add shuffle helm chart
remove gitlab ci file
This commit is contained in:
Pascal Sthamer
@@ -0,0 +1,3 @@
|
||||
.DS_Store
|
||||
*.tgz
|
||||
charts/
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
extends: default
|
||||
|
||||
rules:
|
||||
line-length: disable
|
||||
braces: disable
|
||||
comments:
|
||||
require-starting-space: true
|
||||
ignore-shebangs: true
|
||||
min-spaces-from-content: 1
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v2
|
||||
name: shuffle
|
||||
description: A Helm chart for deploying Shuffle on Kubernetes
|
||||
type: application
|
||||
version: 0.0.0
|
||||
appVersion: nightly
|
||||
dependencies:
|
||||
- name: common
|
||||
version: ^2.23.0
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
- name: opensearch
|
||||
version: ^1.3.0
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
condition: opensearch.enabled
|
||||
@@ -0,0 +1,570 @@
|
||||
# Shuffle Helm chart
|
||||
|
||||
## Chart Template
|
||||
|
||||
The Bitnami Chart Template was used for creating this chart:
|
||||
|
||||
https://github.com/bitnami/charts/tree/7e44e64626f5b1fc6d56889cdfdeadc1f62c7cf1/template/CHART_NAME
|
||||
|
||||
Original license text:
|
||||
|
||||
```
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
```sh
|
||||
# Lint chart
|
||||
helm lint .
|
||||
|
||||
# Package chart
|
||||
helm package .
|
||||
|
||||
# Install (the shuffle namespace is hardcoded into the shuffle source code)
|
||||
helm install shuffle oci://TODO -n shuffle
|
||||
```
|
||||
|
||||
## Secret Parameters
|
||||
|
||||
The helm chart was designed to not contain any secret data and does not allow configuring secret data using helm values.
|
||||
Instead, secret values must be passed to services using `extraEnvVarsSecret`. The secrets need to be manually created.
|
||||
|
||||
### Creating secrets using vault-secrets-operator
|
||||
|
||||
If you are using [vault-secret-operator by Rico Berger](https://github.com/ricoberger/vault-secrets-operator),
|
||||
then you can create VaultSecret resources via Helm.
|
||||
Note that the resulting (Vault)Secret is prefixed with the release name of the chart.
|
||||
|
||||
```yaml
|
||||
vault:
|
||||
secrets:
|
||||
- name: backend-env
|
||||
type: Opaque
|
||||
path: shuffle/backend/env
|
||||
```
|
||||
|
||||
### Mounting env variables into a service
|
||||
|
||||
After creating a secret which holds the environment variables (either manually or via a VaultSecret), you can then
|
||||
use that secret to mount environment variables into a service via the `extraEnvVarsSecret` value.
|
||||
|
||||
You can use helm templates for generating the secret name as shown in the example below.
|
||||
|
||||
```yaml
|
||||
backend:
|
||||
extraEnvVarsSecret: "{{ include \"common.names.fullname\" . }}-backend-env"
|
||||
```
|
||||
|
||||
### Backend
|
||||
|
||||
A list of environment variables containing secret values for the backend.
|
||||
|
||||
```yaml
|
||||
# OpenSearch password
|
||||
SHUFFLE_OPENSEARCH_PASSWORD: ""
|
||||
|
||||
# Basic auth credentials for downloading apps from git
|
||||
SHUFFLE_DOWNLOAD_AUTH_USERNAME: ""
|
||||
SHUFFLE_DOWNLOAD_AUTH_PASSWORD: ""
|
||||
|
||||
# Automatically create the initial admin user. Username and password have a min length of 3.
|
||||
# If not set, you are prompted with an admin user creation dialog when visiting the shuffle frontend for the first time.
|
||||
SHUFFLE_DEFAULT_USERNAME: admin
|
||||
SHUFFLE_DEFAULT_PASSWORD: MySecretAdminPassword1234!
|
||||
SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uuid v4
|
||||
|
||||
# Encryption modifier. This HAS to be set to encrypt any authentication being used in Shuffle.
|
||||
# This is put together with other relevant values to ensure multiple parts are needed to decrypt.
|
||||
# If this key is lost or changed, you will have to reauthenticate all apps.
|
||||
# The encryption modifier is added to encrypted values to prevent rainbow table attacks. It can be any random string.
|
||||
SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `global.imageRegistry` | Global Docker image registry | `""` |
|
||||
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
|
||||
| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` |
|
||||
| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` |
|
||||
| `global.compatibility.omitEmptySeLinuxOptions` | If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object | `false` |
|
||||
|
||||
### Common parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
|
||||
| `kubeVersion` | Override Kubernetes version | `""` |
|
||||
| `nameOverride` | String to partially override common.names.name | `""` |
|
||||
| `fullnameOverride` | String to fully override common.names.fullname | `""` |
|
||||
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the chart release | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the chart release | `["infinity"]` |
|
||||
|
||||
### Shared Shuffle Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------- | ------------------------------------------------------------- | --------------- |
|
||||
| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` |
|
||||
| `shuffle.org` | Default shuffle organization | `Shuffle` |
|
||||
| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `""` |
|
||||
| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` |
|
||||
|
||||
### backend Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
|
||||
| `backend.image.registry` | backend image registry | `ghcr.io` |
|
||||
| `backend.image.repository` | backend image repository | `shuffle/shuffle-backend` |
|
||||
| `backend.image.digest` | backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `backend.image.pullPolicy` | backend image pull policy | `IfNotPresent` |
|
||||
| `backend.image.pullSecrets` | backend image pull secrets | `[]` |
|
||||
| `backend.replicaCount` | Number of backend replicas to deploy | `1` |
|
||||
| `backend.livenessProbe.enabled` | Enable livenessProbe on backend containers | `false` |
|
||||
| `backend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
|
||||
| `backend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
|
||||
| `backend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
|
||||
| `backend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
|
||||
| `backend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `backend.readinessProbe.enabled` | Enable readinessProbe on backend containers | `false` |
|
||||
| `backend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
|
||||
| `backend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `backend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `backend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `backend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `backend.startupProbe.enabled` | Enable startupProbe on backend containers | `false` |
|
||||
| `backend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
|
||||
| `backend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
|
||||
| `backend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `backend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
|
||||
| `backend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `backend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `backend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `backend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `backend.resourcesPreset` | Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production). | `small` |
|
||||
| `backend.resources` | Set backend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `backend.podSecurityContext.enabled` | Enable backend pods' Security Context | `true` |
|
||||
| `backend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for backend pods | `Always` |
|
||||
| `backend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for backend pods | `[]` |
|
||||
| `backend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for backend pods | `[]` |
|
||||
| `backend.podSecurityContext.fsGroup` | Set fsGroup in backend pods' Security Context | `1001` |
|
||||
| `backend.containerSecurityContext.enabled` | Enabled backend container' Security Context | `true` |
|
||||
| `backend.containerSecurityContext.seLinuxOptions` | Set SELinux options in backend container | `{}` |
|
||||
| `backend.containerSecurityContext.runAsUser` | Set runAsUser in backend container' Security Context | `1000` |
|
||||
| `backend.containerSecurityContext.runAsGroup` | Set runAsGroup in backend container' Security Context | `1000` |
|
||||
| `backend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in backend container' Security Context | `true` |
|
||||
| `backend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in backend container' Security Context | `true` |
|
||||
| `backend.containerSecurityContext.privileged` | Set privileged in backend container' Security Context | `false` |
|
||||
| `backend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in backend container' Security Context | `false` |
|
||||
| `backend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in backend container | `["ALL"]` |
|
||||
| `backend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in backend container | `RuntimeDefault` |
|
||||
| `backend.command` | Override default backend container command (useful when using custom images) | `[]` |
|
||||
| `backend.args` | Override default backend container args (useful when using custom images) | `[]` |
|
||||
| `backend.automountServiceAccountToken` | Mount Service Account token in backend pods | `true` |
|
||||
| `backend.hostAliases` | backend pods host aliases | `[]` |
|
||||
| `backend.daemonsetAnnotations` | Annotations for backend daemonset | `{}` |
|
||||
| `backend.deploymentAnnotations` | Annotations for backend deployment | `{}` |
|
||||
| `backend.statefulsetAnnotations` | Annotations for backend statefulset | `{}` |
|
||||
| `backend.podLabels` | Extra labels for backend pods | `{}` |
|
||||
| `backend.podAnnotations` | Annotations for backend pods | `{}` |
|
||||
| `backend.podAffinityPreset` | Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `backend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `backend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `backend.nodeAffinityPreset.key` | Node label key to match. Ignored if `backend.affinity` is set | `""` |
|
||||
| `backend.nodeAffinityPreset.values` | Node label values to match. Ignored if `backend.affinity` is set | `[]` |
|
||||
| `backend.affinity` | Affinity for backend pods assignment | `{}` |
|
||||
| `backend.nodeSelector` | Node labels for backend pods assignment | `{}` |
|
||||
| `backend.tolerations` | Tolerations for backend pods assignment | `[]` |
|
||||
| `backend.updateStrategy.type` | backend deployment strategy type | `RollingUpdate` |
|
||||
| `backend.updateStrategy.type` | backend statefulset strategy type | `RollingUpdate` |
|
||||
| `backend.podManagementPolicy` | Pod management policy for backend statefulset | `OrderedReady` |
|
||||
| `backend.priorityClassName` | backend pods' priorityClassName | `""` |
|
||||
| `backend.topologySpreadConstraints` | Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | `[]` |
|
||||
| `backend.schedulerName` | Name of the k8s scheduler (other than default) for backend pods | `""` |
|
||||
| `backend.terminationGracePeriodSeconds` | Seconds backend pods need to terminate gracefully | `""` |
|
||||
| `backend.lifecycleHooks` | for backend containers to automate configuration before or after startup | `{}` |
|
||||
| `backend.extraEnvVars` | Array with extra environment variables to add to backend containers | `[]` |
|
||||
| `backend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for backend containers | `""` |
|
||||
| `backend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for backend containers | `""` |
|
||||
| `backend.extraVolumes` | Optionally specify extra list of additional volumes for the backend pods | `[]` |
|
||||
| `backend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the backend containers | `[]` |
|
||||
| `backend.sidecars` | Add additional sidecar containers to the backend pods | `[]` |
|
||||
| `backend.initContainers` | Add additional init containers to the backend pods | `[]` |
|
||||
| `backend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
|
||||
| `backend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
|
||||
| `backend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty. | `""` |
|
||||
| `backend.autoscaling.vpa.enabled` | Enable VPA for backend pods | `false` |
|
||||
| `backend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
|
||||
| `backend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
|
||||
| `backend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
|
||||
| `backend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
|
||||
| `backend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
|
||||
| `backend.autoscaling.hpa.enabled` | Enable HPA for backend pods | `false` |
|
||||
| `backend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
|
||||
| `backend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
|
||||
| `backend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `backend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
| `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
| `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
|
||||
| `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` |
|
||||
| `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `backend.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `backend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `backend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `backend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
| `backend.cleanupSchedule` | The interval in seconds at which the cleanup job runs | `300` |
|
||||
| `backend.openSearch.url` | The URL at which OpenSearch is available | `http://{{ .Release.Name }}-opensearch:9200` |
|
||||
| `backend.openSearch.username` | The username that is used for authenticating with OpenSearch | `admin` |
|
||||
| `backend.openSearch.certificateFile` | The path to a custom OpenSearch certificate file | `""` |
|
||||
| `backend.openSearch.skipSSLVerify` | Skip SSL verification | `false` |
|
||||
| `backend.openSearch.indexPrefix` | A prefix for OpenSearch indices | `""` |
|
||||
| `backend.apps.downloadLocation` | The location to a git repository from which default appps are downloaded on startup. | `https://github.com/shuffle/python-apps` |
|
||||
| `backend.apps.downloadBranch` | The branch from which apps should be downloaded on startup. | `master` |
|
||||
| `backend.apps.forceUpdate` | Force an update of apps on startup. | `false` |
|
||||
|
||||
### frontend Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
|
||||
| `frontend.image.registry` | frontend image registry | `ghcr.io` |
|
||||
| `frontend.image.repository` | frontend image repository | `shuffle/shuffle-frontend` |
|
||||
| `frontend.image.digest` | frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `frontend.image.pullPolicy` | frontend image pull policy | `IfNotPresent` |
|
||||
| `frontend.image.pullSecrets` | frontend image pull secrets | `[]` |
|
||||
| `frontend.replicaCount` | Number of frontend replicas to deploy | `1` |
|
||||
| `frontend.livenessProbe.enabled` | Enable livenessProbe on frontend containers | `false` |
|
||||
| `frontend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
|
||||
| `frontend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
|
||||
| `frontend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
|
||||
| `frontend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
|
||||
| `frontend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `frontend.readinessProbe.enabled` | Enable readinessProbe on frontend containers | `false` |
|
||||
| `frontend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
|
||||
| `frontend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `frontend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `frontend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `frontend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `frontend.startupProbe.enabled` | Enable startupProbe on frontend containers | `false` |
|
||||
| `frontend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
|
||||
| `frontend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
|
||||
| `frontend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `frontend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
|
||||
| `frontend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `frontend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `frontend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `frontend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `frontend.resourcesPreset` | Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). | `nano` |
|
||||
| `frontend.resources` | Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `true` |
|
||||
| `frontend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for frontend pods | `Always` |
|
||||
| `frontend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for frontend pods | `[]` |
|
||||
| `frontend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for frontend pods | `[]` |
|
||||
| `frontend.podSecurityContext.fsGroup` | Set fsGroup in frontend pods' Security Context | `1001` |
|
||||
| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `true` |
|
||||
| `frontend.containerSecurityContext.seLinuxOptions` | Set SELinux options in frontend container | `{}` |
|
||||
| `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `101` |
|
||||
| `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `101` |
|
||||
| `frontend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in frontend container' Security Context | `true` |
|
||||
| `frontend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in frontend container' Security Context | `true` |
|
||||
| `frontend.containerSecurityContext.privileged` | Set privileged in frontend container' Security Context | `false` |
|
||||
| `frontend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in frontend container' Security Context | `false` |
|
||||
| `frontend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in frontend container | `["ALL"]` |
|
||||
| `frontend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in frontend container | `RuntimeDefault` |
|
||||
| `frontend.command` | Override default frontend container command (useful when using custom images) | `[]` |
|
||||
| `frontend.args` | Override default frontend container args (useful when using custom images) | `[]` |
|
||||
| `frontend.automountServiceAccountToken` | Mount Service Account token in frontend pods | `false` |
|
||||
| `frontend.hostAliases` | frontend pods host aliases | `[]` |
|
||||
| `frontend.daemonsetAnnotations` | Annotations for frontend daemonset | `{}` |
|
||||
| `frontend.deploymentAnnotations` | Annotations for frontend deployment | `{}` |
|
||||
| `frontend.statefulsetAnnotations` | Annotations for frontend statefulset | `{}` |
|
||||
| `frontend.podLabels` | Extra labels for frontend pods | `{}` |
|
||||
| `frontend.podAnnotations` | Annotations for frontend pods | `{}` |
|
||||
| `frontend.podAffinityPreset` | Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `frontend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `frontend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `frontend.nodeAffinityPreset.key` | Node label key to match. Ignored if `frontend.affinity` is set | `""` |
|
||||
| `frontend.nodeAffinityPreset.values` | Node label values to match. Ignored if `frontend.affinity` is set | `[]` |
|
||||
| `frontend.affinity` | Affinity for frontend pods assignment | `{}` |
|
||||
| `frontend.nodeSelector` | Node labels for frontend pods assignment | `{}` |
|
||||
| `frontend.tolerations` | Tolerations for frontend pods assignment | `[]` |
|
||||
| `frontend.updateStrategy.type` | frontend deployment strategy type | `RollingUpdate` |
|
||||
| `frontend.updateStrategy.type` | frontend statefulset strategy type | `RollingUpdate` |
|
||||
| `frontend.podManagementPolicy` | Pod management policy for frontend statefulset | `OrderedReady` |
|
||||
| `frontend.priorityClassName` | frontend pods' priorityClassName | `""` |
|
||||
| `frontend.topologySpreadConstraints` | Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains | `[]` |
|
||||
| `frontend.schedulerName` | Name of the k8s scheduler (other than default) for frontend pods | `""` |
|
||||
| `frontend.terminationGracePeriodSeconds` | Seconds frontend pods need to terminate gracefully | `""` |
|
||||
| `frontend.lifecycleHooks` | for frontend containers to automate configuration before or after startup | `{}` |
|
||||
| `frontend.extraEnvVars` | Array with extra environment variables to add to frontend containers | `[]` |
|
||||
| `frontend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for frontend containers | `""` |
|
||||
| `frontend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for frontend containers | `""` |
|
||||
| `frontend.extraVolumes` | Optionally specify extra list of additional volumes for the frontend pods | `[]` |
|
||||
| `frontend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the frontend containers | `[]` |
|
||||
| `frontend.sidecars` | Add additional sidecar containers to the frontend pods | `[]` |
|
||||
| `frontend.initContainers` | Add additional init containers to the frontend pods | `[]` |
|
||||
| `frontend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
|
||||
| `frontend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
|
||||
| `frontend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty. | `""` |
|
||||
| `frontend.autoscaling.vpa.enabled` | Enable VPA for frontend pods | `false` |
|
||||
| `frontend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
|
||||
| `frontend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
|
||||
| `frontend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
|
||||
| `frontend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
|
||||
| `frontend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
|
||||
| `frontend.autoscaling.hpa.enabled` | Enable HPA for frontend pods | `false` |
|
||||
| `frontend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
|
||||
| `frontend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
|
||||
| `frontend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `frontend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
| `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
| `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
|
||||
| `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `frontend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `frontend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `frontend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
|
||||
### orborus Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
|
||||
| `orborus.image.registry` | orborus image registry | `ghcr.io` |
|
||||
| `orborus.image.repository` | orborus image repository | `shuffle/shuffle-orborus` |
|
||||
| `orborus.image.digest` | orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `orborus.image.pullPolicy` | orborus image pull policy | `IfNotPresent` |
|
||||
| `orborus.image.pullSecrets` | orborus image pull secrets | `[]` |
|
||||
| `orborus.replicaCount` | Number of orborus replicas to deploy | `1` |
|
||||
| `orborus.livenessProbe.enabled` | Enable livenessProbe on orborus containers | `false` |
|
||||
| `orborus.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
|
||||
| `orborus.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
|
||||
| `orborus.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
|
||||
| `orborus.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
|
||||
| `orborus.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `orborus.readinessProbe.enabled` | Enable readinessProbe on orborus containers | `false` |
|
||||
| `orborus.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
|
||||
| `orborus.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `orborus.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `orborus.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `orborus.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `orborus.startupProbe.enabled` | Enable startupProbe on orborus containers | `false` |
|
||||
| `orborus.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
|
||||
| `orborus.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
|
||||
| `orborus.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `orborus.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
|
||||
| `orborus.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `orborus.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `orborus.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `orborus.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `orborus.resourcesPreset` | Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production). | `nano` |
|
||||
| `orborus.resources` | Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `orborus.podSecurityContext.enabled` | Enable orborus pods' Security Context | `true` |
|
||||
| `orborus.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for orborus pods | `Always` |
|
||||
| `orborus.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for orborus pods | `[]` |
|
||||
| `orborus.podSecurityContext.supplementalGroups` | Set filesystem extra groups for orborus pods | `[]` |
|
||||
| `orborus.podSecurityContext.fsGroup` | Set fsGroup in orborus pods' Security Context | `1001` |
|
||||
| `orborus.containerSecurityContext.enabled` | Enabled orborus container' Security Context | `true` |
|
||||
| `orborus.containerSecurityContext.seLinuxOptions` | Set SELinux options in orborus container | `{}` |
|
||||
| `orborus.containerSecurityContext.runAsUser` | Set runAsUser in orborus container' Security Context | `101` |
|
||||
| `orborus.containerSecurityContext.runAsGroup` | Set runAsGroup in orborus container' Security Context | `101` |
|
||||
| `orborus.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in orborus container' Security Context | `true` |
|
||||
| `orborus.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in orborus container' Security Context | `true` |
|
||||
| `orborus.containerSecurityContext.privileged` | Set privileged in orborus container' Security Context | `false` |
|
||||
| `orborus.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in orborus container' Security Context | `false` |
|
||||
| `orborus.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in orborus container | `["ALL"]` |
|
||||
| `orborus.containerSecurityContext.seccompProfile.type` | Set seccomp profile in orborus container | `RuntimeDefault` |
|
||||
| `orborus.command` | Override default orborus container command (useful when using custom images) | `[]` |
|
||||
| `orborus.args` | Override default orborus container args (useful when using custom images) | `[]` |
|
||||
| `orborus.automountServiceAccountToken` | Mount Service Account token in orborus pods | `true` |
|
||||
| `orborus.hostAliases` | orborus pods host aliases | `[]` |
|
||||
| `orborus.daemonsetAnnotations` | Annotations for orborus daemonset | `{}` |
|
||||
| `orborus.deploymentAnnotations` | Annotations for orborus deployment | `{}` |
|
||||
| `orborus.statefulsetAnnotations` | Annotations for orborus statefulset | `{}` |
|
||||
| `orborus.podLabels` | Extra labels for orborus pods | `{}` |
|
||||
| `orborus.podAnnotations` | Annotations for orborus pods | `{}` |
|
||||
| `orborus.podAffinityPreset` | Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `orborus.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `orborus.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `orborus.nodeAffinityPreset.key` | Node label key to match. Ignored if `orborus.affinity` is set | `""` |
|
||||
| `orborus.nodeAffinityPreset.values` | Node label values to match. Ignored if `orborus.affinity` is set | `[]` |
|
||||
| `orborus.affinity` | Affinity for orborus pods assignment | `{}` |
|
||||
| `orborus.nodeSelector` | Node labels for orborus pods assignment | `{}` |
|
||||
| `orborus.tolerations` | Tolerations for orborus pods assignment | `[]` |
|
||||
| `orborus.updateStrategy.type` | orborus deployment strategy type | `RollingUpdate` |
|
||||
| `orborus.updateStrategy.type` | orborus statefulset strategy type | `RollingUpdate` |
|
||||
| `orborus.podManagementPolicy` | Pod management policy for orborus statefulset | `OrderedReady` |
|
||||
| `orborus.priorityClassName` | orborus pods' priorityClassName | `""` |
|
||||
| `orborus.topologySpreadConstraints` | Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains | `[]` |
|
||||
| `orborus.schedulerName` | Name of the k8s scheduler (other than default) for orborus pods | `""` |
|
||||
| `orborus.terminationGracePeriodSeconds` | Seconds orborus pods need to terminate gracefully | `""` |
|
||||
| `orborus.lifecycleHooks` | for orborus containers to automate configuration before or after startup | `{}` |
|
||||
| `orborus.extraEnvVars` | Array with extra environment variables to add to orborus containers | `[]` |
|
||||
| `orborus.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for orborus containers | `""` |
|
||||
| `orborus.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for orborus containers | `""` |
|
||||
| `orborus.extraVolumes` | Optionally specify extra list of additional volumes for the orborus pods | `[]` |
|
||||
| `orborus.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the orborus containers | `[]` |
|
||||
| `orborus.sidecars` | Add additional sidecar containers to the orborus pods | `[]` |
|
||||
| `orborus.initContainers` | Add additional init containers to the orborus pods | `[]` |
|
||||
| `orborus.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
|
||||
| `orborus.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
|
||||
| `orborus.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty. | `""` |
|
||||
| `orborus.autoscaling.vpa.enabled` | Enable VPA for orborus pods | `false` |
|
||||
| `orborus.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
|
||||
| `orborus.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
|
||||
| `orborus.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
|
||||
| `orborus.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
|
||||
| `orborus.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
|
||||
| `orborus.autoscaling.hpa.enabled` | Enable HPA for orborus pods | `false` |
|
||||
| `orborus.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
|
||||
| `orborus.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
|
||||
| `orborus.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `orborus.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
| `orborus.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
| `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
|
||||
| `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` |
|
||||
| `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `orborus.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `orborus.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `orborus.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `orborus.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
|
||||
### worker Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `worker.image.registry` | worker image registry | `ghcr.io` |
|
||||
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
|
||||
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
|
||||
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
|
||||
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
|
||||
### app Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------- | ---------------------------------------------------------------------------------- | ------ |
|
||||
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
|
||||
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
|
||||
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
|
||||
### Traffic Exposure Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- |
|
||||
| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` |
|
||||
| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` |
|
||||
| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` |
|
||||
| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
|
||||
| `ingress.hostname` | Default host for the ingress record | `shuffle.local` |
|
||||
| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` |
|
||||
| `ingress.path` | Ingress path for Shuffle frontend | `"/"` |
|
||||
| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` |
|
||||
| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` |
|
||||
| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` |
|
||||
| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
|
||||
| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
|
||||
| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
|
||||
| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
|
||||
| `ingress.secrets` | Custom TLS certificates as secrets | `[]` |
|
||||
| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
|
||||
|
||||
### Istio Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` |
|
||||
| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` |
|
||||
| `istio.hosts` | One or more hosts exposed by Istio | `[]` |
|
||||
| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` |
|
||||
| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` |
|
||||
| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` |
|
||||
| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` |
|
||||
| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` |
|
||||
| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` |
|
||||
| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` |
|
||||
| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` |
|
||||
|
||||
### Persistence Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------- | ------------------------------------------------- | ------------------- |
|
||||
| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` |
|
||||
| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` |
|
||||
| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` |
|
||||
| `persistence.apps.subPath` | The sub path used in the volume | `""` |
|
||||
| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
|
||||
| `persistence.apps.size` | The size of the volume | `5Gi` |
|
||||
| `persistence.apps.annotations` | Annotations for the PVC | `{}` |
|
||||
| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` |
|
||||
| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` |
|
||||
| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
|
||||
| `persistence.appBuilder.size` | The size of the volume | `5Gi` |
|
||||
| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` |
|
||||
| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` |
|
||||
| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` |
|
||||
| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` |
|
||||
| `persistence.files.subPath` | The sub path used in the volume | `""` |
|
||||
| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` |
|
||||
| `persistence.files.size` | The size of the volume | `5Gi` |
|
||||
| `persistence.files.annotations` | Annotations for the PVC | `{}` |
|
||||
| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` |
|
||||
|
||||
### Init Container Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
|
||||
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnami/os-shell` |
|
||||
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
|
||||
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
|
||||
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
|
||||
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
|
||||
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
|
||||
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
|
||||
|
||||
### OpenSearch Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------- | ----------------------------------------------------- | ------ |
|
||||
| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` |
|
||||
|
||||
### Vault Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------- | -------------------------------------------------------------------------- | ----- |
|
||||
| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` |
|
||||
| `vault.secrets` | A list of VaultSecrets to create | `[]` |
|
||||
|
||||
### Other Parameters
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||
|
||||
Get the list of pods by executing:
|
||||
|
||||
kubectl get pods --namespace {{ include "common.names.namespace" . | quote }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||
|
||||
Access the pod you want to debug by executing
|
||||
|
||||
kubectl exec --namespace {{ include "common.names.namespace" . | quote }} -ti <NAME OF THE POD> -- bash
|
||||
|
||||
{{- end }}
|
||||
|
||||
TODO
|
||||
|
||||
{{- include "common.warnings.rollingTag" .Values.backend.image }}
|
||||
@@ -0,0 +1,215 @@
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "shuffle.imagePullSecrets" -}}
|
||||
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image .Values.frontend.image .Values.orborus.image .Values.worker.image .Values.volumePermissions.image) "context" $) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common name for backend componentes
|
||||
*/}}
|
||||
{{- define "shuffle.backend.name" -}}
|
||||
{{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common name for frontend components
|
||||
*/}}
|
||||
{{- define "shuffle.frontend.name" -}}
|
||||
{{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common name for orborus components
|
||||
*/}}
|
||||
{{- define "shuffle.orborus.name" -}}
|
||||
{{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common name for worker components
|
||||
*/}}
|
||||
{{- define "shuffle.worker.name" -}}
|
||||
{{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common name for app components
|
||||
*/}}
|
||||
{{- define "shuffle.app.name" -}}
|
||||
{{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common labels for backend components
|
||||
The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod.
|
||||
*/}}
|
||||
{{- define "shuffle.backend.labels" -}}
|
||||
{{- include "common.labels.standard" . }}
|
||||
app.kubernetes.io/component: backend
|
||||
io.kompose.service: backend
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common labels for frontend components
|
||||
*/}}
|
||||
{{- define "shuffle.frontend.labels" -}}
|
||||
{{- include "common.labels.standard" . }}
|
||||
app.kubernetes.io/component: frontend
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common labels for orborus components
|
||||
*/}}
|
||||
{{- define "shuffle.orborus.labels" -}}
|
||||
{{- include "common.labels.standard" . }}
|
||||
app.kubernetes.io/component: orborus
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common labels for worker components
|
||||
*/}}
|
||||
{{- define "shuffle.worker.labels" -}}
|
||||
{{- include "common.labels.standard" . }}
|
||||
app.kubernetes.io/component: worker
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the common labels for app components
|
||||
*/}}
|
||||
{{- define "shuffle.app.labels" -}}
|
||||
{{- include "common.labels.standard" . }}
|
||||
app.kubernetes.io/component: app
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the match labels for backend components
|
||||
*/}}
|
||||
{{- define "shuffle.backend.matchLabels" -}}
|
||||
{{- include "common.labels.matchLabels" . }}
|
||||
app.kubernetes.io/component: backend
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the match labels for frontend components
|
||||
*/}}
|
||||
{{- define "shuffle.frontend.matchLabels" -}}
|
||||
{{- include "common.labels.matchLabels" . }}
|
||||
app.kubernetes.io/component: frontend
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the match labels for orborus components
|
||||
*/}}
|
||||
{{- define "shuffle.orborus.matchLabels" -}}
|
||||
{{- include "common.labels.matchLabels" . }}
|
||||
app.kubernetes.io/component: orborus
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the match labels for worker components
|
||||
NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app.
|
||||
*/}}
|
||||
{{- define "shuffle.worker.matchLabels" -}}
|
||||
container: shuffle-worker
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the match labels for app components
|
||||
NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app.
|
||||
*/}}
|
||||
{{- define "shuffle.app.matchLabels" -}}
|
||||
app: shuffle-app
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "shuffle.volumePermissions.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Shuffle backend image name
|
||||
*/}}
|
||||
{{- define "shuffle.backend.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Shuffle frontend image name
|
||||
*/}}
|
||||
{{- define "shuffle.frontend.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Shuffle orborus image name
|
||||
*/}}
|
||||
{{- define "shuffle.orborus.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Shuffle worker image name
|
||||
*/}}
|
||||
{{- define "shuffle.worker.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for the Shuffle backend
|
||||
*/}}
|
||||
{{- define "shuffle.backend.serviceAccountName" -}}
|
||||
{{- if .Values.backend.serviceAccount.create -}}
|
||||
{{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.backend.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for the Shuffle frontend
|
||||
*/}}
|
||||
{{- define "shuffle.frontend.serviceAccountName" -}}
|
||||
{{- if .Values.frontend.serviceAccount.create -}}
|
||||
{{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.frontend.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for Shuffle orborus
|
||||
*/}}
|
||||
{{- define "shuffle.orborus.serviceAccountName" -}}
|
||||
{{- if .Values.orborus.serviceAccount.create -}}
|
||||
{{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.orborus.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for Shuffle workers
|
||||
*/}}
|
||||
{{- define "shuffle.worker.serviceAccountName" -}}
|
||||
{{- if .Values.worker.serviceAccount.create -}}
|
||||
{{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.worker.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for Shuffle apps
|
||||
*/}}
|
||||
{{- define "shuffle.app.serviceAccountName" -}}
|
||||
{{- if .Values.app.serviceAccount.create -}}
|
||||
{{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.app.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
# This PVC is always enabled, regardless of .Values.persistence.enabled,
|
||||
# as app building does not work without it.
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: backend-apps-claim # Hardcoded by shuffle-app-builder
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
annotations:
|
||||
{{- if eq .Values.persistence.resourcePolicy "keep" }}
|
||||
helm.sh/resource-policy: keep
|
||||
{{- end }}
|
||||
{{- if or .Values.persistence.appBuilder.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.appBuilder.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.appBuilder.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.appBuilder.size }}
|
||||
{{- if .Values.persistence.appBuilder.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.appBuilder.selector "context" $) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.appBuilder "global" .Values.global ) | nindent 2 }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
{{- if (not .Values.persistence.apps.existingClaim) }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ printf "%s-apps" (include "shuffle.backend.name" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
annotations:
|
||||
{{- if eq .Values.persistence.resourcePolicy "keep" }}
|
||||
helm.sh/resource-policy: keep
|
||||
{{- end }}
|
||||
{{- if or .Values.persistence.apps.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.apps.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.apps.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.apps.size }}
|
||||
{{- if .Values.persistence.apps.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.apps.selector "context" $) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.apps "global" .Values.global ) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "shuffle.backend.name" . }}-env
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
BACKEND_PORT: "5001"
|
||||
{{- if .Values.shuffle.baseUrl }}
|
||||
BASE_URL: "{{ .Values.shuffle.baseUrl }}"
|
||||
SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
|
||||
{{- else }}
|
||||
BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001"
|
||||
{{- end }}
|
||||
ORG_ID: "{{ .Values.shuffle.org }}"
|
||||
SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
|
||||
SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
|
||||
SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
|
||||
SHUFFLE_CHAT_DISABLED: "true"
|
||||
SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
|
||||
SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
|
||||
SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"
|
||||
SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}"
|
||||
SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}"
|
||||
SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}"
|
||||
TZ: "{{ .Values.shuffle.timezone }}"
|
||||
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
|
||||
@@ -0,0 +1,221 @@
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.backend.deploymentAnnotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.deploymentAnnotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.backend.autoscaling.hpa.enabled }}
|
||||
replicas: {{ .Values.backend.replicaCount }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.updateStrategy }}
|
||||
strategy: {{- toYaml .Values.backend.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector:
|
||||
matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- if .Values.backend.podAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
spec:
|
||||
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
|
||||
serviceAccountName: {{ template "shuffle.backend.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }}
|
||||
{{- if .Values.backend.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAntiAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.backend.nodeAffinityPreset.type "key" .Values.backend.nodeAffinityPreset.key "values" .Values.backend.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.priorityClassName }}
|
||||
priorityClassName: {{ .Values.backend.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.schedulerName }}
|
||||
schedulerName: {{ .Values.backend.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.backend.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.backend.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.backend.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
|
||||
- name: volume-permissions
|
||||
image: {{ include "shuffle.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |
|
||||
chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /app/generated && \
|
||||
chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-apps && \
|
||||
chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-files
|
||||
{{- if .Values.volumePermissions.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: shuffle-app-builder
|
||||
mountPath: /app/generated
|
||||
- name: shuffle-apps
|
||||
mountPath: /shuffle-apps
|
||||
{{- if .Values.persistence.apps.subPath }}
|
||||
subPath: {{ .Values.persistence.apps.subPath }}
|
||||
{{- end }}
|
||||
- name: shuffle-files
|
||||
mountPath: /shuffle-files
|
||||
{{- if .Values.persistence.files.subPath }}
|
||||
subPath: {{ .Values.persistence.apps.subPath }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.backend.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: backend
|
||||
image: {{ template "shuffle.backend.image" . }}
|
||||
imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
|
||||
{{- if .Values.backend.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backend.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.backend.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.backend.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.backend.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.backend.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: RUNNING_MODE
|
||||
value: kubernetes
|
||||
- name: IS_KUBERNETES
|
||||
value: "true"
|
||||
- name: SHUFFLE_APP_HOTLOAD_FOLDER
|
||||
value: /shuffle-apps
|
||||
- name: SHUFFLE_FILE_LOCATION
|
||||
value: /shuffle-files
|
||||
{{- if .Values.backend.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ include "shuffle.backend.name" . }}-env
|
||||
{{- if .Values.backend.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.resources }}
|
||||
resources: {{- toYaml .Values.backend.resources | nindent 12 }}
|
||||
{{- else if ne .Values.backend.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.backend.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 5001
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.backend.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.backend.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /api/v1/health
|
||||
port: 5001
|
||||
{{- end }}
|
||||
{{- if .Values.backend.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.backend.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /api/v1/health
|
||||
port: 5001
|
||||
{{- end }}
|
||||
{{- if .Values.backend.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.backend.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /api/v1/health
|
||||
port: 5001
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.backend.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: shuffle-app-builder
|
||||
mountPath: /app/generated
|
||||
- name: shuffle-apps
|
||||
mountPath: /shuffle-apps
|
||||
{{- if .Values.persistence.apps.subPath }}
|
||||
subPath: {{ .Values.persistence.apps.subPath }}
|
||||
{{- end }}
|
||||
- name: shuffle-files
|
||||
mountPath: /shuffle-files
|
||||
{{- if .Values.persistence.files.subPath }}
|
||||
subPath: {{ .Values.persistence.apps.subPath }}
|
||||
{{- end }}
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.backend.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
- name: shuffle-app-builder
|
||||
persistentVolumeClaim:
|
||||
claimName: backend-apps-claim
|
||||
- name: shuffle-apps
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ default (printf "%s-apps" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
- name: shuffle-files
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ default (printf "%s-files" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
{{- if (not .Values.persistence.files.existingClaim) }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ printf "%s-files" (include "shuffle.backend.name" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
annotations:
|
||||
{{- if eq .Values.persistence.resourcePolicy "keep" }}
|
||||
helm.sh/resource-policy: keep
|
||||
{{- end }}
|
||||
{{- if or .Values.persistence.files.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.files.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.files.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.files.size }}
|
||||
{{- if .Values.persistence.files.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.files.selector "context" $) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.files "global" .Values.global ) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if .Values.backend.autoscaling.hpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
name: {{ include "shuffle.backend.name" . }}
|
||||
minReplicas: {{ .Values.backend.autoscaling.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.backend.autoscaling.hpa.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.backend.autoscaling.hpa.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetMemory }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.autoscaling.hpa.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetCPU }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,66 @@
|
||||
{{- if .Values.backend.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
{{- if .Values.backend.networkPolicy.allowExternalEgress }}
|
||||
- {}
|
||||
{{- else }}
|
||||
# Allow DNS resolution with an in-cluster DNS server
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
{{- if .Values.backend.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 5001
|
||||
protocol: TCP
|
||||
{{- if not .Values.backend.networkPolicy.allowExternal }}
|
||||
from:
|
||||
# Allow traffic from orborus
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }}
|
||||
|
||||
# Allow traffic from workers
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
|
||||
|
||||
# Allow traffic from apps
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backend.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if .Values.backend.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.backend.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.backend.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.backend.pdb.maxUnavailable ( not .Values.backend.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.backend.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{ if .Values.backend.rbac.create }}
|
||||
kind: RoleBinding
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "shuffle.backend.serviceAccountName" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "shuffle.backend.name" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{ if .Values.backend.rbac.create }}
|
||||
kind: Role
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["list"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["get", "create", "delete"]
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.backend.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "shuffle.backend.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 5001
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
|
||||
@@ -0,0 +1,38 @@
|
||||
{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.backend.autoscaling.vpa.enabled }}
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "shuffle.backend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
resourcePolicy:
|
||||
containerPolicies:
|
||||
- containerName: backend
|
||||
{{- with .Values.backend.autoscaling.vpa.controlledResources }}
|
||||
controlledResources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backend.autoscaling.vpa.maxAllowed }}
|
||||
maxAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backend.autoscaling.vpa.minAllowed }}
|
||||
minAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
targetRef:
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
name: {{ include "backend.names.name" . }}
|
||||
{{- if .Values.backend.autoscaling.vpa.updatePolicy }}
|
||||
updatePolicy:
|
||||
{{- with .Values.backend.autoscaling.vpa.updatePolicy.updateMode }}
|
||||
updateMode: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,4 @@
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "shuffle.frontend.name" . }}-env
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
@@ -0,0 +1,151 @@
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "shuffle.frontend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.frontend.deploymentAnnotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.deploymentAnnotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.frontend.autoscaling.hpa.enabled }}
|
||||
replicas: {{ .Values.frontend.replicaCount }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.updateStrategy }}
|
||||
strategy: {{- toYaml .Values.frontend.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector:
|
||||
matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- if .Values.frontend.podAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
spec:
|
||||
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
|
||||
serviceAccountName: {{ template "shuffle.frontend.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }}
|
||||
{{- if .Values.frontend.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAntiAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.frontend.nodeAffinityPreset.type "key" .Values.frontend.nodeAffinityPreset.key "values" .Values.frontend.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.priorityClassName }}
|
||||
priorityClassName: {{ .Values.frontend.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.schedulerName }}
|
||||
schedulerName: {{ .Values.frontend.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.frontend.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.frontend.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if .Values.frontend.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: frontend
|
||||
image: {{ template "shuffle.frontend.image" . }}
|
||||
imagePullPolicy: {{ .Values.frontend.image.pullPolicy }}
|
||||
{{- if .Values.frontend.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.frontend.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.frontend.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.frontend.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if .Values.frontend.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ include "shuffle.frontend.name" . }}-env
|
||||
{{- if .Values.frontend.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.resources }}
|
||||
resources: {{- toYaml .Values.frontend.resources | nindent 12 }}
|
||||
{{- else if ne .Values.frontend.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.frontend.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.frontend.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.frontend.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.frontend.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.frontend.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.frontend.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if .Values.frontend.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if .Values.frontend.autoscaling.hpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "shuffle.frontend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
name: {{ include "shuffle.frontend.name" . }}
|
||||
minReplicas: {{ .Values.frontend.autoscaling.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.frontend.autoscaling.hpa.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.frontend.autoscaling.hpa.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetMemory }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.autoscaling.hpa.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetCPU }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if .Values.frontend.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.frontend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
{{- if .Values.frontend.networkPolicy.allowExternalEgress }}
|
||||
- {}
|
||||
{{- else }}
|
||||
# Allow DNS resolution with an in-cluster DNS server
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
{{- if .Values.frontend.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
{{ if .Values.frontend.networkPolicy.allowExternal }}
|
||||
- ports:
|
||||
- port: 8080
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if .Values.frontend.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "shuffle.frontend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.frontend.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.frontend.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.frontend.pdb.maxUnavailable ( not .Values.frontend.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.frontend.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.frontend.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "shuffle.frontend.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "shuffle.frontend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
|
||||
@@ -0,0 +1,38 @@
|
||||
{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.frontend.autoscaling.vpa.enabled }}
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "shuffle.frontend.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
resourcePolicy:
|
||||
containerPolicies:
|
||||
- containerName: frontend
|
||||
{{- with .Values.frontend.autoscaling.vpa.controlledResources }}
|
||||
controlledResources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.frontend.autoscaling.vpa.maxAllowed }}
|
||||
maxAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.frontend.autoscaling.vpa.minAllowed }}
|
||||
minAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
targetRef:
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
name: {{ include "frontend.names.name" . }}
|
||||
{{- if .Values.frontend.autoscaling.vpa.updatePolicy }}
|
||||
updatePolicy:
|
||||
{{- with .Values.frontend.autoscaling.vpa.updatePolicy.updateMode }}
|
||||
updateMode: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,60 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.ingress.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.ingress.hostname }}
|
||||
- host: {{ .Values.ingress.hostname }}
|
||||
http:
|
||||
paths:
|
||||
{{- if .Values.ingress.extraPaths }}
|
||||
{{- toYaml .Values.ingress.extraPaths | nindent 10 }}
|
||||
{{- end }}
|
||||
- path: {{ .Values.ingress.path }}
|
||||
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
|
||||
pathType: {{ .Values.ingress.pathType }}
|
||||
{{- end }}
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.frontend.name" .) "servicePort" "http" "context" $) | nindent 14 }}
|
||||
- path: {{ .Values.ingress.backendPath }}
|
||||
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
|
||||
pathType: {{ .Values.ingress.backendPathType }}
|
||||
{{- end }}
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.backend.name" .) "servicePort" "http" "context" $) | nindent 14 }}
|
||||
|
||||
{{- end }}
|
||||
{{- range .Values.ingress.extraHosts }}
|
||||
- host: {{ .name | quote }}
|
||||
http:
|
||||
paths:
|
||||
- path: {{ default "/" .path }}
|
||||
{{- if eq "true" (include "common.ingress.supportsPathType" $) }}
|
||||
pathType: {{ default "ImplementationSpecific" .pathType }}
|
||||
{{- end }}
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "http" "context" $) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.extraRules }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned)) .Values.ingress.extraTls }}
|
||||
tls:
|
||||
{{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned) }}
|
||||
- hosts:
|
||||
- {{ .Values.ingress.hostname | quote }}
|
||||
secretName: {{ printf "%s-tls" .Values.ingress.hostname }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.extraTls }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- if .Values.ingress.secrets }}
|
||||
{{- range .Values.ingress.secrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
namespace: {{ include "common.names.namespace" $ | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if $.Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ .certificate | b64enc }}
|
||||
tls.key: {{ .key | b64enc }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
|
||||
{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
|
||||
{{- $ca := genCA "shuffle-ca" 365 }}
|
||||
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.istio.enabled }}
|
||||
apiVersion: "{{ .Values.istio.apiVersion }}"
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.gateway.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector: {{- include "common.tplvalues.render" ( dict "value" .Values.istio.gateway.selector "context" $ ) | nindent 4 }}
|
||||
servers:
|
||||
{{- if .Values.istio.gateway.http.enabled }}
|
||||
- name: "{{ include "common.names.fullname" . }}-http"
|
||||
port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts: {{ .Values.istio.hosts }}
|
||||
tls:
|
||||
httpsRedirect: {{ .Values.istio.gateway.http.httpsRedirect }}
|
||||
{{- end }}
|
||||
{{- if .Values.istio.gateway.https.enabled }}
|
||||
- name: "{{ include "common.names.fullname" . }}-https"
|
||||
port:
|
||||
number: 443
|
||||
name: https
|
||||
protocol: HTTPS
|
||||
hosts: {{ .Values.istio.hosts }}
|
||||
tls:
|
||||
credentialName: {{ .Values.istio.gateway.https.tlsCredentialName }}
|
||||
mode: SIMPLE
|
||||
{{- end }}
|
||||
{{- if .Values.istio.gateway.extraServers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.istio.gateway.extraServers "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if .Values.istio.enabled }}
|
||||
apiVersion: "{{ .Values.istio.apiVersion }}"
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.virtualService.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
hosts: {{ .Values.istio.hosts }}
|
||||
gateways:
|
||||
- {{ include "common.names.fullname" . }}
|
||||
http:
|
||||
- match:
|
||||
- uri:
|
||||
prefix: /api
|
||||
route:
|
||||
- destination:
|
||||
host: {{ include "shuffle.backend.name" . }}
|
||||
port:
|
||||
number: 5001
|
||||
- route:
|
||||
- destination:
|
||||
host: {{ include "shuffle.frontend.name" . }}
|
||||
port:
|
||||
number: 8080
|
||||
{{- end }}
|
||||
@@ -0,0 +1,61 @@
|
||||
{{- if .Values.app.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.app.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.app.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "shuffle.app.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
{{- if .Values.app.networkPolicy.allowExternalEgress }}
|
||||
- {}
|
||||
{{- else }}
|
||||
# Allow DNS resolution with an in-cluster DNS server
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
# Allow access to workers
|
||||
- ports:
|
||||
- port: 33333
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
|
||||
{{- if .Values.app.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
{{- if .Values.app.networkPolicy.allowExternal }}
|
||||
- {}
|
||||
{{- else }}
|
||||
# Allow access from workers. Apps will typicaly use port 80/TCP, but this is not enforced.
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.app.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{ if .Values.app.rbac.create }}
|
||||
kind: RoleBinding
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.app.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
# Deployed shuffle apps will use the default service account. There is currently no way to change that.
|
||||
# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: default
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "shuffle.app.name" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{ if .Values.app.rbac.create }}
|
||||
kind: Role
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.app.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: [""]
|
||||
verbs: [""]
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.app.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "shuffle.app.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.app.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- if .Values.worker.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.worker.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "shuffle.worker.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
{{- if .Values.worker.networkPolicy.allowExternalEgress }}
|
||||
- {}
|
||||
{{- else }}
|
||||
# Allow DNS resolution with an in-cluster DNS server
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
# Allow access to orborus
|
||||
- ports:
|
||||
- port: 8080
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }}
|
||||
# Allow arbitrary connections to apps. Apps will typically use port 80/TCP, but this is not enforced.
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }}
|
||||
{{- if .Values.worker.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 33333
|
||||
protocol: TCP
|
||||
{{- if not .Values.worker.networkPolicy.allowExternal }}
|
||||
from:
|
||||
# Allow traffic from orborus
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{ if .Values.worker.rbac.create }}
|
||||
kind: RoleBinding
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.worker.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
# Deployed shuffle workers will use the default service account. There is currently no way to change that.
|
||||
# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: default
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "shuffle.worker.name" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{ if .Values.worker.rbac.create }}
|
||||
kind: Role
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.worker.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["list", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["list", "create"]
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.worker.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "shuffle.worker.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.worker.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "shuffle.orborus.name" . }}-env
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
|
||||
ORG_ID: "{{ .Values.shuffle.org }}"
|
||||
TZ: "{{ .Values.shuffle.timezone }}"
|
||||
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
|
||||
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
|
||||
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccountName" . }}
|
||||
SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"
|
||||
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
|
||||
SHUFFLE_SWARM_CONFIG: run
|
||||
@@ -0,0 +1,155 @@
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "shuffle.orborus.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.orborus.deploymentAnnotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.deploymentAnnotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.orborus.autoscaling.hpa.enabled }}
|
||||
replicas: {{ .Values.orborus.replicaCount }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.updateStrategy }}
|
||||
strategy: {{- toYaml .Values.orborus.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector:
|
||||
matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- if .Values.orborus.podAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
spec:
|
||||
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
|
||||
serviceAccountName: {{ template "shuffle.orborus.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }}
|
||||
{{- if .Values.orborus.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAntiAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.orborus.nodeAffinityPreset.type "key" .Values.orborus.nodeAffinityPreset.key "values" .Values.orborus.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.priorityClassName }}
|
||||
priorityClassName: {{ .Values.orborus.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.schedulerName }}
|
||||
schedulerName: {{ .Values.orborus.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.orborus.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.orborus.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if .Values.orborus.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: orborus
|
||||
image: {{ template "shuffle.orborus.image" . }}
|
||||
imagePullPolicy: {{ .Values.orborus.image.pullPolicy }}
|
||||
{{- if .Values.orborus.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.orborus.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.orborus.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.orborus.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: RUNNING_MODE
|
||||
value: kubernetes
|
||||
- name: IS_KUBERNETES
|
||||
value: "true"
|
||||
{{- if .Values.orborus.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ include "shuffle.orborus.name" . }}-env
|
||||
{{- if .Values.orborus.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.resources }}
|
||||
resources: {{- toYaml .Values.orborus.resources | nindent 12 }}
|
||||
{{- else if ne .Values.orborus.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.orborus.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.orborus.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.orborus.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.orborus.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.orborus.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.orborus.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.orborus.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if .Values.orborus.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if .Values.orborus.autoscaling.hpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "shuffle.orborus.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
name: {{ include "shuffle.orborus.name" . }}
|
||||
minReplicas: {{ .Values.orborus.autoscaling.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.orborus.autoscaling.hpa.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.orborus.autoscaling.hpa.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetMemory }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.autoscaling.hpa.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetCPU }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,72 @@
|
||||
{{- if .Values.orborus.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "shuffle.orborus.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
{{- if .Values.orborus.networkPolicy.allowExternalEgress }}
|
||||
- {}
|
||||
{{- else }}
|
||||
# Allow DNS resolution with an in-cluster DNS server
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
# Allow access to backend
|
||||
- ports:
|
||||
- port: 5001
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }}
|
||||
# Allow access to workers
|
||||
- ports:
|
||||
- port: 33333
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
|
||||
{{- if .Values.orborus.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 8080
|
||||
protocol: TCP
|
||||
{{- if not .Values.orborus.networkPolicy.allowExternal }}
|
||||
from:
|
||||
# Allow traffic from workers
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ .Release.Namespace }}
|
||||
podSelector:
|
||||
matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.orborus.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if .Values.orborus.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "shuffle.orborus.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.orborus.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.orborus.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.orborus.pdb.maxUnavailable ( not .Values.orborus.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.orborus.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{ if .Values.orborus.rbac.create }}
|
||||
kind: RoleBinding
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "shuffle.orborus.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "shuffle.orborus.serviceAccountName" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "shuffle.orborus.name" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,29 @@
|
||||
{{ if .Values.orborus.rbac.create }}
|
||||
kind: Role
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "shuffle.orborus.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- verbs:
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- verbs:
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.orborus.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "shuffle.orborus.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,38 @@
|
||||
{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.orborus.autoscaling.vpa.enabled }}
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "shuffle.orborus.name" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
resourcePolicy:
|
||||
containerPolicies:
|
||||
- containerName: orborus
|
||||
{{- with .Values.orborus.autoscaling.vpa.controlledResources }}
|
||||
controlledResources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.orborus.autoscaling.vpa.maxAllowed }}
|
||||
maxAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.orborus.autoscaling.vpa.minAllowed }}
|
||||
minAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
targetRef:
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
name: {{ include "orborus.names.name" . }}
|
||||
{{- if .Values.orborus.autoscaling.vpa.updatePolicy }}
|
||||
updatePolicy:
|
||||
{{- with .Values.orborus.autoscaling.vpa.updatePolicy.updateMode }}
|
||||
updateMode: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{ range $index, $element := .Values.vault.secrets }}
|
||||
{{- $vaultRole := $element.vaultRole | default $.Values.vault.role }}
|
||||
---
|
||||
apiVersion: ricoberger.de/v1alpha1
|
||||
kind: VaultSecret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" $ }}-{{ $element.name }}
|
||||
spec:
|
||||
type: {{ $element.type }}
|
||||
path: {{ $element.path }}
|
||||
{{- if $vaultRole }}
|
||||
vaultRole: {{ $vaultRole }}
|
||||
{{- end }}
|
||||
{{- range $k, $v := $element }}
|
||||
{{- if (not (has $k (list "name" "type" "path" "vaultRole"))) }}
|
||||
{{ $k }}: {{ $v }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user