diff --git a/.github/workflows/.github/workflows/helm.yml b/.github/workflows/.github/workflows/helm.yml new file mode 100644 index 00000000..c3a6657a --- /dev/null +++ b/.github/workflows/.github/workflows/helm.yml @@ -0,0 +1,41 @@ + +name: helm + +on: + workflow_dispatch: + push: + branches: + - main + paths: + - "charts/**" + +permissions: + contents: read + packages: write + +jobs: + main: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install apt dependencies + run: | + curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null + sudo apt-get install apt-transport-https -y --no-install-recommends + echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list + sudo apt-get update + sudo apt-get install helm -y --no-install-recommends + + - name: Update helm dependencies + run: helm dependency update ./charts/shuffle + + - name: Package Helm chart + run: helm package ./charts/shuffle --destination ./charts + + - name: Login to OCI registry (ghcr.io) + run: helm registry login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} + + - name: Push helm chart + run: helm push ./charts/shuffle-*.tgz oci://ghcr.io/shuffle/shuffle/charts diff --git a/backend/go-app/go.mod b/backend/go-app/go.mod index 34c45a2a..14708724 100644 --- a/backend/go-app/go.mod +++ b/backend/go-app/go.mod @@ -18,7 +18,7 @@ require ( github.com/gorilla/mux v1.8.1 github.com/h2non/filetype v1.1.3 github.com/satori/go.uuid v1.2.0 - github.com/shuffle/shuffle-shared v0.7.95 + github.com/shuffle/shuffle-shared v0.8.0 golang.org/x/crypto v0.32.0 google.golang.org/api v0.176.1 google.golang.org/grpc v1.68.1 diff --git a/charts/shuffle/.gitignore b/charts/shuffle/.gitignore new file mode 100644 index 00000000..1fab0544 --- /dev/null +++ b/charts/shuffle/.gitignore @@ -0,0 +1,3 @@ +.DS_Store +*.tgz +charts/ diff --git a/charts/shuffle/.helmignore b/charts/shuffle/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/shuffle/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/shuffle/.yamllint b/charts/shuffle/.yamllint new file mode 100644 index 00000000..8b3ce4aa --- /dev/null +++ b/charts/shuffle/.yamllint @@ -0,0 +1,11 @@ +--- +extends: default + +rules: + line-length: disable + braces: disable + comments: + require-starting-space: true + ignore-shebangs: true + min-spaces-from-content: 1 + diff --git a/charts/shuffle/Chart.yaml b/charts/shuffle/Chart.yaml new file mode 100644 index 00000000..67d1de83 --- /dev/null +++ b/charts/shuffle/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v2 +name: shuffle +description: A Helm chart for deploying Shuffle on Kubernetes +type: application +version: 0.1.0 +appVersion: nightly +dependencies: + - name: common + version: ^2.23.0 + repository: oci://registry-1.docker.io/bitnamicharts + - name: opensearch + version: ^1.3.0 + repository: oci://registry-1.docker.io/bitnamicharts + condition: opensearch.enabled diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md new file mode 100644 index 00000000..495d2690 --- /dev/null +++ b/charts/shuffle/README.md @@ -0,0 +1,607 @@ +# Shuffle Helm chart + +## Chart Template + +The Bitnami Chart Template was used for creating this chart: + +https://github.com/bitnami/charts/tree/7e44e64626f5b1fc6d56889cdfdeadc1f62c7cf1/template/CHART_NAME + +Original license text: + +``` +Copyright Broadcom, Inc. All Rights Reserved. + +SPDX-License-Identifier: APACHE-2.0 +``` + +## Usage + +```sh +# Install shuffle via helm (the shuffle namespace is hardcoded into the shuffle source code) +helm install shuffle oci://ghcr.io/shuffle/shuffle/charts/shuffle --namespace shuffle --create-namespace +``` + +Make sure that no other application is deployed to the shuffle namespace, as shuffle deletes kubernetes resources in this namespace. + +Only a single deployment of shuffle is supported per namespace. + +## Uninstallation + +```sh +# Uninstall shuffle via helm +helm uninstall shuffle --namespace shuffle + +# Remove additional resources created by shuffle (such as workers and apps) +kubectl delete svc --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)" +kubectl delete deploy --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)" +``` + +## Secret Parameters + +The helm chart was designed to not contain any secret data and does not allow configuring secret data using helm values. +Instead, secret values must be passed to services using `extraEnvVarsSecret` or `extraEnvVars`. + +The secrets need to be manually created. It is possible to run this helm chart without specifying any secrets. +You will be prompted to create an admin user when visiting the shuffle dashboard for the first time. +Note that information will not be encrypted without specifying the `SHUFFLE_ENCRYPTION_MODIFIER` value. + +### Mounting env variables into a service + +After creating secrets which hold sensitive information, you can mount them as environment variables into a +service via the `extraEnvVarsSecret` or `extraEnvVars` values. + +```yaml +backend: + # Use a single secret, which holds environment variables. + # Remember that the secret keys must exactly match the environment variable names. + extraEnvVarsSecret: shuffle-backend-env + + # Or mount each value explicitly + extraEnvVars: + - name: SHUFFLE_DEFAULT_USERNAME + valueFrom: + secretKeyRef: + name: "shuffle-initial-user" + key: username + - name: SHUFFLE_DEFAULT_PASSWORD + valueFrom: + secretKeyRef: + name: "shuffle-initial-user" + key: password + - name: SHUFFLE_DEFAULT_APIKEY + valueFrom: + secretKeyRef: + name: "shuffle-initial-user" + key: apikey + - name: SHUFFLE_ENCRYPTION_MODIFIER + valueFrom: + secretKeyRef: + name: "shuffle-encryption" + key: modifier +``` + +### Backend + +A list of environment variables containing secret values for the backend. + +```yaml +# OpenSearch password +SHUFFLE_OPENSEARCH_PASSWORD: "" + +# Basic auth credentials for downloading apps from git +SHUFFLE_DOWNLOAD_AUTH_USERNAME: "" +SHUFFLE_DOWNLOAD_AUTH_PASSWORD: "" + +# Automatically create the initial admin user. Username and password have a min length of 3. +# If not set, you are prompted with an admin user creation dialog when visiting the shuffle frontend for the first time. +SHUFFLE_DEFAULT_USERNAME: admin +SHUFFLE_DEFAULT_PASSWORD: MySecretAdminPassword1234! +SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uuid v4 + +# Encryption modifier. This HAS to be set to encrypt any authentication being used in Shuffle. +# This is put together with other relevant values to ensure multiple parts are needed to decrypt. +# If this key is lost or changed, you will have to reauthenticate all apps. +# The encryption modifier is added to encrypted values to prevent rainbow table attacks. It can be any random string. +SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" +``` + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | +| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | +| `global.compatibility.omitEmptySeLinuxOptions` | If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object | `false` | + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.name | `""` | +| `fullnameOverride` | String to fully override common.names.fullname | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the chart release | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the chart release | `["infinity"]` | + +### Shared Shuffle Parameters + +| Name | Description | Value | +| --------------------- | ------------------------------------------------------------- | --------------- | +| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` | +| `shuffle.org` | Default shuffle organization | `Shuffle` | +| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `""` | +| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` | + +### backend Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | +| `backend.image.registry` | backend image registry | `ghcr.io` | +| `backend.image.repository` | backend image repository | `shuffle/shuffle-backend` | +| `backend.image.digest` | backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `backend.image.pullPolicy` | backend image pull policy | `IfNotPresent` | +| `backend.image.pullSecrets` | backend image pull secrets | `[]` | +| `backend.replicaCount` | Number of backend replicas to deploy | `1` | +| `backend.containerPorts.http` | backend HTTP container port | `5001` | +| `backend.extraContainerPorts` | Optionally specify extra list of additional ports for backend containers | `[]` | +| `backend.livenessProbe.enabled` | Enable livenessProbe on backend containers | `false` | +| `backend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `backend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `backend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `backend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `backend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `backend.readinessProbe.enabled` | Enable readinessProbe on backend containers | `false` | +| `backend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `backend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `backend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `backend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `backend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `backend.startupProbe.enabled` | Enable startupProbe on backend containers | `false` | +| `backend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `backend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `backend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `backend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `backend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `backend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `backend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `backend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `backend.resourcesPreset` | Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production). | `small` | +| `backend.resources` | Set backend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `backend.podSecurityContext.enabled` | Enable backend pods' Security Context | `true` | +| `backend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for backend pods | `Always` | +| `backend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for backend pods | `[]` | +| `backend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for backend pods | `[]` | +| `backend.podSecurityContext.fsGroup` | Set fsGroup in backend pods' Security Context | `1001` | +| `backend.containerSecurityContext.enabled` | Enabled backend container' Security Context | `true` | +| `backend.containerSecurityContext.seLinuxOptions` | Set SELinux options in backend container | `{}` | +| `backend.containerSecurityContext.runAsUser` | Set runAsUser in backend container' Security Context | `1000` | +| `backend.containerSecurityContext.runAsGroup` | Set runAsGroup in backend container' Security Context | `1000` | +| `backend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in backend container' Security Context | `true` | +| `backend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in backend container' Security Context | `true` | +| `backend.containerSecurityContext.privileged` | Set privileged in backend container' Security Context | `false` | +| `backend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in backend container' Security Context | `false` | +| `backend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in backend container | `["ALL"]` | +| `backend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in backend container | `RuntimeDefault` | +| `backend.command` | Override default backend container command (useful when using custom images) | `[]` | +| `backend.args` | Override default backend container args (useful when using custom images) | `[]` | +| `backend.automountServiceAccountToken` | Mount Service Account token in backend pods | `true` | +| `backend.hostAliases` | backend pods host aliases | `[]` | +| `backend.daemonsetAnnotations` | Annotations for backend daemonset | `{}` | +| `backend.deploymentAnnotations` | Annotations for backend deployment | `{}` | +| `backend.statefulsetAnnotations` | Annotations for backend statefulset | `{}` | +| `backend.podLabels` | Extra labels for backend pods | `{}` | +| `backend.podAnnotations` | Annotations for backend pods | `{}` | +| `backend.podAffinityPreset` | Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `backend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `backend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `backend.nodeAffinityPreset.key` | Node label key to match. Ignored if `backend.affinity` is set | `""` | +| `backend.nodeAffinityPreset.values` | Node label values to match. Ignored if `backend.affinity` is set | `[]` | +| `backend.affinity` | Affinity for backend pods assignment | `{}` | +| `backend.nodeSelector` | Node labels for backend pods assignment | `{}` | +| `backend.tolerations` | Tolerations for backend pods assignment | `[]` | +| `backend.updateStrategy.type` | backend deployment strategy type | `RollingUpdate` | +| `backend.updateStrategy.type` | backend statefulset strategy type | `RollingUpdate` | +| `backend.podManagementPolicy` | Pod management policy for backend statefulset | `OrderedReady` | +| `backend.priorityClassName` | backend pods' priorityClassName | `""` | +| `backend.topologySpreadConstraints` | Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | `[]` | +| `backend.schedulerName` | Name of the k8s scheduler (other than default) for backend pods | `""` | +| `backend.terminationGracePeriodSeconds` | Seconds backend pods need to terminate gracefully | `""` | +| `backend.lifecycleHooks` | for backend containers to automate configuration before or after startup | `{}` | +| `backend.extraEnvVars` | Array with extra environment variables to add to backend containers | `[]` | +| `backend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for backend containers | `""` | +| `backend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for backend containers | `""` | +| `backend.extraVolumes` | Optionally specify extra list of additional volumes for the backend pods | `[]` | +| `backend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the backend containers | `[]` | +| `backend.sidecars` | Add additional sidecar containers to the backend pods | `[]` | +| `backend.initContainers` | Add additional init containers to the backend pods | `[]` | +| `backend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `backend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `backend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty. | `""` | +| `backend.autoscaling.vpa.enabled` | Enable VPA for backend pods | `false` | +| `backend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `backend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `backend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `backend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `backend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `backend.autoscaling.hpa.enabled` | Enable HPA for backend pods | `false` | +| `backend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `backend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `backend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `backend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the backend service account | `true` | +| `backend.serviceAccount.imagePullSecrets` | Add image pull secrets to the backend service account | `[]` | +| `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `backend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `backend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `backend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `backend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `backend.cleanupSchedule` | The interval in seconds at which the cleanup job runs | `300` | +| `backend.openSearch.url` | The URL at which OpenSearch is available | `http://{{ .Release.Name }}-opensearch:9200` | +| `backend.openSearch.username` | The username that is used for authenticating with OpenSearch | `admin` | +| `backend.openSearch.certificateFile` | The path to a custom OpenSearch certificate file | `""` | +| `backend.openSearch.skipSSLVerify` | Skip SSL verification | `false` | +| `backend.openSearch.indexPrefix` | A prefix for OpenSearch indices | `""` | +| `backend.apps.downloadLocation` | The location to a git repository from which default appps are downloaded on startup. | `https://github.com/shuffle/python-apps` | +| `backend.apps.downloadBranch` | The branch from which apps should be downloaded on startup. | `master` | +| `backend.apps.forceUpdate` | Force an update of apps on startup. | `false` | + +### frontend Parameters + +| Name | Description | Value | +| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | +| `frontend.image.registry` | frontend image registry | `ghcr.io` | +| `frontend.image.repository` | frontend image repository | `shuffle/shuffle-frontend` | +| `frontend.image.digest` | frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `frontend.image.pullPolicy` | frontend image pull policy | `IfNotPresent` | +| `frontend.image.pullSecrets` | frontend image pull secrets | `[]` | +| `frontend.replicaCount` | Number of frontend replicas to deploy | `1` | +| `frontend.containerPorts.http` | frontend HTTP container port | `80` | +| `frontend.containerPorts.https` | frontend HTTPS container port | `443` | +| `frontend.extraContainerPorts` | Optionally specify extra list of additional ports for frontend containers | `[]` | +| `frontend.livenessProbe.enabled` | Enable livenessProbe on frontend containers | `false` | +| `frontend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `frontend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `frontend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `frontend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `frontend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `frontend.readinessProbe.enabled` | Enable readinessProbe on frontend containers | `false` | +| `frontend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `frontend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `frontend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `frontend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `frontend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `frontend.startupProbe.enabled` | Enable startupProbe on frontend containers | `false` | +| `frontend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `frontend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `frontend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `frontend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `frontend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `frontend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `frontend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `frontend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `frontend.resourcesPreset` | Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). | `nano` | +| `frontend.resources` | Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `false` | +| `frontend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for frontend pods | `Always` | +| `frontend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for frontend pods | `[]` | +| `frontend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for frontend pods | `[]` | +| `frontend.podSecurityContext.fsGroup` | Set fsGroup in frontend pods' Security Context | `1001` | +| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `false` | +| `frontend.containerSecurityContext.seLinuxOptions` | Set SELinux options in frontend container | `{}` | +| `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `101` | +| `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `101` | +| `frontend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in frontend container' Security Context | `true` | +| `frontend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in frontend container' Security Context | `true` | +| `frontend.containerSecurityContext.privileged` | Set privileged in frontend container' Security Context | `false` | +| `frontend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in frontend container' Security Context | `false` | +| `frontend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in frontend container | `["ALL"]` | +| `frontend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in frontend container | `RuntimeDefault` | +| `frontend.command` | Override default frontend container command (useful when using custom images) | `[]` | +| `frontend.args` | Override default frontend container args (useful when using custom images) | `[]` | +| `frontend.automountServiceAccountToken` | Mount Service Account token in frontend pods | `false` | +| `frontend.hostAliases` | frontend pods host aliases | `[]` | +| `frontend.daemonsetAnnotations` | Annotations for frontend daemonset | `{}` | +| `frontend.deploymentAnnotations` | Annotations for frontend deployment | `{}` | +| `frontend.statefulsetAnnotations` | Annotations for frontend statefulset | `{}` | +| `frontend.podLabels` | Extra labels for frontend pods | `{}` | +| `frontend.podAnnotations` | Annotations for frontend pods | `{}` | +| `frontend.podAffinityPreset` | Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `frontend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `frontend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `frontend.nodeAffinityPreset.key` | Node label key to match. Ignored if `frontend.affinity` is set | `""` | +| `frontend.nodeAffinityPreset.values` | Node label values to match. Ignored if `frontend.affinity` is set | `[]` | +| `frontend.affinity` | Affinity for frontend pods assignment | `{}` | +| `frontend.nodeSelector` | Node labels for frontend pods assignment | `{}` | +| `frontend.tolerations` | Tolerations for frontend pods assignment | `[]` | +| `frontend.updateStrategy.type` | frontend deployment strategy type | `RollingUpdate` | +| `frontend.updateStrategy.type` | frontend statefulset strategy type | `RollingUpdate` | +| `frontend.podManagementPolicy` | Pod management policy for frontend statefulset | `OrderedReady` | +| `frontend.priorityClassName` | frontend pods' priorityClassName | `""` | +| `frontend.topologySpreadConstraints` | Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains | `[]` | +| `frontend.schedulerName` | Name of the k8s scheduler (other than default) for frontend pods | `""` | +| `frontend.terminationGracePeriodSeconds` | Seconds frontend pods need to terminate gracefully | `""` | +| `frontend.lifecycleHooks` | for frontend containers to automate configuration before or after startup | `{}` | +| `frontend.extraEnvVars` | Array with extra environment variables to add to frontend containers | `[]` | +| `frontend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for frontend containers | `""` | +| `frontend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for frontend containers | `""` | +| `frontend.extraVolumes` | Optionally specify extra list of additional volumes for the frontend pods | `[]` | +| `frontend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the frontend containers | `[]` | +| `frontend.sidecars` | Add additional sidecar containers to the frontend pods | `[]` | +| `frontend.initContainers` | Add additional init containers to the frontend pods | `[]` | +| `frontend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `frontend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `frontend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty. | `""` | +| `frontend.autoscaling.vpa.enabled` | Enable VPA for frontend pods | `false` | +| `frontend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `frontend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `frontend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `frontend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `frontend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `frontend.autoscaling.hpa.enabled` | Enable HPA for frontend pods | `false` | +| `frontend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `frontend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `frontend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `frontend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the frontend service account | `true` | +| `frontend.serviceAccount.imagePullSecrets` | Add image pull secrets to the frontend service account | `[]` | +| `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `frontend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `frontend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `frontend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### orborus Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| `orborus.image.registry` | orborus image registry | `ghcr.io` | +| `orborus.image.repository` | orborus image repository | `shuffle/shuffle-orborus` | +| `orborus.image.digest` | orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `orborus.image.pullPolicy` | orborus image pull policy | `IfNotPresent` | +| `orborus.image.pullSecrets` | orborus image pull secrets | `[]` | +| `orborus.replicaCount` | Number of orborus replicas to deploy | `1` | +| `orborus.containerPorts.http` | orborus HTTP container port | `8080` | +| `orborus.extraContainerPorts` | Optionally specify extra list of additional ports for orborus containers | `[]` | +| `orborus.livenessProbe.enabled` | Enable livenessProbe on orborus containers | `false` | +| `orborus.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `orborus.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `orborus.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `orborus.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `orborus.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `orborus.readinessProbe.enabled` | Enable readinessProbe on orborus containers | `false` | +| `orborus.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `orborus.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `orborus.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `orborus.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `orborus.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `orborus.startupProbe.enabled` | Enable startupProbe on orborus containers | `false` | +| `orborus.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `orborus.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `orborus.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `orborus.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `orborus.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `orborus.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `orborus.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `orborus.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `orborus.resourcesPreset` | Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production). | `nano` | +| `orborus.resources` | Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `orborus.podSecurityContext.enabled` | Enable orborus pods' Security Context | `true` | +| `orborus.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for orborus pods | `Always` | +| `orborus.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for orborus pods | `[]` | +| `orborus.podSecurityContext.supplementalGroups` | Set filesystem extra groups for orborus pods | `[]` | +| `orborus.podSecurityContext.fsGroup` | Set fsGroup in orborus pods' Security Context | `1001` | +| `orborus.containerSecurityContext.enabled` | Enabled orborus container' Security Context | `true` | +| `orborus.containerSecurityContext.seLinuxOptions` | Set SELinux options in orborus container | `{}` | +| `orborus.containerSecurityContext.runAsUser` | Set runAsUser in orborus container' Security Context | `101` | +| `orborus.containerSecurityContext.runAsGroup` | Set runAsGroup in orborus container' Security Context | `101` | +| `orborus.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in orborus container' Security Context | `true` | +| `orborus.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in orborus container' Security Context | `true` | +| `orborus.containerSecurityContext.privileged` | Set privileged in orborus container' Security Context | `false` | +| `orborus.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in orborus container' Security Context | `false` | +| `orborus.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in orborus container | `["ALL"]` | +| `orborus.containerSecurityContext.seccompProfile.type` | Set seccomp profile in orborus container | `RuntimeDefault` | +| `orborus.command` | Override default orborus container command (useful when using custom images) | `[]` | +| `orborus.args` | Override default orborus container args (useful when using custom images) | `[]` | +| `orborus.automountServiceAccountToken` | Mount Service Account token in orborus pods | `true` | +| `orborus.hostAliases` | orborus pods host aliases | `[]` | +| `orborus.daemonsetAnnotations` | Annotations for orborus daemonset | `{}` | +| `orborus.deploymentAnnotations` | Annotations for orborus deployment | `{}` | +| `orborus.statefulsetAnnotations` | Annotations for orborus statefulset | `{}` | +| `orborus.podLabels` | Extra labels for orborus pods | `{}` | +| `orborus.podAnnotations` | Annotations for orborus pods | `{}` | +| `orborus.podAffinityPreset` | Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `orborus.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `orborus.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `orborus.nodeAffinityPreset.key` | Node label key to match. Ignored if `orborus.affinity` is set | `""` | +| `orborus.nodeAffinityPreset.values` | Node label values to match. Ignored if `orborus.affinity` is set | `[]` | +| `orborus.affinity` | Affinity for orborus pods assignment | `{}` | +| `orborus.nodeSelector` | Node labels for orborus pods assignment | `{}` | +| `orborus.tolerations` | Tolerations for orborus pods assignment | `[]` | +| `orborus.updateStrategy.type` | orborus deployment strategy type | `RollingUpdate` | +| `orborus.updateStrategy.type` | orborus statefulset strategy type | `RollingUpdate` | +| `orborus.podManagementPolicy` | Pod management policy for orborus statefulset | `OrderedReady` | +| `orborus.priorityClassName` | orborus pods' priorityClassName | `""` | +| `orborus.topologySpreadConstraints` | Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains | `[]` | +| `orborus.schedulerName` | Name of the k8s scheduler (other than default) for orborus pods | `""` | +| `orborus.terminationGracePeriodSeconds` | Seconds orborus pods need to terminate gracefully | `""` | +| `orborus.lifecycleHooks` | for orborus containers to automate configuration before or after startup | `{}` | +| `orborus.extraEnvVars` | Array with extra environment variables to add to orborus containers | `[]` | +| `orborus.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for orborus containers | `""` | +| `orborus.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for orborus containers | `""` | +| `orborus.extraVolumes` | Optionally specify extra list of additional volumes for the orborus pods | `[]` | +| `orborus.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the orborus containers | `[]` | +| `orborus.sidecars` | Add additional sidecar containers to the orborus pods | `[]` | +| `orborus.initContainers` | Add additional init containers to the orborus pods | `[]` | +| `orborus.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `orborus.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `orborus.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty. | `""` | +| `orborus.autoscaling.vpa.enabled` | Enable VPA for orborus pods | `false` | +| `orborus.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `orborus.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `orborus.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `orborus.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `orborus.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `orborus.autoscaling.hpa.enabled` | Enable HPA for orborus pods | `false` | +| `orborus.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `orborus.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `orborus.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `orborus.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `orborus.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the orborus service account | `true` | +| `orborus.serviceAccount.imagePullSecrets` | Add image pull secrets to the orborus service account | `[]` | +| `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `orborus.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `orborus.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `orborus.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `orborus.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### worker Parameters + +| Name | Description | Value | +| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `worker.image.registry` | worker image registry | `ghcr.io` | +| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` | +| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` | +| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` | +| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### app Parameters + +| Name | Description | Value | +| ------------------------------------------------- | ---------------------------------------------------------------------------------- | ------ | +| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` | +| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` | +| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### Traffic Exposure Parameters + +| Name | Description | Value | +| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- | +| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` | +| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` | +| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` | +| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | +| `ingress.hostname` | Default host for the ingress record | `shuffle.local` | +| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` | +| `ingress.path` | Ingress path for Shuffle frontend | `"/"` | +| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` | +| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` | +| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` | +| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | +| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` | +| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` | +| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | +| `ingress.secrets` | Custom TLS certificates as secrets | `[]` | +| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` | + +### Istio Parameters + +| Name | Description | Value | +| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ | +| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` | +| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` | +| `istio.hosts` | One or more hosts exposed by Istio | `[]` | +| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` | +| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` | +| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` | +| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` | +| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` | +| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` | +| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` | +| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` | +| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` | +| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` | +| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` | + +### Persistence Parameters + +| Name | Description | Value | +| ------------------------------------- | ------------------------------------------------- | ------------------- | +| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` | +| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` | +| `persistence.apps.subPath` | The sub path used in the volume | `""` | +| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.apps.size` | The size of the volume | `5Gi` | +| `persistence.apps.annotations` | Annotations for the PVC | `{}` | +| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` | +| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.appBuilder.size` | The size of the volume | `5Gi` | +| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` | +| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` | +| `persistence.files.subPath` | The sub path used in the volume | `""` | +| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.files.size` | The size of the volume | `5Gi` | +| `persistence.files.annotations` | Annotations for the PVC | `{}` | +| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` | + +### Init Container Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | +| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` | +| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnami/os-shell` | +| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | + +### OpenSearch Parameters + +| Name | Description | Value | +| -------------------- | ----------------------------------------------------- | ------ | +| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` | + +### Vault Parameters + +| Name | Description | Value | +| --------------- | -------------------------------------------------------------------------- | ----- | +| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` | +| `vault.secrets` | A list of VaultSecrets to create | `[]` | + +### Other Parameters + diff --git a/charts/shuffle/templates/NOTES.txt b/charts/shuffle/templates/NOTES.txt new file mode 100644 index 00000000..10e38886 --- /dev/null +++ b/charts/shuffle/templates/NOTES.txt @@ -0,0 +1,27 @@ +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +** Please be patient while the chart is being deployed ** + +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ include "common.names.namespace" . | quote }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ include "common.names.namespace" . | quote }} -ti -- bash + +{{- end }} + +To access shuffle using port-forwarding: + +1. Run `kubectl port-forward -n shuffle svc/shuffle-frontend 8080:http` +2. Visit http://localhost:8080 with your browser + diff --git a/charts/shuffle/templates/_helpers.tpl b/charts/shuffle/templates/_helpers.tpl new file mode 100644 index 00000000..6bd29238 --- /dev/null +++ b/charts/shuffle/templates/_helpers.tpl @@ -0,0 +1,377 @@ +{{/* +Return the common name for backend componentes +*/}} +{{- define "shuffle.backend.name" -}} + {{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for frontend components +*/}} +{{- define "shuffle.frontend.name" -}} + {{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for orborus components +*/}} +{{- define "shuffle.orborus.name" -}} + {{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for worker components +*/}} +{{- define "shuffle.worker.name" -}} + {{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for app components +*/}} +{{- define "shuffle.app.name" -}} + {{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common labels for backend components +The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod. +*/}} +{{- define "shuffle.backend.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: backend +io.kompose.service: backend +{{- end -}} + +{{/* +Return the common labels for frontend components +*/}} +{{- define "shuffle.frontend.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: frontend +{{- end -}} + +{{/* +Return the common labels for orborus components +*/}} +{{- define "shuffle.orborus.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: orborus +{{- end -}} + +{{/* +Return the common labels for worker components +*/}} +{{- define "shuffle.worker.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: worker +{{- end -}} + +{{/* +Return the common labels for app components +*/}} +{{- define "shuffle.app.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: app +{{- end -}} + +{{/* +Return the match labels for backend components +*/}} +{{- define "shuffle.backend.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: backend +{{- end -}} + +{{/* +Return the match labels for frontend components +*/}} +{{- define "shuffle.frontend.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: frontend +{{- end -}} + +{{/* +Return the match labels for orborus components +*/}} +{{- define "shuffle.orborus.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: orborus +{{- end -}} + +{{/* +Return the match labels for worker components +NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. +*/}} +{{- define "shuffle.worker.matchLabels" -}} +app.kubernetes.io/name: shuffle-worker +{{- end -}} + +{{/* +Return the match labels for app components +NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. +*/}} +{{- define "shuffle.app.matchLabels" -}} +app.kubernetes.io/name: shuffle-app +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "shuffle.volumePermissions.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Shuffle backend image name +*/}} +{{- define "shuffle.backend.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the backend pod +*/}} +{{- define "shuffle.backend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}} +{{- end -}} + +{{/* +Return the proper Shuffle frontend image name +*/}} +{{- define "shuffle.frontend.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the frontend pod +*/}} +{{- define "shuffle.frontend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}} +{{- end -}} + +{{/* +Return the proper Shuffle orborus image name +*/}} +{{- define "shuffle.orborus.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the orborus pod +*/}} +{{- define "shuffle.orborus.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}} +{{- end -}} + +{{/* +Return the proper Shuffle worker image name +*/}} +{{- define "shuffle.worker.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Create the name of the service account to use for the Shuffle backend +*/}} +{{- define "shuffle.backend.serviceAccount.name" -}} +{{- if .Values.backend.serviceAccount.create -}} + {{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.backend.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the backend service account +*/}} +{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.backend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Create the name of the service account to use for the Shuffle frontend +*/}} +{{- define "shuffle.frontend.serviceAccount.name" -}} +{{- if .Values.frontend.serviceAccount.create -}} + {{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.frontend.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the frontend service account +*/}} +{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.frontend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle orborus +*/}} +{{- define "shuffle.orborus.serviceAccount.name" -}} +{{- if .Values.orborus.serviceAccount.create -}} + {{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.orborus.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the orborus service account +*/}} +{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.orborus.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle workers +*/}} +{{- define "shuffle.worker.serviceAccount.name" -}} +{{- if .Values.worker.serviceAccount.create -}} + {{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.worker.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the worker service account +*/}} +{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.worker.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle apps +*/}} +{{- define "shuffle.app.serviceAccount.name" -}} +{{- if .Values.app.serviceAccount.create -}} + {{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.app.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the app service account +*/}} +{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.app.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml b/charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml new file mode 100644 index 00000000..e0e8ef7d --- /dev/null +++ b/charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml @@ -0,0 +1,28 @@ +# This PVC is always enabled, regardless of .Values.persistence.enabled, +# as app building does not work without it. +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: backend-apps-claim # Hardcoded by shuffle-app-builder + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} + helm.sh/resource-policy: keep + {{- end }} + {{- if or .Values.persistence.appBuilder.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.appBuilder.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + accessModes: + {{- range .Values.persistence.appBuilder.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.appBuilder.size }} + {{- if .Values.persistence.appBuilder.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.appBuilder.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.appBuilder "global" .Values.global ) | nindent 2 }} diff --git a/charts/shuffle/templates/backend/backend-apps-pvc.yaml b/charts/shuffle/templates/backend/backend-apps-pvc.yaml new file mode 100644 index 00000000..b26dfdf3 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-apps-pvc.yaml @@ -0,0 +1,30 @@ +{{- if .Values.persistence.enabled }} +{{- if (not .Values.persistence.apps.existingClaim) }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ printf "%s-apps" (include "shuffle.backend.name" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} + helm.sh/resource-policy: keep + {{- end }} + {{- if or .Values.persistence.apps.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.apps.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + accessModes: + {{- range .Values.persistence.apps.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.apps.size }} + {{- if .Values.persistence.apps.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.apps.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.apps "global" .Values.global ) | nindent 2 }} +{{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-cm-env.yaml b/charts/shuffle/templates/backend/backend-cm-env.yaml new file mode 100644 index 00000000..e7138dc0 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-cm-env.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "shuffle.backend.name" . }}-env + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + BACKEND_PORT: "5001" + {{- if .Values.shuffle.baseUrl }} + BASE_URL: "{{ .Values.shuffle.baseUrl }}" + SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}" + {{- else }} + BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001" + {{- end }} + ORG_ID: "{{ .Values.shuffle.org }}" + SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}" + SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}" + SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}" + SHUFFLE_CHAT_DISABLED: "true" + SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }} + SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}" + SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}" + SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}" + SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}" + SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}" + TZ: "{{ .Values.shuffle.timezone }}" + REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" diff --git a/charts/shuffle/templates/backend/backend-dpl.yaml b/charts/shuffle/templates/backend/backend-dpl.yaml new file mode 100644 index 00000000..b1cc606c --- /dev/null +++ b/charts/shuffle/templates/backend/backend-dpl.yaml @@ -0,0 +1,224 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.backend.deploymentAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.deploymentAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.backend.autoscaling.hpa.enabled }} + replicas: {{ .Values.backend.replicaCount }} + {{- end }} + {{- if .Values.backend.updateStrategy }} + strategy: {{- toYaml .Values.backend.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }} + selector: + matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if .Values.backend.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "shuffle.backend.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.backend.serviceAccount.name" . }} + automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }} + {{- if .Values.backend.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.backend.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAntiAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.backend.nodeAffinityPreset.type "key" .Values.backend.nodeAffinityPreset.key "values" .Values.backend.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.backend.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.backend.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.backend.priorityClassName }} + priorityClassName: {{ .Values.backend.priorityClassName | quote }} + {{- end }} + {{- if .Values.backend.schedulerName }} + schedulerName: {{ .Values.backend.schedulerName | quote }} + {{- end }} + {{- if .Values.backend.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.backend.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.backend.podSecurityContext.enabled }} + securityContext: {{- omit .Values.backend.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.backend.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.backend.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: {{ include "shuffle.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /app/generated && \ + chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-apps && \ + chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-files + {{- if .Values.volumePermissions.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} + {{- end }} + volumeMounts: + - name: shuffle-app-builder + mountPath: /app/generated + - name: shuffle-apps + mountPath: /shuffle-apps + {{- if .Values.persistence.apps.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + - name: shuffle-files + mountPath: /shuffle-files + {{- if .Values.persistence.files.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + {{- end }} + {{- if .Values.backend.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: backend + image: {{ template "shuffle.backend.image" . }} + imagePullPolicy: {{ .Values.backend.image.pullPolicy }} + {{- if .Values.backend.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backend.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.backend.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.backend.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.backend.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.backend.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: RUNNING_MODE + value: kubernetes + - name: IS_KUBERNETES + value: "true" + - name: SHUFFLE_APP_HOTLOAD_FOLDER + value: /shuffle-apps + - name: SHUFFLE_FILE_LOCATION + value: /shuffle-files + {{- if .Values.backend.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ include "shuffle.backend.name" . }}-env + {{- if .Values.backend.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.backend.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.backend.resources }} + resources: {{- toYaml .Values.backend.resources | nindent 12 }} + {{- else if ne .Values.backend.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.backend.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ .Values.backend.containerPorts.http }} + {{- if .Values.backend.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.backend.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.backend.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: {{ .Values.backend.containerPorts.http }} + {{- end }} + {{- if .Values.backend.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.backend.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: {{ .Values.backend.containerPorts.http }} + {{- end }} + {{- if .Values.backend.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.backend.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: {{ .Values.backend.containerPorts.http }} + {{- end }} + {{- end }} + {{- if .Values.backend.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.backend.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: shuffle-app-builder + mountPath: /app/generated + - name: shuffle-apps + mountPath: /shuffle-apps + {{- if .Values.persistence.apps.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + - name: shuffle-files + mountPath: /shuffle-files + {{- if .Values.persistence.files.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.backend.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.backend.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backend.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + - name: shuffle-app-builder + persistentVolumeClaim: + claimName: backend-apps-claim + - name: shuffle-apps + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ default (printf "%s-apps" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }} + {{- else }} + emptyDir: {} + {{- end }} + - name: shuffle-files + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ default (printf "%s-files" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }} + {{- else }} + emptyDir: {} + {{- end }} + {{- if .Values.backend.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/charts/shuffle/templates/backend/backend-files-pvc.yaml b/charts/shuffle/templates/backend/backend-files-pvc.yaml new file mode 100644 index 00000000..86faac82 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-files-pvc.yaml @@ -0,0 +1,30 @@ +{{- if .Values.persistence.enabled }} +{{- if (not .Values.persistence.files.existingClaim) }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ printf "%s-files" (include "shuffle.backend.name" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} + helm.sh/resource-policy: keep + {{- end }} + {{- if or .Values.persistence.files.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.files.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + accessModes: + {{- range .Values.persistence.files.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.files.size }} + {{- if .Values.persistence.files.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.files.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.files "global" .Values.global ) | nindent 2 }} +{{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-hpa.yaml b/charts/shuffle/templates/backend/backend-hpa.yaml new file mode 100644 index 00000000..bd099242 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-hpa.yaml @@ -0,0 +1,43 @@ +{{- if .Values.backend.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.backend.name" . }} + minReplicas: {{ .Values.backend.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.backend.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.backend.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.backend.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-network-policy.yaml b/charts/shuffle/templates/backend/backend-network-policy.yaml new file mode 100644 index 00000000..48010706 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-network-policy.yaml @@ -0,0 +1,66 @@ +{{- if .Values.backend.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.backend.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + {{- if .Values.backend.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: {{ .Values.backend.containerPorts.http }} + protocol: TCP + {{- if not .Values.backend.networkPolicy.allowExternal }} + from: + # Allow traffic from orborus + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }} + + # Allow traffic from workers + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + + # Allow traffic from apps + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.backend.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-pdb.yaml b/charts/shuffle/templates/backend/backend-pdb.yaml new file mode 100644 index 00000000..5b253ca6 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-pdb.yaml @@ -0,0 +1,21 @@ +{{- if .Values.backend.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.backend.pdb.minAvailable }} + minAvailable: {{ .Values.backend.pdb.minAvailable }} + {{- end }} + {{- if or .Values.backend.pdb.maxUnavailable ( not .Values.backend.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.backend.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-role-binding.yaml b/charts/shuffle/templates/backend/backend-role-binding.yaml new file mode 100644 index 00000000..171e2c98 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-role-binding.yaml @@ -0,0 +1,18 @@ +{{ if .Values.backend.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + name: {{ include "shuffle.backend.serviceAccount.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "shuffle.backend.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-role.yaml b/charts/shuffle/templates/backend/backend-role.yaml new file mode 100644 index 00000000..790ea462 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-role.yaml @@ -0,0 +1,18 @@ +{{ if .Values.backend.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list"] + - apiGroups: ["batch"] + resources: ["jobs"] + verbs: ["get", "create", "delete"] +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-service-account.yaml b/charts/shuffle/templates/backend/backend-service-account.yaml new file mode 100644 index 00000000..5a49ba3a --- /dev/null +++ b/charts/shuffle/templates/backend/backend-service-account.yaml @@ -0,0 +1,14 @@ +{{- if .Values.backend.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.backend.serviceAccount.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.backend.serviceAccount.imagePullSecrets" . | nindent 0 }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-svc.yaml b/charts/shuffle/templates/backend/backend-svc.yaml new file mode 100644 index 00000000..18328899 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-svc.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http + port: {{ .Values.backend.containerPorts.http }} + targetPort: http + protocol: TCP + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }} + selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/backend/backend-vpa.yaml b/charts/shuffle/templates/backend/backend-vpa.yaml new file mode 100644 index 00000000..dfdd0bf5 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-vpa.yaml @@ -0,0 +1,38 @@ +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.backend.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: backend + {{- with .Values.backend.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.backend.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.backend.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "backend.names.name" . }} + {{- if .Values.backend.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.backend.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/extra-list.yaml b/charts/shuffle/templates/extra-list.yaml new file mode 100644 index 00000000..9ac65f9e --- /dev/null +++ b/charts/shuffle/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-cm-env.yaml b/charts/shuffle/templates/frontend/frontend-cm-env.yaml new file mode 100644 index 00000000..9d9f8e72 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-cm-env.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "shuffle.frontend.name" . }}-env + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: diff --git a/charts/shuffle/templates/frontend/frontend-dpl.yaml b/charts/shuffle/templates/frontend/frontend-dpl.yaml new file mode 100644 index 00000000..1a984eaf --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-dpl.yaml @@ -0,0 +1,158 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.frontend.deploymentAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.deploymentAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.frontend.autoscaling.hpa.enabled }} + replicas: {{ .Values.frontend.replicaCount }} + {{- end }} + {{- if .Values.frontend.updateStrategy }} + strategy: {{- toYaml .Values.frontend.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }} + selector: + matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if .Values.frontend.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "shuffle.frontend.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.frontend.serviceAccount.name" . }} + automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }} + {{- if .Values.frontend.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAntiAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.frontend.nodeAffinityPreset.type "key" .Values.frontend.nodeAffinityPreset.key "values" .Values.frontend.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.frontend.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.priorityClassName }} + priorityClassName: {{ .Values.frontend.priorityClassName | quote }} + {{- end }} + {{- if .Values.frontend.schedulerName }} + schedulerName: {{ .Values.frontend.schedulerName | quote }} + {{- end }} + {{- if .Values.frontend.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.podSecurityContext.enabled }} + securityContext: {{- omit .Values.frontend.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.frontend.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.frontend.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if .Values.frontend.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: frontend + image: {{ template "shuffle.frontend.image" . }} + imagePullPolicy: {{ .Values.frontend.image.pullPolicy }} + {{- if .Values.frontend.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.frontend.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.frontend.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.frontend.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.args "context" $) | nindent 12 }} + {{- end }} + env: + {{- if .Values.frontend.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ include "shuffle.frontend.name" . }}-env + {{- if .Values.frontend.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.frontend.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.frontend.resources }} + resources: {{- toYaml .Values.frontend.resources | nindent 12 }} + {{- else if ne .Values.frontend.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.frontend.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ .Values.frontend.containerPorts.http }} + {{- if .Values.frontend.containerPorts.https }} + - name: https + containerPort: {{ .Values.frontend.containerPorts.https }} + {{- end }} + {{- if .Values.frontend.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.frontend.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.frontend.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ .Values.frontend.containerPorts.http }} + {{- end }} + {{- if .Values.frontend.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.frontend.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ .Values.frontend.containerPorts.http }} + {{- end }} + {{- if .Values.frontend.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.frontend.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ .Values.frontend.containerPorts.http }} + {{- end }} + {{- end }} + {{- if .Values.frontend.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.frontend.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.frontend.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if .Values.frontend.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-hpa.yaml b/charts/shuffle/templates/frontend/frontend-hpa.yaml new file mode 100644 index 00000000..d1b31e11 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-hpa.yaml @@ -0,0 +1,43 @@ +{{- if .Values.frontend.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.frontend.name" . }} + minReplicas: {{ .Values.frontend.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.frontend.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.frontend.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.frontend.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-network-policy.yaml b/charts/shuffle/templates/frontend/frontend-network-policy.yaml new file mode 100644 index 00000000..9082535b --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-network-policy.yaml @@ -0,0 +1,47 @@ +{{- if .Values.frontend.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.frontend.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + {{- if .Values.frontend.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + {{ if .Values.frontend.networkPolicy.allowExternal }} + - ports: + - port: {{ .Values.frontend.containerPorts.http }} + {{- if .Values.frontend.containerPorts.https }} + - port: {{ .Values.frontend.containerPorts.https }} + {{- end }} + {{- end }} + {{- if .Values.frontend.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-pdb.yaml b/charts/shuffle/templates/frontend/frontend-pdb.yaml new file mode 100644 index 00000000..b1c2eb28 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-pdb.yaml @@ -0,0 +1,21 @@ +{{- if .Values.frontend.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.frontend.pdb.minAvailable }} + minAvailable: {{ .Values.frontend.pdb.minAvailable }} + {{- end }} + {{- if or .Values.frontend.pdb.maxUnavailable ( not .Values.frontend.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.frontend.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-service-account.yaml b/charts/shuffle/templates/frontend/frontend-service-account.yaml new file mode 100644 index 00000000..d580dd3e --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-service-account.yaml @@ -0,0 +1,14 @@ +{{- if .Values.frontend.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.frontend.serviceAccount.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.frontend.serviceAccount.imagePullSecrets" . | nindent 0 }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-svc.yaml b/charts/shuffle/templates/frontend/frontend-svc.yaml new file mode 100644 index 00000000..76851c0a --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-svc.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http + port: {{ .Values.frontend.containerPorts.http }} + targetPort: http + protocol: TCP + {{- if .Values.frontend.containerPorts.https }} + - name: https + port: {{ .Values.frontend.containerPorts.https }} + targetPort: https + protocol: TCP + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }} + selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/frontend/frontend-vpa.yaml b/charts/shuffle/templates/frontend/frontend-vpa.yaml new file mode 100644 index 00000000..8dd26333 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-vpa.yaml @@ -0,0 +1,38 @@ +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.frontend.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: frontend + {{- with .Values.frontend.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.frontend.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.frontend.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "frontend.names.name" . }} + {{- if .Values.frontend.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.frontend.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/ingress/ingress.yaml b/charts/shuffle/templates/ingress/ingress.yaml new file mode 100644 index 00000000..cd08c0f9 --- /dev/null +++ b/charts/shuffle/templates/ingress/ingress.yaml @@ -0,0 +1,60 @@ +{{- if .Values.ingress.enabled }} +apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.ingress.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.ingress.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }} + ingressClassName: {{ .Values.ingress.ingressClassName | quote }} + {{- end }} + rules: + {{- if .Values.ingress.hostname }} + - host: {{ .Values.ingress.hostname }} + http: + paths: + {{- if .Values.ingress.extraPaths }} + {{- toYaml .Values.ingress.extraPaths | nindent 10 }} + {{- end }} + - path: {{ .Values.ingress.path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.frontend.name" .) "servicePort" "http" "context" $) | nindent 14 }} + - path: {{ .Values.ingress.backendPath }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.backendPathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.backend.name" .) "servicePort" "http" "context" $) | nindent 14 }} + + {{- end }} + {{- range .Values.ingress.extraHosts }} + - host: {{ .name | quote }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "http" "context" $) | nindent 14 }} + {{- end }} + {{- if .Values.ingress.extraRules }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }} + {{- end }} + {{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned)) .Values.ingress.extraTls }} + tls: + {{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned) }} + - hosts: + - {{ .Values.ingress.hostname | quote }} + secretName: {{ printf "%s-tls" .Values.ingress.hostname }} + {{- end }} + {{- if .Values.ingress.extraTls }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/ingress/tls-secret.yaml b/charts/shuffle/templates/ingress/tls-secret.yaml new file mode 100644 index 00000000..4e35a9aa --- /dev/null +++ b/charts/shuffle/templates/ingress/tls-secret.yaml @@ -0,0 +1,39 @@ +{{- if .Values.ingress.enabled }} +{{- if .Values.ingress.secrets }} +{{- range .Values.ingress.secrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} +--- +{{- end }} +{{- end }} +{{- if and .Values.ingress.tls .Values.ingress.selfSigned }} +{{- $secretName := printf "%s-tls" .Values.ingress.hostname }} +{{- $ca := genCA "shuffle-ca" 365 }} +{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }} + tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }} + ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} +{{- end }} +{{- end }} diff --git a/charts/shuffle/templates/istio/gateway.yaml b/charts/shuffle/templates/istio/gateway.yaml new file mode 100644 index 00000000..f30a5ecb --- /dev/null +++ b/charts/shuffle/templates/istio/gateway.yaml @@ -0,0 +1,42 @@ +{{- if .Values.istio.enabled }} +apiVersion: "{{ .Values.istio.apiVersion }}" +kind: Gateway +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.gateway.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + selector: {{- include "common.tplvalues.render" ( dict "value" .Values.istio.gateway.selector "context" $ ) | nindent 4 }} + servers: + {{- if .Values.istio.gateway.http.enabled }} + - name: "{{ include "common.names.fullname" . }}-http" + port: + number: 80 + name: http + protocol: HTTP + hosts: {{ .Values.istio.hosts }} + tls: + httpsRedirect: {{ .Values.istio.gateway.http.httpsRedirect }} + {{- end }} + {{- if .Values.istio.gateway.https.enabled }} + - name: "{{ include "common.names.fullname" . }}-https" + port: + number: 443 + name: https + protocol: HTTPS + hosts: {{ .Values.istio.hosts }} + tls: + credentialName: {{ .Values.istio.gateway.https.tlsCredentialName }} + mode: SIMPLE + {{- with .Values.istio.gateway.https.tlsCipherSuites }} + cipherSuites: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 10 }} + {{- end }} + {{- end }} + {{- if .Values.istio.gateway.extraServers }} + {{- include "common.tplvalues.render" (dict "value" .Values.istio.gateway.extraServers "context" $) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/istio/virtual-service.yaml b/charts/shuffle/templates/istio/virtual-service.yaml new file mode 100644 index 00000000..aae37e77 --- /dev/null +++ b/charts/shuffle/templates/istio/virtual-service.yaml @@ -0,0 +1,38 @@ +{{- if .Values.istio.enabled }} +apiVersion: "{{ .Values.istio.apiVersion }}" +kind: VirtualService +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.virtualService.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + hosts: {{ .Values.istio.hosts }} + gateways: + - {{ include "common.names.fullname" . }} + http: + - name: backend + match: + - uri: + prefix: /api + route: + - destination: + host: {{ include "shuffle.backend.name" . }} + port: + number: {{ .Values.backend.containerPorts.http }} + {{- with .Values.istio.virtualService.backendHeaders }} + headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }} + {{- end }} + - name: frontend + route: + - destination: + host: {{ include "shuffle.frontend.name" . }} + port: + number: {{ .Values.frontend.containerPorts.http }} + {{- with .Values.istio.virtualService.frontendHeaders }} + headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-cm-env.yaml b/charts/shuffle/templates/orborus/orborus-cm-env.yaml new file mode 100644 index 00000000..57b020a7 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-cm-env.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "shuffle.orborus.name" . }}-env + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}" + ORG_ID: "{{ .Values.shuffle.org }}" + TZ: "{{ .Values.shuffle.timezone }}" + BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001" + KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}" + KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }} + SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}" + REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" + SHUFFLE_SWARM_CONFIG: run diff --git a/charts/shuffle/templates/orborus/orborus-dpl.yaml b/charts/shuffle/templates/orborus/orborus-dpl.yaml new file mode 100644 index 00000000..a2d9c278 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -0,0 +1,162 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.orborus.deploymentAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.deploymentAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.orborus.autoscaling.hpa.enabled }} + replicas: {{ .Values.orborus.replicaCount }} + {{- end }} + {{- if .Values.orborus.updateStrategy }} + strategy: {{- toYaml .Values.orborus.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.podLabels .Values.commonLabels) "context" .) }} + selector: + matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if .Values.orborus.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "shuffle.orborus.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.orborus.serviceAccount.name" . }} + automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }} + {{- if .Values.orborus.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAntiAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.orborus.nodeAffinityPreset.type "key" .Values.orborus.nodeAffinityPreset.key "values" .Values.orborus.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.orborus.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.priorityClassName }} + priorityClassName: {{ .Values.orborus.priorityClassName | quote }} + {{- end }} + {{- if .Values.orborus.schedulerName }} + schedulerName: {{ .Values.orborus.schedulerName | quote }} + {{- end }} + {{- if .Values.orborus.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.podSecurityContext.enabled }} + securityContext: {{- omit .Values.orborus.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.orborus.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.orborus.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if .Values.orborus.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: orborus + image: {{ template "shuffle.orborus.image" . }} + imagePullPolicy: {{ .Values.orborus.image.pullPolicy }} + {{- if .Values.orborus.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.orborus.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.orborus.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.orborus.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: RUNNING_MODE + value: kubernetes + - name: IS_KUBERNETES + value: "true" + - name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME + value: {{ include "shuffle.worker.serviceAccount.name" . }} + - name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME + value: {{ include "shuffle.app.serviceAccount.name" . }} + {{- if .Values.orborus.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ include "shuffle.orborus.name" . }}-env + {{- if .Values.orborus.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.orborus.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.orborus.resources }} + resources: {{- toYaml .Values.orborus.resources | nindent 12 }} + {{- else if ne .Values.orborus.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.orborus.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ .Values.orborus.containerPorts.http }} + {{- if .Values.orborus.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.orborus.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.orborus.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ .Values.orborus.containerPorts.http }} + {{- end }} + {{- if .Values.orborus.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.orborus.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ .Values.orborus.containerPorts.http }} + {{- end }} + {{- if .Values.orborus.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.orborus.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: {{ .Values.orborus.containerPorts.http }} + {{- end }} + {{- end }} + {{- if .Values.orborus.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.orborus.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.orborus.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if .Values.orborus.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-hpa.yaml b/charts/shuffle/templates/orborus/orborus-hpa.yaml new file mode 100644 index 00000000..12bf073f --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-hpa.yaml @@ -0,0 +1,43 @@ +{{- if .Values.orborus.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.orborus.name" . }} + minReplicas: {{ .Values.orborus.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.orborus.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.orborus.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.orborus.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-network-policy.yaml b/charts/shuffle/templates/orborus/orborus-network-policy.yaml new file mode 100644 index 00000000..f6a22339 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-network-policy.yaml @@ -0,0 +1,72 @@ +{{- if .Values.orborus.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.orborus.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + # Allow access to backend + - ports: + - port: {{ .Values.backend.containerPorts.http }} + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }} + # Allow access to workers + - ports: + - port: 33333 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- if .Values.orborus.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: {{ .Values.orborus.containerPorts.http }} + protocol: TCP + {{- if not .Values.orborus.networkPolicy.allowExternal }} + from: + # Allow traffic from workers + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.orborus.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-pdb.yaml b/charts/shuffle/templates/orborus/orborus-pdb.yaml new file mode 100644 index 00000000..827b01bc --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-pdb.yaml @@ -0,0 +1,21 @@ +{{- if .Values.orborus.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.orborus.pdb.minAvailable }} + minAvailable: {{ .Values.orborus.pdb.minAvailable }} + {{- end }} + {{- if or .Values.orborus.pdb.maxUnavailable ( not .Values.orborus.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.orborus.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-role-binding.yaml b/charts/shuffle/templates/orborus/orborus-role-binding.yaml new file mode 100644 index 00000000..feb73887 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-role-binding.yaml @@ -0,0 +1,18 @@ +{{ if .Values.orborus.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + name: {{ include "shuffle.orborus.serviceAccount.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "shuffle.orborus.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-role.yaml b/charts/shuffle/templates/orborus/orborus-role.yaml new file mode 100644 index 00000000..90041d89 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-role.yaml @@ -0,0 +1,29 @@ +{{ if .Values.orborus.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - verbs: + - list + - create + - delete + apiGroups: + - '' + resources: + - pods + - services + - verbs: + - list + - create + - delete + apiGroups: + - apps + resources: + - deployments +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-service-account.yaml b/charts/shuffle/templates/orborus/orborus-service-account.yaml new file mode 100644 index 00000000..27c4b9f6 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-service-account.yaml @@ -0,0 +1,14 @@ +{{- if .Values.orborus.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.orborus.serviceAccount.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.orborus.serviceAccount.imagePullSecrets" . | nindent 0 }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-vpa.yaml b/charts/shuffle/templates/orborus/orborus-vpa.yaml new file mode 100644 index 00000000..a1a7c386 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-vpa.yaml @@ -0,0 +1,38 @@ +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.orborus.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: orborus + {{- with .Values.orborus.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.orborus.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.orborus.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "orborus.names.name" . }} + {{- if .Values.orborus.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.orborus.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml new file mode 100644 index 00000000..d4a24fe6 --- /dev/null +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml @@ -0,0 +1,61 @@ +{{- if .Values.app.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.app.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.app.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.app.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.app.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + # Allow access to workers + - ports: + - port: 33333 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- if .Values.app.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + {{- if .Values.app.networkPolicy.allowExternal }} + - {} + {{- else }} + # Allow access from workers. Apps will typicaly use port 80/TCP, but this is not enforced. + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.app.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml new file mode 100644 index 00000000..55a166e7 --- /dev/null +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml @@ -0,0 +1,18 @@ +{{ if .Values.app.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.app.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + name: {{ include "shuffle.app.serviceAccount.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "shuffle.app.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml new file mode 100644 index 00000000..8be2a6f0 --- /dev/null +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml @@ -0,0 +1,15 @@ +{{ if .Values.app.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.app.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: [""] + resources: [""] + verbs: [""] +{{- end }} diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml new file mode 100644 index 00000000..736e9957 --- /dev/null +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml @@ -0,0 +1,14 @@ +{{- if .Values.app.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.app.serviceAccount.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.app.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.app.serviceAccount.imagePullSecrets" . | nindent 0 }} +{{- end }} diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml new file mode 100644 index 00000000..1b07d9a9 --- /dev/null +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml @@ -0,0 +1,69 @@ +{{- if .Values.worker.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.worker.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.worker.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + # Allow access to orborus + - ports: + - port: {{ .Values.orborus.containerPorts.http }} + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }} + # Allow arbitrary connections to apps. Apps will typically use port 80/TCP, but this is not enforced. + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }} + {{- if .Values.worker.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: 33333 + protocol: TCP + {{- if not .Values.worker.networkPolicy.allowExternal }} + from: + # Allow traffic from orborus + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.worker.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml new file mode 100644 index 00000000..328b3dd5 --- /dev/null +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml @@ -0,0 +1,18 @@ +{{ if .Values.worker.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + name: {{ include "shuffle.worker.serviceAccount.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "shuffle.worker.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml new file mode 100644 index 00000000..fdef5855 --- /dev/null +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml @@ -0,0 +1,21 @@ +{{ if .Values.worker.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] + - apiGroups: [""] + resources: ["services"] + verbs: ["create"] + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["list", "create"] +{{- end }} diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml new file mode 100644 index 00000000..a9a90204 --- /dev/null +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml @@ -0,0 +1,14 @@ +{{- if .Values.worker.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.worker.serviceAccount.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.worker.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.worker.serviceAccount.imagePullSecrets" . | nindent 0 }} +{{- end }} diff --git a/charts/shuffle/templates/vault-secrets.yaml b/charts/shuffle/templates/vault-secrets.yaml new file mode 100644 index 00000000..0755f20a --- /dev/null +++ b/charts/shuffle/templates/vault-secrets.yaml @@ -0,0 +1,19 @@ +{{ range $index, $element := .Values.vault.secrets }} +{{- $vaultRole := $element.vaultRole | default $.Values.vault.role }} +--- +apiVersion: ricoberger.de/v1alpha1 +kind: VaultSecret +metadata: + name: {{ include "common.names.fullname" $ }}-{{ $element.name }} +spec: + type: {{ $element.type }} + path: {{ $element.path }} + {{- if $vaultRole }} + vaultRole: {{ $vaultRole }} + {{- end }} + {{- range $k, $v := $element }} + {{- if (not (has $k (list "name" "type" "path" "vaultRole"))) }} + {{ $k }}: {{ $v }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json new file mode 100644 index 00000000..7a85b9fa --- /dev/null +++ b/charts/shuffle/values.schema.json @@ -0,0 +1,2661 @@ +{ + "title": "Chart Values", + "type": "object", + "properties": { + "global": { + "type": "object", + "properties": { + "imageRegistry": { + "type": "string", + "description": "Global Docker image registry", + "default": "" + }, + "imagePullSecrets": { + "type": "array", + "description": "Global Docker registry secret names as an array", + "default": [], + "items": {} + }, + "defaultStorageClass": { + "type": "string", + "description": "Global default StorageClass for Persistent Volume(s)", + "default": "" + }, + "compatibility": { + "type": "object", + "properties": { + "openshift": { + "type": "object", + "properties": { + "adaptSecurityContext": { + "type": "string", + "description": "Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)", + "default": "auto" + } + } + }, + "omitEmptySeLinuxOptions": { + "type": "boolean", + "description": "If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object", + "default": false + } + } + } + } + }, + "kubeVersion": { + "type": "string", + "description": "Override Kubernetes version", + "default": "" + }, + "nameOverride": { + "type": "string", + "description": "String to partially override common.names.name", + "default": "" + }, + "fullnameOverride": { + "type": "string", + "description": "String to fully override common.names.fullname", + "default": "" + }, + "namespaceOverride": { + "type": "string", + "description": "String to fully override common.names.namespace", + "default": "" + }, + "commonLabels": { + "type": "object", + "description": "Labels to add to all deployed objects", + "default": {} + }, + "commonAnnotations": { + "type": "object", + "description": "Annotations to add to all deployed objects", + "default": {} + }, + "clusterDomain": { + "type": "string", + "description": "Kubernetes cluster domain name", + "default": "cluster.local" + }, + "extraDeploy": { + "type": "array", + "description": "Array of extra objects to deploy with the release", + "default": [], + "items": {} + }, + "diagnosticMode": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable diagnostic mode (all probes will be disabled and the command will be overridden)", + "default": false + }, + "command": { + "type": "array", + "description": "Command to override all containers in the chart release", + "default": [ + "sleep" + ], + "items": { + "type": "string" + } + }, + "args": { + "type": "array", + "description": "Args to override all containers in the chart release", + "default": [ + "infinity" + ], + "items": { + "type": "string" + } + } + } + }, + "shuffle": { + "type": "object", + "properties": { + "baseUrl": { + "type": "string", + "description": "The external base URL under which Shuffle is reachable.", + "default": "" + }, + "org": { + "type": "string", + "description": "Default shuffle organization", + "default": "Shuffle" + }, + "appRegistry": { + "type": "string", + "description": "The registry from / to which shuffle apps are pulled / pushed", + "default": "" + }, + "timezone": { + "type": "string", + "description": "The timezone used by Shuffle", + "default": "Europe/Berlin" + } + } + }, + "backend": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "backend image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "backend image repository", + "default": "shuffle/shuffle-backend" + }, + "digest": { + "type": "string", + "description": "backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "backend image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "backend image pull secrets", + "default": [], + "items": {} + } + } + }, + "replicaCount": { + "type": "number", + "description": "Number of backend replicas to deploy", + "default": 1 + }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "backend HTTP container port", + "default": 5001 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for backend containers", + "default": [], + "items": {} + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on backend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on backend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on backend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one", + "default": {} + }, + "resourcesPreset": { + "type": "string", + "description": "Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production).", + "default": "small" + }, + "resources": { + "type": "object", + "description": "Set backend container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable backend pods' Security Context", + "default": true + }, + "fsGroupChangePolicy": { + "type": "string", + "description": "Set filesystem group change policy for backend pods", + "default": "Always" + }, + "sysctls": { + "type": "array", + "description": "Set kernel settings using the sysctl interface for backend pods", + "default": [], + "items": {} + }, + "supplementalGroups": { + "type": "array", + "description": "Set filesystem extra groups for backend pods", + "default": [], + "items": {} + }, + "fsGroup": { + "type": "number", + "description": "Set fsGroup in backend pods' Security Context", + "default": 1001 + } + } + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled backend container' Security Context", + "default": true + }, + "runAsUser": { + "type": "number", + "description": "Set runAsUser in backend container' Security Context", + "default": 1000 + }, + "runAsGroup": { + "type": "number", + "description": "Set runAsGroup in backend container' Security Context", + "default": 1000 + }, + "runAsNonRoot": { + "type": "boolean", + "description": "Set runAsNonRoot in backend container' Security Context", + "default": true + }, + "readOnlyRootFilesystem": { + "type": "boolean", + "description": "Set readOnlyRootFilesystem in backend container' Security Context", + "default": true + }, + "privileged": { + "type": "boolean", + "description": "Set privileged in backend container' Security Context", + "default": false + }, + "allowPrivilegeEscalation": { + "type": "boolean", + "description": "Set allowPrivilegeEscalation in backend container' Security Context", + "default": false + }, + "capabilities": { + "type": "object", + "properties": { + "drop": { + "type": "array", + "description": "List of capabilities to be dropped in backend container", + "default": [ + "ALL" + ], + "items": { + "type": "string" + } + } + } + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Set seccomp profile in backend container", + "default": "RuntimeDefault" + } + } + } + } + }, + "command": { + "type": "array", + "description": "Override default backend container command (useful when using custom images)", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default backend container args (useful when using custom images)", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in backend pods", + "default": true + }, + "hostAliases": { + "type": "array", + "description": "backend pods host aliases", + "default": [], + "items": {} + }, + "daemonsetAnnotations": { + "type": "object", + "description": "Annotations for backend daemonset", + "default": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for backend deployment", + "default": {} + }, + "statefulsetAnnotations": { + "type": "object", + "description": "Annotations for backend statefulset", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for backend pods", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for backend pods", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `backend.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `backend.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for backend pods assignment", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for backend pods assignment", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for backend pods assignment", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "backend statefulset strategy type", + "default": "RollingUpdate" + } + } + }, + "podManagementPolicy": { + "type": "string", + "description": "Pod management policy for backend statefulset", + "default": "OrderedReady" + }, + "priorityClassName": { + "type": "string", + "description": "backend pods' priorityClassName", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for backend pods", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds backend pods need to terminate gracefully", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for backend containers to automate configuration before or after startup", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to backend containers", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for backend containers", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for backend containers", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the backend pods", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the backend containers", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the backend pods", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the backend pods", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for backend pods", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for backend pods", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the backend service account", + "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the backend service account", + "default": [], + "items": {} + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + }, + "cleanupSchedule": { + "type": "number", + "description": "The interval in seconds at which the cleanup job runs", + "default": 300 + }, + "openSearch": { + "type": "object", + "properties": { + "url": { + "type": "string", + "description": "The URL at which OpenSearch is available", + "default": "http://{{ .Release.Name }}-opensearch:9200" + }, + "username": { + "type": "string", + "description": "The username that is used for authenticating with OpenSearch", + "default": "admin" + }, + "certificateFile": { + "type": "string", + "description": "The path to a custom OpenSearch certificate file", + "default": "" + }, + "skipSSLVerify": { + "type": "boolean", + "description": "Skip SSL verification", + "default": false + }, + "indexPrefix": { + "type": "string", + "description": "A prefix for OpenSearch indices", + "default": "" + } + } + }, + "apps": { + "type": "object", + "properties": { + "downloadLocation": { + "type": "string", + "description": "The location to a git repository from which default appps are downloaded on startup.", + "default": "https://github.com/shuffle/python-apps" + }, + "downloadBranch": { + "type": "string", + "description": "The branch from which apps should be downloaded on startup.", + "default": "master" + }, + "forceUpdate": { + "type": "boolean", + "description": "Force an update of apps on startup.", + "default": false + } + } + } + } + }, + "frontend": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "frontend image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "frontend image repository", + "default": "shuffle/shuffle-frontend" + }, + "digest": { + "type": "string", + "description": "frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "frontend image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "frontend image pull secrets", + "default": [], + "items": {} + } + } + }, + "replicaCount": { + "type": "number", + "description": "Number of frontend replicas to deploy", + "default": 1 + }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "frontend HTTP container port", + "default": 80 + }, + "https": { + "type": "number", + "description": "frontend HTTPS container port", + "default": 443 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for frontend containers", + "default": [], + "items": {} + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on frontend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on frontend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on frontend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one", + "default": {} + }, + "resourcesPreset": { + "type": "string", + "description": "Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production).", + "default": "nano" + }, + "resources": { + "type": "object", + "description": "Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable frontend pods' Security Context", + "default": false + }, + "fsGroupChangePolicy": { + "type": "string", + "description": "Set filesystem group change policy for frontend pods", + "default": "Always" + }, + "sysctls": { + "type": "array", + "description": "Set kernel settings using the sysctl interface for frontend pods", + "default": [], + "items": {} + }, + "supplementalGroups": { + "type": "array", + "description": "Set filesystem extra groups for frontend pods", + "default": [], + "items": {} + }, + "fsGroup": { + "type": "number", + "description": "Set fsGroup in frontend pods' Security Context", + "default": 1001 + } + } + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled frontend container' Security Context", + "default": false + }, + "runAsUser": { + "type": "number", + "description": "Set runAsUser in frontend container' Security Context", + "default": 101 + }, + "runAsGroup": { + "type": "number", + "description": "Set runAsGroup in frontend container' Security Context", + "default": 101 + }, + "runAsNonRoot": { + "type": "boolean", + "description": "Set runAsNonRoot in frontend container' Security Context", + "default": true + }, + "readOnlyRootFilesystem": { + "type": "boolean", + "description": "Set readOnlyRootFilesystem in frontend container' Security Context", + "default": true + }, + "privileged": { + "type": "boolean", + "description": "Set privileged in frontend container' Security Context", + "default": false + }, + "allowPrivilegeEscalation": { + "type": "boolean", + "description": "Set allowPrivilegeEscalation in frontend container' Security Context", + "default": false + }, + "capabilities": { + "type": "object", + "properties": { + "drop": { + "type": "array", + "description": "List of capabilities to be dropped in frontend container", + "default": [ + "ALL" + ], + "items": { + "type": "string" + } + } + } + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Set seccomp profile in frontend container", + "default": "RuntimeDefault" + } + } + } + } + }, + "command": { + "type": "array", + "description": "Override default frontend container command (useful when using custom images)", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default frontend container args (useful when using custom images)", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in frontend pods", + "default": false + }, + "hostAliases": { + "type": "array", + "description": "frontend pods host aliases", + "default": [], + "items": {} + }, + "daemonsetAnnotations": { + "type": "object", + "description": "Annotations for frontend daemonset", + "default": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for frontend deployment", + "default": {} + }, + "statefulsetAnnotations": { + "type": "object", + "description": "Annotations for frontend statefulset", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for frontend pods", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for frontend pods", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `frontend.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `frontend.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for frontend pods assignment", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for frontend pods assignment", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for frontend pods assignment", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "frontend statefulset strategy type", + "default": "RollingUpdate" + } + } + }, + "podManagementPolicy": { + "type": "string", + "description": "Pod management policy for frontend statefulset", + "default": "OrderedReady" + }, + "priorityClassName": { + "type": "string", + "description": "frontend pods' priorityClassName", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for frontend pods", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds frontend pods need to terminate gracefully", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for frontend containers to automate configuration before or after startup", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to frontend containers", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for frontend containers", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for frontend containers", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the frontend pods", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the frontend containers", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the frontend pods", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the frontend pods", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for frontend pods", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for frontend pods", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the frontend service account", + "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the frontend service account", + "default": [], + "items": {} + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "orborus": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "orborus image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "orborus image repository", + "default": "shuffle/shuffle-orborus" + }, + "digest": { + "type": "string", + "description": "orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "orborus image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "orborus image pull secrets", + "default": [], + "items": {} + } + } + }, + "replicaCount": { + "type": "number", + "description": "Number of orborus replicas to deploy", + "default": 1 + }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "orborus HTTP container port", + "default": 8080 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for orborus containers", + "default": [], + "items": {} + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on orborus containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on orborus containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on orborus containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one", + "default": {} + }, + "resourcesPreset": { + "type": "string", + "description": "Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production).", + "default": "nano" + }, + "resources": { + "type": "object", + "description": "Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable orborus pods' Security Context", + "default": true + }, + "fsGroupChangePolicy": { + "type": "string", + "description": "Set filesystem group change policy for orborus pods", + "default": "Always" + }, + "sysctls": { + "type": "array", + "description": "Set kernel settings using the sysctl interface for orborus pods", + "default": [], + "items": {} + }, + "supplementalGroups": { + "type": "array", + "description": "Set filesystem extra groups for orborus pods", + "default": [], + "items": {} + }, + "fsGroup": { + "type": "number", + "description": "Set fsGroup in orborus pods' Security Context", + "default": 1001 + } + } + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled orborus container' Security Context", + "default": true + }, + "runAsUser": { + "type": "number", + "description": "Set runAsUser in orborus container' Security Context", + "default": 101 + }, + "runAsGroup": { + "type": "number", + "description": "Set runAsGroup in orborus container' Security Context", + "default": 101 + }, + "runAsNonRoot": { + "type": "boolean", + "description": "Set runAsNonRoot in orborus container' Security Context", + "default": true + }, + "readOnlyRootFilesystem": { + "type": "boolean", + "description": "Set readOnlyRootFilesystem in orborus container' Security Context", + "default": true + }, + "privileged": { + "type": "boolean", + "description": "Set privileged in orborus container' Security Context", + "default": false + }, + "allowPrivilegeEscalation": { + "type": "boolean", + "description": "Set allowPrivilegeEscalation in orborus container' Security Context", + "default": false + }, + "capabilities": { + "type": "object", + "properties": { + "drop": { + "type": "array", + "description": "List of capabilities to be dropped in orborus container", + "default": [ + "ALL" + ], + "items": { + "type": "string" + } + } + } + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Set seccomp profile in orborus container", + "default": "RuntimeDefault" + } + } + } + } + }, + "command": { + "type": "array", + "description": "Override default orborus container command (useful when using custom images)", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default orborus container args (useful when using custom images)", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in orborus pods", + "default": true + }, + "hostAliases": { + "type": "array", + "description": "orborus pods host aliases", + "default": [], + "items": {} + }, + "daemonsetAnnotations": { + "type": "object", + "description": "Annotations for orborus daemonset", + "default": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for orborus deployment", + "default": {} + }, + "statefulsetAnnotations": { + "type": "object", + "description": "Annotations for orborus statefulset", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for orborus pods", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for orborus pods", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard`", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `orborus.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `orborus.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for orborus pods assignment", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for orborus pods assignment", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for orborus pods assignment", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "orborus statefulset strategy type", + "default": "RollingUpdate" + } + } + }, + "podManagementPolicy": { + "type": "string", + "description": "Pod management policy for orborus statefulset", + "default": "OrderedReady" + }, + "priorityClassName": { + "type": "string", + "description": "orborus pods' priorityClassName", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for orborus pods", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds orborus pods need to terminate gracefully", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for orborus containers to automate configuration before or after startup", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to orborus containers", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for orborus containers", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for orborus containers", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the orborus pods", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the orborus containers", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the orborus pods", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the orborus pods", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for orborus pods", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for orborus pods", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the orborus service account", + "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the orborus service account", + "default": [], + "items": {} + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "worker": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "worker image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "worker image repository", + "default": "shuffle/shuffle-worker" + }, + "digest": { + "type": "string", + "description": "worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the worker service account", + "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the worker service account", + "default": [], + "items": {} + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "app": { + "type": "object", + "properties": { + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the app service account", + "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the app service account", + "default": [], + "items": {} + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "ingress": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable ingress record generation for frontend and backend", + "default": false + }, + "pathType": { + "type": "string", + "description": "Ingress path type for the frontend path", + "default": "Prefix" + }, + "backendPathType": { + "type": "string", + "description": "Ingress path type for the backend path", + "default": "Prefix" + }, + "apiVersion": { + "type": "string", + "description": "Force Ingress API version (automatically detected if not set)", + "default": "" + }, + "hostname": { + "type": "string", + "description": "Default host for the ingress record", + "default": "shuffle.local" + }, + "ingressClassName": { + "type": "string", + "description": "IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)", + "default": "nginx" + }, + "path": { + "type": "string", + "description": "Ingress path for Shuffle frontend", + "default": "\"/\"" + }, + "backendPath": { + "type": "string", + "description": "Ingress path for Shuffle backend", + "default": "\"/api/\"" + }, + "annotations": { + "type": "object", + "description": "Additional annotations for the Ingress resource.", + "default": {} + }, + "tls": { + "type": "boolean", + "description": "Enable TLS configuration for the host defined at `ingress.hostname` parameter", + "default": false + }, + "selfSigned": { + "type": "boolean", + "description": "Create a TLS secret for this ingress record using self-signed certificates generated by Helm", + "default": false + }, + "extraHosts": { + "type": "array", + "description": "An array with additional hostname(s) to be covered with the ingress record", + "default": [], + "items": {} + }, + "extraPaths": { + "type": "array", + "description": "An array with additional arbitrary paths that may need to be added to the ingress under the main host", + "default": [], + "items": {} + }, + "extraTls": { + "type": "array", + "description": "TLS configuration for additional hostname(s) to be covered with this ingress record", + "default": [], + "items": {} + }, + "secrets": { + "type": "array", + "description": "Custom TLS certificates as secrets", + "default": [], + "items": {} + }, + "extraRules": { + "type": "array", + "description": "Additional rules to be covered with this ingress record", + "default": [], + "items": {} + } + } + }, + "istio": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable creation of an Istio Gateway and VirtualService for frontend and backend", + "default": false + }, + "apiVersion": { + "type": "string", + "description": "The istio apiVersion to use for Gateway and VirtualService resources", + "default": "networking.istio.io/v1" + }, + "hosts": { + "type": "array", + "description": "One or more hosts exposed by Istio", + "default": [], + "items": {} + }, + "gateway": { + "type": "object", + "properties": { + "annotations": { + "type": "object", + "description": "Additional annotations for the Gateway resource", + "default": {} + }, + "http": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HTTP server port 80", + "default": true + }, + "httpsRedirect": { + "type": "boolean", + "description": "If set to true, a 301 redirect is send for all HTTP connections", + "default": false + } + } + }, + "https": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HTTPS server on port 443", + "default": false + }, + "tlsCredentialName": { + "type": "string", + "description": "The name of the secret that holds the TLS certs including the CA certificates.", + "default": "" + }, + "tlsCipherSuites": { + "type": "array", + "description": "If specified, only support the specified cipher list.", + "default": [], + "items": {} + } + } + }, + "extraServers": { + "type": "array", + "description": "Additional servers for the Gateway resource", + "default": [], + "items": {} + } + } + }, + "virtualService": { + "type": "object", + "properties": { + "annotations": { + "type": "object", + "description": "Additional annotations for the VirtualService resource.", + "default": {} + }, + "backendHeaders": { + "type": "object", + "description": "Header manipulation rules for backend traffic", + "default": {} + }, + "frontendHeaders": { + "type": "object", + "description": "Header manipulation rules for frontend traffic", + "default": {} + } + } + } + } + }, + "persistence": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable persistence using Persistent Volume Claims", + "default": true + }, + "apps": { + "type": "object", + "properties": { + "existingClaim": { + "type": "string", + "description": "Name of an existing PVC to use", + "default": "" + }, + "storageClass": { + "type": "string", + "description": "PVC Storage Class for shuffle-apps volume", + "default": "" + }, + "subPath": { + "type": "string", + "description": "The sub path used in the volume", + "default": "" + }, + "accessModes": { + "type": "array", + "description": "The access mode of the volume", + "default": [ + "ReadWriteOnce" + ], + "items": { + "type": "string" + } + }, + "size": { + "type": "string", + "description": "The size of the volume", + "default": "5Gi" + }, + "annotations": { + "type": "object", + "description": "Annotations for the PVC", + "default": {} + }, + "selector": { + "type": "object", + "description": "Selector to match an existing Persistent Volume", + "default": {} + } + } + }, + "appBuilder": { + "type": "object", + "properties": { + "storageClass": { + "type": "string", + "description": "PVC Storage Class for backend-apps-claim volume", + "default": "" + }, + "accessModes": { + "type": "array", + "description": "The access mode of the volume", + "default": [ + "ReadWriteOnce" + ], + "items": { + "type": "string" + } + }, + "size": { + "type": "string", + "description": "The size of the volume", + "default": "5Gi" + }, + "annotations": { + "type": "object", + "description": "Annotations for the PVC", + "default": {} + }, + "selector": { + "type": "object", + "description": "Selector to match an existing Persistent Volume", + "default": {} + } + } + }, + "files": { + "type": "object", + "properties": { + "existingClaim": { + "type": "string", + "description": "Name of an existing PVC to use", + "default": "" + }, + "storageClass": { + "type": "string", + "description": "PVC Storage Class for shuffle-files volume", + "default": "" + }, + "subPath": { + "type": "string", + "description": "The sub path used in the volume", + "default": "" + }, + "accessModes": { + "type": "array", + "description": "The access mode of the volume", + "default": [ + "ReadWriteOnce" + ], + "items": { + "type": "string" + } + }, + "size": { + "type": "string", + "description": "The size of the volume", + "default": "5Gi" + }, + "annotations": { + "type": "object", + "description": "Annotations for the PVC", + "default": {} + }, + "selector": { + "type": "object", + "description": "Selector to match an existing Persistent Volume", + "default": {} + } + } + } + } + }, + "volumePermissions": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup`", + "default": false + }, + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "OS Shell + Utility image registry", + "default": "docker.io" + }, + "repository": { + "type": "string", + "description": "OS Shell + Utility image repository", + "default": "bitnami/os-shell" + }, + "pullPolicy": { + "type": "string", + "description": "OS Shell + Utility image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "OS Shell + Utility image pull secrets", + "default": [], + "items": {} + } + } + }, + "resourcesPreset": { + "type": "string", + "description": "Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).", + "default": "nano" + }, + "resources": { + "type": "object", + "description": "Set init container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled init container' Security Context", + "default": true + }, + "runAsUser": { + "type": "number", + "description": "Set init container's Security Context runAsUser", + "default": 0 + } + } + } + } + }, + "opensearch": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Switch to enable or disable the opensearch helm chart", + "default": true + } + } + }, + "vault": { + "type": "object", + "properties": { + "role": { + "type": "string", + "description": "Specify the Vault role, which should be used to get the secret from Vault.", + "default": "" + }, + "secrets": { + "type": "array", + "description": "A list of VaultSecrets to create", + "default": [], + "items": {} + } + } + } + } +} \ No newline at end of file diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml new file mode 100644 index 00000000..35492f94 --- /dev/null +++ b/charts/shuffle/values.yaml @@ -0,0 +1,1834 @@ +--- +## @section Global parameters +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass +## + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s) +## +global: + imageRegistry: "" + ## e.g: + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + defaultStorageClass: "" + ## Compatibility adaptations for Kubernetes platforms + ## + compatibility: + ## Compatibility adaptations for Openshift + ## + openshift: + ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) + ## + adaptSecurityContext: auto + ## @param global.compatibility.omitEmptySeLinuxOptions If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object + ## + omitEmptySeLinuxOptions: false + +## @section Common parameters +## + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.name +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname +## +fullnameOverride: "" +## @param namespaceOverride String to fully override common.names.namespace +## +namespaceOverride: "" +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} +## @param clusterDomain Kubernetes cluster domain name +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release +## +extraDeploy: [] +## Diagnostic mode +## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) +## @param diagnosticMode.command Command to override all containers in the chart release +## @param diagnosticMode.args Args to override all containers in the chart release +## +diagnosticMode: + enabled: false + command: + - sleep + args: + - infinity + +## @section Shared Shuffle Parameters +## +shuffle: + ## @param shuffle.baseUrl The external base URL under which Shuffle is reachable. + ## + baseUrl: "" + + ## ref: https://shuffler.io/docs/organizations + ## This chart only supports single-tenant deployments at the moment + ## @param shuffle.org Default shuffle organization + ## + org: Shuffle + + ## @param shuffle.appRegistry The registry from / to which shuffle apps are pulled / pushed + ## + appRegistry: "" + + ## @param shuffle.timezone The timezone used by Shuffle + ## + timezone: Europe/Berlin + +## @section backend Parameters +## +backend: + ## backend image + ## @param backend.image.registry backend image registry + ## @param backend.image.repository backend image repository + ## @skip backend.image.tag backend image tag (immutable tags are recommended) + ## @param backend.image.digest backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## @param backend.image.pullPolicy backend image pull policy + ## @param backend.image.pullSecrets backend image pull secrets + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-backend + tag: nightly + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param backend.replicaCount Number of backend replicas to deploy + ## + replicaCount: 1 + ## @param backend.containerPorts.http backend HTTP container port + ## + containerPorts: + http: 5001 + ## @param backend.extraContainerPorts Optionally specify extra list of additional ports for backend containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] + ## Configure extra options for backend containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param backend.livenessProbe.enabled Enable livenessProbe on backend containers + ## @param backend.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param backend.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param backend.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param backend.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param backend.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param backend.readinessProbe.enabled Enable readinessProbe on backend containers + ## @param backend.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param backend.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param backend.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param backend.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param backend.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param backend.startupProbe.enabled Enable startupProbe on backend containers + ## @param backend.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param backend.startupProbe.periodSeconds Period seconds for startupProbe + ## @param backend.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param backend.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param backend.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param backend.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param backend.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param backend.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## backend resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param backend.resourcesPreset Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## Shuffle gets OOM killed with 256M memory during startup. Up to 360MiB of memory usage were observed during testing. + ## The small preset grants 512M. + ## + resourcesPreset: "small" + ## @param backend.resources Set backend container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param backend.podSecurityContext.enabled Enable backend pods' Security Context + ## @param backend.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for backend pods + ## @param backend.podSecurityContext.sysctls Set kernel settings using the sysctl interface for backend pods + ## @param backend.podSecurityContext.supplementalGroups Set filesystem extra groups for backend pods + ## @param backend.podSecurityContext.fsGroup Set fsGroup in backend pods' Security Context + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param backend.containerSecurityContext.enabled Enabled backend container' Security Context + ## @param backend.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in backend container + ## @param backend.containerSecurityContext.runAsUser Set runAsUser in backend container' Security Context + ## @param backend.containerSecurityContext.runAsGroup Set runAsGroup in backend container' Security Context + ## @param backend.containerSecurityContext.runAsNonRoot Set runAsNonRoot in backend container' Security Context + ## @param backend.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in backend container' Security Context + ## @param backend.containerSecurityContext.privileged Set privileged in backend container' Security Context + ## @param backend.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in backend container' Security Context + ## @param backend.containerSecurityContext.capabilities.drop List of capabilities to be dropped in backend container + ## @param backend.containerSecurityContext.seccompProfile.type Set seccomp profile in backend container + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + + ## @param backend.command Override default backend container command (useful when using custom images) + ## + command: [] + ## @param backend.args Override default backend container args (useful when using custom images) + ## + args: [] + ## @param backend.automountServiceAccountToken Mount Service Account token in backend pods + ## NOTE: backend requires the service account credentials to be mounted + ## + automountServiceAccountToken: true + ## @param backend.hostAliases backend pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param backend.daemonsetAnnotations Annotations for backend daemonset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + daemonsetAnnotations: {} + ## @param backend.deploymentAnnotations Annotations for backend deployment + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param backend.statefulsetAnnotations Annotations for backend statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param backend.podLabels Extra labels for backend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param backend.podAnnotations Annotations for backend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param backend.podAffinityPreset Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param backend.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node backend.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param backend.nodeAffinityPreset.type Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param backend.nodeAffinityPreset.key Node label key to match. Ignored if `backend.affinity` is set + ## + key: "" + ## @param backend.nodeAffinityPreset.values Node label values to match. Ignored if `backend.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param backend.affinity Affinity for backend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `backend.podAffinityPreset`, `backend.podAntiAffinityPreset`, and `backend.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param backend.nodeSelector Node labels for backend pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param backend.tolerations Tolerations for backend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## ONLY FOR DEPLOYMENTS: + ## @param backend.updateStrategy.type backend deployment strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ONLY FOR STATEFULSETS: + ## @param backend.updateStrategy.type backend statefulset strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## ONLY FOR DEPLOYMENTS: + ## Can be set to RollingUpdate or Recreate + ## ONLY FOR STATEFULSETS: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## ONLY FOR STATEFULSETS: + ## @param backend.podManagementPolicy Pod management policy for backend statefulset + ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies + ## + podManagementPolicy: OrderedReady + ## @param backend.priorityClassName backend pods' priorityClassName + ## + priorityClassName: "" + ## @param backend.topologySpreadConstraints Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param backend.schedulerName Name of the k8s scheduler (other than default) for backend pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param backend.terminationGracePeriodSeconds Seconds backend pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param backend.lifecycleHooks for backend containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param backend.extraEnvVars Array with extra environment variables to add to backend containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param backend.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for backend containers + ## + extraEnvVarsCM: "" + ## @param backend.extraEnvVarsSecret Name of existing Secret containing extra env vars for backend containers + ## + extraEnvVarsSecret: "" + ## @param backend.extraVolumes Optionally specify extra list of additional volumes for the backend pods + ## + extraVolumes: [] + ## @param backend.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the backend containers + ## + extraVolumeMounts: [] + ## @param backend.sidecars Add additional sidecar containers to the backend pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param backend.initContainers Add additional init containers to the backend pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param backend.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param backend.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param backend.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param backend.autoscaling.vpa.enabled Enable VPA for backend pods + ## @param backend.autoscaling.vpa.annotations Annotations for VPA resource + ## @param backend.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param backend.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param backend.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param backend.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param backend.autoscaling.hpa.enabled Enable HPA for backend pods + ## @param backend.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param backend.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param backend.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param backend.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param backend.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param backend.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param backend.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param backend.serviceAccount.automountServiceAccountToken Automount service account token for the backend service account + ## + automountServiceAccountToken: true + ## @param backend.serviceAccount.imagePullSecrets Add image pull secrets to the backend service account + ## + imagePullSecrets: [] + + ## RBAC configuration + ## + rbac: + ## @param backend.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param backend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param backend.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param backend.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param backend.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## NOTE: You likely want to allow access from your ingress, e.g.: + ## extraIngress: + ## - ports: + ## - protocol: TCP + ## port: 5001 + ## from: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-ingress + ## podSelector: + ## matchLabels: + ## istio: ingress + ## + extraIngress: [] + ## @param backend.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## NOTE: You likely want to allow access to OpenSearch and cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## - ports: + ## - protocol: TCP + ## port: 9200 + ## - protocol: TCP + ## port: 9300 + ## to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: shuffle + ## podSelector: + ## matchLabels: + ## app.kubernetes.io/name: opensearch + ## + extraEgress: [] + + ## @param backend.cleanupSchedule The interval in seconds at which the cleanup job runs + ## + cleanupSchedule: 300 + + ## OpenSearch configuration + ## + openSearch: + ## @param backend.openSearch.url The URL at which OpenSearch is available + ## + url: "http://{{ .Release.Name }}-opensearch:9200" + ## @param backend.openSearch.username The username that is used for authenticating with OpenSearch + ## + username: admin + ## @param backend.openSearch.certificateFile The path to a custom OpenSearch certificate file + ## + certificateFile: "" + ## @param backend.openSearch.skipSSLVerify Skip SSL verification + ## + skipSSLVerify: false + ## @param backend.openSearch.indexPrefix A prefix for OpenSearch indices + ## + indexPrefix: "" + + ## App configuration + ## + apps: + ## @param backend.apps.downloadLocation The location to a git repository from which default appps are downloaded on startup. + ## + downloadLocation: https://github.com/shuffle/python-apps + ## @param backend.apps.downloadBranch The branch from which apps should be downloaded on startup. + ## + downloadBranch: master + ## @param backend.apps.forceUpdate Force an update of apps on startup. + ## + forceUpdate: false + +## @section frontend Parameters +## +frontend: + ## frontend image + ## @param frontend.image.registry frontend image registry + ## @param frontend.image.repository frontend image repository + ## @skip frontend.image.tag frontend image tag (immutable tags are recommended) + ## @param frontend.image.digest frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## @param frontend.image.pullPolicy frontend image pull policy + ## @param frontend.image.pullSecrets frontend image pull secrets + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-frontend + tag: nightly + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param frontend.replicaCount Number of frontend replicas to deploy + ## + replicaCount: 1 + ## @param frontend.containerPorts.http frontend HTTP container port + ## @param frontend.containerPorts.https frontend HTTPS container port + ## + containerPorts: + http: 80 + https: 443 + ## @param frontend.extraContainerPorts Optionally specify extra list of additional ports for frontend containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] + ## Configure extra options for frontend containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param frontend.livenessProbe.enabled Enable livenessProbe on frontend containers + ## @param frontend.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param frontend.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param frontend.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param frontend.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param frontend.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param frontend.readinessProbe.enabled Enable readinessProbe on frontend containers + ## @param frontend.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param frontend.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param frontend.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param frontend.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param frontend.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param frontend.startupProbe.enabled Enable startupProbe on frontend containers + ## @param frontend.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param frontend.startupProbe.periodSeconds Period seconds for startupProbe + ## @param frontend.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param frontend.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param frontend.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param frontend.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param frontend.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param frontend.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## frontend resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param frontend.resourcesPreset Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param frontend.resources Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param frontend.podSecurityContext.enabled Enable frontend pods' Security Context + ## @param frontend.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for frontend pods + ## @param frontend.podSecurityContext.sysctls Set kernel settings using the sysctl interface for frontend pods + ## @param frontend.podSecurityContext.supplementalGroups Set filesystem extra groups for frontend pods + ## @param frontend.podSecurityContext.fsGroup Set fsGroup in frontend pods' Security Context + ## + podSecurityContext: + enabled: false + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param frontend.containerSecurityContext.enabled Enabled frontend container' Security Context + ## @param frontend.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in frontend container + ## @param frontend.containerSecurityContext.runAsUser Set runAsUser in frontend container' Security Context + ## @param frontend.containerSecurityContext.runAsGroup Set runAsGroup in frontend container' Security Context + ## @param frontend.containerSecurityContext.runAsNonRoot Set runAsNonRoot in frontend container' Security Context + ## @param frontend.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in frontend container' Security Context + ## @param frontend.containerSecurityContext.privileged Set privileged in frontend container' Security Context + ## @param frontend.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in frontend container' Security Context + ## @param frontend.containerSecurityContext.capabilities.drop List of capabilities to be dropped in frontend container + ## @param frontend.containerSecurityContext.seccompProfile.type Set seccomp profile in frontend container + ## + containerSecurityContext: + enabled: false + seLinuxOptions: {} + runAsUser: 101 + runAsGroup: 101 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + + ## @param frontend.command Override default frontend container command (useful when using custom images) + ## + command: [] + ## @param frontend.args Override default frontend container args (useful when using custom images) + ## + args: [] + ## @param frontend.automountServiceAccountToken Mount Service Account token in frontend pods + ## + automountServiceAccountToken: false + ## @param frontend.hostAliases frontend pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param frontend.daemonsetAnnotations Annotations for frontend daemonset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + daemonsetAnnotations: {} + ## @param frontend.deploymentAnnotations Annotations for frontend deployment + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param frontend.statefulsetAnnotations Annotations for frontend statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param frontend.podLabels Extra labels for frontend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param frontend.podAnnotations Annotations for frontend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param frontend.podAffinityPreset Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param frontend.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node frontend.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param frontend.nodeAffinityPreset.type Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param frontend.nodeAffinityPreset.key Node label key to match. Ignored if `frontend.affinity` is set + ## + key: "" + ## @param frontend.nodeAffinityPreset.values Node label values to match. Ignored if `frontend.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param frontend.affinity Affinity for frontend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `frontend.podAffinityPreset`, `frontend.podAntiAffinityPreset`, and `frontend.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param frontend.nodeSelector Node labels for frontend pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param frontend.tolerations Tolerations for frontend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## ONLY FOR DEPLOYMENTS: + ## @param frontend.updateStrategy.type frontend deployment strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ONLY FOR STATEFULSETS: + ## @param frontend.updateStrategy.type frontend statefulset strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## ONLY FOR DEPLOYMENTS: + ## Can be set to RollingUpdate or Recreate + ## ONLY FOR STATEFULSETS: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## ONLY FOR STATEFULSETS: + ## @param frontend.podManagementPolicy Pod management policy for frontend statefulset + ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies + ## + podManagementPolicy: OrderedReady + ## @param frontend.priorityClassName frontend pods' priorityClassName + ## + priorityClassName: "" + ## @param frontend.topologySpreadConstraints Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param frontend.schedulerName Name of the k8s scheduler (other than default) for frontend pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param frontend.terminationGracePeriodSeconds Seconds frontend pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param frontend.lifecycleHooks for frontend containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param frontend.extraEnvVars Array with extra environment variables to add to frontend containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param frontend.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for frontend containers + ## + extraEnvVarsCM: "" + ## @param frontend.extraEnvVarsSecret Name of existing Secret containing extra env vars for frontend containers + ## + extraEnvVarsSecret: "" + ## @param frontend.extraVolumes Optionally specify extra list of additional volumes for the frontend pods + ## + extraVolumes: [] + ## @param frontend.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the frontend containers + ## + extraVolumeMounts: [] + ## @param frontend.sidecars Add additional sidecar containers to the frontend pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param frontend.initContainers Add additional init containers to the frontend pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param frontend.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param frontend.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param frontend.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param frontend.autoscaling.vpa.enabled Enable VPA for frontend pods + ## @param frontend.autoscaling.vpa.annotations Annotations for VPA resource + ## @param frontend.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param frontend.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param frontend.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param frontend.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param frontend.autoscaling.hpa.enabled Enable HPA for frontend pods + ## @param frontend.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param frontend.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param frontend.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param frontend.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param frontend.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param frontend.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param frontend.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param frontend.serviceAccount.automountServiceAccountToken Automount service account token for the frontend service account + ## + automountServiceAccountToken: true + ## @param frontend.serviceAccount.imagePullSecrets Add image pull secrets to the frontend service account + ## + imagePullSecrets: [] + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param frontend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param frontend.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param frontend.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param frontend.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## NOTE: You likely want to allow access from your ingress, e.g.: + ## extraIngress: + ## - ports: + ## - protocol: TCP + ## port: 5001 + ## from: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-ingress + ## podSelector: + ## matchLabels: + ## istio: ingress + ## + extraIngress: [] + ## @param frontend.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## + extraEgress: [] + +## @section orborus Parameters +## +orborus: + ## orborus image + ## @param orborus.image.registry orborus image registry + ## @param orborus.image.repository orborus image repository + ## @skip orborus.image.tag orborus image tag (immutable tags are recommended) + ## @param orborus.image.digest orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## @param orborus.image.pullPolicy orborus image pull policy + ## @param orborus.image.pullSecrets orborus image pull secrets + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-orborus + tag: nightly + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param orborus.replicaCount Number of orborus replicas to deploy + ## + replicaCount: 1 + ## @param orborus.containerPorts.http orborus HTTP container port + ## + containerPorts: + http: 8080 + ## @param orborus.extraContainerPorts Optionally specify extra list of additional ports for orborus containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] + ## Configure extra options for orborus containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param orborus.livenessProbe.enabled Enable livenessProbe on orborus containers + ## @param orborus.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param orborus.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param orborus.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param orborus.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param orborus.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param orborus.readinessProbe.enabled Enable readinessProbe on orborus containers + ## @param orborus.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param orborus.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param orborus.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param orborus.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param orborus.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param orborus.startupProbe.enabled Enable startupProbe on orborus containers + ## @param orborus.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param orborus.startupProbe.periodSeconds Period seconds for startupProbe + ## @param orborus.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param orborus.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param orborus.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param orborus.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param orborus.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param orborus.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## orborus resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param orborus.resourcesPreset Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param orborus.resources Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param orborus.podSecurityContext.enabled Enable orborus pods' Security Context + ## @param orborus.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for orborus pods + ## @param orborus.podSecurityContext.sysctls Set kernel settings using the sysctl interface for orborus pods + ## @param orborus.podSecurityContext.supplementalGroups Set filesystem extra groups for orborus pods + ## @param orborus.podSecurityContext.fsGroup Set fsGroup in orborus pods' Security Context + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param orborus.containerSecurityContext.enabled Enabled orborus container' Security Context + ## @param orborus.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in orborus container + ## @param orborus.containerSecurityContext.runAsUser Set runAsUser in orborus container' Security Context + ## @param orborus.containerSecurityContext.runAsGroup Set runAsGroup in orborus container' Security Context + ## @param orborus.containerSecurityContext.runAsNonRoot Set runAsNonRoot in orborus container' Security Context + ## @param orborus.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in orborus container' Security Context + ## @param orborus.containerSecurityContext.privileged Set privileged in orborus container' Security Context + ## @param orborus.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in orborus container' Security Context + ## @param orborus.containerSecurityContext.capabilities.drop List of capabilities to be dropped in orborus container + ## @param orborus.containerSecurityContext.seccompProfile.type Set seccomp profile in orborus container + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 101 + runAsGroup: 101 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + + ## @param orborus.command Override default orborus container command (useful when using custom images) + ## + command: [] + ## @param orborus.args Override default orborus container args (useful when using custom images) + ## + args: [] + ## @param orborus.automountServiceAccountToken Mount Service Account token in orborus pods + ## NOTE: orborus requires the service account credentials to be mounted + ## + automountServiceAccountToken: true + ## @param orborus.hostAliases orborus pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param orborus.daemonsetAnnotations Annotations for orborus daemonset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + daemonsetAnnotations: {} + ## @param orborus.deploymentAnnotations Annotations for orborus deployment + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param orborus.statefulsetAnnotations Annotations for orborus statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param orborus.podLabels Extra labels for orborus pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param orborus.podAnnotations Annotations for orborus pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param orborus.podAffinityPreset Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param orborus.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node orborus.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param orborus.nodeAffinityPreset.type Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param orborus.nodeAffinityPreset.key Node label key to match. Ignored if `orborus.affinity` is set + ## + key: "" + ## @param orborus.nodeAffinityPreset.values Node label values to match. Ignored if `orborus.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param orborus.affinity Affinity for orborus pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `orborus.podAffinityPreset`, `orborus.podAntiAffinityPreset`, and `orborus.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param orborus.nodeSelector Node labels for orborus pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param orborus.tolerations Tolerations for orborus pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## ONLY FOR DEPLOYMENTS: + ## @param orborus.updateStrategy.type orborus deployment strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ONLY FOR STATEFULSETS: + ## @param orborus.updateStrategy.type orborus statefulset strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## ONLY FOR DEPLOYMENTS: + ## Can be set to RollingUpdate or Recreate + ## ONLY FOR STATEFULSETS: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## ONLY FOR STATEFULSETS: + ## @param orborus.podManagementPolicy Pod management policy for orborus statefulset + ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies + ## + podManagementPolicy: OrderedReady + ## @param orborus.priorityClassName orborus pods' priorityClassName + ## + priorityClassName: "" + ## @param orborus.topologySpreadConstraints Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param orborus.schedulerName Name of the k8s scheduler (other than default) for orborus pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param orborus.terminationGracePeriodSeconds Seconds orborus pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param orborus.lifecycleHooks for orborus containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param orborus.extraEnvVars Array with extra environment variables to add to orborus containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param orborus.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for orborus containers + ## + extraEnvVarsCM: "" + ## @param orborus.extraEnvVarsSecret Name of existing Secret containing extra env vars for orborus containers + ## + extraEnvVarsSecret: "" + ## @param orborus.extraVolumes Optionally specify extra list of additional volumes for the orborus pods + ## + extraVolumes: [] + ## @param orborus.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the orborus containers + ## + extraVolumeMounts: [] + ## @param orborus.sidecars Add additional sidecar containers to the orborus pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param orborus.initContainers Add additional init containers to the orborus pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param orborus.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param orborus.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param orborus.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param orborus.autoscaling.vpa.enabled Enable VPA for orborus pods + ## @param orborus.autoscaling.vpa.annotations Annotations for VPA resource + ## @param orborus.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param orborus.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param orborus.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param orborus.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param orborus.autoscaling.hpa.enabled Enable HPA for orborus pods + ## @param orborus.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param orborus.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param orborus.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param orborus.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param orborus.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param orborus.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param orborus.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param orborus.serviceAccount.automountServiceAccountToken Automount service account token for the orborus service account + ## + automountServiceAccountToken: true + ## @param orborus.serviceAccount.imagePullSecrets Add image pull secrets to the orborus service account + ## + imagePullSecrets: [] + + ## RBAC configuration + ## + rbac: + ## @param orborus.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param orborus.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param orborus.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param orborus.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param orborus.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: [] + ## @param orborus.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## NOTE: You likely want to allow access to cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## + extraEgress: [] + +## @section worker Parameters +## +worker: + ## worker image + ## @param worker.image.registry worker image registry + ## @param worker.image.repository worker image repository + ## @skip worker.image.tag worker image tag (immutable tags are recommended) + ## @param worker.image.digest worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-worker + tag: nightly + digest: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param worker.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param worker.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param worker.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param worker.serviceAccount.automountServiceAccountToken Automount service account token for the worker service account + ## + automountServiceAccountToken: true + ## @param worker.serviceAccount.imagePullSecrets Add image pull secrets to the worker service account + ## + imagePullSecrets: [] + + ## RBAC configuration + ## + rbac: + ## @param worker.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param worker.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param worker.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param worker.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param worker.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: [] + ## @param worker.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## NOTE: You likely want to allow access to cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## + extraEgress: [] + +## @section app Parameters +## +app: + ## ServiceAccount configuration + ## + serviceAccount: + ## @param app.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param app.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param app.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param app.serviceAccount.automountServiceAccountToken Automount service account token for the app service account + ## NOTE: You likely want to allow access to cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## + automountServiceAccountToken: true + ## @param app.serviceAccount.imagePullSecrets Add image pull secrets to the app service account + ## + imagePullSecrets: [] + + ## RBAC configuration + ## + rbac: + ## @param app.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param app.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param app.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param app.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param app.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: [] + ## @param app.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## + extraEgress: [] + +## @section Traffic Exposure Parameters +## + +## ingress parameters +## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/ +## +ingress: + ## @param ingress.enabled Enable ingress record generation for frontend and backend + ## + enabled: false + ## @param ingress.pathType Ingress path type for the frontend path + ## + pathType: Prefix + ## @param ingress.backendPathType Ingress path type for the backend path + ## + backendPathType: Prefix + ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) + ## + apiVersion: "" + ## @param ingress.hostname Default host for the ingress record + ## + hostname: shuffle.local + ## @param ingress.ingressClassName [default: nginx] IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) + ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster . + ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ + ## + ingressClassName: "" + ## @param ingress.path [default: "/"] Ingress path for Shuffle frontend + ## NOTE: The shuffle frontend currently does not support using base paths + ## + path: / + ## @param ingress.backendPath [default: "/api/"] Ingress path for Shuffle backend + ## NOTE: The shuffle backend is currently required to be reachable at shuffle-frontend.example.com/api/ + ## + backendPath: /api/ + ## @param ingress.annotations Additional annotations for the Ingress resource. + ## + annotations: {} + ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter + ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}` + ## You can: + ## - Use the `ingress.secrets` parameter to create this TLS secret + ## - Rely on cert-manager to create it by setting the corresponding annotations + ## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true` + ## + tls: false + ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm + ## + selfSigned: false + ## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record + ## e.g: + ## extraHosts: + ## - name: example.local + ## path: / + ## + extraHosts: [] + ## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host + ## e.g: + ## extraPaths: + ## - path: /* + ## backend: + ## serviceName: ssl-redirect + ## servicePort: use-annotation + ## + extraPaths: [] + ## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## e.g: + ## extraTls: + ## - hosts: + ## - example.local + ## secretName: example.local-tls + ## + extraTls: [] + ## @param ingress.secrets Custom TLS certificates as secrets + ## NOTE: 'key' and 'certificate' are expected in PEM format + ## NOTE: 'name' should line up with a 'secretName' set further up + ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates + ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## e.g: + ## secrets: + ## - name: example.local-tls + ## key: |- + ## -----BEGIN RSA PRIVATE KEY----- + ## ... + ## -----END RSA PRIVATE KEY----- + ## certificate: |- + ## -----BEGIN CERTIFICATE----- + ## ... + ## -----END CERTIFICATE----- + ## + secrets: [] + ## @param ingress.extraRules Additional rules to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules + ## e.g: + ## extraRules: + ## - host: example.local + ## http: + ## path: / + ## backend: + ## service: + ## name: example-svc + ## port: + ## name: http + ## + extraRules: [] + +## @section Istio Parameters +## +istio: + ## @param istio.enabled Enable creation of an Istio Gateway and VirtualService for frontend and backend + ## + enabled: false + + ## @param istio.apiVersion The istio apiVersion to use for Gateway and VirtualService resources + ## + apiVersion: networking.istio.io/v1 + + ## @param istio.hosts One or more hosts exposed by Istio + ## + hosts: [] + + gateway: + ## @param istio.gateway.annotations Additional annotations for the Gateway resource + ## + annotations: {} + ## @param istio.gateway.selector [object, default: { istio: ingress }] The selector matches the ingress gateway pod labels + ## + selector: + istio: ingress + ## @param istio.gateway.http.enabled Enable HTTP server port 80 + ## @param istio.gateway.http.httpsRedirect If set to true, a 301 redirect is send for all HTTP connections + ## + http: + enabled: true + httpsRedirect: false + ## @param istio.gateway.https.enabled Enable HTTPS server on port 443 + ## @param istio.gateway.https.tlsCredentialName The name of the secret that holds the TLS certs including the CA certificates. + ## @param istio.gateway.https.tlsCipherSuites If specified, only support the specified cipher list. + ## NOTE: The secret must exist in the namespace of the istio gateway pod + ## + https: + enabled: false + tlsCredentialName: "" + tlsCipherSuites: [] + ## @param istio.gateway.extraServers Additional servers for the Gateway resource + ## ref: https://istio.io/latest/docs/reference/config/networking/gateway/#Server + ## + extraServers: [] + + virtualService: + ## @param istio.virtualService.annotations Additional annotations for the VirtualService resource. + ## + annotations: {} + ## @param istio.virtualService.backendHeaders Header manipulation rules for backend traffic + ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers + ## + backendHeaders: {} + ## @param istio.virtualService.frontendHeaders Header manipulation rules for frontend traffic + ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers + ## + frontendHeaders: {} + +## @section Persistence Parameters +## + +## Enable persistence using Persistent Volume Claims +## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/ +## +persistence: + ## @param persistence.enabled Enable persistence using Persistent Volume Claims + ## + enabled: true + + ## @param persistence.apps.existingClaim Name of an existing PVC to use + ## @param persistence.apps.storageClass PVC Storage Class for shuffle-apps volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning + ## @param persistence.apps.subPath The sub path used in the volume + ## @param persistence.apps.accessModes The access mode of the volume + ## @param persistence.apps.size The size of the volume + ## @param persistence.apps.annotations Annotations for the PVC + ## @param persistence.apps.selector Selector to match an existing Persistent Volume + apps: + existingClaim: "" + storageClass: "" + subPath: "" + accessModes: + - ReadWriteOnce + size: 5Gi + annotations: {} + selector: {} + + ## @param persistence.appBuilder.storageClass PVC Storage Class for backend-apps-claim volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning + ## @param persistence.appBuilder.accessModes The access mode of the volume + ## @param persistence.appBuilder.size The size of the volume + ## @param persistence.appBuilder.annotations Annotations for the PVC + ## @param persistence.appBuilder.selector Selector to match an existing Persistent Volume + appBuilder: + storageClass: "" + accessModes: + - ReadWriteOnce + size: 5Gi + annotations: {} + selector: {} + + ## @param persistence.files.existingClaim Name of an existing PVC to use + ## @param persistence.files.storageClass PVC Storage Class for shuffle-files volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning + ## @param persistence.files.subPath The sub path used in the volume + ## @param persistence.files.accessModes The access mode of the volume + ## @param persistence.files.size The size of the volume + ## @param persistence.files.annotations Annotations for the PVC + ## @param persistence.files.selector Selector to match an existing Persistent Volume + files: + existingClaim: "" + storageClass: "" + subPath: "" + accessModes: + - ReadWriteOnce + size: 5Gi + annotations: {} + selector: {} + +## @section Init Container Parameters +## + +## 'volumePermissions' init container parameters +## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values +## based on the *podSecurityContext/*containerSecurityContext parameters +## +volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` + ## + enabled: false + ## OS Shell + Utility image + ## ref: https://hub.docker.com/r/bitnami/os-shell/tags/ + ## @param volumePermissions.image.registry OS Shell + Utility image registry + ## @param volumePermissions.image.repository OS Shell + Utility image repository + ## @skip volumePermissions.image.tag OS Shell + Utility image tag (immutable tags are recommended) + ## @param volumePermissions.image.pullPolicy OS Shell + Utility image pull policy + ## @param volumePermissions.image.pullSecrets OS Shell + Utility image pull secrets + ## + image: + registry: docker.io + repository: bitnami/os-shell + tag: 12-debian-12-r30 + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Init container's resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param volumePermissions.resourcesPreset Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param volumePermissions.resources Set init container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Init container Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param volumePermissions.containerSecurityContext.enabled Enabled init container' Security Context + ## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in init container + ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser + ## NOTE: when runAsUser is set to special value "auto", init container will try to chown the + ## data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` + ## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed) + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 0 + +## @section OpenSearch Parameters +## + +## OpenSearch chart configuration +## ref: https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml +## @param opensearch.enabled Switch to enable or disable the opensearch helm chart +## +opensearch: + enabled: true + +## @section Vault Parameters +## + +vault: + ## @param vault.role Specify the Vault role, which should be used to get the secret from Vault. + ## NOTE: This value is used as a default for all secrets and can be overwritten for individual secrets + ## with the vaultRole property. + ## + role: "" + + ## @param vault.secrets A list of VaultSecrets to create + ## NOTE: 'type', 'name' and 'path' must be set + ## type is the type of the Kubernetes secret + ## name is the suffix of the name of the resulting (Vault)Secret + ## path is the path of the corresponding secret in Vault + ## Additional VaultSecret parameters can optionally be set. + ## Ref: https://github.com/ricoberger/vault-secrets-operator/blob/0409d56beb36ab95c4582a0cc35c0a2b517961e7/api/v1alpha1/vaultsecret_types.go#L9-L59 + ## e.g: + ## secrets: + ## - type: Opaque + ## name: "example" + ## path: "example/secret" + ## + secrets: [] +## @section Other Parameters +## diff --git a/frontend/src/components/AppGrid.jsx b/frontend/src/components/AppGrid.jsx index 1f758a7e..8a5d9a18 100644 --- a/frontend/src/components/AppGrid.jsx +++ b/frontend/src/components/AppGrid.jsx @@ -116,7 +116,7 @@ const AppGrid = (props) => { }) .then((response) => response.json()) .then((response) => { - if (response.success === true) { + if (response?.success === true) { setFormMessage(response.reason); //toast("Thanks for submitting!") } else { @@ -307,7 +307,7 @@ const AppGrid = (props) => { }) .then(response => response.json()) .then(responseJson => { - if (responseJson.success) { + if (responseJson?.success) { setUserdata(responseJson); setAllActivatedAppIds(responseJson.active_apps) setIsLoggedIn(true); @@ -350,7 +350,7 @@ const AppGrid = (props) => { }) .then((response) => response.json()) .then((responseJson) => { - if (responseJson.success === false) { + if (responseJson?.success === false) { toast.error(responseJson.reason); } else { //toast.success(`App ${type}d Successfully!`); @@ -414,7 +414,7 @@ const AppGrid = (props) => { scrollbarColor: "#494949 #2f2f2f", }} > - {hits.map((data, index) => { + {hits?.map((data, index) => { const appUrl = isCloud === true ? `/apps/${data.objectID}` @@ -556,7 +556,7 @@ const AppGrid = (props) => { }} > - {data.tags.slice(0, 1).map((tag, tagIndex) => ( + {data?.tags?.slice(0, 1)?.map((tag, tagIndex) => ( {normalizedString(tag)} {tagIndex < 1 ? ", " : ""} @@ -569,7 +569,7 @@ const AppGrid = (props) => { ) : (
{data.tags && - data.tags.map((tag, tagIndex) => ( + data?.tags?.map((tag, tagIndex) => ( {normalizedString(tag)} {tagIndex < data.tags.length - 1 ? ", " : ""} @@ -760,7 +760,7 @@ const AppGrid = (props) => { }; const transformRefinementListItems = items => - items.map(item => ({ + items?.map(item => ({ ...item, label: item.label === 'true' ? 'App Editor' : 'Python', })); @@ -1103,7 +1103,7 @@ const AppGrid = (props) => { } }); - const categoryArray = Object.keys(categoryCountMap).map((category) => ({ + const categoryArray = Object.keys(categoryCountMap)?.map((category) => ({ category, count: categoryCountMap[category], })); @@ -1169,7 +1169,7 @@ const AppGrid = (props) => { {!isLoading && (
- {topCategories.map((data, index) => ( + {topCategories?.map((data, index) => (
- {topTags && topTags.length > 0 && topTags.map((data, index) => ( + {topTags && topTags.length > 0 && topTags?.map((data, index) => ( + + {fileCategories !== undefined && + fileCategories !== null && + fileCategories.length > 1 ? ( + + + { + setShowFileCategoryPopup(false) + }} + > + File Categories + + Please note that your selected files ({selectedFileId?.length}) will be moved to the {updateToThisCategory} category. + + + + + + + + ) : null} + +
+ {renderTextBox ? + + + + : + + + + } + + {renderTextBox && { + handleKeyDown(event); + if(event.key === 'Enter' && selectedFileId.length > 0){ + //setShowFileCategoryPopup(true) + setUpdateToThisCategory(event.target.value) + } + + }} + style={{ + height: 35, + width: 200, + marginTop: 0, + }} + InputProps={{ + style: { + color: "white", + height: 35, + fontSize: 16, + borderRadius: 4, + paddingTop: 0, + }, + }} + color="primary" + placeholder="Category name" + required + margin="dense" + defaultValue={""} + autoFocus + />}
{isSelectedDataStore? null : { ): listCache?.map((data, index) => { + var category = selectedCategory + if (selectedCategory === "default") { + category = "" + } + + if (data?.category === undefined && category === "") { + } else if (data?.category !== category) { + return null + } + var bgColor = isSelectedDataStore? "#212121":"#27292d"; if (index % 2 === 0) { bgColor = isSelectedDataStore? "#1A1A1A":"#1f2023"; diff --git a/frontend/src/components/EditWorkflow.jsx b/frontend/src/components/EditWorkflow.jsx index c07a7d2c..e06a1e0d 100644 --- a/frontend/src/components/EditWorkflow.jsx +++ b/frontend/src/components/EditWorkflow.jsx @@ -191,6 +191,10 @@ const EditWorkflow = (props) => { var upload = ""; var total_count = 0 + const isCloud = + window.location.host === "localhost:3002" || + window.location.host === "shuffler.io"; + return ( { All {userdata.orgs.map((data, index) => { + var skipOrg = false; if (data.creator_org !== undefined && data.creator_org !== null && data.creator_org === userdata.active_org.id) { // Finds the parent org @@ -631,6 +636,8 @@ const EditWorkflow = (props) => { return null } + const correctRegion = data?.region_url === userdata?.region_url + const imagesize = 22 const imageStyle = { width: imagesize, @@ -664,7 +671,11 @@ const EditWorkflow = (props) => { return ( - + {image}{" "} @@ -1135,14 +1146,26 @@ const EditWorkflow = (props) => {
+ - + + Publishing + + - Publishing is related to making the workflow itself public. When publishing a workflow, all the details (except sensitive info) become available to everyone. The details below will help a user understand this better. When a workflow is published, you keep the original, and a copy enters the workflow search, and is associated with your creator account, if you have one. You can always unpublish the workflow after. When ready to publish, click the three dots next to a workflow on the main workflow screen. After publishing, you can find it in the Shuffle search engine. + Publishing is related to making this workflow itself public. When publishing a workflow, all the details (except sensitive info) become available to anyone. The fields below will help a user and Shuffle's system understand your workflow better. When a workflow is published, you keep the original, and a copy enters the Shuffle workflow search, and is associated with your creator or partner account, if you have one. You can always unpublish the workflow after. When ready to publish, click the three dots next to a workflow on the main workflow page. + + You can always unpublish a workflow after. + { setInnerWorkflow(innerWorkflow) }} > - } label="Trigger" /> - } label="Subflow" /> - } label="Standalone" /> + + } label="Agentic" /> + + + + } label="Trigger" /> + + + + } label="Subflow" /> + + + + } label="Standalone" /> + diff --git a/frontend/src/components/Files.jsx b/frontend/src/components/Files.jsx index 8ca4a281..f825fb7f 100644 --- a/frontend/src/components/Files.jsx +++ b/frontend/src/components/Files.jsx @@ -89,7 +89,6 @@ const Files = memo((props) => { console.log('escape pressed') setRenderTextBox(false); } - } const changeDistribution = (id, selectedSubOrg) => { @@ -1051,6 +1050,7 @@ const Files = memo((props) => { ) : null} +
{renderTextBox ? diff --git a/frontend/src/components/LeftSideBar.jsx b/frontend/src/components/LeftSideBar.jsx index 0fe5bd3a..2db47c3a 100644 --- a/frontend/src/components/LeftSideBar.jsx +++ b/frontend/src/components/LeftSideBar.jsx @@ -721,11 +721,7 @@ useEffect(() => { margin_left: org.creator_org !== undefined && org.creator_org !== null && - org.creator_org.length > 0 - ? org.id === userdata.active_org.id - ? 0 - : 20 - : 0, + org.creator_org.length > 0 ? 20 : 0, }; }) || [] ); diff --git a/frontend/src/components/OrgHeaderexpandedNew.jsx b/frontend/src/components/OrgHeaderexpandedNew.jsx index 63adc751..a6616269 100644 --- a/frontend/src/components/OrgHeaderexpandedNew.jsx +++ b/frontend/src/components/OrgHeaderexpandedNew.jsx @@ -74,7 +74,7 @@ const OrgHeaderexpandedNew = (props) => { getContentAnchorEl: () => null, }; -const [orgName, setOrgName] = useState(selectedOrganization?.name); + const [orgName, setOrgName] = useState(selectedOrganization?.name); const [orgDescription, setOrgDescription] = React.useState( selectedOrganization.description ); @@ -180,41 +180,41 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); const [uploadUsername, setUploadUsername] = React.useState(selectedOrganization.defaults === undefined ? "" : selectedOrganization.defaults.workflow_upload_username === undefined || selectedOrganization.defaults.workflow_upload_username.length === 0 ? "" : selectedOrganization.defaults.workflow_upload_username) const [uploadToken, setUploadToken] = React.useState(selectedOrganization.defaults === undefined ? "" : selectedOrganization.defaults.workflow_upload_token === undefined || selectedOrganization.defaults.workflow_upload_token.length === 0 ? "" : selectedOrganization.defaults.workflow_upload_token) const [regionStatus, setRegionStatus] = useState(); - + useEffect(() => { if (documentationReference !== selectedOrganization?.defaults?.documentation_reference) { setDocumentationReference(selectedOrganization?.defaults?.documentation_reference) } - - if (uploadRepo !== selectedOrganization?.defaults?.workflow_upload_repo){ + + if (uploadRepo !== selectedOrganization?.defaults?.workflow_upload_repo) { setUploadRepo(selectedOrganization?.defaults?.workflow_upload_repo) } - if (uploadBranch !== selectedOrganization?.defaults?.workflow_upload_branch){ + if (uploadBranch !== selectedOrganization?.defaults?.workflow_upload_branch) { setUploadBranch(selectedOrganization?.defaults?.workflow_upload_branch) } - if (uploadUsername !== selectedOrganization?.defaults?.workflow_upload_username){ + if (uploadUsername !== selectedOrganization?.defaults?.workflow_upload_username) { setUploadUsername(selectedOrganization?.defaults?.workflow_upload_username) } - if (uploadToken !== selectedOrganization?.defaults?.workflow_upload_token){ + if (uploadToken !== selectedOrganization?.defaults?.workflow_upload_token) { setUploadToken(selectedOrganization?.defaults?.workflow_upload_token) } }, [selectedOrganization]) useEffect(() => { if (selectedOrganization !== undefined && selectedOrganization !== null) { - if((orgName === undefined || orgName === null || orgName.length === 0) && selectedOrganization?.name !== orgName) { + if ((orgName === undefined || orgName === null || orgName.length === 0) && selectedOrganization?.name !== orgName) { setOrgName(selectedOrganization?.name) } - if((orgDescription === undefined || orgDescription === null || orgDescription.length === 0) && selectedOrganization?.description !== orgDescription) { + if ((orgDescription === undefined || orgDescription === null || orgDescription.length === 0) && selectedOrganization?.description !== orgDescription) { setOrgDescription(selectedOrganization?.description) } } }, [selectedOrganization]) - + const handleEditOrg = ( name, description, @@ -262,21 +262,21 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); }); } - const handleSendChangeRegionMail = (region)=> { - if(selectedOrganization === undefined || selectedOrganization === null){ + const handleSendChangeRegionMail = (region) => { + if (selectedOrganization === undefined || selectedOrganization === null) { toast.error("Failed to send request for changing region. Please contact support@shuffler.io.") return } - let destinationRegion = region; - if (region === "US") { - destinationRegion = "us-west2"; - } else if (region === "EU") { - destinationRegion = "europe-west3"; - } else if (region === "CA") { - destinationRegion = "northamerica-northeast1"; - } else if (region === "UK") { - destinationRegion = "europe-west2"; - } + + const regionToCloudRegion = { + 'US': 'us-west2', + 'EU': 'europe-west3', + 'CA': 'northamerica-northeast1', + 'UK': 'europe-west2', + 'EU-2': 'europe-west3' + }; + + const destinationRegion = regionToCloudRegion[region] || region; var data = { dst_region: destinationRegion @@ -284,7 +284,7 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); toast.info("Sending request for changing region to " + region) - fetch(`${globalUrl}/api/v1/orgs/${selectedOrganization?.id}/change/region/request`,{ + fetch(`${globalUrl}/api/v1/orgs/${selectedOrganization?.id}/change/region/request`, { method: "POST", headers: { "Content-Type": "application/json", @@ -292,13 +292,13 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); }, credentials: "include", body: JSON.stringify(data), - }).then((response)=>{ - if(response.status !== 200){ + }).then((response) => { + if (response.status !== 200) { toast.error("Failed to send request for changing region. Please contact support@shuffler.io.") - }else{ - toast.success("successfully send request for changing region. We will contact you shortly.") + } else { + toast.success("Successfully sent request for region change. We will process the move and contact you shortly.") } - }).catch((err)=>{ + }).catch((err) => { console.log(err) toast.error("Failed to send request for changing region. Please contact support@shuffler.io.") }) @@ -307,13 +307,13 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); const setSelectedRegion = (region) => { // send a POST request to /api/v1/orgs/{org_id}/region with the region as the body - if(region === "US") { + if (region === "US") { region = "us-west2" - } else if(region === "EU") { + } else if (region === "EU") { region = "europe-west2" - } else if(region === "CA") { + } else if (region === "CA") { region = "northamerica-northeast1" - } else if(region === "UK") { + } else if (region === "UK") { region = "europe-west2" } else if (region === "EU-2") { region = "europe-west3" @@ -355,7 +355,7 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); const orgSaveButton = (
- + Preferences @@ -647,9 +650,9 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); - Org Documentation reference + Org Documentation reference - + Add a URL that is added as a link, pointing to any external documentation page you want. @@ -672,7 +675,7 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); placeholder="Paste a URL to an external reference for this implementation" value={documentationReference} onBlur={() => { - if(documentationReference !== selectedOrganization?.defaults?.documentation_reference) { + if (documentationReference !== selectedOrganization?.defaults?.documentation_reference) { handleEditOrg( orgName, orgDescription, @@ -714,7 +717,7 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); }, style: { color: "white", - + fontWeight: 400, fontSize: 16, borderRadius: 4, @@ -728,16 +731,16 @@ const [orgName, setOrgName] = useState(selectedOrganization?.name); globalUrl={globalUrl} userdata={userdata} serverside={false} - /> + /> - Workflow Backup Repository - - Decide where workflows are backed up in a Git repository. Will create logs and notifications if upload fails. The repository and branch must already have been initialized. Files will show up in the repo root in the /orgId/workflow-status/workflowId.json format. MSSP: If suborg exists, this will automatically be applied for them as well (not retroactive). Credentials are encrypted. + Workflow Backup Repository + + Decide where workflows are backed up in a Git repository. Will create logs and notifications if upload fails. The repository and branch must already have been initialized. Files will show up in the repo root in the /orgId/workflow-status/workflowId.json format. MSSP: If suborg exists, this will automatically be applied for them as well (not retroactive). Credentials are encrypted. - Repository for workflow backup + Repository for workflow backup - Branch + Branch - Username for backup of workflows + Username for backup of workflows - Git token/password + Git token/password { +const RegionChangeModal = memo(({ selectedOrganization, setSelectedRegion, userdata, handleSendChangeRegionMail }) => { // Show from options: "us-west2", "europe-west2", "europe-west3", "northamerica-northeast1" // var regions = ["us-west2", "europe-west2", "europe-west3", "northamerica-northeast1"] const regionMapping = { "US": "us", "EU-2": "eu", "CA": "ca", - "UK": "gb" + "UK": "gb", }; //let regiontag = "UK"; @@ -1095,6 +1098,7 @@ const RegionChangeModal = memo(({selectedOrganization, setSelectedRegion, userda let regionCode = "gb"; const regionsplit = selectedOrganization?.region_url?.split("."); + if (regionsplit?.length > 2 && !regionsplit[0]?.includes("shuffler")) { const namesplit = regionsplit[0]?.split("/"); regiontag = namesplit[namesplit.length - 1]; @@ -1103,58 +1107,59 @@ const RegionChangeModal = memo(({selectedOrganization, setSelectedRegion, userda regiontag = "US"; regionCode = "us"; } else if (regiontag === "frankfurt") { - regiontag = "EU"; + regiontag = "EU-2"; regionCode = "eu"; } else if (regiontag === "ca") { regiontag = "CA"; regionCode = "ca"; } } -return ( - - {/* Region */} - { + if (userdata?.support) { + setSelectedRegion(e.target.value) + } else { + handleSendChangeRegionMail(e.target.value) + } + }} + > + {Object.keys(regionMapping).map((region, index) => { + const regionImageCode = regionMapping[region]; + // Set the default region if selectedOrganization.region is not set + if (selectedOrganization.region === undefined) { + selectedOrganization.region = "europe-west2"; + } + + // Check if the current region matches the selected region + if (region === selectedOrganization.region) { + // If the region matches, set the MenuItem as selected + return ( + + {/* show region image through cdn */} + {region} + {region} + + ); + } else { + return + {region} {region} - - ); - } else { - return - {region} - {region} ; - } - })} - - -); + } + })} + + + ); }) diff --git a/frontend/src/components/ParsedAction.jsx b/frontend/src/components/ParsedAction.jsx index 85840e8d..e035724d 100755 --- a/frontend/src/components/ParsedAction.jsx +++ b/frontend/src/components/ParsedAction.jsx @@ -214,6 +214,20 @@ const ParsedAction = (props) => { } }, [expansionModalOpen]) + /* + useEffect(() => { + // This will have the OLD selectedAction, not the new one huh? + // How do we map the fields correctly? + if (selectedAction === undefined || selectedAction === null) { + console.log("Selected action is undefined") + return + } + + console.log("Selected action: ", selectedAction?.name, selectedAction) + + }, [selectedAction]) + */ + useEffect(() => { // Changes the order of params to show in order: // auth, required, optional @@ -347,7 +361,7 @@ const ParsedAction = (props) => { } if (keyorder.join(",") !== newkeyorder.join(",")) { - //toast("KEYORDER CHANGED!") + console.log("KEYORDER CHANGED! DID ACTION AS WELL?", keyorder, newkeyorder) setSelectedActionParameters(newparams) selectedAction.parameters = newparams @@ -872,7 +886,7 @@ const ParsedAction = (props) => { } } return { ...param, value: paramvalue, error: message } - }); + }) setSelectedActionParameters(newParameters) setActionlist(newActionList) @@ -3645,6 +3659,14 @@ const ParsedAction = (props) => { ); + if ((multiline === undefined || multiline === false) && ((data?.autocompleted === true || data?.field_active === true) || data.name.startsWith("${") && data.name.endsWith("}"))) { + multiline = true + } + + if (data?.autocompleted === true || data?.field_active === true) { + rows = "1" + } + var datafield = ( { setScrollConfig(scrollConfig) } }} - rows={data.name.startsWith("${") && data.name.endsWith("}") ? 2 : rows} + minRows={rows} + maxRows={6} color="primary" // defaultValue={data.value} value={ @@ -4034,7 +4057,8 @@ const ParsedAction = (props) => { helperText={returnHelperText(data.name, data.value)} fullWidth multiline={multiline} - rows={"3"} + minRows={3} + maxRows={6} color="primary" defaultValue={data.value} type={"text"} @@ -4580,7 +4604,7 @@ const ParsedAction = (props) => { data.field_active === true ? { var imageSource = ""; if (params?.row?.org?.id?.length > 0) { if (params?.row?.org?.image?.length > 0){ - imageSource = params.row.org.image + imageSource = params?.row.org?.image }else { imageSource = "/images/no_image.png" } }else { if (userdata.active_org.image?.length > 0){ - imageSource = userdata.active_org.image + imageSource = userdata?.active_org?.image }else { imageSource = "/images/no_image.png" } @@ -370,7 +370,7 @@ const RuntimeDebugger = (props) => { { //setStatus(params.row.status) }}> - {userdata?.active_org?.creator_org?.length === 0 ? ( + {userdata?.active_org?.creator_org?.length === 0 && suborgWorkflowRuns ? ( {source} ) : null} @@ -924,28 +924,13 @@ const RuntimeDebugger = (props) => { onClick={() => setSearchQuery('')} /> )} - ), }} onChange={(e)=>{handleQueryChange(e)}} color="primary" - placeholder="Filter by Workflow Name, Status, Execution Argument, Results.." + placeholder="Filter by Workflow Name, Status, Execution Argument, Results" id="shuffle_search_field" />
diff --git a/frontend/src/components/SearchData.jsx b/frontend/src/components/SearchData.jsx index 08139472..0a53e7e9 100644 --- a/frontend/src/components/SearchData.jsx +++ b/frontend/src/components/SearchData.jsx @@ -109,6 +109,12 @@ const SearchData = props => { } }, [searchOpen]); + useEffect(() => { + if (currentRefinement !== inputValue) { + refine(inputValue); + } + }, [currentRefinement]); + return (
diff --git a/frontend/src/views/RunWorkflow.jsx b/frontend/src/views/RunWorkflow.jsx index 34b8c38c..883051a3 100644 --- a/frontend/src/views/RunWorkflow.jsx +++ b/frontend/src/views/RunWorkflow.jsx @@ -77,6 +77,24 @@ const RunWorkflow = (defaultprops) => { const [boxWidth, setBoxWidth] = React.useState(500) const [inputQuestions, setInputQuestions] = React.useState([]) + + useEffect(() => { + if (workflow === undefined || workflow === null || Object.keys(workflow).length === 0) { + return + } + + if (workflow.input_questions === undefined || workflow.input_questions === null) { + return + } + + // Checks if it's a user input-node based or not + if ((answer !== undefined && answer !== null) || (foundSourcenode !== undefined && foundSourcenode !== null)) { + } else { + setInputQuestions(workflow.input_questions) + setUpdate(Math.random()) + } + }, [workflow]) + const IframeWrapper = (props) => { var propsCopy = JSON.parse(JSON.stringify(props)) propsCopy.width = 400 diff --git a/frontend/src/views/Welcome.jsx b/frontend/src/views/Welcome.jsx index 7dd21dea..cb5c24c5 100644 --- a/frontend/src/views/Welcome.jsx +++ b/frontend/src/views/Welcome.jsx @@ -447,6 +447,7 @@ const Welcome = (props) => { } navigate("/welcome?tab=2") + setActiveStep(1) setShowWelcome(true) }}> diff --git a/frontend/src/views/Workflows.jsx b/frontend/src/views/Workflows.jsx index b9baf567..30376769 100755 --- a/frontend/src/views/Workflows.jsx +++ b/frontend/src/views/Workflows.jsx @@ -553,6 +553,10 @@ export const validateJson = (showResult) => { // Check fields if they can be parsed too try { for (const [key, value] of Object.entries(result)) { + if (typeof value === "string") { + value = value.replaceAll(" ", "_") + } + if (typeof value === "string" && (value.startsWith("{") || value.startsWith("["))) { //console.log("CHECKING STRING: ", value) @@ -573,6 +577,10 @@ export const validateJson = (showResult) => { // Usually only reaches here if raw array > dict > value if (typeof showResult !== "array") { for (const [subkey, subvalue] of Object.entries(value)) { + if (typeof subvalue === "string") { + subvalue = subvalue.replaceAll(" ", "_") + } + if (typeof subvalue === "string" && (subvalue.startsWith("{") || subvalue.startsWith("["))) { const inside_result = validateJson(subvalue) if (inside_result.valid) { @@ -1841,9 +1849,13 @@ const Workflows = (props) => { var parsedworkflows = []; for (var key in newSubflows) { + if (key === data.id) { + continue + } + const foundWorkflow = workflows.find( (workflow) => workflow.id === newSubflows[key] - ); + ) if (foundWorkflow !== undefined && foundWorkflow !== null) { parsedworkflows.push(foundWorkflow); } @@ -1854,7 +1866,7 @@ const Workflows = (props) => { "Appending subflows during export: ", parsedworkflows.length ); - data.subflows = parsedworkflows; + data.subflows = parsedworkflows } } diff --git a/frontend/src/views/Workflows2.jsx b/frontend/src/views/Workflows2.jsx index 0491b40c..f03b8f97 100644 --- a/frontend/src/views/Workflows2.jsx +++ b/frontend/src/views/Workflows2.jsx @@ -1935,6 +1935,10 @@ const Workflows2 = (props) => { var parsedworkflows = []; for (var key in newSubflows) { + if (key === data.id) { + continue + } + const foundWorkflow = workflows.find( (workflow) => workflow.id === newSubflows[key] ); @@ -2362,7 +2366,6 @@ const Workflows2 = (props) => { { setDeleteModalOpen(true); setSelectedWorkflowId(data.id); diff --git a/functions/onprem/orborus/go.mod b/functions/onprem/orborus/go.mod index 9369e1dc..ecf3171b 100644 --- a/functions/onprem/orborus/go.mod +++ b/functions/onprem/orborus/go.mod @@ -10,7 +10,7 @@ require ( github.com/docker/docker v27.5.0+incompatible github.com/docker/go-connections v0.5.0 github.com/satori/go.uuid v1.2.0 - github.com/shuffle/shuffle-shared v0.7.95 + github.com/shuffle/shuffle-shared v0.8.0 k8s.io/api v0.30.2 k8s.io/apimachinery v0.30.2 ) diff --git a/functions/onprem/orborus/go.sum b/functions/onprem/orborus/go.sum index 4caf4280..e077c2a4 100644 --- a/functions/onprem/orborus/go.sum +++ b/functions/onprem/orborus/go.sum @@ -319,6 +319,8 @@ github.com/shuffle/shuffle-shared v0.7.82 h1:La11F5jp9bNtM3VuR9PawyWo90/vZ+1Txo4 github.com/shuffle/shuffle-shared v0.7.82/go.mod h1:bBXhEsPKjxln0mFnSeri7gIJ3tL/636Sh5NyTyNrvIQ= github.com/shuffle/shuffle-shared v0.7.83 h1:OyyDo0ii8rOYHN5wGbcM94JuDKLmbZ9jhMQ0+/KMb0A= github.com/shuffle/shuffle-shared v0.7.83/go.mod h1:bBXhEsPKjxln0mFnSeri7gIJ3tL/636Sh5NyTyNrvIQ= +github.com/shuffle/shuffle-shared v0.7.96 h1:mH6Bkzn8QIFntkcUxPfyMZJY2r7PNKfc0zWYjZXYQm8= +github.com/shuffle/shuffle-shared v0.7.96/go.mod h1:bBXhEsPKjxln0mFnSeri7gIJ3tL/636Sh5NyTyNrvIQ= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go index 093faf79..72afaa6c 100755 --- a/functions/onprem/orborus/orborus.go +++ b/functions/onprem/orborus/orborus.go @@ -142,6 +142,7 @@ func init() { os.Setenv("SHUFFLE_PIPELINE_AUTH", pipelineApikey) } } + } // form id of current running container @@ -1239,18 +1240,20 @@ func deployK8sWorker(image string, identifier string, env []string) error { } func deployWorker(image string, identifier string, env []string, executionRequest shuffle.ExecutionRequest) error { + + if len(os.Getenv("REGISTRY_URL")) > 0 && os.Getenv("REGISTRY_URL") != "" { env = append(env, fmt.Sprintf("REGISTRY_URL=%s", os.Getenv("REGISTRY_URL"))) } - // if isKubernetes == "true" { - // err := deployK8sWorker(image, identifier, env, executionRequest) - // if err != nil { - // log.Printf("[ERROR] Failed deploying Kubernetes worker: %s", err) - // } + if swarmConfig == "run" || swarmConfig == "swarm" || isKubernetes == "true" { + // FIXME: Should we handle replies properly? + // In certain cases, a workflow may e.g. be aborted already. If it's aborted, that returns + // a 401 from the worker, which returns an error here + go sendWorkerRequest(executionRequest, image, env) - // return err - // } + return nil + } // Binds is the actual "-v" volume. // Max 20% CPU every second @@ -1298,6 +1301,10 @@ func deployWorker(image string, identifier string, env []string, executionReques } } + + //var swarmConfig = os.Getenv("SHUFFLE_SWARM_CONFIG") + parsedUuid := uuid.NewV4() + config := &container.Config{ Image: image, Env: env, @@ -1305,22 +1312,12 @@ func deployWorker(image string, identifier string, env []string, executionReques if isKubernetes != "true" { hostConfig.NetworkMode = container.NetworkMode(fmt.Sprintf("container:%s", containerId)) + if strings.ToLower(cleanupEnv) != "false" { hostConfig.AutoRemove = true } } - //var swarmConfig = os.Getenv("SHUFFLE_SWARM_CONFIG") - parsedUuid := uuid.NewV4() - if swarmConfig == "run" || swarmConfig == "swarm" || isKubernetes == "true" { - // FIXME: Should we handle replies properly? - // In certain cases, a workflow may e.g. be aborted already. If it's aborted, that returns - // a 401 from the worker, which returns an error here - go sendWorkerRequest(executionRequest, image, env) - - return nil - } - //log.Printf("[INFO] Identifier: %s", identifier) cont, err := dockercli.ContainerCreate( context.Background(), @@ -1354,6 +1351,8 @@ func deployWorker(image string, identifier string, env []string, executionReques } } + log.Printf("WORKER STARTING WITH ENV: %#v", env) + containerStartOptions := container.StartOptions{} err = dockercli.ContainerStart(context.Background(), cont.ID, containerStartOptions) if err != nil { @@ -1388,27 +1387,30 @@ func deployWorker(image string, identifier string, env []string, executionReques log.Printf("[INFO][%s] Worker Container created (2). Environment %s: docker logs %s", executionRequest.ExecutionId, environment, cont.ID) } - //stats, err := cli.ContainerInspect(context.Background(), containerName) - //if err != nil { - // log.Printf("Failed checking worker %s", containerName) - // return - //} + stats, err := dockercli.ContainerInspect(context.Background(), containerName) + if err != nil { + log.Printf("[WARNING] Failed checking worker %s", containerName) + return nil + } - //containerStatus := stats.ContainerJSONBase.State.Status - //if containerStatus != "running" { - // log.Printf("Status of %s is %s. Should be running. Will reset", containerName, containerStatus) - // err = stopWorker(containerName) - // if err != nil { - // log.Printf("Failed stopping worker %s", execution.ExecutionId) - // return - // } + containerStatus := stats.ContainerJSONBase.State.Status + if containerStatus != "running" { + log.Printf("[ERROR] Status of %s is %s. Should be running. Will reset", containerName, containerStatus) + } + /* + err = stopWorker(containerName) + if err != nil { + log.Printf("Failed stopping worker %s", execution.ExecutionId) + return nil + } - // err = deployWorke(cli, workerImage, containerName, env) - // if err != nil { - // log.Printf("Failed executing worker %s in state %s", execution.ExecutionId, containerStatus) - // return - // } - //} + err = deployWorker(dockercli, workerImage, containerName, env) + if err != nil { + log.Printf("Failed executing worker %s in state %s", execution.ExecutionId, containerStatus) + return nil + } + } + */ } else { log.Printf("[INFO][%s] New Worker created. Environment %s: docker logs %s", executionRequest.ExecutionId, environment, cont.ID) } @@ -1917,6 +1919,10 @@ func main() { cleanupEnv = "true" } + if len(cleanupEnv) > 0 { + log.Printf("[DEBUG] Verbose mode. NOT cleaning up. Cleanup env: %s", cleanupEnv) + } + workerTimeout := 600 if workerTimeoutEnv != "" { tmpInt, err := strconv.Atoi(workerTimeoutEnv) diff --git a/functions/onprem/worker/go.mod b/functions/onprem/worker/go.mod index 209dd0db..885c11b7 100644 --- a/functions/onprem/worker/go.mod +++ b/functions/onprem/worker/go.mod @@ -8,7 +8,7 @@ require ( github.com/docker/docker v27.5.0+incompatible github.com/gorilla/mux v1.8.1 github.com/satori/go.uuid v1.2.0 - github.com/shuffle/shuffle-shared v0.7.95 + github.com/shuffle/shuffle-shared v0.8.0 k8s.io/api v0.30.2 k8s.io/apimachinery v0.30.2 k8s.io/client-go v0.30.2