with worker.enableHelmDeployment. | `""` |
| `worker.terminationGracePeriodSeconds` | Seconds worker pods need to terminate gracefully. Only effective with worker.enableHelmDeployment. | `""` |
| `worker.lifecycleHooks` | for worker containers to automate configuration before or after startup. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.extraEnvVars` | Array with extra environment variables to add to worker containers. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. | `""` |
| `worker.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. | `""` |
| `worker.extraVolumes` | Optionally specify extra list of additional volumes for the worker pods. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the worker containers. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.sidecars` | Add additional sidecar containers to the worker pods. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.initContainers` | Add additional init containers to the worker pods. Only effective with worker.enableHelmDeployment. | `[]` |
| `worker.pdb.create` | Enable/disable a Pod Disruption Budget creation. Only effective with worker.enableHelmDeployment. | `true` |
| `worker.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
| `worker.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `worker.pdb.minAvailable` and `worker.pdb.maxUnavailable` are empty. | `""` |
| `worker.autoscaling.vpa.enabled` | Enable VPA for worker pods. Only effective with worker.enableHelmDeployment. | `false` |
| `worker.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
| `worker.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
| `worker.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
| `worker.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
| `worker.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
| `worker.autoscaling.hpa.enabled` | Enable HPA for worker pods. Only effective with worker.enableHelmDeployment. | `false` |
| `worker.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
| `worker.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `worker.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `worker.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `worker.service.labels` | Extra labels for worker service. Only effective with worker.enableHelmDeployment. | `{}` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -512,11 +684,40 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| `worker.manageAppDeployments` | Whether apps are deployed and managed by worker. When disabled, every used app is expected to to be already deployed (see apps.enabled). | `true` |
### app Parameters
##### app Parameters
| Name | Description | Value |
| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
| `app.image.registry` | app image registry (defaults to shuffle.appRegistry) | `""` |
| `app.image.repository` | app image repository (defaults to shuffle.appBaseImageName) | `""` |
| `app.image.tag` | app image tag (defaults to the apps version) | `""` |
| `app.image.pullPolicy` | default image pull policy for app deployments. Only effective for helm-deployed apps (see apps.enabled). | `IfNotPresent` |
| `app.image.pullSecrets` | default image pull secrets for app deployments. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.replicaCount` | Default number of replicas to deploy for each app. Only effective for helm-deployed apps (see apps.enabled). | `1` |
| `app.extraContainerPorts` | Optionally specify extra list of additional ports for app containers. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.livenessProbe.enabled` | Enable livenessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). | `false` |
| `app.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
| `app.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
| `app.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
| `app.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
| `app.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `app.readinessProbe.enabled` | Enable readinessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). | `false` |
| `app.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
| `app.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `app.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `app.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `app.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `app.startupProbe.enabled` | Enable startupProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). | `false` |
| `app.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
| `app.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
| `app.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
| `app.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
| `app.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `app.customLivenessProbe` | Custom livenessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.customReadinessProbe` | Custom readinessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.customStartupProbe` | Custom startupProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.resourcesPreset` | Set app container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if app.resources is set (app.resources is recommended for production). | `nano` |
| `app.resources` | Set app container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `app.podSecurityContext.enabled` | Enable app pods' Security Context | `true` |
@@ -534,6 +735,49 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `app.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in app container' Security Context | `false` |
| `app.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in app container | `["ALL"]` |
| `app.containerSecurityContext.seccompProfile.type` | Set seccomp profile in app container | `RuntimeDefault` |
| `app.command` | Override default app container command (useful when using custom images) | `[]` |
| `app.args` | Override default app container args (useful when using custom images) | `[]` |
| `app.automountServiceAccountToken` | Mount Service Account token in app pods. Only effective for helm-deployed apps (see apps.enabled). | `false` |
| `app.hostAliases` | app pods host aliases. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.deploymentAnnotations` | Annotations for app deployment. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.podLabels` | Extra labels for app pods. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.podAnnotations` | Annotations for app pods. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.podAffinityPreset` | Pod affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). | `""` |
| `app.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). | `soft` |
| `app.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). | `""` |
| `app.nodeAffinityPreset.key` | Node label key to match. Ignored if `app.affinity` is set | `""` |
| `app.nodeAffinityPreset.values` | Node label values to match. Ignored if `app.affinity` is set | `[]` |
| `app.affinity` | Affinity for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.nodeSelector` | Node labels for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.tolerations` | Tolerations for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.updateStrategy.type` | app deployment strategy type. Only effective for helm-deployed apps (see apps.enabled). | `RollingUpdate` |
| `app.priorityClassName` | app pods' priorityClassName. Only effective for helm-deployed apps (see apps.enabled). | `""` |
| `app.topologySpreadConstraints` | Topology Spread Constraints for app pod assignment spread across your cluster among failure-domains. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.schedulerName` | Name of the k8s scheduler (other than default) for app pods. Only effective for helm-deployed apps (see apps.enabled). | `""` |
| `app.terminationGracePeriodSeconds` | Seconds app pods need to terminate gracefully. Only effective for helm-deployed apps (see apps.enabled). | `""` |
| `app.lifecycleHooks` | for app containers to automate configuration before or after startup. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.extraEnvVars` | Array with extra environment variables to add to app containers. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled). | `""` |
| `app.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled). | `""` |
| `app.extraVolumes` | Optionally specify extra list of additional volumes for the app pods. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the app containers. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.sidecars` | Add additional sidecar containers to the app pods. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.initContainers` | Add additional init containers to the app pods. Only effective for helm-deployed apps (see apps.enabled). | `[]` |
| `app.pdb.create` | Enable/disable a Pod Disruption Budget creation. Only effective for helm-deployed apps (see apps.enabled). | `true` |
| `app.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
| `app.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `app.pdb.minAvailable` and `app.pdb.maxUnavailable` are empty. | `""` |
| `app.autoscaling.vpa.enabled` | Enable VPA for app pods. Only effective for helm-deployed apps (see apps.enabled). | `false` |
| `app.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
| `app.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
| `app.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
| `app.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
| `app.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
| `app.autoscaling.hpa.enabled` | Enable HPA for app pods. Only effective for helm-deployed apps (see apps.enabled). | `false` |
| `app.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
| `app.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `app.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `app.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `app.service.labels` | Extra labels for app service. Only effective for helm-deployed apps (see apps.enabled). | `{}` |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -545,7 +789,240 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| `app.mountTmpVolume` | Whether a writable /tmp emptyDir volume should be mounted to the app. | `true` |
| `app.exposedContainerPort` | The port that shuffle app containers will listen on for new requests. | `80` |
| `app.sdkTimeout` | The timeout in seconds for app actions. | `300` |
| `app.disableLogs` | Do not capture app logs. By default, app logs are captured, so that they are visible in the frontend. | `false` |
##### Parameters to deploy apps using helm
| Name | Description | Value |
| ----------------------------- | -------------------------------------------------- | ------- |
| `apps.enabled` | Whether apps should be deployed using helm. | `false` |
| `apps.shuffleTools.enabled` | Whether the shuffle-tools app is enabled | `true` |
| `apps.shuffleTools.version` | The version of the shuffle-tools app to deploy. | `1.2.0` |
| `apps.shuffleSubflow.enabled` | Whether the shuffle-subflow app is enabled | `true` |
| `apps.shuffleSubflow.version` | The version of the shuffle-subflow app to deploy. | `1.1.0` |
| `apps.http.enabled` | Whether the http app is enabled | `true` |
| `apps.http.version` | The version of the http app to deploy. | `1.4.0` |
| `apps.MY_APP.app` | The name of the app (required, e.g. shuffle-tools) | |
| `apps.MY_APP.version` | The version of the app (required, e.g. 1.2.0) | |
##### Traffic Exposure Parameters
| Name | Description | Value |
| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- |
| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` |
| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` |
| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` |
| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
| `ingress.hostname` | Default host for the ingress record | `shuffle.local` |
| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` |
| `ingress.path` | Ingress path for Shuffle frontend | `"/"` |
| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` |
| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` |
| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` |
| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
| `ingress.secrets` | Custom TLS certificates as secrets | `[]` |
| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
##### Istio Parameters
| Name | Description | Value |
| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ |
| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` |
| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` |
| `istio.hosts` | One or more hosts exposed by Istio | `[]` |
| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` |
| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` |
| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` |
| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` |
| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` |
| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` |
| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` |
| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` |
| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` |
| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` |
| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` |
##### Persistence Parameters
| Name | Description | Value |
| ------------------------------------- | ------------------------------------------------- | ------------------- |
| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` |
| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` |
| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` |
| `persistence.apps.subPath` | The sub path used in the volume | `""` |
| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.apps.size` | The size of the volume | `5Gi` |
| `persistence.apps.annotations` | Annotations for the PVC | `{}` |
| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` |
| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` |
| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.appBuilder.size` | The size of the volume | `5Gi` |
| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` |
| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` |
| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` |
| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` |
| `persistence.files.subPath` | The sub path used in the volume | `""` |
| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.files.size` | The size of the volume | `5Gi` |
| `persistence.files.annotations` | Annotations for the PVC | `{}` |
| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` |
##### Init Container Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnamilegacy/os-shell` |
| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` |
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
##### OpenSearch Parameters
| Name | Description | Value |
| -------------------- | ----------------------------------------------------- | ------ |
| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` |
##### Vault Parameters
| Name | Description | Value |
| --------------- | -------------------------------------------------------------------------- | ----- |
| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` |
| `vault.secrets` | A list of VaultSecrets to create | `[]` |
##### Other Parameters
| Name | Description | Value |
| ----------------------------- | -------------------------------------------------- | ------- |
| `apps.enabled` | Whether apps should be deployed using helm. | `false` |
| `apps.shuffleTools.enabled` | Whether the shuffle-tools app is enabled | `true` |
| `apps.shuffleTools.version` | The version of the shuffle-tools app to deploy. | `1.2.0` |
| `apps.shuffleSubflow.enabled` | Whether the shuffle-subflow app is enabled | `true` |
| `apps.shuffleSubflow.version` | The version of the shuffle-subflow app to deploy. | `1.1.0` |
| `apps.http.enabled` | Whether the http app is enabled | `true` |
| `apps.http.version` | The version of the http app to deploy. | `1.4.0` |
| `apps.MY_APP.app` | The name of the app (required, e.g. shuffle-tools) | |
| `apps.MY_APP.version` | The version of the app (required, e.g. 1.2.0) | |
#### Traffic Exposure Parameters
| Name | Description | Value |
| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- |
| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` |
| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` |
| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` |
| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
| `ingress.hostname` | Default host for the ingress record | `shuffle.local` |
| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` |
| `ingress.path` | Ingress path for Shuffle frontend | `"/"` |
| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` |
| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` |
| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` |
| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
| `ingress.secrets` | Custom TLS certificates as secrets | `[]` |
| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
#### Istio Parameters
| Name | Description | Value |
| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ |
| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` |
| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` |
| `istio.hosts` | One or more hosts exposed by Istio | `[]` |
| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` |
| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` |
| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` |
| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` |
| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` |
| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` |
| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` |
| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` |
| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` |
| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` |
| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` |
#### Persistence Parameters
| Name | Description | Value |
| ------------------------------------- | ------------------------------------------------- | ------------------- |
| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` |
| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` |
| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` |
| `persistence.apps.subPath` | The sub path used in the volume | `""` |
| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.apps.size` | The size of the volume | `5Gi` |
| `persistence.apps.annotations` | Annotations for the PVC | `{}` |
| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` |
| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` |
| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.appBuilder.size` | The size of the volume | `5Gi` |
| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` |
| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` |
| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` |
| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` |
| `persistence.files.subPath` | The sub path used in the volume | `""` |
| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.files.size` | The size of the volume | `5Gi` |
| `persistence.files.annotations` | Annotations for the PVC | `{}` |
| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` |
#### Init Container Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnamilegacy/os-shell` |
| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` |
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
#### OpenSearch Parameters
| Name | Description | Value |
| -------------------- | ----------------------------------------------------- | ------ |
| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` |
#### Vault Parameters
| Name | Description | Value |
| --------------- | -------------------------------------------------------------------------- | ----- |
| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` |
| `vault.secrets` | A list of VaultSecrets to create | `[]` |
#### Other Parameters
| Name | Description | Value |
| ----------------------------- | -------------------------------------------------- | ------- |
| `apps.enabled` | Whether apps should be deployed using helm. | `false` |
| `apps.shuffleTools.enabled` | Whether the shuffle-tools app is enabled | `true` |
| `apps.shuffleTools.version` | The version of the shuffle-tools app to deploy. | `1.2.0` |
| `apps.shuffleSubflow.enabled` | Whether the shuffle-subflow app is enabled | `true` |
| `apps.shuffleSubflow.version` | The version of the shuffle-subflow app to deploy. | `1.1.0` |
| `apps.http.enabled` | Whether the http app is enabled | `true` |
| `apps.http.version` | The version of the http app to deploy. | `1.4.0` |
| `apps.MY_APP.app` | The name of the app (required, e.g. shuffle-tools) | |
| `apps.MY_APP.version` | The version of the app (required, e.g. 1.2.0) | |
### Traffic Exposure Parameters
@@ -614,19 +1091,19 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### Init Container Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnami/os-shell` |
| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` |
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
| Name | Description | Value |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnamilegacy/os-shell` |
| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` |
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
### OpenSearch Parameters
@@ -642,6 +1119,3 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `vault.secrets` | A list of VaultSecrets to create | `[]` |
### Other Parameters
functions/kubernetes/charts/shuffle/templates/NOTES.txt
+2 -2
View File
@@ -22,6 +22,6 @@ Access the pod you want to debug by executing
To access shuffle using port-forwarding:
1. Run `kubectl port-forward -n shuffle svc/shuffle-frontend 8080:http`
1. Run `kubectl port-forward -n {{ .Release.Namespace }} svc/{{ include "shuffle.frontend.name" . }} 8080:http`
2. Visit http://localhost:8080 with your browser
3. Create the administrator account, if not already done
functions/kubernetes/charts/shuffle/templates/_helpers.tpl
-371
View File
@@ -1,377 +1,6 @@
{{/*
Return the common name for backend componentes
*/}}
{{- define "shuffle.backend.name" -}}
{{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for frontend components
*/}}
{{- define "shuffle.frontend.name" -}}
{{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for orborus components
*/}}
{{- define "shuffle.orborus.name" -}}
{{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for worker components
*/}}
{{- define "shuffle.worker.name" -}}
{{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for app components
*/}}
{{- define "shuffle.app.name" -}}
{{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common labels for backend components
The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod.
*/}}
{{- define "shuffle.backend.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: backend
io.kompose.service: backend
{{- end -}}
{{/*
Return the common labels for frontend components
*/}}
{{- define "shuffle.frontend.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: frontend
{{- end -}}
{{/*
Return the common labels for orborus components
*/}}
{{- define "shuffle.orborus.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: orborus
{{- end -}}
{{/*
Return the common labels for worker components
*/}}
{{- define "shuffle.worker.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: worker
{{- end -}}
{{/*
Return the common labels for app components
*/}}
{{- define "shuffle.app.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: app
{{- end -}}
{{/*
Return the match labels for backend components
*/}}
{{- define "shuffle.backend.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: backend
{{- end -}}
{{/*
Return the match labels for frontend components
*/}}
{{- define "shuffle.frontend.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: frontend
{{- end -}}
{{/*
Return the match labels for orborus components
*/}}
{{- define "shuffle.orborus.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: orborus
{{- end -}}
{{/*
Return the match labels for worker components
NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app.
*/}}
{{- define "shuffle.worker.matchLabels" -}}
app.kubernetes.io/name: shuffle-worker
{{- end -}}
{{/*
Return the match labels for app components
NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app.
*/}}
{{- define "shuffle.app.matchLabels" -}}
app.kubernetes.io/name: shuffle-app
{{- end -}}
{{/*
Return the proper image name (for the init container volume-permissions image)
*/}}
{{- define "shuffle.volumePermissions.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Shuffle backend image name
*/}}
{{- define "shuffle.backend.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend pod
*/}}
{{- define "shuffle.backend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle frontend image name
*/}}
{{- define "shuffle.frontend.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend pod
*/}}
{{- define "shuffle.frontend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle orborus image name
*/}}
{{- define "shuffle.orborus.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus pod
*/}}
{{- define "shuffle.orborus.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle worker image name
*/}}
{{- define "shuffle.worker.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle backend
*/}}
{{- define "shuffle.backend.serviceAccount.name" -}}
{{- if .Values.backend.serviceAccount.create -}}
{{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.backend.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend service account
*/}}
{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.backend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle frontend
*/}}
{{- define "shuffle.frontend.serviceAccount.name" -}}
{{- if .Values.frontend.serviceAccount.create -}}
{{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.frontend.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend service account
*/}}
{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.frontend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle orborus
*/}}
{{- define "shuffle.orborus.serviceAccount.name" -}}
{{- if .Values.orborus.serviceAccount.create -}}
{{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.orborus.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus service account
*/}}
{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.orborus.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle workers
*/}}
{{- define "shuffle.worker.serviceAccount.name" -}}
{{- if .Values.worker.serviceAccount.create -}}
{{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.worker.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the worker service account
*/}}
{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.worker.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle apps
*/}}
{{- define "shuffle.app.serviceAccount.name" -}}
{{- if .Values.app.serviceAccount.create -}}
{{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.app.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the app service account
*/}}
{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.app.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
functions/kubernetes/charts/shuffle/templates/backend/_helpers.tpl
+116
View File
@@ -0,0 +1,116 @@
{{/*
Return the common name for backend componentes
*/}}
{{- define "shuffle.backend.name" -}}
{{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common labels for backend components
The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod.
*/}}
{{- define "shuffle.backend.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: backend
io.kompose.service: backend
{{- end -}}
{{/*
Return the match labels for backend components
*/}}
{{- define "shuffle.backend.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: backend
{{- end -}}
{{/*
Return the proper Shuffle backend image name
*/}}
{{- define "shuffle.backend.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend pod
*/}}
{{- define "shuffle.backend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle backend
*/}}
{{- define "shuffle.backend.serviceAccount.name" -}}
{{- if .Values.backend.serviceAccount.create -}}
{{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.backend.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend service account
*/}}
{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.backend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{- define "shuffle.backend.baseUrl" -}}
http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}
{{- end -}}
{{/*
Return the environment variables of shuffle-backend in the format
KEY: VALUE
*/}}
{{- define "shuffle.backend.env" -}}
RUNNING_MODE: kubernetes
IS_KUBERNETES: "true"
SHUFFLE_APP_HOTLOAD_FOLDER: /shuffle-apps
SHUFFLE_FILE_LOCATION: /shuffle-files
BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}"
{{- if .Values.shuffle.baseUrl }}
BASE_URL: "{{ .Values.shuffle.baseUrl }}"
SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
{{- else }}
BASE_URL: "{{ include "shuffle.backend.baseUrl" . }}"
{{- end }}
ORG_ID: "{{ .Values.shuffle.org }}"
SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
SHUFFLE_CHAT_DISABLED: "true"
# Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address
SHUFFLE_CLOUDRUN_URL: "{{ include "shuffle.backend.baseUrl" .}}"
SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"
SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}"
SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}"
SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}"
TZ: "{{ .Values.shuffle.timezone }}"
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" # Used by app builder
{{- end -}}
functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml
-32
View File
@@ -1,32 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "shuffle.backend.name" . }}-env
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}"
{{- if .Values.shuffle.baseUrl }}
BASE_URL: "{{ .Values.shuffle.baseUrl }}"
SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
{{- else }}
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
{{- end }}
ORG_ID: "{{ .Values.shuffle.org }}"
SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
SHUFFLE_CHAT_DISABLED: "true"
# Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address
SHUFFLE_CLOUDRUN_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"
SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}"
SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}"
SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}"
TZ: "{{ .Values.shuffle.timezone }}"
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
functions/kubernetes/charts/shuffle/templates/backend/backend-dpl.yaml
+5 -10
View File
@@ -115,20 +115,15 @@ spec:
args: {{- include "common.tplvalues.render" (dict "value" .Values.backend.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: RUNNING_MODE
value: kubernetes
- name: IS_KUBERNETES
value: "true"
- name: SHUFFLE_APP_HOTLOAD_FOLDER
value: /shuffle-apps
- name: SHUFFLE_FILE_LOCATION
value: /shuffle-files
{{- $env := include "shuffle.backend.env" . | fromYaml }}
{{- range $key, $val := $env }}
- name: {{ $key | quote }}
value: {{ $val | quote }}
{{- end }}
{{- if .Values.backend.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "shuffle.backend.name" . }}-env
{{- if .Values.backend.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsCM "context" $) }}
functions/kubernetes/charts/shuffle/templates/frontend/_helpers.tpl
+77
View File
@@ -0,0 +1,77 @@
{{/*
Return the common name for frontend components
*/}}
{{- define "shuffle.frontend.name" -}}
{{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common labels for frontend components
*/}}
{{- define "shuffle.frontend.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: frontend
{{- end -}}
{{/*
Return the match labels for frontend components
*/}}
{{- define "shuffle.frontend.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: frontend
{{- end -}}
{{/*
Return the proper Shuffle frontend image name
*/}}
{{- define "shuffle.frontend.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend pod
*/}}
{{- define "shuffle.frontend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle frontend
*/}}
{{- define "shuffle.frontend.serviceAccount.name" -}}
{{- if .Values.frontend.serviceAccount.create -}}
{{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.frontend.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend service account
*/}}
{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.frontend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
functions/kubernetes/charts/shuffle/templates/orborus/_helpers.tpl
+128
View File
@@ -0,0 +1,128 @@
{{/*
Return the common name for orborus components
*/}}
{{- define "shuffle.orborus.name" -}}
{{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common labels for orborus components
*/}}
{{- define "shuffle.orborus.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: orborus
{{- end -}}
{{/*
Return the match labels for orborus components
*/}}
{{- define "shuffle.orborus.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: orborus
{{- end -}}
{{/*
Return the proper Shuffle orborus image name
*/}}
{{- define "shuffle.orborus.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus pod
*/}}
{{- define "shuffle.orborus.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle orborus
*/}}
{{- define "shuffle.orborus.serviceAccount.name" -}}
{{- if .Values.orborus.serviceAccount.create -}}
{{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.orborus.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus service account
*/}}
{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.orborus.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Return the environment variables of shuffle-orborus in the format
KEY: VALUE
*/}}
{{- define "shuffle.orborus.env" -}}
RUNNING_MODE: kubernetes
IS_KUBERNETES: "true"
ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
ORG_ID: "{{ .Values.shuffle.org }}"
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: {{ include "shuffle.backend.baseUrl" . | quote }}
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
SHUFFLE_ORBORUS_EXECUTION_CONCURRENCY: {{ .Values.orborus.executionConcurrency | quote }}
{{- if .Values.orborus.manageWorkerDeployments }}
# Shuffle worker configuration
SHUFFLE_WORKER_IMAGE: {{ include "shuffle.worker.image" . | quote }}
SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME: {{ include "shuffle.worker.serviceAccount.name" . | quote }}
{{- if .Values.worker.podSecurityContext.enabled }}
SHUFFLE_WORKER_POD_SECURITY_CONTEXT: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.worker.containerSecurityContext.enabled }}
SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
# Shuffle worker resources
{{- $workerResources := (.Values.worker.resources | default (include "common.resources.preset" (dict "type" .Values.worker.resourcesPreset) | fromYaml)) -}}
{{- if and $workerResources.requests $workerResources.requests.cpu }}
SHUFFLE_WORKER_CPU_REQUEST: {{ $workerResources.requests.cpu | quote }}
{{- end }}
{{- if and $workerResources.requests $workerResources.requests.memory}}
SHUFFLE_WORKER_MEMORY_REQUEST: {{ $workerResources.requests.memory | quote }}
{{- end }}
{{- if and $workerResources.requests (index $workerResources.requests "ephemeral-storage") }}
SHUFFLE_WORKER_EPHEMERAL_STORAGE_REQUEST: {{ (index $workerResources.requests "ephemeral-storage") | quote }}
{{- end }}
{{- if and $workerResources.limits $workerResources.limits.cpu }}
SHUFFLE_WORKER_CPU_LIMIT: {{ $workerResources.limits.cpu | quote }}
{{- end }}
{{- if and $workerResources.limits $workerResources.limits.memory}}
SHUFFLE_WORKER_MEMORY_LIMIT: {{ $workerResources.limits.memory | quote }}
{{- end }}
{{- if and $workerResources.limits (index $workerResources.limits "ephemeral-storage") }}
SHUFFLE_WORKER_EPHEMERAL_STORAGE_LIMIT: {{ (index $workerResources.limits "ephemeral-storage") | quote }}
{{- end }}
# Include shuffle worker environment variables. Orborus passes them down to worker, when creating the deployment.
{{ include "shuffle.workerInstance.env" . }}
{{- end }}
{{- end -}}
functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml
-78
View File
@@ -1,78 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "shuffle.orborus.name" . }}-env
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
ORG_ID: "{{ .Values.shuffle.org }}"
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
# Shuffle worker configuration
SHUFFLE_WORKER_IMAGE: {{ include "shuffle.worker.image" . | quote }}
SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME: {{ include "shuffle.worker.serviceAccount.name" . | quote }}
{{- if .Values.worker.podSecurityContext.enabled }}
SHUFFLE_WORKER_POD_SECURITY_CONTEXT: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.worker.containerSecurityContext.enabled }}
SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
# Shuffle worker resources
{{- $workerResources := (.Values.worker.resources | default (include "common.resources.preset" (dict "type" .Values.worker.resourcesPreset) | fromYaml)) -}}
{{- if and $workerResources.requests $workerResources.requests.cpu }}
SHUFFLE_WORKER_CPU_REQUEST: {{ $workerResources.requests.cpu | quote }}
{{- end }}
{{- if and $workerResources.requests $workerResources.requests.memory}}
SHUFFLE_WORKER_MEMORY_REQUEST: {{ $workerResources.requests.memory | quote }}
{{- end }}
{{- if and $workerResources.requests (index $workerResources.requests "ephemeral-storage") }}
SHUFFLE_WORKER_EPHEMERAL_STORAGE_REQUEST: {{ (index $workerResources.requests "ephemeral-storage") | quote }}
{{- end }}
{{- if and $workerResources.limits $workerResources.limits.cpu }}
SHUFFLE_WORKER_CPU_LIMIT: {{ $workerResources.limits.cpu | quote }}
{{- end }}
{{- if and $workerResources.limits $workerResources.limits.memory}}
SHUFFLE_WORKER_MEMORY_LIMIT: {{ $workerResources.limits.memory | quote }}
{{- end }}
{{- if and $workerResources.limits (index $workerResources.limits "ephemeral-storage") }}
SHUFFLE_WORKER_EPHEMERAL_STORAGE_LIMIT: {{ (index $workerResources.limits "ephemeral-storage") | quote }}
{{- end }}
# Shuffle app configuration
SHUFFLE_APP_EXPOSED_PORT: {{ .Values.app.exposedContainerPort | quote }}
SHUFFLE_APP_SERVICE_ACCOUNT_NAME: {{ include "shuffle.app.serviceAccount.name" . | quote }}
{{- if .Values.app.podSecurityContext.enabled }}
SHUFFLE_APP_POD_SECURITY_CONTEXT: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.app.containerSecurityContext.enabled }}
SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
# Shuffle app resources
{{- $appResources := (.Values.app.resources | default (include "common.resources.preset" (dict "type" .Values.app.resourcesPreset) | fromYaml)) -}}
{{- if and $appResources.requests $appResources.requests.cpu }}
SHUFFLE_APP_CPU_REQUEST: {{ $appResources.requests.cpu | quote }}
{{- end }}
{{- if and $appResources.requests $appResources.requests.memory }}
SHUFFLE_APP_MEMORY_REQUEST: {{ $appResources.requests.memory | quote }}
{{- end }}
{{- if and $appResources.requests (index $appResources.requests "ephemeral-storage") }}
SHUFFLE_APP_EPHEMERAL_STORAGE_REQUEST: {{ (index $appResources.requests "ephemeral-storage") | quote }}
{{- end }}
{{- if and $appResources.limits $appResources.limits.cpu }}
SHUFFLE_APP_CPU_LIMIT: {{ $appResources.limits.cpu | quote }}
{{- end }}
{{- if and $appResources.limits $appResources.limits.memory }}
SHUFFLE_APP_MEMORY_LIMIT: {{ $appResources.limits.memory | quote }}
{{- end }}
{{- if and $appResources.limits (index $appResources.limits "ephemeral-storage") }}
SHUFFLE_APP_EPHEMERAL_STORAGE_LIMIT: {{ (index $appResources.limits "ephemeral-storage") | quote }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml
+7 -6
View File
@@ -82,16 +82,17 @@ spec:
args: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: RUNNING_MODE
value: kubernetes
- name: IS_KUBERNETES
value: "true"
- name: CLEANUP
value: "false" # Do not remove resources when restarting orborus
{{- $env := include "shuffle.orborus.env" . | fromYaml }}
{{- range $key, $val := $env }}
- name: {{ $key | quote }}
value: {{ $val | quote }}
{{- end }}
{{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "shuffle.orborus.name" . }}-env
{{- if .Values.orborus.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsCM "context" $) }}
functions/kubernetes/charts/shuffle/templates/orborus/orborus-role.yaml
+16
View File
@@ -9,6 +9,7 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
rules:
{{- if .Values.orborus.manageWorkerDeployments }}
- verbs:
- list
- create
@@ -26,4 +27,19 @@ rules:
- apps
resources:
- deployments
{{- else }}
- verbs:
- list
apiGroups:
- ''
resources:
- pods
- services
- verbs:
- list
apiGroups:
- apps
resources:
- deployments
{{- end }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-app/_helpers.tpl
+129
View File
@@ -0,0 +1,129 @@
{{/*
Return the common name for app components.
*/}}
{{- define "shuffle.app.name" -}}
{{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common labels for app components deployed via helm.
NOTE: App deployments and services use shuffle.appInstance.labels instead.
*/}}
{{- define "shuffle.app.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: app
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle apps
*/}}
{{- define "shuffle.app.serviceAccount.name" -}}
{{- if .Values.app.serviceAccount.create -}}
{{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.app.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the app service account
*/}}
{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.app.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Return the match labels for ALL apps.
These match the labels of helm-deployed apps (shuffle.appInstance.labels),
as well as worker-deployed apps (deployK8sApp).
*/}}
{{- define "shuffle.app.matchLabels" -}}
app.kubernetes.io/name: shuffle-app
{{- end -}}
{{/*
Return the sanitized name of a shuffle app.
Usage:
{{ include "shuffle.appInstance.name" $app }}
*/}}
{{- define "shuffle.appInstance.name" -}}
{{ .name | replace "_" "-" | lower }}
{{- end -}}
{{/*
Return the sanitized name of a shuffle app, including the version of the app.
Usage:
{{ include "shuffle.appInstance.fullname" $app }}
*/}}
{{- define "shuffle.appInstance.fullname" -}}
{{ printf "%s-%s" .name .version | replace "." "-" | replace "_" "-" | lower }}
{{- end -}}
{{/*
Return the labels for a shuffle app deployed by helm.
Usage:
{{ include "shuffle.appInstance.labels" (dict "app" $app "customLabels" .Values.commonLabels "context" $) }}
*/}}
{{- define "shuffle.appInstance.labels" -}}
{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-app" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}}
{{ include "common.labels.standard" (dict "customLabels" $customLabels "context" .context) }}
app.shuffler.io/name: {{ include "shuffle.appInstance.name" .app }}
app.shuffler.io/version: {{ .app.version | quote }}
{{- end -}}
{{/*
Return the match labels of a single app, deployed via helm.
Usage:
{{ include "shuffle.appInstance.matchLabels" (dict "app" $app "customLabels" .Values.commonLabels "context" $) }}
*/}}
{{- define "shuffle.appInstance.matchLabels" -}}
{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-app" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}}
{{ include "common.labels.matchLabels" (dict "customLabels" $customLabels "context" .context) }}
app.shuffler.io/name: {{ include "shuffle.appInstance.name" .app }}
app.shuffler.io/version: {{ .app.version | quote }}
{{- end -}}
{{/*
Return a podAffinity/podAntiAffinity definition.
Usage:
{{ include "shuffle.appInstance.affinities.pods" (dict "type" "soft" "app" $app "customLabels" $podLabels "context" $) -}}
*/}}
{{- define "shuffle.appInstance.affinities.pods" -}}
{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-app" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}}
{{- $extraMatchLabels := dict "app.shuffler.io/name" (include "shuffle.appInstance.name" .app) "app.shuffler.io/version" (.app.version) }}
{{ include "common.affinities.pods" (dict "type" .type "customLabels" $customLabels "context" .context "extraMatchLabels" $extraMatchLabels )}}
{{- end -}}
{{/*
Return the environment variables of shuffle apps in the format
KEY: VALUE
*/}}
{{- define "shuffle.appInstance.env" -}}
SHUFFLE_APP_SDK_TIMEOUT: {{ .Values.app.sdkTimeout | quote }}
SHUFFLE_APP_EXPOSED_PORT: {{ .Values.app.exposedContainerPort | quote }}
SHUFFLE_LOGS_DISABLED: {{ .Values.app.disableLogs | quote }}
{{- end -}}
functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
+1 -2
View File
@@ -9,9 +9,8 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.app.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "shuffle.app.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
matchLabels: {{- include "shuffle.app.matchLabels" . | nindent 6 }}
policyTypes:
- Ingress
- Egress
functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-apps.yaml
+353
View File
@@ -0,0 +1,353 @@
{{- if .Values.apps.enabled }}
{{- range $key, $app := .Values.apps }}
{{- $ignoredKeys := list "enabled" -}}
{{- if and (not ($ignoredKeys | has $key)) $app.enabled }}
{{/* Merge .Values.app into $app, giving precedence to the values defined on the app. */}}
{{- $appValues := mustDeepCopy (mustMerge $app $.Values.app) -}}
{{/* use shuffle.appRegistry as default image registry */}}
{{- $_ := set $appValues.image "registry" ($appValues.image.registry | default $.Values.shuffle.appRegistry) -}}
{{/* use shuffle.appBaseImageName as default image repository */}}
{{- $_ := set $appValues.image "repository" ($appValues.image.repository | default (printf "%s/%s" $.Values.shuffle.appBaseImageName $appValues.name)) -}}
{{/* use app version as default tag */}}
{{- $_ := set $appValues.image "tag" ($appValues.image.tag | default $appValues.version) -}}
{{/* Only create a service account if create is explicitly enabled on that specific app ($app not $appValues). Otherwise the shared shuffle-app service account is used. */}}
{{- $shouldCreateDedicatedServiceAccount := and $app.serviceAccount.create $app.serviceAccount.name -}}
{{- if $shouldCreateDedicatedServiceAccount }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ $app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or $appValues.serviceAccount.annotations $.Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list $appValues.serviceAccount.annotations $.Values.commonAnnotations) "context" $) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ $appValues.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.app.serviceAccount.imagePullSecrets" $ | nindent 0 }}
{{- if $appValues.rbac.create }}
---
kind: RoleBinding
apiVersion: {{ include "common.capabilities.rbac.apiVersion" $ }}
metadata:
name: {{ $app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ $app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "shuffle.app.name" $ }}
{{- end }}
{{- end }}
---
apiVersion: v1
kind: Service
metadata:
name: {{ include "shuffle.appInstance.fullname" $app }}
namespace: {{ include "common.names.namespace" $ | quote }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list $appValues.service.labels $.Values.commonLabels) "context" $) }}
labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $serviceLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" $.Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
spec:
type: ClusterIP
ports:
- name: http
port: 80
targetPort: {{ $appValues.exposedContainerPort }}
protocol: TCP
appProtocol: http
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list $appValues.podLabels $.Values.commonLabels) "context" $) }}
selector: {{- include "shuffle.appInstance.matchLabels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 6 }}
---
apiVersion: {{ include "common.capabilities.deployment.apiVersion" $ }}
kind: Deployment
metadata:
name: {{ include "shuffle.appInstance.fullname" $app }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or $appValues.deploymentAnnotations $.Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list $appValues.deploymentAnnotations $.Values.commonAnnotations) "context" $) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if not $appValues.autoscaling.hpa.enabled }}
replicas: {{ $appValues.replicaCount }}
{{- end }}
{{- if $appValues.updateStrategy }}
strategy: {{- toYaml $appValues.updateStrategy | nindent 4 }}
{{- end }}
selector:
matchLabels: {{- include "shuffle.appInstance.matchLabels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 6 }}
template:
metadata:
{{- if $appValues.podAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" $appValues.podAnnotations "context" $) | nindent 8 }}
{{- end }}
labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "common.images.renderPullSecrets" (dict "images" (list $appValues.image) "context" $) | nindent 6 }}
{{- if $appValues.serviceAccount.create }}
serviceAccountName: {{ default (include "shuffle.app.name" $) $appValues.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else }}
serviceAccountName: {{ default "default" $appValues.serviceAccount.name }}
{{- end }}
automountServiceAccountToken: {{ $appValues.automountServiceAccountToken }}
{{- if $appValues.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" $appValues.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if $appValues.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" $appValues.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "shuffle.appInstance.affinities.pods" (dict "app" $app "type" $appValues.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "shuffle.appInstance.affinities.pods" (dict "app" $app "type" $appValues.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" $appValues.nodeAffinityPreset.type "key" $appValues.nodeAffinityPreset.key "values" $appValues.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if $appValues.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" $appValues.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if $appValues.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" $appValues.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if $appValues.priorityClassName }}
priorityClassName: {{ $appValues.priorityClassName | quote }}
{{- end }}
{{- if $appValues.schedulerName }}
schedulerName: {{ $appValues.schedulerName | quote }}
{{- end }}
{{- if $appValues.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" $appValues.topologySpreadConstraints "context" $) | nindent 8 }}
{{- end }}
{{- if $appValues.podSecurityContext.enabled }}
securityContext: {{- omit $appValues.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if $appValues.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ $appValues.terminationGracePeriodSeconds }}
{{- end }}
initContainers:
{{- if $appValues.initContainers }}
{{- include "common.tplvalues.render" (dict "value" $appValues.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: {{ include "shuffle.appInstance.fullname" $app }}
image: {{ include "common.images.image" ( dict "imageRoot" $appValues.image "global" $.Values.global "chart" $.Chart ) }}
imagePullPolicy: {{ $appValues.image.pullPolicy }}
{{- if $appValues.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" $appValues.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if $.Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" $.Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if $appValues.command }}
command: {{- include "common.tplvalues.render" (dict "value" $appValues.command "context" $) | nindent 12 }}
{{- end }}
{{- if $.Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" $.Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if $appValues.args }}
args: {{- include "common.tplvalues.render" (dict "value" $appValues.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: AUTHORIZATION
value: ""
- name: EXECUTIONID
value: ""
- name: BASE_URL
value: {{ include "shuffle.worker.baseUrl" $ | quote }}
- name: CALLBACK_URL
value: {{ include "shuffle.backend.baseUrl" $ | quote }}
- name: SHUFFLE_SWARM_CONFIG
value: run # Shuffle Worker requires this to be set even when using K8s instead of swarm
{{- $env := include "shuffle.appInstance.env" $ | fromYaml }}
{{- range $key, $val := $env }}
- name: {{ $key | quote }}
value: {{ $val | quote }}
{{- end }}
{{- if $appValues.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" $appValues.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
{{- if $appValues.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" $appValues.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if $appValues.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" $appValues.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- if $appValues.resources }}
resources: {{- toYaml $appValues.resources | nindent 12 }}
{{- else if ne $appValues.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" $appValues.resourcesPreset) | nindent 12 }}
{{- end }}
ports:
- name: http
containerPort: {{ $appValues.exposedContainerPort }}
{{- if $appValues.extraContainerPorts }}
{{- include "common.tplvalues.render" (dict "value" $appValues.extraContainerPorts "context" $) | nindent 12 }}
{{- end }}
{{- if not $.Values.diagnosticMode.enabled }}
{{- if $appValues.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" $appValues.customLivenessProbe "context" $) | nindent 12 }}
{{- else if $appValues.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit $appValues.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/health
port: {{ $appValues.containerPorts.http }}
{{- end }}
{{- if $appValues.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" $appValues.customReadinessProbe "context" $) | nindent 12 }}
{{- else if $appValues.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit $appValues.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/health
port: {{ $appValues.containerPorts.http }}
{{- end }}
{{- if $appValues.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" $appValues.customStartupProbe "context" $) | nindent 12 }}
{{- else if $appValues.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit $appValues.startupProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/health
port: {{ $appValues.containerPorts.http }}
{{- end }}
{{- end }}
{{- if $appValues.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" $appValues.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
{{- if $appValues.mountTmpVolume }}
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- end }}
{{- if $appValues.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" $appValues.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if $appValues.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" $appValues.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if $appValues.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" $appValues.extraVolumes "context" $) | nindent 8 }}
{{- end }}
---
{{- if $appValues.pdb.create }}
apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
kind: PodDisruptionBudget
metadata:
name: {{ include "shuffle.appInstance.fullname" $app }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if $appValues.pdb.minAvailable }}
minAvailable: {{ $appValues.pdb.minAvailable }}
{{- end }}
{{- if or $appValues.pdb.maxUnavailable ( not $appValues.pdb.minAvailable ) }}
maxUnavailable: {{ $appValues.pdb.maxUnavailable | default 1 }}
{{- end }}
selector:
matchLabels: {{- include "shuffle.appInstance.matchLabels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- end }}
---
{{- if $appValues.autoscaling.hpa.enabled }}
apiVersion: {{ include "common.capabilities.hpa.apiVersion" $ }}
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "shuffle.appInstance.fullname" $app }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
scaleTargetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" $ }}
kind: Deployment
name: {{ include "shuffle.appInstance.fullname" $app }}
minReplicas: {{ $appValues.autoscaling.hpa.minReplicas }}
maxReplicas: {{ $appValues.autoscaling.hpa.maxReplicas }}
metrics:
{{- if $appValues.autoscaling.hpa.targetMemory }}
- type: Resource
resource:
name: memory
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" $) }}
targetAverageUtilization: {{ $appValues.autoscaling.hpa.targetMemory }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ $appValues.autoscaling.hpa.targetMemory }}
{{- end }}
{{- end }}
{{- if $appValues.autoscaling.hpa.targetCPU }}
- type: Resource
resource:
name: cpu
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" $) }}
targetAverageUtilization: {{ $appValues.autoscaling.hpa.targetCPU }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ $appValues.autoscaling.hpa.targetCPU }}
{{- end }}
{{- end }}
{{- end }}
---
{{- if and ($.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") $appValues.autoscaling.vpa.enabled }}
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: {{ include "shuffle.appInstance.fullname" $app }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or $appValues.autoscaling.vpa.annotations $.Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list $appValues.autoscaling.vpa.annotations $.Values.commonAnnotations ) "context" $ ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
resourcePolicy:
containerPolicies:
- containerName: app
{{- with $appValues.autoscaling.vpa.controlledResources }}
controlledResources:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with $appValues.autoscaling.vpa.maxAllowed }}
maxAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with $appValues.autoscaling.vpa.minAllowed }}
minAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
targetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" $ }}
kind: Deployment
name: {{ include "shuffle.appInstance.fullname" $app }}
{{- if $appValues.autoscaling.vpa.updatePolicy }}
updatePolicy:
{{- with $appValues.autoscaling.vpa.updatePolicy.updateMode }}
updateMode: {{ . }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/_helpers.tpl
+182
View File
@@ -0,0 +1,182 @@
{{/*
Return the common name for worker components
*/}}
{{/*
Shuffle currently hardcodes the shuffle-workers:33333 address at some places.
Until that can be properly configured, we make sure that the worker deployment and service
are named exactly the same as the deployment and service that orborus would create.
{{- define "shuffle.worker.name" -}}
{{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
*/}}
{{- define "shuffle.worker.name" -}}
shuffle-workers
{{- end -}}
{{/*
Return the common labels for worker components deployed via helm.
NOTE: Worker deployments and services use shuffle.workerInstance.labels instead.
*/}}
{{- define "shuffle.worker.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: worker
{{- end -}}
{{/*
Return the proper Shuffle worker image name
*/}}
{{- define "shuffle.worker.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global "chart" .Chart ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the worker pod
*/}}
{{- define "shuffle.worker.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.worker.image) "context" $) -}}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle workers
*/}}
{{- define "shuffle.worker.serviceAccount.name" -}}
{{- if .Values.worker.serviceAccount.create -}}
{{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.worker.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the worker service account
*/}}
{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.worker.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Return the labels to match ALL workers.
These match the labels of helm-deployed workers (shuffle.workerInstance.labels),
as well as orborus-deployed workers (deployk8sworker).
*/}}
{{- define "shuffle.worker.matchLabels" -}}
app.kubernetes.io/name: shuffle-worker
{{- end -}}
{{/*
Return the labels for a specific worker instance deployed via helm.
Usage:
{{ include "shuffle.workerInstance.labels" (dict "customLabels" $podLabels "context" $) -}}
*/}}
{{- define "shuffle.workerInstance.labels" -}}
{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-worker" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}}
{{ include "common.labels.standard" (dict "customLabels" $customLabels "context" .context) }}
{{- end -}}
{{/*
Return the labels to match a helm-deployed worker.
Usage:
{{ include "shuffle.workerInstance.matchLabels" (dict "customLabels" $podLabels "context" $) -}}
*/}}
{{- define "shuffle.workerInstance.matchLabels" -}}
{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-worker" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}}
{{ include "common.labels.matchLabels" (dict "customLabels" $customLabels "context" .context) }}
{{- end -}}
{{/*
Return a podAffinity/podAntiAffinity definition.
Usage:
{{ include "shuffle.workerInstance.affinities.pods" (dict "type" "soft" "customLabels" $podLabels "context" $) -}}
*/}}
{{- define "shuffle.workerInstance.affinities.pods" -}}
{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-worker" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}}
{{ include "common.affinities.pods" (dict "type" .type "customLabels" $customLabels "context" .context )}}
{{- end -}}
{{- define "shuffle.worker.hostname" -}}
{{- if .Values.worker.enableHelmDeployment -}}
http://{{ include "shuffle.worker.name" . }}.{{ .Release.Namespace }}.svc.cluster.local
{{- else -}}
http://shuffle-workers.{{ .Release.Namespace }}.svc.cluster.local
{{- end -}}
{{- end -}}
{{- define "shuffle.worker.baseUrl" -}}
{{ include "shuffle.worker.hostname" . }}:{{ .Values.worker.containerPorts.http }}
{{- end -}}
{{/*
Return the environment variables of shuffle-worker in the format
KEY: VALUE
*/}}
{{- define "shuffle.workerInstance.env" -}}
IS_KUBERNETES: "true"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
SHUFFLE_SWARM_CONFIG: "run" # Shuffle Worker requires this to be set even when using K8s instead of swarm
BASE_URL: {{ include "shuffle.backend.baseUrl" . | quote }}
SHUFFLE_APP_EXPOSED_PORT: {{ .Values.app.exposedContainerPort | quote }}
WORKER_HOSTNAME: {{ include "shuffle.worker.hostname" . }}
{{- if .Values.worker.manageAppDeployments }}
# Shuffle app images
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
SHUFFLE_BASE_IMAGE_NAME: "{{ .Values.shuffle.appBaseImageName }}"
# Shuffle app deployment configuration
SHUFFLE_APP_MOUNT_TMP_VOLUME: {{ .Values.app.mountTmpVolume | quote }}
SHUFFLE_APP_SERVICE_ACCOUNT_NAME: {{ include "shuffle.app.serviceAccount.name" . | quote }}
{{- if .Values.app.podSecurityContext.enabled }}
SHUFFLE_APP_POD_SECURITY_CONTEXT: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.app.containerSecurityContext.enabled }}
SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
# Shuffle app resources
{{- $appResources := (.Values.app.resources | default (include "common.resources.preset" (dict "type" .Values.app.resourcesPreset) | fromYaml)) -}}
{{- if and $appResources.requests $appResources.requests.cpu }}
SHUFFLE_APP_CPU_REQUEST: {{ $appResources.requests.cpu | quote }}
{{- end }}
{{- if and $appResources.requests $appResources.requests.memory }}
SHUFFLE_APP_MEMORY_REQUEST: {{ $appResources.requests.memory | quote }}
{{- end }}
{{- if and $appResources.requests (index $appResources.requests "ephemeral-storage") }}
SHUFFLE_APP_EPHEMERAL_STORAGE_REQUEST: {{ (index $appResources.requests "ephemeral-storage") | quote }}
{{- end }}
{{- if and $appResources.limits $appResources.limits.cpu }}
SHUFFLE_APP_CPU_LIMIT: {{ $appResources.limits.cpu | quote }}
{{- end }}
{{- if and $appResources.limits $appResources.limits.memory }}
SHUFFLE_APP_MEMORY_LIMIT: {{ $appResources.limits.memory | quote }}
{{- end }}
{{- if and $appResources.limits (index $appResources.limits "ephemeral-storage") }}
SHUFFLE_APP_EPHEMERAL_STORAGE_LIMIT: {{ (index $appResources.limits "ephemeral-storage") | quote }}
{{- end }}
# Include shuffle app environment variables. Worker passes them down to apps, when creating their deployment.
{{ include "shuffle.appInstance.env" . }}
{{- end }}
{{- end -}}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-dpl.yaml
+152
View File
@@ -0,0 +1,152 @@
{{- if .Values.worker.enableHelmDeployment }}
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ template "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.workerInstance.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.worker.deploymentAnnotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.worker.deploymentAnnotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if not .Values.worker.autoscaling.hpa.enabled }}
replicas: {{ .Values.worker.replicaCount }}
{{- end }}
{{- if .Values.worker.updateStrategy }}
strategy: {{- toYaml .Values.worker.updateStrategy | nindent 4 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.worker.podLabels .Values.commonLabels) "context" .) }}
selector:
matchLabels: {{- include "shuffle.workerInstance.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
template:
metadata:
{{- if .Values.worker.podAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.worker.podAnnotations "context" $) | nindent 8 }}
{{- end }}
labels: {{- include "shuffle.workerInstance.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.worker.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.worker.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.worker.automountServiceAccountToken }}
{{- if .Values.worker.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.worker.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.worker.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.worker.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "shuffle.workerInstance.affinities.pods" (dict "type" .Values.worker.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "shuffle.workerInstance.affinities.pods" (dict "type" .Values.worker.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.worker.nodeAffinityPreset.type "key" .Values.worker.nodeAffinityPreset.key "values" .Values.worker.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.worker.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.worker.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.worker.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.worker.tolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.worker.priorityClassName }}
priorityClassName: {{ .Values.worker.priorityClassName | quote }}
{{- end }}
{{- if .Values.worker.schedulerName }}
schedulerName: {{ .Values.worker.schedulerName | quote }}
{{- end }}
{{- if .Values.worker.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.worker.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.worker.podSecurityContext.enabled }}
securityContext: {{- omit .Values.worker.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.worker.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }}
{{- end }}
initContainers:
{{- if .Values.worker.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.worker.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: worker
image: {{ template "shuffle.worker.image" . }}
imagePullPolicy: {{ .Values.worker.image.pullPolicy }}
{{- if .Values.worker.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.worker.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.worker.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.worker.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.worker.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: CLEANUP
value: "false" # Do not remove resources when restarting worker
{{- $env := include "shuffle.workerInstance.env" . | fromYaml }}
{{- range $key, $val := $env }}
- name: {{ $key | quote }}
value: {{ $val | quote }}
{{- end }}
{{- if .Values.worker.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
{{- if .Values.worker.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.worker.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- if .Values.worker.resources }}
resources: {{- toYaml .Values.worker.resources | nindent 12 }}
{{- else if ne .Values.worker.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.worker.resourcesPreset) | nindent 12 }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.worker.containerPorts.http }}
{{- if .Values.worker.extraContainerPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraContainerPorts "context" $) | nindent 12 }}
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.worker.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.worker.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.livenessProbe "enabled") "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.worker.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.worker.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.readinessProbe "enabled") "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.worker.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.worker.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.startupProbe "enabled") "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.worker.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.worker.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.worker.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.worker.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.worker.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumes "context" $) | nindent 8 }}
{{- end }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-hpa.yaml
+43
View File
@@ -0,0 +1,43 @@
{{- if and .Values.worker.enableHelmDeployment .Values.worker.autoscaling.hpa.enabled }}
apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
scaleTargetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "shuffle.worker.name" . }}
minReplicas: {{ .Values.worker.autoscaling.hpa.minReplicas }}
maxReplicas: {{ .Values.worker.autoscaling.hpa.maxReplicas }}
metrics:
{{- if .Values.worker.autoscaling.hpa.targetMemory }}
- type: Resource
resource:
name: memory
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
{{- end }}
{{- end }}
{{- if .Values.worker.autoscaling.hpa.targetCPU }}
- type: Resource
resource:
name: cpu
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
{{- end }}
{{- end }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml
+3 -4
View File
@@ -9,9 +9,8 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "shuffle.worker.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
matchLabels: {{- include "shuffle.worker.matchLabels" . | nindent 6 }}
policyTypes:
- Ingress
- Egress
@@ -35,7 +34,7 @@ spec:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }}
matchLabels: {{- include "shuffle.app.matchLabels" . | nindent 14 }}
{{- if .Values.worker.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
@@ -57,7 +56,7 @@ spec:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }}
matchLabels: {{- include "shuffle.app.matchLabels" . | nindent 14 }}
{{- end }}
{{- if .Values.worker.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-pdb.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if .Values.worker.pdb.create }}
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
kind: PodDisruptionBudget
metadata:
name: {{ include "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.worker.pdb.minAvailable }}
minAvailable: {{ .Values.worker.pdb.minAvailable }}
{{- end }}
{{- if or .Values.worker.pdb.maxUnavailable ( not .Values.worker.pdb.minAvailable ) }}
maxUnavailable: {{ .Values.worker.pdb.maxUnavailable | default 1 }}
{{- end }}
selector:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
matchLabels: {{- include "shuffle.workerInstance.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 6 }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml
+9
View File
@@ -9,6 +9,7 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
rules:
{{- if .Values.worker.manageAppDeployments }}
- apiGroups: [""]
resources: ["pods"]
verbs: ["list", "delete"]
@@ -18,4 +19,12 @@ rules:
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["list", "create"]
{{- else }}
- apiGroups: [""]
resources: ["pods"]
verbs: ["list"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["list"]
{{- end }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-svc.yaml
+22
View File
@@ -0,0 +1,22 @@
{{- if .Values.worker.enableHelmDeployment }}
apiVersion: v1
kind: Service
metadata:
name: {{ template "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.worker.service.labels .Values.commonLabels) "context" .) }}
labels: {{- include "shuffle.workerInstance.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
spec:
type: ClusterIP
ports:
- name: http
port: {{ .Values.worker.containerPorts.http }}
targetPort: http
protocol: TCP
appProtocol: http
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
selector: {{- include "shuffle.workerInstance.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 4 }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-vpa.yaml
+38
View File
@@ -0,0 +1,38 @@
{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") (and .Values.worker.enableHelmDeployment .Values.worker.autoscaling.vpa.enabled) }}
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: {{ include "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.worker.autoscaling.vpa.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
resourcePolicy:
containerPolicies:
- containerName: worker
{{- with .Values.worker.autoscaling.vpa.controlledResources }}
controlledResources:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.worker.autoscaling.vpa.maxAllowed }}
maxAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.worker.autoscaling.vpa.minAllowed }}
minAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
targetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "shuffle.worker.name" . }}
{{- if .Values.worker.autoscaling.vpa.updatePolicy }}
updatePolicy:
{{- with .Values.worker.autoscaling.vpa.updatePolicy.updateMode }}
updateMode: {{ . }}
{{- end }}
{{- end }}
{{- end }}
functions/kubernetes/charts/shuffle/values.schema.json
+946 -3
View File
File diff suppressed because it is too large Load Diff
functions/kubernetes/charts/shuffle/values.yaml
+635 -36
View File
@@ -74,7 +74,7 @@ diagnosticMode:
shuffle:
## @param shuffle.baseUrl The external base URL under which Shuffle is reachable.
##
#baseUrl: ""
baseUrl: ""
## ref: https://shuffler.io/docs/organizations
## This chart only supports single-tenant deployments at the moment
@@ -84,7 +84,11 @@ shuffle:
## @param shuffle.appRegistry The registry from / to which shuffle apps are pulled / pushed
##
appRegistry: ""
appRegistry: "docker.io"
## @param shuffle.appBaseImageName The base image used for shuffle apps. The final image for an app is <appRegistr>/<appBaseImageName>/<appName>:<appVersion>
##
appBaseImageName: "frikky"
## @param shuffle.timezone The timezone used by Shuffle
##
@@ -317,7 +321,7 @@ backend:
## Can be set to RollingUpdate or Recreate
## Backend uses ReadWriteOnce volumes by default, which is incompatible with RollingUpdate
##
type: Recreate
type: Recreate
## @param backend.priorityClassName backend pods' priorityClassName
##
priorityClassName: ""
@@ -525,8 +529,6 @@ backend:
## @param backend.openSearch.username The username that is used for authenticating with OpenSearch
##
username: admin
password: StrongShufflePassword321!
## @param backend.openSearch.certificateFile The path to a custom OpenSearch certificate file
##
certificateFile: ""
@@ -887,16 +889,6 @@ frontend:
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
type: NodePort
ports:
- name: http
port: 80
targetPort: 3001
nodePort: 30080
- name: https
port: 443
targetPort: 3443
nodePort: 30443
## ServiceAccount configuration
##
@@ -968,7 +960,7 @@ orborus:
image:
registry: ghcr.io
repository: shuffle/shuffle-orborus
tag: "nightly"
tag: ""
digest: ""
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
@@ -1111,7 +1103,7 @@ orborus:
##
args: []
## @param orborus.automountServiceAccountToken Mount Service Account token in orborus pods
## NOTE: orborus requires the service account credentials to be mounted
## NOTE: orborus requires the service account credentials to be mounted if manageWorkerDeployments is enabled.
##
automountServiceAccountToken: true
## @param orborus.hostAliases orborus pods host aliases
@@ -1199,17 +1191,7 @@ orborus:
## - name: FOO
## value: "bar"
##
extraEnvVars:
- name: SHUFFLE_APP_SDK_TIMEOUT
value: "300"
- name: SHUFFLE_ORBORUS_EXCUTION_CONCURRENCY
value: "7"
- name: SHUFFLE_STATS_DISABLED
value: "true"
- name: KUBERNETES_NAMESPACE
value: "shuffle"
- name: SHUFFLE_BASE_IMAGE_NAME
value: "frikky/shuffle"
extraEnvVars: []
## @param orborus.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for orborus containers
##
extraEnvVarsCM: ""
@@ -1347,21 +1329,116 @@ orborus:
##
extraEgress: []
## @param orborus.executionConcurrency The maximum amount of concurrent workflow executions per worker
##
executionConcurrency: 25
## @param orborus.manageWorkerDeployments Whether workers are deployed and managed by orborus. When disabled, every worker is expected to be already deployed (see worker.enableHelmDeployment).
## This effectively removes required RBAC permissions from the shuffle-orborus service account to create deployments and services.
## Orborus might still attempt to create kubernetes objects, resulting in an error. There is currently no way to tell orborus, that it should not manage k8s resources.
## You likely want to disable worker.enableHelmDeployment when enabling this.
manageWorkerDeployments: true
## @section worker Parameters
##
worker:
## @param worker.enableHelmDeployment Deploy worker via helm. By default, workers are deployed by Orborus.
## You might want to disable orborus.manageWorkerDeployments when enabling this.
enableHelmDeployment: false
## worker image
## @param worker.image.registry worker image registry
## @param worker.image.repository worker image repository
## @param worker.image.tag worker image tag (immutable tags are recommended, defaults to appVersion)
## @param worker.image.digest worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)
## @param worker.image.pullPolicy worker image pull policy. Only effective with worker.enableHelmDeployment.
## @param worker.image.pullSecrets worker image pull secrets. Only effective with worker.enableHelmDeployment.
##
image:
registry: ghcr.io
repository: shuffle/shuffle-worker
tag: ""
digest: ""
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
##
pullPolicy: IfNotPresent
## Optionally specify an array of imagePullSecrets.
## Secrets must be manually created in the namespace.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
## e.g:
## pullSecrets:
## - myRegistryKeySecretName
##
pullSecrets: []
## @param worker.replicaCount Number of worker replicas to deploy. Only effective with worker.enableHelmDeployment.
##
replicaCount: 1
## @param worker.containerPorts.http backend HTTP container port
##
containerPorts:
http: 33333
## @param worker.extraContainerPorts Optionally specify extra list of additional ports for worker containers. Only effective with worker.enableHelmDeployment.
## e.g:
## extraContainerPorts:
## - name: myservice
## containerPort: 9090
##
extraContainerPorts: []
## Configure extra options for worker containers' liveness and readiness probes
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param worker.livenessProbe.enabled Enable livenessProbe on worker containers. Only effective with worker.enableHelmDeployment.
## @param worker.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param worker.livenessProbe.periodSeconds Period seconds for livenessProbe
## @param worker.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
## @param worker.livenessProbe.failureThreshold Failure threshold for livenessProbe
## @param worker.livenessProbe.successThreshold Success threshold for livenessProbe
##
livenessProbe:
enabled: false
initialDelaySeconds: 0
periodSeconds: 15
timeoutSeconds: 1
failureThreshold: 4
successThreshold: 1
## @param worker.readinessProbe.enabled Enable readinessProbe on worker containers. Only effective with worker.enableHelmDeployment.
## @param worker.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param worker.readinessProbe.periodSeconds Period seconds for readinessProbe
## @param worker.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
## @param worker.readinessProbe.failureThreshold Failure threshold for readinessProbe
## @param worker.readinessProbe.successThreshold Success threshold for readinessProbe
##
readinessProbe:
enabled: false
initialDelaySeconds: 0
periodSeconds: 5
timeoutSeconds: 1
failureThreshold: 3
successThreshold: 1
## @param worker.startupProbe.enabled Enable startupProbe on worker containers. Only effective with worker.enableHelmDeployment.
## @param worker.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
## @param worker.startupProbe.periodSeconds Period seconds for startupProbe
## @param worker.startupProbe.timeoutSeconds Timeout seconds for startupProbe
## @param worker.startupProbe.failureThreshold Failure threshold for startupProbe
## @param worker.startupProbe.successThreshold Success threshold for startupProbe
##
startupProbe:
enabled: false
initialDelaySeconds: 0
periodSeconds: 1
timeoutSeconds: 1
failureThreshold: 60
successThreshold: 1
## @param worker.customLivenessProbe Custom livenessProbe that overrides the default one. Only effective with worker.enableHelmDeployment.
##
customLivenessProbe: {}
## @param worker.customReadinessProbe Custom readinessProbe that overrides the default one. Only effective with worker.enableHelmDeployment.
##
customReadinessProbe: {}
## @param worker.customStartupProbe Custom startupProbe that overrides the default one. Only effective with worker.enableHelmDeployment.
##
customStartupProbe: {}
## worker resource requests and limits
## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
## @param worker.resourcesPreset Set worker container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if worker.resources is set (worker.resources is recommended for production).
@@ -1394,7 +1471,7 @@ worker:
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context
@@ -1421,6 +1498,187 @@ worker:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param worker.command Override default worker container command (useful when using custom images). Only effective with worker.enableHelmDeployment.
##
command: []
## @param worker.args Override default worker container args (useful when using custom images). Only effective with worker.enableHelmDeployment.
##
args: []
## @param worker.automountServiceAccountToken Mount Service Account token in worker pods. Only effective with worker.enableHelmDeployment.
## NOTE: worker requires the service account credentials to be mounted if manageAppDeployments is enabled.
##
automountServiceAccountToken: true
## @param worker.hostAliases worker pods host aliases. Only effective with worker.enableHelmDeployment.
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
hostAliases: []
## @param worker.deploymentAnnotations Annotations for worker deployment. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
##
deploymentAnnotations: {}
## @param worker.podLabels Extra labels for worker pods. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
podLabels: {}
## @param worker.podAnnotations Annotations for worker pods. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
##
podAnnotations: {}
## @param worker.podAffinityPreset Pod affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
##
podAffinityPreset: ""
## @param worker.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
##
podAntiAffinityPreset: soft
## Node worker.affinity preset
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
##
nodeAffinityPreset:
## @param worker.nodeAffinityPreset.type Node affinity preset type. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment.
##
type: ""
## @param worker.nodeAffinityPreset.key Node label key to match. Ignored if `worker.affinity` is set
##
key: ""
## @param worker.nodeAffinityPreset.values Node label values to match. Ignored if `worker.affinity` is set
## E.g.
## values:
## - e2e-az1
## - e2e-az2
##
values: []
## @param worker.affinity Affinity for worker pods assignment. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
## NOTE: `worker.podAffinityPreset`, `worker.podAntiAffinityPreset`, and `worker.nodeAffinityPreset` will be ignored when it's set
##
affinity: {}
## @param worker.nodeSelector Node labels for worker pods assignment. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
##
nodeSelector: {}
## @param worker.tolerations Tolerations for worker pods assignment. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
##
tolerations: []
## @param worker.updateStrategy.type worker deployment strategy type. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
##
updateStrategy:
## Can be set to RollingUpdate or Recreate
##
type: RollingUpdate
## @param worker.priorityClassName worker pods' priorityClassName. Only effective with worker.enableHelmDeployment.
##
priorityClassName: ""
## @param worker.topologySpreadConstraints Topology Spread Constraints for worker pod assignment spread across your cluster among failure-domains. Only effective with worker.enableHelmDeployment.
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods
##
topologySpreadConstraints: []
## @param worker.schedulerName Name of the k8s scheduler (other than default) for worker pods. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""
## @param worker.terminationGracePeriodSeconds Seconds worker pods need to terminate gracefully. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
##
terminationGracePeriodSeconds: ""
## @param worker.lifecycleHooks for worker containers to automate configuration before or after startup. Only effective with worker.enableHelmDeployment.
##
lifecycleHooks: {}
## @param worker.extraEnvVars Array with extra environment variables to add to worker containers. Only effective with worker.enableHelmDeployment.
## e.g:
## extraEnvVars:
## - name: FOO
## value: "bar"
##
extraEnvVars: []
## @param worker.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment.
##
extraEnvVarsCM: ""
## @param worker.extraEnvVarsSecret Name of existing Secret containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment.
##
extraEnvVarsSecret: ""
## @param worker.extraVolumes Optionally specify extra list of additional volumes for the worker pods. Only effective with worker.enableHelmDeployment.
##
extraVolumes: []
## @param worker.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the worker containers. Only effective with worker.enableHelmDeployment.
##
extraVolumeMounts: []
## @param worker.sidecars Add additional sidecar containers to the worker pods. Only effective with worker.enableHelmDeployment.
## e.g:
## sidecars:
## - name: your-image-name
## image: your-image
## imagePullPolicy: Always
## ports:
## - name: portname
## containerPort: 1234
##
sidecars: []
## @param worker.initContainers Add additional init containers to the worker pods. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
## e.g:
## initContainers:
## - name: your-image-name
## image: your-image
## imagePullPolicy: Always
## command: ['sh', '-c', 'echo "hello world"']
##
initContainers: []
## Pod Disruption Budget configuration
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb
## @param worker.pdb.create Enable/disable a Pod Disruption Budget creation. Only effective with worker.enableHelmDeployment.
## @param worker.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled
## @param worker.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `worker.pdb.minAvailable` and `worker.pdb.maxUnavailable` are empty.
##
pdb:
create: true
minAvailable: ""
maxUnavailable: ""
## Autoscaling configuration
## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/
##
autoscaling:
## @param worker.autoscaling.vpa.enabled Enable VPA for worker pods. Only effective with worker.enableHelmDeployment.
## @param worker.autoscaling.vpa.annotations Annotations for VPA resource
## @param worker.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory
## @param worker.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod
## @param worker.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod
##
vpa:
enabled: false
annotations: {}
controlledResources: []
maxAllowed: {}
minAllowed: {}
## @param worker.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy
## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod
## Possible values are "Off", "Initial", "Recreate", and "Auto".
##
updatePolicy:
updateMode: Auto
## @param worker.autoscaling.hpa.enabled Enable HPA for worker pods. Only effective with worker.enableHelmDeployment.
## @param worker.autoscaling.hpa.minReplicas Minimum number of replicas
## @param worker.autoscaling.hpa.maxReplicas Maximum number of replicas
## @param worker.autoscaling.hpa.targetCPU Target CPU utilization percentage
## @param worker.autoscaling.hpa.targetMemory Target Memory utilization percentage
##
hpa:
enabled: false
minReplicas: ""
maxReplicas: ""
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param worker.service.labels Extra labels for worker service. Only effective with worker.enableHelmDeployment.
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
@@ -1481,9 +1739,100 @@ worker:
##
extraEgress: []
## @param worker.manageAppDeployments Whether apps are deployed and managed by worker. When disabled, every used app is expected to to be already deployed (see apps.enabled).
## This effectively removes required RBAC permissions from the shuffle-worker service account to create deployments and services.
## The worker might still attempt to create kubernetes objects, resulting in an error. There is currently no way to tell the worker, that it should not manage k8s resources.
manageAppDeployments: true
## @section app Parameters
##
app:
## @param app.image.registry app image registry (defaults to shuffle.appRegistry)
## @param app.image.repository app image repository (defaults to shuffle.appBaseImageName)
## @param app.image.tag app image tag (defaults to the apps version)
## @param app.image.pullPolicy default image pull policy for app deployments. Only effective for helm-deployed apps (see apps.enabled).
## @param app.image.pullSecrets default image pull secrets for app deployments. Only effective for helm-deployed apps (see apps.enabled).
##
image:
registry: ""
repository: ""
tag: ""
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
##
pullPolicy: IfNotPresent
## Optionally specify an array of imagePullSecrets.
## Secrets must be manually created in the namespace.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
## e.g:
## pullSecrets:
## - myRegistryKeySecretName
##
pullSecrets: []
## @param app.replicaCount Default number of replicas to deploy for each app. Only effective for helm-deployed apps (see apps.enabled).
##
replicaCount: 1
## @param app.extraContainerPorts Optionally specify extra list of additional ports for app containers. Only effective for helm-deployed apps (see apps.enabled).
## e.g:
## extraContainerPorts:
## - name: myservice
## containerPort: 9090
##
extraContainerPorts: []
## Configure extra options for app containers' liveness and readiness probes
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param app.livenessProbe.enabled Enable livenessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled).
## @param app.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param app.livenessProbe.periodSeconds Period seconds for livenessProbe
## @param app.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
## @param app.livenessProbe.failureThreshold Failure threshold for livenessProbe
## @param app.livenessProbe.successThreshold Success threshold for livenessProbe
##
livenessProbe:
enabled: false
initialDelaySeconds: 0
periodSeconds: 15
timeoutSeconds: 1
failureThreshold: 4
successThreshold: 1
## @param app.readinessProbe.enabled Enable readinessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled).
## @param app.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param app.readinessProbe.periodSeconds Period seconds for readinessProbe
## @param app.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
## @param app.readinessProbe.failureThreshold Failure threshold for readinessProbe
## @param app.readinessProbe.successThreshold Success threshold for readinessProbe
##
readinessProbe:
enabled: false
initialDelaySeconds: 0
periodSeconds: 5
timeoutSeconds: 1
failureThreshold: 3
successThreshold: 1
## @param app.startupProbe.enabled Enable startupProbe on app containers. Only effective for helm-deployed apps (see apps.enabled).
## @param app.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
## @param app.startupProbe.periodSeconds Period seconds for startupProbe
## @param app.startupProbe.timeoutSeconds Timeout seconds for startupProbe
## @param app.startupProbe.failureThreshold Failure threshold for startupProbe
## @param app.startupProbe.successThreshold Success threshold for startupProbe
##
startupProbe:
enabled: false
initialDelaySeconds: 0
periodSeconds: 1
timeoutSeconds: 1
failureThreshold: 60
successThreshold: 1
## @param app.customLivenessProbe Custom livenessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled).
##
customLivenessProbe: {}
## @param app.customReadinessProbe Custom readinessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled).
##
customReadinessProbe: {}
## @param app.customStartupProbe Custom startupProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled).
##
customStartupProbe: {}
## app resource requests and limits
## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
## @param app.resourcesPreset Set app container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if app.resources is set (app.resources is recommended for production).
@@ -1516,7 +1865,7 @@ app:
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param app.containerSecurityContext.enabled Enabled app container' Security Context
@@ -1543,7 +1892,188 @@ app:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param app.command Override default app container command (useful when using custom images)
##
command: []
## @param app.args Override default app container args (useful when using custom images)
##
args: []
## @param app.automountServiceAccountToken Mount Service Account token in app pods. Only effective for helm-deployed apps (see apps.enabled).
##
automountServiceAccountToken: false
## @param app.hostAliases app pods host aliases. Only effective for helm-deployed apps (see apps.enabled).
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
hostAliases: []
## @param app.deploymentAnnotations Annotations for app deployment. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
##
deploymentAnnotations: {}
## @param app.podLabels Extra labels for app pods. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
podLabels: {}
## @param app.podAnnotations Annotations for app pods. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
##
podAnnotations: {}
## @param app.podAffinityPreset Pod affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
##
podAffinityPreset: ""
## @param app.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
##
podAntiAffinityPreset: soft
## Node app.affinity preset
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
##
nodeAffinityPreset:
## @param app.nodeAffinityPreset.type Node affinity preset type. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled).
##
type: ""
## @param app.nodeAffinityPreset.key Node label key to match. Ignored if `app.affinity` is set
##
key: ""
## @param app.nodeAffinityPreset.values Node label values to match. Ignored if `app.affinity` is set
## E.g.
## values:
## - e2e-az1
## - e2e-az2
##
values: []
## @param app.affinity Affinity for app pods assignment. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
## NOTE: `app.podAffinityPreset`, `app.podAntiAffinityPreset`, and `app.nodeAffinityPreset` will be ignored when it's set
##
affinity: {}
## @param app.nodeSelector Node labels for app pods assignment. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
##
nodeSelector: {}
## @param app.tolerations Tolerations for app pods assignment. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
##
tolerations: []
## @param app.updateStrategy.type app deployment strategy type. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
##
updateStrategy:
## Can be set to RollingUpdate or Recreate
##
type: RollingUpdate
## @param app.priorityClassName app pods' priorityClassName. Only effective for helm-deployed apps (see apps.enabled).
##
priorityClassName: ""
## @param app.topologySpreadConstraints Topology Spread Constraints for app pod assignment spread across your cluster among failure-domains. Only effective for helm-deployed apps (see apps.enabled).
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods
##
topologySpreadConstraints: []
## @param app.schedulerName Name of the k8s scheduler (other than default) for app pods. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""
## @param app.terminationGracePeriodSeconds Seconds app pods need to terminate gracefully. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
##
terminationGracePeriodSeconds: ""
## @param app.lifecycleHooks for app containers to automate configuration before or after startup. Only effective for helm-deployed apps (see apps.enabled).
##
lifecycleHooks: {}
## @param app.extraEnvVars Array with extra environment variables to add to app containers. Only effective for helm-deployed apps (see apps.enabled).
## e.g:
## extraEnvVars:
## - name: FOO
## value: "bar"
##
extraEnvVars: []
## @param app.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled).
##
extraEnvVarsCM: ""
## @param app.extraEnvVarsSecret Name of existing Secret containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled).
##
extraEnvVarsSecret: ""
## @param app.extraVolumes Optionally specify extra list of additional volumes for the app pods. Only effective for helm-deployed apps (see apps.enabled).
##
extraVolumes: []
## @param app.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the app containers. Only effective for helm-deployed apps (see apps.enabled).
##
extraVolumeMounts: []
## @param app.sidecars Add additional sidecar containers to the app pods. Only effective for helm-deployed apps (see apps.enabled).
## e.g:
## sidecars:
## - name: your-image-name
## image: your-image
## imagePullPolicy: Always
## ports:
## - name: portname
## containerPort: 1234
##
sidecars: []
## @param app.initContainers Add additional init containers to the app pods. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
## e.g:
## initContainers:
## - name: your-image-name
## image: your-image
## imagePullPolicy: Always
## command: ['sh', '-c', 'echo "hello world"']
##
initContainers: []
## Pod Disruption Budget configuration
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb
## @param app.pdb.create Enable/disable a Pod Disruption Budget creation. Only effective for helm-deployed apps (see apps.enabled).
## @param app.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled
## @param app.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `app.pdb.minAvailable` and `app.pdb.maxUnavailable` are empty.
##
pdb:
create: true
minAvailable: ""
maxUnavailable: ""
## Autoscaling configuration
## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/
##
autoscaling:
## @param app.autoscaling.vpa.enabled Enable VPA for app pods. Only effective for helm-deployed apps (see apps.enabled).
## @param app.autoscaling.vpa.annotations Annotations for VPA resource
## @param app.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory
## @param app.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod
## @param app.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod
##
vpa:
enabled: false
annotations: {}
controlledResources: []
maxAllowed: {}
minAllowed: {}
## @param app.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy
## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod
## Possible values are "Off", "Initial", "Recreate", and "Auto".
##
updatePolicy:
updateMode: Auto
## @param app.autoscaling.hpa.enabled Enable HPA for app pods. Only effective for helm-deployed apps (see apps.enabled).
## @param app.autoscaling.hpa.minReplicas Minimum number of replicas
## @param app.autoscaling.hpa.maxReplicas Maximum number of replicas
## @param app.autoscaling.hpa.targetCPU Target CPU utilization percentage
## @param app.autoscaling.hpa.targetMemory Target Memory utilization percentage
##
hpa:
enabled: false
minReplicas: ""
maxReplicas: ""
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param app.service.labels Extra labels for app service. Only effective for helm-deployed apps (see apps.enabled).
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
serviceAccount:
@@ -1594,9 +2124,79 @@ app:
##
extraEgress: []
## @param app.exposedContainerPort The port that shuffle app containers will listen on for new requests.
## @param app.mountTmpVolume Whether a writable /tmp emptyDir volume should be mounted to the app.
##
mountTmpVolume: true
## @param app.exposedContainerPort The port that shuffle app containers will listen on for new requests.
##
exposedContainerPort: 80
## @param app.sdkTimeout The timeout in seconds for app actions.
##
sdkTimeout: 300
## @param app.disableLogs Do not capture app logs. By default, app logs are captured, so that they are visible in the frontend.
##
disableLogs: false
## @section Parameters to deploy apps using helm
##
apps:
## @param apps.enabled Whether apps should be deployed using helm.
## By default, workers create deployments and services for apps when they are first needed (or during startup for some selected apps).
## Deploying apps via workers has some drawbacks, such as:
## - A workflow fails when the app is not deployed when the workflow gets executed (see https://github.com/Shuffle/Shuffle/issues/1739)
## - There is no way to set different service accounts, security contexts, resources, env variables, volume mounts, or replicas for different apps
## - Worker needs elevated permissions in Kubernetes
## Note that you can deploy some apps via helm, while keeping the flexibility of letting workers deploy apps if they are not already deployed.
## If you deploy all needed apps via helm and dont want workers to create additional deployments, set worker.manageAppDeployments to false.
##
enabled: false
shuffleTools:
## @param apps.shuffleTools.enabled Whether the shuffle-tools app is enabled
##
enabled: true
## @skip apps.shuffleTools.name
##
name: shuffle-tools
## @param apps.shuffleTools.version The version of the shuffle-tools app to deploy.
##
version: 1.2.0
# You can override .app.* values here, e.g. replicaCount, resources or image.
shuffleSubflow:
## @param apps.shuffleSubflow.enabled Whether the shuffle-subflow app is enabled
##
enabled: true
## @skip apps.shuffleSubflow.name
##
name: shuffle-subflow
## @param apps.shuffleSubflow.version The version of the shuffle-subflow app to deploy.
##
version: 1.1.0
# You can override .app.* values here, e.g. replicaCount, resources or image.
http:
## @param apps.http.enabled Whether the http app is enabled
##
enabled: true
## @skip apps.http.name
##
name: http
## @param apps.http.version The version of the http app to deploy.
##
version: 1.4.0
# You can override .app.* values here, e.g. replicaCount, resources or image.
## @extra apps.MY_APP.app [string] The name of the app (required, e.g. shuffle-tools)
## @extra apps.MY_APP.version [string] The version of the app (required, e.g. 1.2.0)
## Add your own apps here. The key of the app does not matter, as long as it is unique.
## myApp:
## enabled: true
## name: my-app
## version: 1.0.0
## ... Overwrite .app.* values here, e.g.:
## replicaCount: 3
## resources: {}
## @section Traffic Exposure Parameters
##
@@ -1893,6 +2493,8 @@ volumePermissions:
## OpenSearch chart configuration
## ref: https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml
## @param opensearch.enabled Switch to enable or disable the opensearch helm chart
## @skip opensearch.sysctlImage
## @skip opensearch.image
## @skip opensearch.master
## @skip opensearch.data
## @skip opensearch.coordinating
@@ -1901,15 +2503,12 @@ volumePermissions:
##
opensearch:
enabled: true
sysctlImage:
enabled: false
image:
registry: docker.io
repository: bitnamilegacy/opensearch
tag: "3.2.0"
master:
replicaCount: 1
data:
functions/onprem/orborus/go.mod
+1 -1
View File
@@ -10,7 +10,7 @@ require (
github.com/docker/docker v28.3.3+incompatible
github.com/docker/go-connections v0.5.0
github.com/satori/go.uuid v1.2.0
github.com/shuffle/shuffle-shared v0.9.79
github.com/shuffle/shuffle-shared v0.9.82
k8s.io/api v0.34.2
k8s.io/apimachinery v0.34.2
)
functions/onprem/orborus/orborus.go
+1
View File
@@ -1159,6 +1159,7 @@ func fixk8sRoles() {
}
}
// TODO: Check if deployment or service already exist by labels and only create if not already exists
func deployK8sWorker(image string, identifier string, env []string) error {
env = append(env, fmt.Sprintf("IS_KUBERNETES=true"))
env = append(env, fmt.Sprintf("KUBERNETES_NAMESPACE=%s", os.Getenv("KUBERNETES_NAMESPACE")))
functions/onprem/worker/README.md
+4
View File
@@ -1,6 +1,10 @@
# Worker
A worker implementation in Golang. This runs ALL Shuffle workflows onprem. In general receives jobs from Orborus.
## Standalone run (testing)
`go run worker.go standalone <executionid> <authorization> <optional:url>`
## Development
The ideal way to test the Worker is with a single workflow execution, standalone. Here are some environment variables you can use:
functions/onprem/worker/go.mod
+3 -3
View File
@@ -11,8 +11,8 @@ require (
github.com/docker/docker v28.3.3+incompatible
github.com/gorilla/mux v1.8.1
github.com/satori/go.uuid v1.2.0
github.com/shuffle/shuffle-shared v0.9.76
github.com/shuffle/singul v0.0.20
github.com/shuffle/shuffle-shared v0.9.82
github.com/shuffle/singul v0.0.24
k8s.io/api v0.34.2
k8s.io/apimachinery v0.34.2
k8s.io/client-go v0.34.2
@@ -60,7 +60,7 @@ require (
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/frikky/kin-openapi v0.42.0 // indirect
github.com/frikky/schemaless v0.0.25 // indirect
github.com/frikky/schemaless v0.0.28 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/ghodss/yaml v1.0.0 // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect