diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 2dd62129..3c713a6c 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -137,6 +137,8 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `backend.image.pullPolicy` | backend image pull policy | `IfNotPresent` | | `backend.image.pullSecrets` | backend image pull secrets | `[]` | | `backend.replicaCount` | Number of backend replicas to deploy | `1` | +| `backend.containerPorts.http` | backend HTTP container port | `5001` | +| `backend.extraContainerPorts` | Optionally specify extra list of additional ports for backend containers | `[]` | | `backend.livenessProbe.enabled` | Enable livenessProbe on backend containers | `false` | | `backend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | | `backend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | @@ -251,6 +253,9 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `frontend.image.pullPolicy` | frontend image pull policy | `IfNotPresent` | | `frontend.image.pullSecrets` | frontend image pull secrets | `[]` | | `frontend.replicaCount` | Number of frontend replicas to deploy | `1` | +| `frontend.containerPorts.http` | frontend HTTP container port | `80` | +| `frontend.containerPorts.https` | frontend HTTPS container port | `443` | +| `frontend.extraContainerPorts` | Optionally specify extra list of additional ports for frontend containers | `[]` | | `frontend.livenessProbe.enabled` | Enable livenessProbe on frontend containers | `false` | | `frontend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | | `frontend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | @@ -274,12 +279,12 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `frontend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | | `frontend.resourcesPreset` | Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). | `nano` | | `frontend.resources` | Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `true` | +| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `false` | | `frontend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for frontend pods | `Always` | | `frontend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for frontend pods | `[]` | | `frontend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for frontend pods | `[]` | | `frontend.podSecurityContext.fsGroup` | Set fsGroup in frontend pods' Security Context | `1001` | -| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `true` | +| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `false` | | `frontend.containerSecurityContext.seLinuxOptions` | Set SELinux options in frontend container | `{}` | | `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `101` | | `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `101` | @@ -355,6 +360,8 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `orborus.image.pullPolicy` | orborus image pull policy | `IfNotPresent` | | `orborus.image.pullSecrets` | orborus image pull secrets | `[]` | | `orborus.replicaCount` | Number of orborus replicas to deploy | `1` | +| `orborus.containerPorts.http` | orborus HTTP container port | `8080` | +| `orborus.extraContainerPorts` | Optionally specify extra list of additional ports for orborus containers | `[]` | | `orborus.livenessProbe.enabled` | Enable livenessProbe on orborus containers | `false` | | `orborus.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | | `orborus.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | @@ -574,3 +581,4 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `vault.secrets` | A list of VaultSecrets to create | `[]` | ### Other Parameters + diff --git a/charts/shuffle/templates/backend/backend-dpl.yaml b/charts/shuffle/templates/backend/backend-dpl.yaml index 8a4cfc36..ecf52e20 100644 --- a/charts/shuffle/templates/backend/backend-dpl.yaml +++ b/charts/shuffle/templates/backend/backend-dpl.yaml @@ -144,7 +144,10 @@ spec: {{- end }} ports: - name: http - containerPort: 5001 + containerPort: {{ .Values.backend.containerPorts.http }} + {{- if .Values.backend.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.backend.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customLivenessProbe "context" $) | nindent 12 }} @@ -152,7 +155,7 @@ spec: livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /api/v1/health - port: 5001 + port: {{ .Values.backend.containerPorts.http }} {{- end }} {{- if .Values.backend.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customReadinessProbe "context" $) | nindent 12 }} @@ -160,7 +163,7 @@ spec: readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /api/v1/health - port: 5001 + port: {{ .Values.backend.containerPorts.http }} {{- end }} {{- if .Values.backend.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customStartupProbe "context" $) | nindent 12 }} @@ -168,7 +171,7 @@ spec: startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /api/v1/health - port: 5001 + port: {{ .Values.backend.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.backend.lifecycleHooks }} diff --git a/charts/shuffle/templates/backend/backend-network-policy.yaml b/charts/shuffle/templates/backend/backend-network-policy.yaml index 47d7bd3b..48010706 100644 --- a/charts/shuffle/templates/backend/backend-network-policy.yaml +++ b/charts/shuffle/templates/backend/backend-network-policy.yaml @@ -35,7 +35,7 @@ spec: {{- end }} ingress: - ports: - - port: 5001 + - port: {{ .Values.backend.containerPorts.http }} protocol: TCP {{- if not .Values.backend.networkPolicy.allowExternal }} from: diff --git a/charts/shuffle/templates/backend/backend-svc.yaml b/charts/shuffle/templates/backend/backend-svc.yaml index c41aa3bb..18328899 100644 --- a/charts/shuffle/templates/backend/backend-svc.yaml +++ b/charts/shuffle/templates/backend/backend-svc.yaml @@ -11,7 +11,7 @@ spec: type: ClusterIP ports: - name: http - port: 5001 + port: {{ .Values.backend.containerPorts.http }} targetPort: http protocol: TCP {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }} diff --git a/charts/shuffle/templates/frontend/frontend-dpl.yaml b/charts/shuffle/templates/frontend/frontend-dpl.yaml index 659167df..b3a68dbb 100644 --- a/charts/shuffle/templates/frontend/frontend-dpl.yaml +++ b/charts/shuffle/templates/frontend/frontend-dpl.yaml @@ -103,7 +103,14 @@ spec: {{- end }} ports: - name: http - containerPort: 8080 + containerPort: {{ .Values.frontend.containerPorts.http }} + {{- if .Values.frontend.containerPorts.https }} + - name: https + containerPort: {{ .Values.frontend.containerPorts.https }} + {{- end }} + {{- if .Values.frontend.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.frontend.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customLivenessProbe "context" $) | nindent 12 }} @@ -111,7 +118,7 @@ spec: livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} {{- end }} {{- if .Values.frontend.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customReadinessProbe "context" $) | nindent 12 }} @@ -119,7 +126,7 @@ spec: readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} {{- end }} {{- if .Values.frontend.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customStartupProbe "context" $) | nindent 12 }} @@ -127,7 +134,7 @@ spec: startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.frontend.lifecycleHooks }} diff --git a/charts/shuffle/templates/frontend/frontend-network-policy.yaml b/charts/shuffle/templates/frontend/frontend-network-policy.yaml index b8143312..9082535b 100644 --- a/charts/shuffle/templates/frontend/frontend-network-policy.yaml +++ b/charts/shuffle/templates/frontend/frontend-network-policy.yaml @@ -36,7 +36,10 @@ spec: ingress: {{ if .Values.frontend.networkPolicy.allowExternal }} - ports: - - port: 8080 + - port: {{ .Values.frontend.containerPorts.http }} + {{- if .Values.frontend.containerPorts.https }} + - port: {{ .Values.frontend.containerPorts.https }} + {{- end }} {{- end }} {{- if .Values.frontend.networkPolicy.extraIngress }} {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }} diff --git a/charts/shuffle/templates/frontend/frontend-svc.yaml b/charts/shuffle/templates/frontend/frontend-svc.yaml index 8a5ca84c..76851c0a 100644 --- a/charts/shuffle/templates/frontend/frontend-svc.yaml +++ b/charts/shuffle/templates/frontend/frontend-svc.yaml @@ -11,8 +11,14 @@ spec: type: ClusterIP ports: - name: http - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} targetPort: http protocol: TCP + {{- if .Values.frontend.containerPorts.https }} + - name: https + port: {{ .Values.frontend.containerPorts.https }} + targetPort: https + protocol: TCP + {{- end }} {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }} selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/istio/virtual-service.yaml b/charts/shuffle/templates/istio/virtual-service.yaml index ed74004b..902a1583 100644 --- a/charts/shuffle/templates/istio/virtual-service.yaml +++ b/charts/shuffle/templates/istio/virtual-service.yaml @@ -21,10 +21,10 @@ spec: - destination: host: {{ include "shuffle.backend.name" . }} port: - number: 5001 + number: {{ .Values.backend.containerPorts.http }} - route: - destination: host: {{ include "shuffle.frontend.name" . }} port: - number: 8080 + number: {{ .Values.frontend.containerPorts.http }} {{- end }} diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml b/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml index f4ee4aba..1b07d9a9 100644 --- a/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml +++ b/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml @@ -28,10 +28,10 @@ spec: to: - namespaceSelector: matchLabels: - kubernetes.io/metadata.name: kube-system + kubernetes.io/metadata.name: kube-system # Allow access to orborus - ports: - - port: 8080 + - port: {{ .Values.orborus.containerPorts.http }} protocol: TCP to: - namespaceSelector: diff --git a/charts/shuffle/templates/orborus/orborus-dpl.yaml b/charts/shuffle/templates/orborus/orborus-dpl.yaml index b63c7a8b..411db680 100644 --- a/charts/shuffle/templates/orborus/orborus-dpl.yaml +++ b/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -107,7 +107,10 @@ spec: {{- end }} ports: - name: http - containerPort: 8080 + containerPort: {{ .Values.orborus.containerPorts.http }} + {{- if .Values.orborus.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.orborus.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customLivenessProbe "context" $) | nindent 12 }} @@ -115,7 +118,7 @@ spec: livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.orborus.containerPorts.http }} {{- end }} {{- if .Values.orborus.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customReadinessProbe "context" $) | nindent 12 }} @@ -123,7 +126,7 @@ spec: readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.orborus.containerPorts.http }} {{- end }} {{- if .Values.orborus.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customStartupProbe "context" $) | nindent 12 }} @@ -131,7 +134,7 @@ spec: startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.orborus.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.orborus.lifecycleHooks }} diff --git a/charts/shuffle/templates/orborus/orborus-network-policy.yaml b/charts/shuffle/templates/orborus/orborus-network-policy.yaml index 6e03b9e3..f6a22339 100644 --- a/charts/shuffle/templates/orborus/orborus-network-policy.yaml +++ b/charts/shuffle/templates/orborus/orborus-network-policy.yaml @@ -31,7 +31,7 @@ spec: kubernetes.io/metadata.name: kube-system # Allow access to backend - ports: - - port: 5001 + - port: {{ .Values.backend.containerPorts.http }} protocol: TCP to: - namespaceSelector: @@ -55,7 +55,7 @@ spec: {{- end }} ingress: - ports: - - port: 8080 + - port: {{ .Values.orborus.containerPorts.http }} protocol: TCP {{- if not .Values.orborus.networkPolicy.allowExternal }} from: diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json index 62e2dff2..d70c16cb 100644 --- a/charts/shuffle/values.schema.json +++ b/charts/shuffle/values.schema.json @@ -178,6 +178,22 @@ "description": "Number of backend replicas to deploy", "default": 1 }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "backend HTTP container port", + "default": 5001 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for backend containers", + "default": [], + "items": {} + }, "livenessProbe": { "type": "object", "properties": { @@ -840,6 +856,27 @@ "description": "Number of frontend replicas to deploy", "default": 1 }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "frontend HTTP container port", + "default": 80 + }, + "https": { + "type": "number", + "description": "frontend HTTPS container port", + "default": 443 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for frontend containers", + "default": [], + "items": {} + }, "livenessProbe": { "type": "object", "properties": { @@ -976,7 +1013,7 @@ "enabled": { "type": "boolean", "description": "Enable frontend pods' Security Context", - "default": true + "default": false }, "fsGroupChangePolicy": { "type": "string", @@ -1008,7 +1045,7 @@ "enabled": { "type": "boolean", "description": "Enabled frontend container' Security Context", - "default": true + "default": false }, "runAsUser": { "type": "number", @@ -1437,6 +1474,22 @@ "description": "Number of orborus replicas to deploy", "default": 1 }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "orborus HTTP container port", + "default": 8080 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for orborus containers", + "default": [], + "items": {} + }, "livenessProbe": { "type": "object", "properties": { diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index daa4ec9a..b9d47913 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -122,6 +122,17 @@ backend: ## @param backend.replicaCount Number of backend replicas to deploy ## replicaCount: 1 + ## @param backend.containerPorts.http backend HTTP container port + ## + containerPorts: + http: 5001 + ## @param backend.extraContainerPorts Optionally specify extra list of additional ports for backend containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] ## Configure extra options for backend containers' liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes ## @param backend.livenessProbe.enabled Enable livenessProbe on backend containers @@ -577,6 +588,19 @@ frontend: ## @param frontend.replicaCount Number of frontend replicas to deploy ## replicaCount: 1 + ## @param frontend.containerPorts.http frontend HTTP container port + ## @param frontend.containerPorts.https frontend HTTPS container port + ## + containerPorts: + http: 80 + https: 443 + ## @param frontend.extraContainerPorts Optionally specify extra list of additional ports for frontend containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] ## Configure extra options for frontend containers' liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes ## @param frontend.livenessProbe.enabled Enable livenessProbe on frontend containers @@ -966,6 +990,17 @@ orborus: ## @param orborus.replicaCount Number of orborus replicas to deploy ## replicaCount: 1 + ## @param orborus.containerPorts.http orborus HTTP container port + ## + containerPorts: + http: 8080 + ## @param orborus.extraContainerPorts Optionally specify extra list of additional ports for orborus containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] ## Configure extra options for orborus containers' liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes ## @param orborus.livenessProbe.enabled Enable livenessProbe on orborus containers