marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1590 from P4sca1/helm-chart

Browse Source 
add shuffle helm chart
This commit is contained in:
Aditya
2025-02-26 03:54:32 +05:30
committed by GitHub
parent 1ffae87420 ceb62abc1c
commit 3e26abc85b
54 changed files with 7379 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/.github/workflows/helm.yml
+41
View File
@@ -0,0 +1,41 @@
name: helm
on:
workflow_dispatch:
push:
branches:
- main
paths:
- "charts/**"
permissions:
contents: read
packages: write
jobs:
main:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install apt dependencies
run: |
curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
sudo apt-get install apt-transport-https -y --no-install-recommends
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
sudo apt-get update
sudo apt-get install helm -y --no-install-recommends
- name: Update helm dependencies
run: helm dependency update ./charts/shuffle
- name: Package Helm chart
run: helm package ./charts/shuffle --destination ./charts
- name: Login to OCI registry (ghcr.io)
run: helm registry login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }}
- name: Push helm chart
run: helm push ./charts/shuffle-*.tgz oci://ghcr.io/shuffle/shuffle/charts
charts/shuffle/.gitignore
+3
View File
@@ -0,0 +1,3 @@
.DS_Store
*.tgz
charts/
charts/shuffle/.helmignore
+23
View File
@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
charts/shuffle/.yamllint
+11
View File
@@ -0,0 +1,11 @@
---
extends: default
rules:
line-length: disable
braces: disable
comments:
require-starting-space: true
ignore-shebangs: true
min-spaces-from-content: 1
charts/shuffle/Chart.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: v2
name: shuffle
description: A Helm chart for deploying Shuffle on Kubernetes
type: application
version: 0.1.0
appVersion: nightly
dependencies:
- name: common
version: ^2.23.0
repository: oci://registry-1.docker.io/bitnamicharts
- name: opensearch
version: ^1.3.0
repository: oci://registry-1.docker.io/bitnamicharts
condition: opensearch.enabled
charts/shuffle/README.md
+607
View File
@@ -0,0 +1,607 @@
# Shuffle Helm chart
## Chart Template
The Bitnami Chart Template was used for creating this chart:
https://github.com/bitnami/charts/tree/7e44e64626f5b1fc6d56889cdfdeadc1f62c7cf1/template/CHART_NAME
Original license text:
```
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
```
## Usage
```sh
# Install shuffle via helm (the shuffle namespace is hardcoded into the shuffle source code)
helm install shuffle oci://ghcr.io/shuffle/shuffle/charts/shuffle --namespace shuffle --create-namespace
```
Make sure that no other application is deployed to the shuffle namespace, as shuffle deletes kubernetes resources in this namespace.
Only a single deployment of shuffle is supported per namespace.
## Uninstallation
```sh
# Uninstall shuffle via helm
helm uninstall shuffle --namespace shuffle
# Remove additional resources created by shuffle (such as workers and apps)
kubectl delete svc --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)"
kubectl delete deploy --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)"
```
## Secret Parameters
The helm chart was designed to not contain any secret data and does not allow configuring secret data using helm values.
Instead, secret values must be passed to services using `extraEnvVarsSecret` or `extraEnvVars`.
The secrets need to be manually created. It is possible to run this helm chart without specifying any secrets.
You will be prompted to create an admin user when visiting the shuffle dashboard for the first time.
Note that information will not be encrypted without specifying the `SHUFFLE_ENCRYPTION_MODIFIER` value.
### Mounting env variables into a service
After creating secrets which hold sensitive information, you can mount them as environment variables into a
service via the `extraEnvVarsSecret` or `extraEnvVars` values.
```yaml
backend:
# Use a single secret, which holds environment variables.
# Remember that the secret keys must exactly match the environment variable names.
extraEnvVarsSecret: shuffle-backend-env
# Or mount each value explicitly
extraEnvVars:
- name: SHUFFLE_DEFAULT_USERNAME
valueFrom:
secretKeyRef:
name: "shuffle-initial-user"
key: username
- name: SHUFFLE_DEFAULT_PASSWORD
valueFrom:
secretKeyRef:
name: "shuffle-initial-user"
key: password
- name: SHUFFLE_DEFAULT_APIKEY
valueFrom:
secretKeyRef:
name: "shuffle-initial-user"
key: apikey
- name: SHUFFLE_ENCRYPTION_MODIFIER
valueFrom:
secretKeyRef:
name: "shuffle-encryption"
key: modifier
```
### Backend
A list of environment variables containing secret values for the backend.
```yaml
# OpenSearch password
SHUFFLE_OPENSEARCH_PASSWORD: ""
# Basic auth credentials for downloading apps from git
SHUFFLE_DOWNLOAD_AUTH_USERNAME: ""
SHUFFLE_DOWNLOAD_AUTH_PASSWORD: ""
# Automatically create the initial admin user. Username and password have a min length of 3.
# If not set, you are prompted with an admin user creation dialog when visiting the shuffle frontend for the first time.
SHUFFLE_DEFAULT_USERNAME: admin
SHUFFLE_DEFAULT_PASSWORD: MySecretAdminPassword1234!
SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uuid v4
# Encryption modifier. This HAS to be set to encrypt any authentication being used in Shuffle.
# This is put together with other relevant values to ensure multiple parts are needed to decrypt.
# If this key is lost or changed, you will have to reauthenticate all apps.
# The encryption modifier is added to encrypted values to prevent rainbow table attacks. It can be any random string.
SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
```
## Parameters
### Global parameters
| Name | Description | Value |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| `global.imageRegistry` | Global Docker image registry | `""` |
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` |
| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` |
| `global.compatibility.omitEmptySeLinuxOptions` | If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object | `false` |
### Common parameters
| Name | Description | Value |
| ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
| `kubeVersion` | Override Kubernetes version | `""` |
| `nameOverride` | String to partially override common.names.name | `""` |
| `fullnameOverride` | String to fully override common.names.fullname | `""` |
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
| `commonLabels` | Labels to add to all deployed objects | `{}` |
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` |
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
| `diagnosticMode.command` | Command to override all containers in the chart release | `["sleep"]` |
| `diagnosticMode.args` | Args to override all containers in the chart release | `["infinity"]` |
### Shared Shuffle Parameters
| Name | Description | Value |
| --------------------- | ------------------------------------------------------------- | --------------- |
| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` |
| `shuffle.org` | Default shuffle organization | `Shuffle` |
| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `""` |
| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` |
### backend Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
| `backend.image.registry` | backend image registry | `ghcr.io` |
| `backend.image.repository` | backend image repository | `shuffle/shuffle-backend` |
| `backend.image.digest` | backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `backend.image.pullPolicy` | backend image pull policy | `IfNotPresent` |
| `backend.image.pullSecrets` | backend image pull secrets | `[]` |
| `backend.replicaCount` | Number of backend replicas to deploy | `1` |
| `backend.containerPorts.http` | backend HTTP container port | `5001` |
| `backend.extraContainerPorts` | Optionally specify extra list of additional ports for backend containers | `[]` |
| `backend.livenessProbe.enabled` | Enable livenessProbe on backend containers | `false` |
| `backend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
| `backend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
| `backend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
| `backend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
| `backend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `backend.readinessProbe.enabled` | Enable readinessProbe on backend containers | `false` |
| `backend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
| `backend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `backend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `backend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `backend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `backend.startupProbe.enabled` | Enable startupProbe on backend containers | `false` |
| `backend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
| `backend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
| `backend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
| `backend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
| `backend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `backend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
| `backend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
| `backend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
| `backend.resourcesPreset` | Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production). | `small` |
| `backend.resources` | Set backend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `backend.podSecurityContext.enabled` | Enable backend pods' Security Context | `true` |
| `backend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for backend pods | `Always` |
| `backend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for backend pods | `[]` |
| `backend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for backend pods | `[]` |
| `backend.podSecurityContext.fsGroup` | Set fsGroup in backend pods' Security Context | `1001` |
| `backend.containerSecurityContext.enabled` | Enabled backend container' Security Context | `true` |
| `backend.containerSecurityContext.seLinuxOptions` | Set SELinux options in backend container | `{}` |
| `backend.containerSecurityContext.runAsUser` | Set runAsUser in backend container' Security Context | `1000` |
| `backend.containerSecurityContext.runAsGroup` | Set runAsGroup in backend container' Security Context | `1000` |
| `backend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in backend container' Security Context | `true` |
| `backend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in backend container' Security Context | `true` |
| `backend.containerSecurityContext.privileged` | Set privileged in backend container' Security Context | `false` |
| `backend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in backend container' Security Context | `false` |
| `backend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in backend container | `["ALL"]` |
| `backend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in backend container | `RuntimeDefault` |
| `backend.command` | Override default backend container command (useful when using custom images) | `[]` |
| `backend.args` | Override default backend container args (useful when using custom images) | `[]` |
| `backend.automountServiceAccountToken` | Mount Service Account token in backend pods | `true` |
| `backend.hostAliases` | backend pods host aliases | `[]` |
| `backend.daemonsetAnnotations` | Annotations for backend daemonset | `{}` |
| `backend.deploymentAnnotations` | Annotations for backend deployment | `{}` |
| `backend.statefulsetAnnotations` | Annotations for backend statefulset | `{}` |
| `backend.podLabels` | Extra labels for backend pods | `{}` |
| `backend.podAnnotations` | Annotations for backend pods | `{}` |
| `backend.podAffinityPreset` | Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `backend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `backend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `backend.nodeAffinityPreset.key` | Node label key to match. Ignored if `backend.affinity` is set | `""` |
| `backend.nodeAffinityPreset.values` | Node label values to match. Ignored if `backend.affinity` is set | `[]` |
| `backend.affinity` | Affinity for backend pods assignment | `{}` |
| `backend.nodeSelector` | Node labels for backend pods assignment | `{}` |
| `backend.tolerations` | Tolerations for backend pods assignment | `[]` |
| `backend.updateStrategy.type` | backend deployment strategy type | `RollingUpdate` |
| `backend.updateStrategy.type` | backend statefulset strategy type | `RollingUpdate` |
| `backend.podManagementPolicy` | Pod management policy for backend statefulset | `OrderedReady` |
| `backend.priorityClassName` | backend pods' priorityClassName | `""` |
| `backend.topologySpreadConstraints` | Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | `[]` |
| `backend.schedulerName` | Name of the k8s scheduler (other than default) for backend pods | `""` |
| `backend.terminationGracePeriodSeconds` | Seconds backend pods need to terminate gracefully | `""` |
| `backend.lifecycleHooks` | for backend containers to automate configuration before or after startup | `{}` |
| `backend.extraEnvVars` | Array with extra environment variables to add to backend containers | `[]` |
| `backend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for backend containers | `""` |
| `backend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for backend containers | `""` |
| `backend.extraVolumes` | Optionally specify extra list of additional volumes for the backend pods | `[]` |
| `backend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the backend containers | `[]` |
| `backend.sidecars` | Add additional sidecar containers to the backend pods | `[]` |
| `backend.initContainers` | Add additional init containers to the backend pods | `[]` |
| `backend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
| `backend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
| `backend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty. | `""` |
| `backend.autoscaling.vpa.enabled` | Enable VPA for backend pods | `false` |
| `backend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
| `backend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
| `backend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
| `backend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
| `backend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
| `backend.autoscaling.hpa.enabled` | Enable HPA for backend pods | `false` |
| `backend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
| `backend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `backend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `backend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the backend service account | `true` |
| `backend.serviceAccount.imagePullSecrets` | Add image pull secrets to the backend service account | `[]` |
| `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `backend.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `backend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `backend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `backend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| `backend.cleanupSchedule` | The interval in seconds at which the cleanup job runs | `300` |
| `backend.openSearch.url` | The URL at which OpenSearch is available | `http://{{ .Release.Name }}-opensearch:9200` |
| `backend.openSearch.username` | The username that is used for authenticating with OpenSearch | `admin` |
| `backend.openSearch.certificateFile` | The path to a custom OpenSearch certificate file | `""` |
| `backend.openSearch.skipSSLVerify` | Skip SSL verification | `false` |
| `backend.openSearch.indexPrefix` | A prefix for OpenSearch indices | `""` |
| `backend.apps.downloadLocation` | The location to a git repository from which default appps are downloaded on startup. | `https://github.com/shuffle/python-apps` |
| `backend.apps.downloadBranch` | The branch from which apps should be downloaded on startup. | `master` |
| `backend.apps.forceUpdate` | Force an update of apps on startup. | `false` |
### frontend Parameters
| Name | Description | Value |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
| `frontend.image.registry` | frontend image registry | `ghcr.io` |
| `frontend.image.repository` | frontend image repository | `shuffle/shuffle-frontend` |
| `frontend.image.digest` | frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `frontend.image.pullPolicy` | frontend image pull policy | `IfNotPresent` |
| `frontend.image.pullSecrets` | frontend image pull secrets | `[]` |
| `frontend.replicaCount` | Number of frontend replicas to deploy | `1` |
| `frontend.containerPorts.http` | frontend HTTP container port | `80` |
| `frontend.containerPorts.https` | frontend HTTPS container port | `443` |
| `frontend.extraContainerPorts` | Optionally specify extra list of additional ports for frontend containers | `[]` |
| `frontend.livenessProbe.enabled` | Enable livenessProbe on frontend containers | `false` |
| `frontend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
| `frontend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
| `frontend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
| `frontend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
| `frontend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `frontend.readinessProbe.enabled` | Enable readinessProbe on frontend containers | `false` |
| `frontend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
| `frontend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `frontend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `frontend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `frontend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `frontend.startupProbe.enabled` | Enable startupProbe on frontend containers | `false` |
| `frontend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
| `frontend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
| `frontend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
| `frontend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
| `frontend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `frontend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
| `frontend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
| `frontend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
| `frontend.resourcesPreset` | Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). | `nano` |
| `frontend.resources` | Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `false` |
| `frontend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for frontend pods | `Always` |
| `frontend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for frontend pods | `[]` |
| `frontend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for frontend pods | `[]` |
| `frontend.podSecurityContext.fsGroup` | Set fsGroup in frontend pods' Security Context | `1001` |
| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `false` |
| `frontend.containerSecurityContext.seLinuxOptions` | Set SELinux options in frontend container | `{}` |
| `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `101` |
| `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `101` |
| `frontend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in frontend container' Security Context | `true` |
| `frontend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in frontend container' Security Context | `true` |
| `frontend.containerSecurityContext.privileged` | Set privileged in frontend container' Security Context | `false` |
| `frontend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in frontend container' Security Context | `false` |
| `frontend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in frontend container | `["ALL"]` |
| `frontend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in frontend container | `RuntimeDefault` |
| `frontend.command` | Override default frontend container command (useful when using custom images) | `[]` |
| `frontend.args` | Override default frontend container args (useful when using custom images) | `[]` |
| `frontend.automountServiceAccountToken` | Mount Service Account token in frontend pods | `false` |
| `frontend.hostAliases` | frontend pods host aliases | `[]` |
| `frontend.daemonsetAnnotations` | Annotations for frontend daemonset | `{}` |
| `frontend.deploymentAnnotations` | Annotations for frontend deployment | `{}` |
| `frontend.statefulsetAnnotations` | Annotations for frontend statefulset | `{}` |
| `frontend.podLabels` | Extra labels for frontend pods | `{}` |
| `frontend.podAnnotations` | Annotations for frontend pods | `{}` |
| `frontend.podAffinityPreset` | Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `frontend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `frontend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `frontend.nodeAffinityPreset.key` | Node label key to match. Ignored if `frontend.affinity` is set | `""` |
| `frontend.nodeAffinityPreset.values` | Node label values to match. Ignored if `frontend.affinity` is set | `[]` |
| `frontend.affinity` | Affinity for frontend pods assignment | `{}` |
| `frontend.nodeSelector` | Node labels for frontend pods assignment | `{}` |
| `frontend.tolerations` | Tolerations for frontend pods assignment | `[]` |
| `frontend.updateStrategy.type` | frontend deployment strategy type | `RollingUpdate` |
| `frontend.updateStrategy.type` | frontend statefulset strategy type | `RollingUpdate` |
| `frontend.podManagementPolicy` | Pod management policy for frontend statefulset | `OrderedReady` |
| `frontend.priorityClassName` | frontend pods' priorityClassName | `""` |
| `frontend.topologySpreadConstraints` | Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains | `[]` |
| `frontend.schedulerName` | Name of the k8s scheduler (other than default) for frontend pods | `""` |
| `frontend.terminationGracePeriodSeconds` | Seconds frontend pods need to terminate gracefully | `""` |
| `frontend.lifecycleHooks` | for frontend containers to automate configuration before or after startup | `{}` |
| `frontend.extraEnvVars` | Array with extra environment variables to add to frontend containers | `[]` |
| `frontend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for frontend containers | `""` |
| `frontend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for frontend containers | `""` |
| `frontend.extraVolumes` | Optionally specify extra list of additional volumes for the frontend pods | `[]` |
| `frontend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the frontend containers | `[]` |
| `frontend.sidecars` | Add additional sidecar containers to the frontend pods | `[]` |
| `frontend.initContainers` | Add additional init containers to the frontend pods | `[]` |
| `frontend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
| `frontend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
| `frontend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty. | `""` |
| `frontend.autoscaling.vpa.enabled` | Enable VPA for frontend pods | `false` |
| `frontend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
| `frontend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
| `frontend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
| `frontend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
| `frontend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
| `frontend.autoscaling.hpa.enabled` | Enable HPA for frontend pods | `false` |
| `frontend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
| `frontend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `frontend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `frontend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the frontend service account | `true` |
| `frontend.serviceAccount.imagePullSecrets` | Add image pull secrets to the frontend service account | `[]` |
| `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `frontend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `frontend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `frontend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### orborus Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
| `orborus.image.registry` | orborus image registry | `ghcr.io` |
| `orborus.image.repository` | orborus image repository | `shuffle/shuffle-orborus` |
| `orborus.image.digest` | orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `orborus.image.pullPolicy` | orborus image pull policy | `IfNotPresent` |
| `orborus.image.pullSecrets` | orborus image pull secrets | `[]` |
| `orborus.replicaCount` | Number of orborus replicas to deploy | `1` |
| `orborus.containerPorts.http` | orborus HTTP container port | `8080` |
| `orborus.extraContainerPorts` | Optionally specify extra list of additional ports for orborus containers | `[]` |
| `orborus.livenessProbe.enabled` | Enable livenessProbe on orborus containers | `false` |
| `orborus.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
| `orborus.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
| `orborus.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
| `orborus.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
| `orborus.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `orborus.readinessProbe.enabled` | Enable readinessProbe on orborus containers | `false` |
| `orborus.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
| `orborus.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `orborus.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `orborus.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `orborus.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `orborus.startupProbe.enabled` | Enable startupProbe on orborus containers | `false` |
| `orborus.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
| `orborus.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
| `orborus.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
| `orborus.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
| `orborus.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `orborus.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
| `orborus.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
| `orborus.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
| `orborus.resourcesPreset` | Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production). | `nano` |
| `orborus.resources` | Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `orborus.podSecurityContext.enabled` | Enable orborus pods' Security Context | `true` |
| `orborus.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for orborus pods | `Always` |
| `orborus.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for orborus pods | `[]` |
| `orborus.podSecurityContext.supplementalGroups` | Set filesystem extra groups for orborus pods | `[]` |
| `orborus.podSecurityContext.fsGroup` | Set fsGroup in orborus pods' Security Context | `1001` |
| `orborus.containerSecurityContext.enabled` | Enabled orborus container' Security Context | `true` |
| `orborus.containerSecurityContext.seLinuxOptions` | Set SELinux options in orborus container | `{}` |
| `orborus.containerSecurityContext.runAsUser` | Set runAsUser in orborus container' Security Context | `101` |
| `orborus.containerSecurityContext.runAsGroup` | Set runAsGroup in orborus container' Security Context | `101` |
| `orborus.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in orborus container' Security Context | `true` |
| `orborus.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in orborus container' Security Context | `true` |
| `orborus.containerSecurityContext.privileged` | Set privileged in orborus container' Security Context | `false` |
| `orborus.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in orborus container' Security Context | `false` |
| `orborus.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in orborus container | `["ALL"]` |
| `orborus.containerSecurityContext.seccompProfile.type` | Set seccomp profile in orborus container | `RuntimeDefault` |
| `orborus.command` | Override default orborus container command (useful when using custom images) | `[]` |
| `orborus.args` | Override default orborus container args (useful when using custom images) | `[]` |
| `orborus.automountServiceAccountToken` | Mount Service Account token in orborus pods | `true` |
| `orborus.hostAliases` | orborus pods host aliases | `[]` |
| `orborus.daemonsetAnnotations` | Annotations for orborus daemonset | `{}` |
| `orborus.deploymentAnnotations` | Annotations for orborus deployment | `{}` |
| `orborus.statefulsetAnnotations` | Annotations for orborus statefulset | `{}` |
| `orborus.podLabels` | Extra labels for orborus pods | `{}` |
| `orborus.podAnnotations` | Annotations for orborus pods | `{}` |
| `orborus.podAffinityPreset` | Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `orborus.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `orborus.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `orborus.nodeAffinityPreset.key` | Node label key to match. Ignored if `orborus.affinity` is set | `""` |
| `orborus.nodeAffinityPreset.values` | Node label values to match. Ignored if `orborus.affinity` is set | `[]` |
| `orborus.affinity` | Affinity for orborus pods assignment | `{}` |
| `orborus.nodeSelector` | Node labels for orborus pods assignment | `{}` |
| `orborus.tolerations` | Tolerations for orborus pods assignment | `[]` |
| `orborus.updateStrategy.type` | orborus deployment strategy type | `RollingUpdate` |
| `orborus.updateStrategy.type` | orborus statefulset strategy type | `RollingUpdate` |
| `orborus.podManagementPolicy` | Pod management policy for orborus statefulset | `OrderedReady` |
| `orborus.priorityClassName` | orborus pods' priorityClassName | `""` |
| `orborus.topologySpreadConstraints` | Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains | `[]` |
| `orborus.schedulerName` | Name of the k8s scheduler (other than default) for orborus pods | `""` |
| `orborus.terminationGracePeriodSeconds` | Seconds orborus pods need to terminate gracefully | `""` |
| `orborus.lifecycleHooks` | for orborus containers to automate configuration before or after startup | `{}` |
| `orborus.extraEnvVars` | Array with extra environment variables to add to orborus containers | `[]` |
| `orborus.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for orborus containers | `""` |
| `orborus.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for orborus containers | `""` |
| `orborus.extraVolumes` | Optionally specify extra list of additional volumes for the orborus pods | `[]` |
| `orborus.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the orborus containers | `[]` |
| `orborus.sidecars` | Add additional sidecar containers to the orborus pods | `[]` |
| `orborus.initContainers` | Add additional init containers to the orborus pods | `[]` |
| `orborus.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
| `orborus.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
| `orborus.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty. | `""` |
| `orborus.autoscaling.vpa.enabled` | Enable VPA for orborus pods | `false` |
| `orborus.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
| `orborus.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
| `orborus.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
| `orborus.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
| `orborus.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
| `orborus.autoscaling.hpa.enabled` | Enable HPA for orborus pods | `false` |
| `orborus.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
| `orborus.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `orborus.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `orborus.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `orborus.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the orborus service account | `true` |
| `orborus.serviceAccount.imagePullSecrets` | Add image pull secrets to the orborus service account | `[]` |
| `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `orborus.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `orborus.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `orborus.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `orborus.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### worker Parameters
| Name | Description | Value |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### app Parameters
| Name | Description | Value |
| ------------------------------------------------- | ---------------------------------------------------------------------------------- | ------ |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### Traffic Exposure Parameters
| Name | Description | Value |
| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- |
| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` |
| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` |
| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` |
| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
| `ingress.hostname` | Default host for the ingress record | `shuffle.local` |
| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` |
| `ingress.path` | Ingress path for Shuffle frontend | `"/"` |
| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` |
| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` |
| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` |
| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
| `ingress.secrets` | Custom TLS certificates as secrets | `[]` |
| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
### Istio Parameters
| Name | Description | Value |
| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ |
| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` |
| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` |
| `istio.hosts` | One or more hosts exposed by Istio | `[]` |
| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` |
| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` |
| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` |
| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` |
| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` |
| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` |
| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` |
| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` |
| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` |
| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` |
| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` |
### Persistence Parameters
| Name | Description | Value |
| ------------------------------------- | ------------------------------------------------- | ------------------- |
| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` |
| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` |
| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` |
| `persistence.apps.subPath` | The sub path used in the volume | `""` |
| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.apps.size` | The size of the volume | `5Gi` |
| `persistence.apps.annotations` | Annotations for the PVC | `{}` |
| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` |
| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` |
| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.appBuilder.size` | The size of the volume | `5Gi` |
| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` |
| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` |
| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` |
| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` |
| `persistence.files.subPath` | The sub path used in the volume | `""` |
| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
| `persistence.files.size` | The size of the volume | `5Gi` |
| `persistence.files.annotations` | Annotations for the PVC | `{}` |
| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` |
### Init Container Parameters
| Name | Description | Value |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnami/os-shell` |
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
### OpenSearch Parameters
| Name | Description | Value |
| -------------------- | ----------------------------------------------------- | ------ |
| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` |
### Vault Parameters
| Name | Description | Value |
| --------------- | -------------------------------------------------------------------------- | ----- |
| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` |
| `vault.secrets` | A list of VaultSecrets to create | `[]` |
### Other Parameters
charts/shuffle/templates/NOTES.txt
+27
View File
@@ -0,0 +1,27 @@
CHART NAME: {{ .Chart.Name }}
CHART VERSION: {{ .Chart.Version }}
APP VERSION: {{ .Chart.AppVersion }}
** Please be patient while the chart is being deployed **
{{- if .Values.diagnosticMode.enabled }}
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
Get the list of pods by executing:
kubectl get pods --namespace {{ include "common.names.namespace" . | quote }} -l app.kubernetes.io/instance={{ .Release.Name }}
Access the pod you want to debug by executing
kubectl exec --namespace {{ include "common.names.namespace" . | quote }} -ti <NAME OF THE POD> -- bash
{{- end }}
To access shuffle using port-forwarding:
1. Run `kubectl port-forward -n shuffle svc/shuffle-frontend 8080:http`
2. Visit http://localhost:8080 with your browser
charts/shuffle/templates/_helpers.tpl
+377
View File
@@ -0,0 +1,377 @@
{{/*
Return the common name for backend componentes
*/}}
{{- define "shuffle.backend.name" -}}
{{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for frontend components
*/}}
{{- define "shuffle.frontend.name" -}}
{{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for orborus components
*/}}
{{- define "shuffle.orborus.name" -}}
{{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for worker components
*/}}
{{- define "shuffle.worker.name" -}}
{{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common name for app components
*/}}
{{- define "shuffle.app.name" -}}
{{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}}
{{- end -}}
{{/*
Return the common labels for backend components
The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod.
*/}}
{{- define "shuffle.backend.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: backend
io.kompose.service: backend
{{- end -}}
{{/*
Return the common labels for frontend components
*/}}
{{- define "shuffle.frontend.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: frontend
{{- end -}}
{{/*
Return the common labels for orborus components
*/}}
{{- define "shuffle.orborus.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: orborus
{{- end -}}
{{/*
Return the common labels for worker components
*/}}
{{- define "shuffle.worker.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: worker
{{- end -}}
{{/*
Return the common labels for app components
*/}}
{{- define "shuffle.app.labels" -}}
{{- include "common.labels.standard" . }}
app.kubernetes.io/component: app
{{- end -}}
{{/*
Return the match labels for backend components
*/}}
{{- define "shuffle.backend.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: backend
{{- end -}}
{{/*
Return the match labels for frontend components
*/}}
{{- define "shuffle.frontend.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: frontend
{{- end -}}
{{/*
Return the match labels for orborus components
*/}}
{{- define "shuffle.orborus.matchLabels" -}}
{{- include "common.labels.matchLabels" . }}
app.kubernetes.io/component: orborus
{{- end -}}
{{/*
Return the match labels for worker components
NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app.
*/}}
{{- define "shuffle.worker.matchLabels" -}}
app.kubernetes.io/name: shuffle-worker
{{- end -}}
{{/*
Return the match labels for app components
NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app.
*/}}
{{- define "shuffle.app.matchLabels" -}}
app.kubernetes.io/name: shuffle-app
{{- end -}}
{{/*
Return the proper image name (for the init container volume-permissions image)
*/}}
{{- define "shuffle.volumePermissions.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Shuffle backend image name
*/}}
{{- define "shuffle.backend.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend pod
*/}}
{{- define "shuffle.backend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle frontend image name
*/}}
{{- define "shuffle.frontend.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend pod
*/}}
{{- define "shuffle.frontend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle orborus image name
*/}}
{{- define "shuffle.orborus.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus pod
*/}}
{{- define "shuffle.orborus.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle worker image name
*/}}
{{- define "shuffle.worker.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle backend
*/}}
{{- define "shuffle.backend.serviceAccount.name" -}}
{{- if .Values.backend.serviceAccount.create -}}
{{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.backend.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend service account
*/}}
{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.backend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle frontend
*/}}
{{- define "shuffle.frontend.serviceAccount.name" -}}
{{- if .Values.frontend.serviceAccount.create -}}
{{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.frontend.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend service account
*/}}
{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.frontend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle orborus
*/}}
{{- define "shuffle.orborus.serviceAccount.name" -}}
{{- if .Values.orborus.serviceAccount.create -}}
{{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.orborus.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus service account
*/}}
{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.orborus.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle workers
*/}}
{{- define "shuffle.worker.serviceAccount.name" -}}
{{- if .Values.worker.serviceAccount.create -}}
{{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.worker.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the worker service account
*/}}
{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.worker.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle apps
*/}}
{{- define "shuffle.app.serviceAccount.name" -}}
{{- if .Values.app.serviceAccount.create -}}
{{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
{{ default "default" .Values.app.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the app service account
*/}}
{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.app.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml
+28
View File
@@ -0,0 +1,28 @@
# This PVC is always enabled, regardless of .Values.persistence.enabled,
# as app building does not work without it.
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: backend-apps-claim # Hardcoded by shuffle-app-builder
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
annotations:
{{- if eq .Values.persistence.resourcePolicy "keep" }}
helm.sh/resource-policy: keep
{{- end }}
{{- if or .Values.persistence.appBuilder.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.appBuilder.annotations .Values.commonAnnotations ) "context" . ) }}
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
accessModes:
{{- range .Values.persistence.appBuilder.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.appBuilder.size }}
{{- if .Values.persistence.appBuilder.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.appBuilder.selector "context" $) | nindent 2 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.appBuilder "global" .Values.global ) | nindent 2 }}
charts/shuffle/templates/backend/backend-apps-pvc.yaml
+30
View File
@@ -0,0 +1,30 @@
{{- if .Values.persistence.enabled }}
{{- if (not .Values.persistence.apps.existingClaim) }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: {{ printf "%s-apps" (include "shuffle.backend.name" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
annotations:
{{- if eq .Values.persistence.resourcePolicy "keep" }}
helm.sh/resource-policy: keep
{{- end }}
{{- if or .Values.persistence.apps.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.apps.annotations .Values.commonAnnotations ) "context" . ) }}
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
accessModes:
{{- range .Values.persistence.apps.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.apps.size }}
{{- if .Values.persistence.apps.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.apps.selector "context" $) | nindent 2 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.apps "global" .Values.global ) | nindent 2 }}
{{- end }}
{{- end }}
charts/shuffle/templates/backend/backend-cm-env.yaml
+30
View File
@@ -0,0 +1,30 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "shuffle.backend.name" . }}-env
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
BACKEND_PORT: "5001"
{{- if .Values.shuffle.baseUrl }}
BASE_URL: "{{ .Values.shuffle.baseUrl }}"
SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
{{- else }}
BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001"
{{- end }}
ORG_ID: "{{ .Values.shuffle.org }}"
SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
SHUFFLE_CHAT_DISABLED: "true"
SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"
SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}"
SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}"
SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}"
TZ: "{{ .Values.shuffle.timezone }}"
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
charts/shuffle/templates/backend/backend-dpl.yaml
+224
View File
@@ -0,0 +1,224 @@
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ template "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.backend.deploymentAnnotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.deploymentAnnotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if not .Values.backend.autoscaling.hpa.enabled }}
replicas: {{ .Values.backend.replicaCount }}
{{- end }}
{{- if .Values.backend.updateStrategy }}
strategy: {{- toYaml .Values.backend.updateStrategy | nindent 4 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
selector:
matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
template:
metadata:
{{- if .Values.backend.podAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.podAnnotations "context" $) | nindent 8 }}
{{- end }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.backend.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.backend.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }}
{{- if .Values.backend.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.backend.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAntiAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.backend.nodeAffinityPreset.type "key" .Values.backend.nodeAffinityPreset.key "values" .Values.backend.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.backend.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.backend.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.tolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.backend.priorityClassName }}
priorityClassName: {{ .Values.backend.priorityClassName | quote }}
{{- end }}
{{- if .Values.backend.schedulerName }}
schedulerName: {{ .Values.backend.schedulerName | quote }}
{{- end }}
{{- if .Values.backend.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.backend.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.backend.podSecurityContext.enabled }}
securityContext: {{- omit .Values.backend.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.backend.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ .Values.backend.terminationGracePeriodSeconds }}
{{- end }}
initContainers:
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
- name: volume-permissions
image: {{ include "shuffle.volumePermissions.image" . }}
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
command:
- /bin/bash
- -ec
- |
chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /app/generated && \
chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-apps && \
chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-files
{{- if .Values.volumePermissions.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.volumePermissions.resources }}
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
{{- end }}
volumeMounts:
- name: shuffle-app-builder
mountPath: /app/generated
- name: shuffle-apps
mountPath: /shuffle-apps
{{- if .Values.persistence.apps.subPath }}
subPath: {{ .Values.persistence.apps.subPath }}
{{- end }}
- name: shuffle-files
mountPath: /shuffle-files
{{- if .Values.persistence.files.subPath }}
subPath: {{ .Values.persistence.apps.subPath }}
{{- end }}
{{- end }}
{{- if .Values.backend.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.backend.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: backend
image: {{ template "shuffle.backend.image" . }}
imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
{{- if .Values.backend.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backend.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.backend.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.backend.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.backend.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.backend.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: RUNNING_MODE
value: kubernetes
- name: IS_KUBERNETES
value: "true"
- name: SHUFFLE_APP_HOTLOAD_FOLDER
value: /shuffle-apps
- name: SHUFFLE_FILE_LOCATION
value: /shuffle-files
{{- if .Values.backend.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "shuffle.backend.name" . }}-env
{{- if .Values.backend.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.backend.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- if .Values.backend.resources }}
resources: {{- toYaml .Values.backend.resources | nindent 12 }}
{{- else if ne .Values.backend.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.backend.resourcesPreset) | nindent 12 }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.backend.containerPorts.http }}
{{- if .Values.backend.extraContainerPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraContainerPorts "context" $) | nindent 12 }}
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.backend.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.backend.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/health
port: {{ .Values.backend.containerPorts.http }}
{{- end }}
{{- if .Values.backend.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.backend.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/health
port: {{ .Values.backend.containerPorts.http }}
{{- end }}
{{- if .Values.backend.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.backend.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.startupProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /api/v1/health
port: {{ .Values.backend.containerPorts.http }}
{{- end }}
{{- end }}
{{- if .Values.backend.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.backend.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: shuffle-app-builder
mountPath: /app/generated
- name: shuffle-apps
mountPath: /shuffle-apps
{{- if .Values.persistence.apps.subPath }}
subPath: {{ .Values.persistence.apps.subPath }}
{{- end }}
- name: shuffle-files
mountPath: /shuffle-files
{{- if .Values.persistence.files.subPath }}
subPath: {{ .Values.persistence.apps.subPath }}
{{- end }}
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.backend.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.backend.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: shuffle-app-builder
persistentVolumeClaim:
claimName: backend-apps-claim
- name: shuffle-apps
{{- if .Values.persistence.enabled }}
persistentVolumeClaim:
claimName: {{ default (printf "%s-apps" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }}
{{- else }}
emptyDir: {}
{{- end }}
- name: shuffle-files
{{- if .Values.persistence.enabled }}
persistentVolumeClaim:
claimName: {{ default (printf "%s-files" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }}
{{- else }}
emptyDir: {}
{{- end }}
{{- if .Values.backend.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumes "context" $) | nindent 8 }}
{{- end }}
charts/shuffle/templates/backend/backend-files-pvc.yaml
+30
View File
@@ -0,0 +1,30 @@
{{- if .Values.persistence.enabled }}
{{- if (not .Values.persistence.files.existingClaim) }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: {{ printf "%s-files" (include "shuffle.backend.name" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
annotations:
{{- if eq .Values.persistence.resourcePolicy "keep" }}
helm.sh/resource-policy: keep
{{- end }}
{{- if or .Values.persistence.files.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.files.annotations .Values.commonAnnotations ) "context" . ) }}
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
accessModes:
{{- range .Values.persistence.files.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.files.size }}
{{- if .Values.persistence.files.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.files.selector "context" $) | nindent 2 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.files "global" .Values.global ) | nindent 2 }}
{{- end }}
{{- end }}
charts/shuffle/templates/backend/backend-hpa.yaml
+43
View File
@@ -0,0 +1,43 @@
{{- if .Values.backend.autoscaling.hpa.enabled }}
apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
scaleTargetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "shuffle.backend.name" . }}
minReplicas: {{ .Values.backend.autoscaling.hpa.minReplicas }}
maxReplicas: {{ .Values.backend.autoscaling.hpa.maxReplicas }}
metrics:
{{- if .Values.backend.autoscaling.hpa.targetMemory }}
- type: Resource
resource:
name: memory
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetMemory }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
{{- end }}
{{- end }}
{{- if .Values.backend.autoscaling.hpa.targetCPU }}
- type: Resource
resource:
name: cpu
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetCPU }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/templates/backend/backend-network-policy.yaml
+66
View File
@@ -0,0 +1,66 @@
{{- if .Values.backend.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
policyTypes:
- Ingress
- Egress
egress:
{{- if .Values.backend.networkPolicy.allowExternalEgress }}
- {}
{{- else }}
# Allow DNS resolution with an in-cluster DNS server
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
{{- if .Values.backend.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.backend.containerPorts.http }}
protocol: TCP
{{- if not .Values.backend.networkPolicy.allowExternal }}
from:
# Allow traffic from orborus
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }}
# Allow traffic from workers
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
# Allow traffic from apps
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }}
{{- end }}
{{- if .Values.backend.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
charts/shuffle/templates/backend/backend-pdb.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if .Values.backend.pdb.create }}
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
kind: PodDisruptionBudget
metadata:
name: {{ include "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.backend.pdb.minAvailable }}
minAvailable: {{ .Values.backend.pdb.minAvailable }}
{{- end }}
{{- if or .Values.backend.pdb.maxUnavailable ( not .Values.backend.pdb.minAvailable ) }}
maxUnavailable: {{ .Values.backend.pdb.maxUnavailable | default 1 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- end }}
charts/shuffle/templates/backend/backend-role-binding.yaml
+18
View File
@@ -0,0 +1,18 @@
{{ if .Values.backend.rbac.create }}
kind: RoleBinding
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ include "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.backend.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ include "shuffle.backend.name" . }}
{{- end }}
charts/shuffle/templates/backend/backend-role.yaml
+18
View File
@@ -0,0 +1,18 @@
{{ if .Values.backend.rbac.create }}
kind: Role
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ include "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["list"]
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "create", "delete"]
{{- end }}
charts/shuffle/templates/backend/backend-service-account.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if .Values.backend.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.backend.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.backend.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/backend/backend-svc.yaml
+18
View File
@@ -0,0 +1,18 @@
apiVersion: v1
kind: Service
metadata:
name: {{ template "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
spec:
type: ClusterIP
ports:
- name: http
port: {{ .Values.backend.containerPorts.http }}
targetPort: http
protocol: TCP
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
charts/shuffle/templates/backend/backend-vpa.yaml
+38
View File
@@ -0,0 +1,38 @@
{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.backend.autoscaling.vpa.enabled }}
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: {{ include "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
resourcePolicy:
containerPolicies:
- containerName: backend
{{- with .Values.backend.autoscaling.vpa.controlledResources }}
controlledResources:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.backend.autoscaling.vpa.maxAllowed }}
maxAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.backend.autoscaling.vpa.minAllowed }}
minAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
targetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "backend.names.name" . }}
{{- if .Values.backend.autoscaling.vpa.updatePolicy }}
updatePolicy:
{{- with .Values.backend.autoscaling.vpa.updatePolicy.updateMode }}
updateMode: {{ . }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/templates/extra-list.yaml
+4
View File
@@ -0,0 +1,4 @@
{{- range .Values.extraDeploy }}
---
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
{{- end }}
charts/shuffle/templates/frontend/frontend-cm-env.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "shuffle.frontend.name" . }}-env
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
charts/shuffle/templates/frontend/frontend-dpl.yaml
+158
View File
@@ -0,0 +1,158 @@
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ template "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.frontend.deploymentAnnotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.deploymentAnnotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if not .Values.frontend.autoscaling.hpa.enabled }}
replicas: {{ .Values.frontend.replicaCount }}
{{- end }}
{{- if .Values.frontend.updateStrategy }}
strategy: {{- toYaml .Values.frontend.updateStrategy | nindent 4 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
selector:
matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
template:
metadata:
{{- if .Values.frontend.podAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.podAnnotations "context" $) | nindent 8 }}
{{- end }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.frontend.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.frontend.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }}
{{- if .Values.frontend.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.frontend.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAntiAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.frontend.nodeAffinityPreset.type "key" .Values.frontend.nodeAffinityPreset.key "values" .Values.frontend.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.frontend.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.frontend.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.tolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.frontend.priorityClassName }}
priorityClassName: {{ .Values.frontend.priorityClassName | quote }}
{{- end }}
{{- if .Values.frontend.schedulerName }}
schedulerName: {{ .Values.frontend.schedulerName | quote }}
{{- end }}
{{- if .Values.frontend.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.frontend.podSecurityContext.enabled }}
securityContext: {{- omit .Values.frontend.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.frontend.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ .Values.frontend.terminationGracePeriodSeconds }}
{{- end }}
initContainers:
{{- if .Values.frontend.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: frontend
image: {{ template "shuffle.frontend.image" . }}
imagePullPolicy: {{ .Values.frontend.image.pullPolicy }}
{{- if .Values.frontend.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.frontend.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.frontend.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.frontend.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.args "context" $) | nindent 12 }}
{{- end }}
env:
{{- if .Values.frontend.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "shuffle.frontend.name" . }}-env
{{- if .Values.frontend.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.frontend.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- if .Values.frontend.resources }}
resources: {{- toYaml .Values.frontend.resources | nindent 12 }}
{{- else if ne .Values.frontend.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.frontend.resourcesPreset) | nindent 12 }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.frontend.containerPorts.http }}
{{- if .Values.frontend.containerPorts.https }}
- name: https
containerPort: {{ .Values.frontend.containerPorts.https }}
{{- end }}
{{- if .Values.frontend.extraContainerPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraContainerPorts "context" $) | nindent 12 }}
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.frontend.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.frontend.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ .Values.frontend.containerPorts.http }}
{{- end }}
{{- if .Values.frontend.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.frontend.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ .Values.frontend.containerPorts.http }}
{{- end }}
{{- if .Values.frontend.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.frontend.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.startupProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ .Values.frontend.containerPorts.http }}
{{- end }}
{{- end }}
{{- if .Values.frontend.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.frontend.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.frontend.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.frontend.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumes "context" $) | nindent 8 }}
{{- end }}
charts/shuffle/templates/frontend/frontend-hpa.yaml
+43
View File
@@ -0,0 +1,43 @@
{{- if .Values.frontend.autoscaling.hpa.enabled }}
apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
scaleTargetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "shuffle.frontend.name" . }}
minReplicas: {{ .Values.frontend.autoscaling.hpa.minReplicas }}
maxReplicas: {{ .Values.frontend.autoscaling.hpa.maxReplicas }}
metrics:
{{- if .Values.frontend.autoscaling.hpa.targetMemory }}
- type: Resource
resource:
name: memory
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetMemory }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
{{- end }}
{{- end }}
{{- if .Values.frontend.autoscaling.hpa.targetCPU }}
- type: Resource
resource:
name: cpu
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetCPU }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/templates/frontend/frontend-network-policy.yaml
+47
View File
@@ -0,0 +1,47 @@
{{- if .Values.frontend.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
policyTypes:
- Ingress
- Egress
egress:
{{- if .Values.frontend.networkPolicy.allowExternalEgress }}
- {}
{{- else }}
# Allow DNS resolution with an in-cluster DNS server
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
{{- if .Values.frontend.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
{{ if .Values.frontend.networkPolicy.allowExternal }}
- ports:
- port: {{ .Values.frontend.containerPorts.http }}
{{- if .Values.frontend.containerPorts.https }}
- port: {{ .Values.frontend.containerPorts.https }}
{{- end }}
{{- end }}
{{- if .Values.frontend.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
charts/shuffle/templates/frontend/frontend-pdb.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if .Values.frontend.pdb.create }}
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
kind: PodDisruptionBudget
metadata:
name: {{ include "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.frontend.pdb.minAvailable }}
minAvailable: {{ .Values.frontend.pdb.minAvailable }}
{{- end }}
{{- if or .Values.frontend.pdb.maxUnavailable ( not .Values.frontend.pdb.minAvailable ) }}
maxUnavailable: {{ .Values.frontend.pdb.maxUnavailable | default 1 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- end }}
charts/shuffle/templates/frontend/frontend-service-account.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if .Values.frontend.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.frontend.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.frontend.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/frontend/frontend-svc.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: v1
kind: Service
metadata:
name: {{ template "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
spec:
type: ClusterIP
ports:
- name: http
port: {{ .Values.frontend.containerPorts.http }}
targetPort: http
protocol: TCP
{{- if .Values.frontend.containerPorts.https }}
- name: https
port: {{ .Values.frontend.containerPorts.https }}
targetPort: https
protocol: TCP
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
charts/shuffle/templates/frontend/frontend-vpa.yaml
+38
View File
@@ -0,0 +1,38 @@
{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.frontend.autoscaling.vpa.enabled }}
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: {{ include "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
resourcePolicy:
containerPolicies:
- containerName: frontend
{{- with .Values.frontend.autoscaling.vpa.controlledResources }}
controlledResources:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.frontend.autoscaling.vpa.maxAllowed }}
maxAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.frontend.autoscaling.vpa.minAllowed }}
minAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
targetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "frontend.names.name" . }}
{{- if .Values.frontend.autoscaling.vpa.updatePolicy }}
updatePolicy:
{{- with .Values.frontend.autoscaling.vpa.updatePolicy.updateMode }}
updateMode: {{ . }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/templates/ingress/ingress.yaml
+60
View File
@@ -0,0 +1,60 @@
{{- if .Values.ingress.enabled }}
apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.ingress.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
{{- end }}
rules:
{{- if .Values.ingress.hostname }}
- host: {{ .Values.ingress.hostname }}
http:
paths:
{{- if .Values.ingress.extraPaths }}
{{- toYaml .Values.ingress.extraPaths | nindent 10 }}
{{- end }}
- path: {{ .Values.ingress.path }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.frontend.name" .) "servicePort" "http" "context" $) | nindent 14 }}
- path: {{ .Values.ingress.backendPath }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.backendPathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.backend.name" .) "servicePort" "http" "context" $) | nindent 14 }}
{{- end }}
{{- range .Values.ingress.extraHosts }}
- host: {{ .name | quote }}
http:
paths:
- path: {{ default "/" .path }}
{{- if eq "true" (include "common.ingress.supportsPathType" $) }}
pathType: {{ default "ImplementationSpecific" .pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "http" "context" $) | nindent 14 }}
{{- end }}
{{- if .Values.ingress.extraRules }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
{{- end }}
{{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned)) .Values.ingress.extraTls }}
tls:
{{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned) }}
- hosts:
- {{ .Values.ingress.hostname | quote }}
secretName: {{ printf "%s-tls" .Values.ingress.hostname }}
{{- end }}
{{- if .Values.ingress.extraTls }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/templates/ingress/tls-secret.yaml
+39
View File
@@ -0,0 +1,39 @@
{{- if .Values.ingress.enabled }}
{{- if .Values.ingress.secrets }}
{{- range .Values.ingress.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .name }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
---
{{- end }}
{{- end }}
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
{{- $ca := genCA "shuffle-ca" 365 }}
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $secretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
{{- end }}
{{- end }}
charts/shuffle/templates/istio/gateway.yaml
+42
View File
@@ -0,0 +1,42 @@
{{- if .Values.istio.enabled }}
apiVersion: "{{ .Values.istio.apiVersion }}"
kind: Gateway
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.gateway.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
selector: {{- include "common.tplvalues.render" ( dict "value" .Values.istio.gateway.selector "context" $ ) | nindent 4 }}
servers:
{{- if .Values.istio.gateway.http.enabled }}
- name: "{{ include "common.names.fullname" . }}-http"
port:
number: 80
name: http
protocol: HTTP
hosts: {{ .Values.istio.hosts }}
tls:
httpsRedirect: {{ .Values.istio.gateway.http.httpsRedirect }}
{{- end }}
{{- if .Values.istio.gateway.https.enabled }}
- name: "{{ include "common.names.fullname" . }}-https"
port:
number: 443
name: https
protocol: HTTPS
hosts: {{ .Values.istio.hosts }}
tls:
credentialName: {{ .Values.istio.gateway.https.tlsCredentialName }}
mode: SIMPLE
{{- with .Values.istio.gateway.https.tlsCipherSuites }}
cipherSuites: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 10 }}
{{- end }}
{{- end }}
{{- if .Values.istio.gateway.extraServers }}
{{- include "common.tplvalues.render" (dict "value" .Values.istio.gateway.extraServers "context" $) | nindent 4 }}
{{- end }}
{{- end }}
charts/shuffle/templates/istio/virtual-service.yaml
+38
View File
@@ -0,0 +1,38 @@
{{- if .Values.istio.enabled }}
apiVersion: "{{ .Values.istio.apiVersion }}"
kind: VirtualService
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.virtualService.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
hosts: {{ .Values.istio.hosts }}
gateways:
- {{ include "common.names.fullname" . }}
http:
- name: backend
match:
- uri:
prefix: /api
route:
- destination:
host: {{ include "shuffle.backend.name" . }}
port:
number: {{ .Values.backend.containerPorts.http }}
{{- with .Values.istio.virtualService.backendHeaders }}
headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }}
{{- end }}
- name: frontend
route:
- destination:
host: {{ include "shuffle.frontend.name" . }}
port:
number: {{ .Values.frontend.containerPorts.http }}
{{- with .Values.istio.virtualService.frontendHeaders }}
headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }}
{{- end }}
{{- end }}
charts/shuffle/templates/orborus/orborus-cm-env.yaml
+19
View File
@@ -0,0 +1,19 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "shuffle.orborus.name" . }}-env
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
ORG_ID: "{{ .Values.shuffle.org }}"
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }}
SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
SHUFFLE_SWARM_CONFIG: run
charts/shuffle/templates/orborus/orborus-dpl.yaml
+162
View File
@@ -0,0 +1,162 @@
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ template "shuffle.orborus.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.orborus.deploymentAnnotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.deploymentAnnotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if not .Values.orborus.autoscaling.hpa.enabled }}
replicas: {{ .Values.orborus.replicaCount }}
{{- end }}
{{- if .Values.orborus.updateStrategy }}
strategy: {{- toYaml .Values.orborus.updateStrategy | nindent 4 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.podLabels .Values.commonLabels) "context" .) }}
selector:
matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
template:
metadata:
{{- if .Values.orborus.podAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.podAnnotations "context" $) | nindent 8 }}
{{- end }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.orborus.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.orborus.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }}
{{- if .Values.orborus.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.orborus.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAntiAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.orborus.nodeAffinityPreset.type "key" .Values.orborus.nodeAffinityPreset.key "values" .Values.orborus.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.orborus.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.orborus.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.tolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.orborus.priorityClassName }}
priorityClassName: {{ .Values.orborus.priorityClassName | quote }}
{{- end }}
{{- if .Values.orborus.schedulerName }}
schedulerName: {{ .Values.orborus.schedulerName | quote }}
{{- end }}
{{- if .Values.orborus.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.orborus.podSecurityContext.enabled }}
securityContext: {{- omit .Values.orborus.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
{{- if .Values.orborus.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ .Values.orborus.terminationGracePeriodSeconds }}
{{- end }}
initContainers:
{{- if .Values.orborus.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: orborus
image: {{ template "shuffle.orborus.image" . }}
imagePullPolicy: {{ .Values.orborus.image.pullPolicy }}
{{- if .Values.orborus.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.orborus.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.orborus.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.orborus.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: RUNNING_MODE
value: kubernetes
- name: IS_KUBERNETES
value: "true"
- name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.worker.serviceAccount.name" . }}
- name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.app.serviceAccount.name" . }}
{{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "shuffle.orborus.name" . }}-env
{{- if .Values.orborus.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.orborus.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- if .Values.orborus.resources }}
resources: {{- toYaml .Values.orborus.resources | nindent 12 }}
{{- else if ne .Values.orborus.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.orborus.resourcesPreset) | nindent 12 }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.orborus.containerPorts.http }}
{{- if .Values.orborus.extraContainerPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraContainerPorts "context" $) | nindent 12 }}
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.orborus.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.orborus.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ .Values.orborus.containerPorts.http }}
{{- end }}
{{- if .Values.orborus.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.orborus.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ .Values.orborus.containerPorts.http }}
{{- end }}
{{- if .Values.orborus.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.orborus.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.startupProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: {{ .Values.orborus.containerPorts.http }}
{{- end }}
{{- end }}
{{- if .Values.orborus.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.orborus.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.orborus.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.orborus.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.orborus.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumes "context" $) | nindent 8 }}
{{- end }}
charts/shuffle/templates/orborus/orborus-hpa.yaml
+43
View File
@@ -0,0 +1,43 @@
{{- if .Values.orborus.autoscaling.hpa.enabled }}
apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "shuffle.orborus.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
scaleTargetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "shuffle.orborus.name" . }}
minReplicas: {{ .Values.orborus.autoscaling.hpa.minReplicas }}
maxReplicas: {{ .Values.orborus.autoscaling.hpa.maxReplicas }}
metrics:
{{- if .Values.orborus.autoscaling.hpa.targetMemory }}
- type: Resource
resource:
name: memory
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetMemory }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
{{- end }}
{{- end }}
{{- if .Values.orborus.autoscaling.hpa.targetCPU }}
- type: Resource
resource:
name: cpu
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetCPU }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/templates/orborus/orborus-network-policy.yaml
+72
View File
@@ -0,0 +1,72 @@
{{- if .Values.orborus.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "shuffle.orborus.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
policyTypes:
- Ingress
- Egress
egress:
{{- if .Values.orborus.networkPolicy.allowExternalEgress }}
- {}
{{- else }}
# Allow DNS resolution with an in-cluster DNS server
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
# Allow access to backend
- ports:
- port: {{ .Values.backend.containerPorts.http }}
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }}
# Allow access to workers
- ports:
- port: 33333
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
{{- if .Values.orborus.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.orborus.containerPorts.http }}
protocol: TCP
{{- if not .Values.orborus.networkPolicy.allowExternal }}
from:
# Allow traffic from workers
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
{{- end }}
{{- if .Values.orborus.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
charts/shuffle/templates/orborus/orborus-pdb.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if .Values.orborus.pdb.create }}
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
kind: PodDisruptionBudget
metadata:
name: {{ include "shuffle.orborus.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.orborus.pdb.minAvailable }}
minAvailable: {{ .Values.orborus.pdb.minAvailable }}
{{- end }}
{{- if or .Values.orborus.pdb.maxUnavailable ( not .Values.orborus.pdb.minAvailable ) }}
maxUnavailable: {{ .Values.orborus.pdb.maxUnavailable | default 1 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- end }}
charts/shuffle/templates/orborus/orborus-role-binding.yaml
+18
View File
@@ -0,0 +1,18 @@
{{ if .Values.orborus.rbac.create }}
kind: RoleBinding
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ include "shuffle.orborus.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.orborus.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ include "shuffle.orborus.name" . }}
{{- end }}
charts/shuffle/templates/orborus/orborus-role.yaml
+29
View File
@@ -0,0 +1,29 @@
{{ if .Values.orborus.rbac.create }}
kind: Role
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ include "shuffle.orborus.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
rules:
- verbs:
- list
- create
- delete
apiGroups:
- ''
resources:
- pods
- services
- verbs:
- list
- create
- delete
apiGroups:
- apps
resources:
- deployments
{{- end }}
charts/shuffle/templates/orborus/orborus-service-account.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if .Values.orborus.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.orborus.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.orborus.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/orborus/orborus-vpa.yaml
+38
View File
@@ -0,0 +1,38 @@
{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.orborus.autoscaling.vpa.enabled }}
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: {{ include "shuffle.orborus.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
resourcePolicy:
containerPolicies:
- containerName: orborus
{{- with .Values.orborus.autoscaling.vpa.controlledResources }}
controlledResources:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.orborus.autoscaling.vpa.maxAllowed }}
maxAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.orborus.autoscaling.vpa.minAllowed }}
minAllowed:
{{- toYaml . | nindent 8 }}
{{- end }}
targetRef:
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
name: {{ include "orborus.names.name" . }}
{{- if .Values.orborus.autoscaling.vpa.updatePolicy }}
updatePolicy:
{{- with .Values.orborus.autoscaling.vpa.updatePolicy.updateMode }}
updateMode: {{ . }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
+61
View File
@@ -0,0 +1,61 @@
{{- if .Values.app.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "shuffle.app.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.app.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "shuffle.app.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
policyTypes:
- Ingress
- Egress
egress:
{{- if .Values.app.networkPolicy.allowExternalEgress }}
- {}
{{- else }}
# Allow DNS resolution with an in-cluster DNS server
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
# Allow access to workers
- ports:
- port: 33333
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
{{- if .Values.app.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
{{- if .Values.app.networkPolicy.allowExternal }}
- {}
{{- else }}
# Allow access from workers. Apps will typicaly use port 80/TCP, but this is not enforced.
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
{{- end }}
{{- if .Values.app.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml
+18
View File
@@ -0,0 +1,18 @@
{{ if .Values.app.rbac.create }}
kind: RoleBinding
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ template "shuffle.app.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.app.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "shuffle.app.name" . }}
{{- end }}
charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml
+15
View File
@@ -0,0 +1,15 @@
{{ if .Values.app.rbac.create }}
kind: Role
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ template "shuffle.app.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
rules:
- apiGroups: [""]
resources: [""]
verbs: [""]
{{- end }}
charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if .Values.app.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.app.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.app.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.app.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml
+69
View File
@@ -0,0 +1,69 @@
{{- if .Values.worker.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "shuffle.worker.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
policyTypes:
- Ingress
- Egress
egress:
{{- if .Values.worker.networkPolicy.allowExternalEgress }}
- {}
{{- else }}
# Allow DNS resolution with an in-cluster DNS server
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
# Allow access to orborus
- ports:
- port: {{ .Values.orborus.containerPorts.http }}
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }}
# Allow arbitrary connections to apps. Apps will typically use port 80/TCP, but this is not enforced.
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }}
{{- if .Values.worker.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: 33333
protocol: TCP
{{- if not .Values.worker.networkPolicy.allowExternal }}
from:
# Allow traffic from orborus
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }}
{{- end }}
{{- if .Values.worker.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml
+18
View File
@@ -0,0 +1,18 @@
{{ if .Values.worker.rbac.create }}
kind: RoleBinding
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ template "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.worker.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "shuffle.worker.name" . }}
{{- end }}
charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml
+21
View File
@@ -0,0 +1,21 @@
{{ if .Values.worker.rbac.create }}
kind: Role
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ template "shuffle.worker.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["list", "delete"]
- apiGroups: [""]
resources: ["services"]
verbs: ["create"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["list", "create"]
{{- end }}
charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if .Values.worker.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.worker.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.worker.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.worker.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/vault-secrets.yaml
+19
View File
@@ -0,0 +1,19 @@
{{ range $index, $element := .Values.vault.secrets }}
{{- $vaultRole := $element.vaultRole | default $.Values.vault.role }}
---
apiVersion: ricoberger.de/v1alpha1
kind: VaultSecret
metadata:
name: {{ include "common.names.fullname" $ }}-{{ $element.name }}
spec:
type: {{ $element.type }}
path: {{ $element.path }}
{{- if $vaultRole }}
vaultRole: {{ $vaultRole }}
{{- end }}
{{- range $k, $v := $element }}
{{- if (not (has $k (list "name" "type" "path" "vaultRole"))) }}
{{ $k }}: {{ $v }}
{{- end }}
{{- end }}
{{- end }}
charts/shuffle/values.schema.json
+2661
View File
File diff suppressed because it is too large Load Diff
charts/shuffle/values.yaml
+1834
View File
File diff suppressed because it is too large Load Diff