marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'nightly' of https://github.com/shuffle/shuffle into nightly

Browse Source
This commit is contained in:
Frikky
2025-05-18 22:45:29 +02:00
parent 8db79e24f5 d61fe9681d
commit 6358d94984
11 changed files with 506 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/kubernetes/charts/shuffle/README.md
+65 -31
View File
@@ -217,7 +217,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `backend.affinity` | Affinity for backend pods assignment | `{}` |
| `backend.nodeSelector` | Node labels for backend pods assignment | `{}` |
| `backend.tolerations` | Tolerations for backend pods assignment | `[]` |
| `backend.updateStrategy.type` | backend deployment strategy type | `RollingUpdate` |
| `backend.updateStrategy.type` | backend deployment strategy type | `Recreate` |
| `backend.priorityClassName` | backend pods' priorityClassName | `""` |
| `backend.topologySpreadConstraints` | Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | `[]` |
| `backend.schedulerName` | Name of the k8s scheduler (other than default) for backend pods | `""` |
@@ -244,6 +244,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `backend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `backend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `backend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `backend.service.labels` | Extra labels for backend service | `{}` |
| `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -359,6 +360,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `frontend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `frontend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `frontend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `frontend.service.labels` | Extra labels for frontend service | `{}` |
| `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -477,39 +479,69 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### worker Parameters
| Name | Description | Value |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| Name | Description | Value |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.podSecurityContext.enabled` | Enable worker pods' Security Context | `true` |
| `worker.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for worker pods | `Always` |
| `worker.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for worker pods | `[]` |
| `worker.podSecurityContext.supplementalGroups` | Set filesystem extra groups for worker pods | `[]` |
| `worker.podSecurityContext.fsGroup` | Set fsGroup in worker pods' Security Context | `1001` |
| `worker.containerSecurityContext.enabled` | Enabled worker container' Security Context | `true` |
| `worker.containerSecurityContext.seLinuxOptions` | Set SELinux options in worker container | `{}` |
| `worker.containerSecurityContext.runAsUser` | Set runAsUser in worker container' Security Context | `1001` |
| `worker.containerSecurityContext.runAsGroup` | Set runAsGroup in worker container' Security Context | `1001` |
| `worker.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in worker container' Security Context | `true` |
| `worker.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in worker container' Security Context | `true` |
| `worker.containerSecurityContext.privileged` | Set privileged in worker container' Security Context | `false` |
| `worker.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in worker container' Security Context | `false` |
| `worker.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in worker container | `["ALL"]` |
| `worker.containerSecurityContext.seccompProfile.type` | Set seccomp profile in worker container | `RuntimeDefault` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### app Parameters
| Name | Description | Value |
| ------------------------------------------------- | ---------------------------------------------------------------------------------- | ------ |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| Name | Description | Value |
| ------------------------------------------------------- | ---------------------------------------------------------------------------------- | ---------------- |
| `app.podSecurityContext.enabled` | Enable app pods' Security Context | `true` |
| `app.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for app pods | `Always` |
| `app.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for app pods | `[]` |
| `app.podSecurityContext.supplementalGroups` | Set filesystem extra groups for app pods | `[]` |
| `app.podSecurityContext.fsGroup` | Set fsGroup in app pods' Security Context | `1001` |
| `app.containerSecurityContext.enabled` | Enabled app container' Security Context | `true` |
| `app.containerSecurityContext.seLinuxOptions` | Set SELinux options in app container | `{}` |
| `app.containerSecurityContext.runAsUser` | Set runAsUser in app container' Security Context | `1001` |
| `app.containerSecurityContext.runAsGroup` | Set runAsGroup in app container' Security Context | `1001` |
| `app.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in app container' Security Context | `true` |
| `app.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in app container' Security Context | `true` |
| `app.containerSecurityContext.privileged` | Set privileged in app container' Security Context | `false` |
| `app.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in app container' Security Context | `false` |
| `app.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in app container | `["ALL"]` |
| `app.containerSecurityContext.seccompProfile.type` | Set seccomp profile in app container | `RuntimeDefault` |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### Traffic Exposure Parameters
@@ -607,3 +639,5 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### Other Parameters
functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml
+4 -2
View File
@@ -8,18 +8,20 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
BACKEND_PORT: "5001"
BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}"
{{- if .Values.shuffle.baseUrl }}
BASE_URL: "{{ .Values.shuffle.baseUrl }}"
SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
{{- else }}
BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
{{- end }}
ORG_ID: "{{ .Values.shuffle.org }}"
SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
SHUFFLE_CHAT_DISABLED: "true"
# Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address
SHUFFLE_CLOUDRUN_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"
functions/kubernetes/charts/shuffle/templates/backend/backend-svc.yaml
+3 -1
View File
@@ -3,7 +3,8 @@ kind: Service
metadata:
name: {{ template "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.service.labels .Values.commonLabels) "context" .) }}
labels: {{- include "shuffle.backend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
@@ -14,5 +15,6 @@ spec:
port: {{ .Values.backend.containerPorts.http }}
targetPort: http
protocol: TCP
appProtocol: http
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
functions/kubernetes/charts/shuffle/templates/frontend/frontend-svc.yaml
+4 -1
View File
@@ -3,7 +3,8 @@ kind: Service
metadata:
name: {{ template "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.service.labels .Values.commonLabels) "context" .) }}
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
@@ -14,11 +15,13 @@ spec:
port: {{ .Values.frontend.containerPorts.http }}
targetPort: http
protocol: TCP
appProtocol: http
{{- if .Values.frontend.containerPorts.https }}
- name: https
port: {{ .Values.frontend.containerPorts.https }}
targetPort: https
protocol: TCP
appProtocol: https
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ data:
ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
ORG_ID: "{{ .Values.shuffle.org }}"
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }}
SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"
functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml
+16
View File
@@ -88,8 +88,24 @@ spec:
value: "true"
- name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.worker.serviceAccount.name" . }}
{{- if .Values.worker.podSecurityContext.enabled }}
- name: SHUFFLE_WORKER_POD_SECURITY_CONTEXT
value: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.worker.containerSecurityContext.enabled }}
- name: SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
- name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.app.serviceAccount.name" . }}
{{- if .Values.app.podSecurityContext.enabled }}
- name: SHUFFLE_APP_POD_SECURITY_CONTEXT
value: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.app.containerSecurityContext.enabled }}
- name: SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
{{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
+10
View File
@@ -29,6 +29,16 @@ spec:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
# Allow access to backend
- ports:
- port: {{ .Values.backend.containerPorts.http }}
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }}
# Allow access to workers
- ports:
- port: 33333
functions/kubernetes/charts/shuffle/values.schema.json
+215 -1
View File
@@ -517,7 +517,7 @@
"type": {
"type": "string",
"description": "backend deployment strategy type",
"default": "RollingUpdate"
"default": "Recreate"
}
}
},
@@ -683,6 +683,16 @@
}
}
},
"service": {
"type": "object",
"properties": {
"labels": {
"type": "object",
"description": "Extra labels for backend service",
"default": {}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -1362,6 +1372,16 @@
}
}
},
"service": {
"type": "object",
"properties": {
"labels": {
"type": "object",
"description": "Extra labels for frontend service",
"default": {}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -2074,6 +2094,103 @@
}
}
},
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable worker pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for worker pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for worker pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for worker pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in worker pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled worker container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in worker container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in worker container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in worker container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in worker container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in worker container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in worker container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in worker container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in worker container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -2152,6 +2269,103 @@
"app": {
"type": "object",
"properties": {
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable app pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for app pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for app pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for app pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in app pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled app container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in app container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in app container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in app container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in app container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in app container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in app container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in app container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in app container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
functions/kubernetes/charts/shuffle/values.yaml
+102 -2
View File
@@ -310,14 +310,14 @@ backend:
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
##
tolerations: []
## ONLY FOR DEPLOYMENTS:
## @param backend.updateStrategy.type backend deployment strategy type
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
##
updateStrategy:
## Can be set to RollingUpdate or Recreate
## Backend uses ReadWriteOnce volumes by default, which is incompatible with RollingUpdate
##
type: RollingUpdate
type: Recreate
## @param backend.priorityClassName backend pods' priorityClassName
##
priorityClassName: ""
@@ -421,6 +421,14 @@ backend:
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param backend.service.labels Extra labels for backend service
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
serviceAccount:
@@ -870,6 +878,14 @@ frontend:
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param frontend.service.labels Extra labels for frontend service
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
serviceAccount:
@@ -1328,6 +1344,48 @@ worker:
tag: ""
digest: ""
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param worker.podSecurityContext.enabled Enable worker pods' Security Context
## @param worker.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for worker pods
## @param worker.podSecurityContext.sysctls Set kernel settings using the sysctl interface for worker pods
## @param worker.podSecurityContext.supplementalGroups Set filesystem extra groups for worker pods
## @param worker.podSecurityContext.fsGroup Set fsGroup in worker pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context
## @param worker.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in worker container
## @param worker.containerSecurityContext.runAsUser Set runAsUser in worker container' Security Context
## @param worker.containerSecurityContext.runAsGroup Set runAsGroup in worker container' Security Context
## @param worker.containerSecurityContext.runAsNonRoot Set runAsNonRoot in worker container' Security Context
## @param worker.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in worker container' Security Context
## @param worker.containerSecurityContext.privileged Set privileged in worker container' Security Context
## @param worker.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in worker container' Security Context
## @param worker.containerSecurityContext.capabilities.drop List of capabilities to be dropped in worker container
## @param worker.containerSecurityContext.seccompProfile.type Set seccomp profile in worker container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration
##
serviceAccount:
@@ -1390,6 +1448,48 @@ worker:
## @section app Parameters
##
app:
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param app.podSecurityContext.enabled Enable app pods' Security Context
## @param app.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for app pods
## @param app.podSecurityContext.sysctls Set kernel settings using the sysctl interface for app pods
## @param app.podSecurityContext.supplementalGroups Set filesystem extra groups for app pods
## @param app.podSecurityContext.fsGroup Set fsGroup in app pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param app.containerSecurityContext.enabled Enabled app container' Security Context
## @param app.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in app container
## @param app.containerSecurityContext.runAsUser Set runAsUser in app container' Security Context
## @param app.containerSecurityContext.runAsGroup Set runAsGroup in app container' Security Context
## @param app.containerSecurityContext.runAsNonRoot Set runAsNonRoot in app container' Security Context
## @param app.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in app container' Security Context
## @param app.containerSecurityContext.privileged Set privileged in app container' Security Context
## @param app.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in app container' Security Context
## @param app.containerSecurityContext.capabilities.drop List of capabilities to be dropped in app container
## @param app.containerSecurityContext.seccompProfile.type Set seccomp profile in app container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration
##
serviceAccount:
functions/onprem/orborus/orborus.go
+40 -5
View File
@@ -76,7 +76,11 @@ var maxCPUPercent = 90
var isKubernetes = os.Getenv("IS_KUBERNETES")
var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
var workerServiceAccountName = os.Getenv("SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME")
var workerPodSecurityContext = os.Getenv("SHUFFLE_WORKER_POD_SECURITY_CONTEXT")
var workerContainerSecurityContext = os.Getenv("SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT")
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
var appPodSecurityContext = os.Getenv("SHUFFLE_APP_POD_SECURITY_CONTEXT")
var appContainerSecurityContext = os.Getenv("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT")
// var baseimagename = "docker.pkg.github.com/shuffle/shuffle"
// var baseimagename = "ghcr.io/frikky"
@@ -747,7 +751,7 @@ func handleBackendImageDownload(ctx context.Context, images string) error {
//log.Printf("[DEBUG] Removing existing image (s): %s", images)
newImages := []string{}
successful := []string{}
successful := []string{}
for _, curimage := range strings.Split(images, ",") {
curimage = strings.TrimSpace(curimage)
if shuffle.ArrayContains(handled, curimage) {
@@ -1000,6 +1004,14 @@ func deployK8sWorker(image string, identifier string, env []string) error {
env = append(env, fmt.Sprintf("SHUFFLE_APP_SERVICE_ACCOUNT_NAME=%s", appServiceAccountName))
}
if len(appPodSecurityContext) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_POD_SECURITY_CONTEXT=%s", appPodSecurityContext))
}
if len(appContainerSecurityContext) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT=%s", appContainerSecurityContext))
}
clientset, _, err := shuffle.GetKubernetesClient()
if err != nil {
log.Printf("[ERROR] Error getting kubernetes client:", err)
@@ -1081,10 +1093,33 @@ func deployK8sWorker(image string, identifier string, env []string) error {
"app.kubernetes.io/instance": identifier,
}
// Parse security contexts from env
var podSecurityContext *corev1.PodSecurityContext
var containerSecurityContext *corev1.SecurityContext
if len(workerPodSecurityContext) > 0 {
podSecurityContext = &corev1.PodSecurityContext{}
err = json.Unmarshal([]byte(workerPodSecurityContext), podSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal worker pod security context: %v", err)
return fmt.Errorf("failed to unmarshal worker pod security context: %v", err)
}
}
if len(workerContainerSecurityContext) > 0 {
containerSecurityContext = &corev1.SecurityContext{}
err = json.Unmarshal([]byte(workerContainerSecurityContext), containerSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal worker container security context: %v", err)
return fmt.Errorf("failed to unmarshal worker container security context: %v", err)
}
}
containerAttachment := corev1.Container{
Name: identifier,
Image: kubernetesImage,
Env: buildEnvVars(envMap),
Name: identifier,
Image: kubernetesImage,
Env: buildEnvVars(envMap),
SecurityContext: containerSecurityContext,
//ImagePullPolicy: "Never",
ImagePullPolicy: corev1.PullIfNotPresent,
@@ -1201,6 +1236,7 @@ func deployK8sWorker(image string, identifier string, env []string) error {
},
DNSPolicy: corev1.DNSClusterFirst,
ServiceAccountName: workerServiceAccountName,
SecurityContext: podSecurityContext,
},
},
},
@@ -1271,7 +1307,6 @@ func deployWorker(image string, identifier string, env []string, executionReques
Resources: container.Resources{},
}
// This is just to test the mounting locally so
// I can control from what source I'm mounting
// the certs to. Default behaviour is:
functions/onprem/worker/worker.go
+46 -20
View File
@@ -57,9 +57,13 @@ var logsDisabled = os.Getenv("SHUFFLE_LOGS_DISABLED")
var cleanupEnv = strings.ToLower(os.Getenv("CLEANUP"))
var swarmNetworkName = os.Getenv("SHUFFLE_SWARM_NETWORK_NAME")
var dockerApiVersion = strings.ToLower(os.Getenv("DOCKER_API_VERSION"))
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
// Kubernetes settings
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
var appPodSecurityContext = os.Getenv("SHUFFLE_APP_POD_SECURITY_CONTEXT")
var appContainerSecurityContext = os.Getenv("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT")
var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
var executionCount int64
var baseimagename = os.Getenv("SHUFFLE_BASE_IMAGE_NAME")
@@ -504,6 +508,28 @@ func deployk8sApp(image string, identifier string, env []string) error {
"app.kubernetes.io/instance": name,
}
// Parse security contexts from env
var podSecurityContext *corev1.PodSecurityContext
var containerSecurityContext *corev1.SecurityContext
if len(appPodSecurityContext) > 0 {
podSecurityContext = &corev1.PodSecurityContext{}
err = json.Unmarshal([]byte(appPodSecurityContext), podSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal app pod security context: %v", err)
return fmt.Errorf("failed to unmarshal app pod security context: %v", err)
}
}
if len(appContainerSecurityContext) > 0 {
containerSecurityContext = &corev1.SecurityContext{}
err = json.Unmarshal([]byte(appContainerSecurityContext), containerSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal app container security context: %v", err)
return fmt.Errorf("failed to unmarshal app container security context: %v", err)
}
}
// pod := &corev1.Pod{
// ObjectMeta: metav1.ObjectMeta{
// Name: podName,
@@ -597,13 +623,15 @@ func deployk8sApp(image string, identifier string, env []string) error {
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: value,
Image: image,
Env: buildEnvVars(envMap),
Name: value,
Image: image,
Env: buildEnvVars(envMap),
SecurityContext: containerSecurityContext,
},
},
DNSPolicy: corev1.DNSClusterFirst,
ServiceAccountName: appServiceAccountName,
SecurityContext: podSecurityContext,
},
},
},
@@ -918,7 +946,7 @@ func deployApp(cli *dockerclient.Client, image string, identifier string, env []
// Add more volume binds if possible
if len(volumeBinds) > 0 {
// Only use mounts, not direct binds
// Only use mounts, not direct binds
hostConfig.Binds = []string{}
hostConfig.Mounts = []mount.Mount{}
for _, bind := range volumeBinds {
@@ -932,7 +960,7 @@ func deployApp(cli *dockerclient.Client, image string, identifier string, env []
sourceFolder := bindSplit[0]
destinationFolder := bindSplit[1]
readOnly := false
readOnly := false
if len(bindSplit) > 2 {
mode := bindSplit[2]
if mode == "ro" {
@@ -941,9 +969,9 @@ func deployApp(cli *dockerclient.Client, image string, identifier string, env []
}
builtMount := mount.Mount{
Type: mount.TypeBind,
Source: sourceFolder,
Target: destinationFolder,
Type: mount.TypeBind,
Source: sourceFolder,
Target: destinationFolder,
ReadOnly: readOnly,
}
@@ -1854,18 +1882,18 @@ func executionInit(workflowExecution shuffle.WorkflowExecution) error {
}
}
// Validates RERUN of single actions
// Identified by:
// Validates RERUN of single actions
// Identified by:
// 1. Predefined result from previous exec
// 2. Only ONE action
// 3. Every predefined result having result.Action.Category == "rerun"
/*
if len(workflowExecution.Workflow.Actions) == 1 && len(workflowExecution.Results) > 0 {
finished := shuffle.ValidateFinished(ctx, extra, workflowExecution)
if finished {
return nil
if len(workflowExecution.Workflow.Actions) == 1 && len(workflowExecution.Results) > 0 {
finished := shuffle.ValidateFinished(ctx, extra, workflowExecution)
if finished {
return nil
}
}
}
*/
nextActions = append(nextActions, startAction)
@@ -1955,7 +1983,6 @@ func executionInit(workflowExecution shuffle.WorkflowExecution) error {
//log.Printf("Successfully downloaded and built %s", image)
}
visited := []string{}
executed := []string{}
environments := []string{}
@@ -3788,7 +3815,7 @@ func checkStandaloneRun() {
if !strings.Contains(backendUrl, "http") {
log.Printf("[ERROR] Backend URL should start with http:// or https://")
return
}
// Format:
@@ -3862,7 +3889,7 @@ func checkStandaloneRun() {
continue
}
// This is to handle reruns of SINGLE actions
// This is to handle reruns of SINGLE actions
if result.Action.Category == "rerun" {
newResults = append(newResults, result)
continue
@@ -3916,7 +3943,6 @@ func checkStandaloneRun() {
log.Printf("\n\n\n[DEBUG] Finished resetting execution %s. Body: %s. Starting execution.\n\n\n", newresp.Status, string(body))
}
// Initial loop etc