marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1692 from P4sca1/k8s-shuffle-app-ports

Browse Source 
feat(k8s): allow to change exposed app port
This commit is contained in:
Frikky
2025-05-18 22:49:05 +02:00
committed by GitHub
parent 6358d94984 ed70913be5
commit 4d1bdf6a0c
7 changed files with 52 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/kubernetes/charts/shuffle/README.md
+14 -3
View File
@@ -514,8 +514,20 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### app Parameters
| Name | Description | Value |
| ------------------------------------------------------- | ---------------------------------------------------------------------------------- | ---------------- |
| Name | Description | Value |
| ------------------------------------------------- | ---------------------------------------------------------------------------------- | ------ |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| `app.exposedContainerPort` | The port that shuffle app containers will listen on for new requests. | `80` |
| `app.podSecurityContext.enabled` | Enable app pods' Security Context | `true` |
| `app.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for app pods | `Always` |
| `app.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for app pods | `[]` |
@@ -640,4 +652,3 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### Other Parameters
functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml
+2
View File
@@ -88,6 +88,8 @@ spec:
value: "true"
- name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.worker.serviceAccount.name" . }}
- name: SHUFFLE_APP_EXPOSED_PORT
value: {{ .Values.app.exposedContainerPort | quote }}
{{- if .Values.worker.podSecurityContext.enabled }}
- name: SHUFFLE_WORKER_POD_SECURITY_CONTEXT
value: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
+7 -6
View File
@@ -54,17 +54,18 @@ spec:
{{- end }}
{{- end }}
ingress:
{{- if .Values.app.networkPolicy.allowExternal }}
- {}
{{- else }}
# Allow access from workers. Apps will typicaly use port 80/TCP, but this is not enforced.
- from:
- ports:
- port: {{ .Values.app.exposedContainerPort }}
protocol: TCP
{{- if not .Values.app.networkPolicy.allowExternal }}
# Allow traffic from workers
from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
{{- end }}
{{- end }}
{{- if .Values.app.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
functions/kubernetes/charts/shuffle/values.schema.json
+5
View File
@@ -2438,6 +2438,11 @@
"items": {}
}
}
},
"exposedContainerPort": {
"type": "number",
"description": "The port that shuffle app containers will listen on for new requests. ",
"default": 80
}
}
},
functions/kubernetes/charts/shuffle/values.yaml
+4
View File
@@ -1549,6 +1549,10 @@ app:
##
extraEgress: []
## @param app.exposedContainerPort The port that shuffle app containers will listen on for new requests.
##
exposedContainerPort: 80
## @section Traffic Exposure Parameters
##
functions/onprem/orborus/orborus.go
+4
View File
@@ -1000,6 +1000,10 @@ func deployK8sWorker(image string, identifier string, env []string) error {
env = append(env, fmt.Sprintf("SHUFFLE_USE_GHCR_OVERRIDE_FOR_AUTODEPLOY=%s", os.Getenv("SHUFFLE_USE_GHCR_OVERRIDE_FOR_AUTODEPLOY")))
}
if len(os.Getenv("SHUFFLE_APP_EXPOSED_PORT")) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_EXPOSED_PORT=%s", os.Getenv("SHUFFLE_APP_EXPOSED_PORT")))
}
if len(appServiceAccountName) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_SERVICE_ACCOUNT_NAME=%s", appServiceAccountName))
}
functions/onprem/worker/worker.go
+16 -8
View File
@@ -404,6 +404,11 @@ func deployk8sApp(image string, identifier string, env []string) error {
kubernetesNamespace = "default"
}
deployport, err := strconv.Atoi(os.Getenv("SHUFFLE_APP_EXPOSED_PORT"))
if err != nil {
deployport = 80
}
envMap := make(map[string]string)
for _, envStr := range env {
parts := strings.SplitN(envStr, "=", 2)
@@ -413,9 +418,7 @@ func deployk8sApp(image string, identifier string, env []string) error {
}
// add to env
// fmt.Sprintf("SHUFFLE_APP_EXPOSED_PORT=%d", deployport),
// fmt.Sprintf("SHUFFLE_SWARM_CONFIG=%s", os.Getenv("SHUFFLE_SWARM_CONFIG")),
envMap["SHUFFLE_APP_EXPOSED_PORT"] = "80"
envMap["SHUFFLE_APP_EXPOSED_PORT"] = strconv.Itoa(deployport)
envMap["SHUFFLE_SWARM_CONFIG"] = os.Getenv("SHUFFLE_SWARM_CONFIG")
envMap["BASE_URL"] = "http://shuffle-workers:33333"
@@ -623,9 +626,15 @@ func deployk8sApp(image string, identifier string, env []string) error {
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: value,
Image: image,
Env: buildEnvVars(envMap),
Name: value,
Image: image,
Env: buildEnvVars(envMap),
Ports: []corev1.ContainerPort{
{
Protocol: "TCP",
ContainerPort: int32(deployport),
},
},
SecurityContext: containerSecurityContext,
},
},
@@ -643,7 +652,6 @@ func deployk8sApp(image string, identifier string, env []string) error {
return err
}
// kubectl expose deployment {podName} --type=NodePort --port=80 --target-port=80
service := &corev1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: name,
@@ -655,7 +663,7 @@ func deployk8sApp(image string, identifier string, env []string) error {
{
Protocol: "TCP",
Port: 80,
TargetPort: intstr.FromInt(80),
TargetPort: intstr.FromInt(deployport),
},
},
Type: corev1.ServiceTypeNodePort,