diff --git a/backend/go-app/go.mod b/backend/go-app/go.mod index c3918475..831f0894 100644 --- a/backend/go-app/go.mod +++ b/backend/go-app/go.mod @@ -26,8 +26,8 @@ require ( github.com/gorilla/mux v1.8.1 github.com/h2non/filetype v1.1.3 github.com/satori/go.uuid v1.2.0 - github.com/shuffle/shuffle-shared v0.9.77 - github.com/shuffle/singul v0.0.20 + github.com/shuffle/shuffle-shared v0.9.83 + github.com/shuffle/singul v0.0.25 golang.org/x/crypto v0.45.0 google.golang.org/api v0.236.0 google.golang.org/grpc v1.72.2 @@ -65,6 +65,7 @@ require ( github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect github.com/containerd/log v0.1.0 // indirect + github.com/coreos/go-oidc/v3 v3.17.0 // indirect github.com/cyphar/filepath-securejoin v0.4.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/distribution/reference v0.6.0 // indirect @@ -75,15 +76,16 @@ require ( github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/frikky/schemaless v0.0.25 // indirect + github.com/frikky/schemaless v0.0.28 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect - github.com/go-jose/go-jose/v4 v4.0.5 // indirect + github.com/go-jose/go-jose/v4 v4.1.3 // indirect github.com/go-logr/logr v1.4.2 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-openapi/jsonpointer v0.21.0 // indirect github.com/go-openapi/jsonreference v0.20.2 // indirect github.com/go-openapi/swag v0.23.0 // indirect + github.com/goccy/go-json v0.10.5 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/golang/protobuf v1.5.4 // indirect diff --git a/backend/go-app/main.go b/backend/go-app/main.go index 8a1fe9b1..30665be7 100755 --- a/backend/go-app/main.go +++ b/backend/go-app/main.go @@ -1263,7 +1263,7 @@ func checkAdminLogin(resp http.ResponseWriter, request *http.Request) { // Should run calculations if len(org.SSOConfig.OpenIdAuthorization) > 0 { - baseSSOUrl = shuffle.GetOpenIdUrl(request, *org) + baseSSOUrl, err = shuffle.GetOpenIdUrl(request, *org, user, "") if err != nil { log.Printf("[ERROR] Failed getting OpenID URL for org %s: %s", org.Name, err) } @@ -5398,6 +5398,7 @@ func initHandlers() { r.HandleFunc("/api/v1/_ah/health", shuffle.HealthCheckHandler) r.HandleFunc("/api/v1/health", shuffle.RunOpsHealthCheck).Methods("GET", "OPTIONS") r.HandleFunc("/api/v1/health/stats", shuffle.GetOpsDashboardStats).Methods("GET", "OPTIONS") + r.HandleFunc("/api/v1/health/opensearch-prefix", shuffle.HandleFixOpensearchPrefix).Methods("POST", "OPTIONS") // Make user related locations // Fix user changes with org @@ -5683,16 +5684,16 @@ func initHandlers() { r.HandleFunc("/api/v1/dashboards/{key}/widgets/{widget_id}", shuffle.HandleGetWidget).Methods("GET", "OPTIONS") // Need to add auth in pprof -// if strings.ToLower(os.Getenv("SHUFFLE_DEBUG_MEMORY")) == "true" || strings.ToLower(os.Getenv("DEBUG_MEMORY")) == "true" { -// log.Printf("[DEBUG] Memory debugging is enabled on /debug/pprof") -// r.HandleFunc("/debug/pprof/", pprof.Index) -// r.HandleFunc("/debug/pprof/heap", pprof.Handler("heap").ServeHTTP) -// r.HandleFunc("/debug/pprof/profile", pprof.Profile) -// r.HandleFunc("/debug/pprof/symbol", pprof.Symbol) -// r.HandleFunc("/debug/pprof/trace", pprof.Trace) -// } else { -// log.Printf("[DEBUG] Memory debugging is disabled. To enable, set SHUFFLE_DEBUG_MEMORY or DEBUG_MEMORY to true") -// } + // if strings.ToLower(os.Getenv("SHUFFLE_DEBUG_MEMORY")) == "true" || strings.ToLower(os.Getenv("DEBUG_MEMORY")) == "true" { + // log.Printf("[DEBUG] Memory debugging is enabled on /debug/pprof") + // r.HandleFunc("/debug/pprof/", pprof.Index) + // r.HandleFunc("/debug/pprof/heap", pprof.Handler("heap").ServeHTTP) + // r.HandleFunc("/debug/pprof/profile", pprof.Profile) + // r.HandleFunc("/debug/pprof/symbol", pprof.Symbol) + // r.HandleFunc("/debug/pprof/trace", pprof.Trace) + // } else { + // log.Printf("[DEBUG] Memory debugging is disabled. To enable, set SHUFFLE_DEBUG_MEMORY or DEBUG_MEMORY to true") + // } r.Use(shuffle.RequestMiddleware) http.Handle("/", r) diff --git a/backend/go-app/walkoff.go b/backend/go-app/walkoff.go index 226c2850..288fedc0 100755 --- a/backend/go-app/walkoff.go +++ b/backend/go-app/walkoff.go @@ -1,7 +1,6 @@ package main import ( - "github.com/shuffle/shuffle-shared" "bytes" @@ -1266,7 +1265,7 @@ func executeWorkflow(resp http.ResponseWriter, request *http.Request) { // Check for "wait" query if it's true wait, waitok := request.URL.Query()["wait"] if waitok && wait[0] == "true" { - returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1) + returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1, 15) returnBytes, err := json.Marshal(returnBody) if err != nil { log.Printf("[ERROR] Failed to marshal retStruct in single execution: %s", err) @@ -2728,7 +2727,7 @@ func executeSingleAction(resp http.ResponseWriter, request *http.Request) { actionId = workflowExecution.Workflow.Actions[0].ID } - returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1, actionId) + returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1, 15, actionId) returnBytes, err := json.Marshal(returnBody) if err != nil { log.Printf("[ERROR] Failed to marshal retStruct in single execution: %s", err) diff --git a/frontend/src/components/HealthPage.jsx b/frontend/src/components/HealthPage.jsx index 287ad9b1..b60a46be 100644 --- a/frontend/src/components/HealthPage.jsx +++ b/frontend/src/components/HealthPage.jsx @@ -24,6 +24,7 @@ const HealthPage = (props) => { const [liveExecutionsRange, setLiveExecutionsRange] = useState('1h'); // Default to 1h const [isHealthLoading, setIsHealthLoading] = useState(false); // Loading state for HealthBarChart const [isLiveExecutionsLoading, setIsLiveExecutionsLoading] = useState(false); // Loading state for LiveExecutionsChart + const [isFixingOpensearchPrefix, setIsFixingOpensearchPrefix] = useState(false); const isCloud = (window.location.host === "localhost:3002" || window.location.host === "shuffler.io") ? true : (import.meta.env.VITE_IS_SSR === "true"); @@ -364,19 +365,63 @@ const HealthPage = (props) => { } }; + const handleFixOpensearchPrefix = async () => { + if (isFixingOpensearchPrefix) { + return; + } + + setIsFixingOpensearchPrefix(true); + try { + const response = await fetch(`${globalUrl}/api/v1/health/opensearch-prefix`, { + method: "POST", + headers: { + "Content-Type": "application/json", + Accept: "application/json", + }, + credentials: "include", + }); + + const data = await response.json(); + if (!response.ok || !data.success) { + const reason = data && data.reason ? data.reason : "Failed to fix opensearch prefix"; + throw new Error(reason); + } + + const reindexed = data.reindexed ? data.reindexed.length : 0; + const aliasUpdates = data.alias_updates ? data.alias_updates.length : 0; + const deleted = data.deleted_indices ? data.deleted_indices.length : 0; + toast.success(`Fixed opensearch prefix (reindexed ${reindexed}, aliases ${aliasUpdates}, deleted ${deleted})`); + } catch (error) { + console.error("Error fixing opensearch prefix:", error); + toast.error(error.message || "Failed to fix opensearch prefix"); + } finally { + setIsFixingOpensearchPrefix(false); + } + }; + const healthBarData = updateChartData() return (
{/* Health Bar Chart Section */} - - - - - - - +
+ + + + + + + + +
{/* Loading Bar for HealthBarChart */} {isHealthLoading && ( diff --git a/functions/kubernetes/charts/shuffle/Chart.yaml b/functions/kubernetes/charts/shuffle/Chart.yaml index e286e11f..9cc97a23 100644 --- a/functions/kubernetes/charts/shuffle/Chart.yaml +++ b/functions/kubernetes/charts/shuffle/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: shuffle description: A Helm chart for deploying Shuffle on Kubernetes type: application -version: 2.1.0 # Set during publishing in GitHub actions +version: 0.0.0 # Set during publishing in GitHub actions appVersion: latest # Overwritten during publishing in GitHub actions dependencies: - name: common diff --git a/functions/kubernetes/charts/shuffle/README.md b/functions/kubernetes/charts/shuffle/README.md index c9810210..7c1315b9 100644 --- a/functions/kubernetes/charts/shuffle/README.md +++ b/functions/kubernetes/charts/shuffle/README.md @@ -105,6 +105,105 @@ SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uu SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" ``` +## Shuffle Worker + +By default, Orborus creates a Kubernetes Deployment and Service for Shuffle Worker. +The deployment can be customized to some degree using some of the `worker.*` helm variables. They are converted to Orborus env variables. + +If you want full control, you can also deploy Shuffle Worker using helm by enabling `worker.enableHelmDeployment`. +This approach respects all of the `worker.*` helm variables. + +You can then set `orborus.manageWorkerDeployments=false` to reduce the permissions assigned to the Shuffle Orborus Kubernetes service account. + +## Shuffle Apps + +By default, Shuffle Worker is responsible for creating Kubernetes Deployments and Services for each app. +Each app and version has their own Deployment and Service. Shuffle automatically deploys a set of apps. +Other apps are deployed on demand, when they are first used. + +You can use some of the `app.*` helm variables to control some aspects of the deployment, e.g. resources and security context. +Helm variables are converted to env variables set on Orborus. Orborus in turn passes the env variables to Worker when creating the Deployment. +When `worker.enableHelmDeployment` is set, env variables for app configuration are set on the worker directly. +Configuration using env variables applies to ALL deployed apps. There is no way to assign different options (e.g. resources) to different apps, or scale apps individually. + +If you want full control, you can deploy apps using helm. This has the following advantages: + +- full control over the deployment using helm values +- granular control per app and version (e.g. have more replicas and resources for frequently used apps) +- avoid problems with on-demand started apps (see https://github.com/Shuffle/Shuffle/issues/1739) + +To deploy apps using helm, set `apps.enabled=true`. By default, this deploys the `shuffle-tools`, `shuffle-subflow` and `http` apps. +You can also deploy your own apps. See the following values file for an example. + +```yaml +app: + replicaCount: 1 # default to 1 replica per app + resources: {} # default resources for apps +# ... configure default options for all apps here + +apps: + enabled: true # Deploy apps using helm. + + # Configure default apps + shuffleTools: + enabled: true # default + shuffleSubflow: + enabled: true # default + http: + enabled: true # default + # optionally override defaults from app values: + replicaCount: 1 + resources: {} + + # Deploy additional apps (e.g. opensearch) + opensearch: + enabled: true # required to actually deploy the app + name: opensearch # required. The name and version must match the values of the `api.yaml` file of the app. + version: 1.1.0 # required. + # optionally change app configuration: + replicaCount: 3 + resources: {} +``` + +The key of an app in the `apps` map does not matter, as long as it is unique. We are not using an array here, to allow overriding values in stage-specific value files or using the command line, e.g. +`helm upgrade ... --set apps.shuffleTools.replicas=3`. + +You can override any value set in `app.*` (e.g. `app.image`, `app.replicaCount`, `app.resources`, `app.podSecurityContext`) for each app +(e.g. for the `shuffle-tools` app using `apps.shuffleTools.image`, `apps.shuffleTools.replicaCount`, ...). + +It is possible to use a hybrid approach - deploy some apps using helm, while still allowing Worker to create additional apps on-demand. + +If you do not want Worker to manage app deployments, set `worker.manageAppDeployments=true`. This effectively removes the required permissions from the Shuffle Worker Kubernetes Service Account. +You are required to deploy all apps that are in use by your Shuffle instance manually using Helm. + +### Shuffle App Service Accounts + +By default a shared `shuffle-app` service account is used for all apps. +If you are deploying apps using helm, you can choose to have a dedicated service account per app. +To enable it, set `apps.MY_APP.serviceAccount.create=true` and provide a name using `apps.MY_APP.serviceAccount.name`. +You can also set `apps.MY_APP.serviceAccount.create=false` while still providing a name to use an existing service account. + +```yaml +apps: + myAppWithCustomServiceAccount: + enabled: true + name: my-custom-service-account + version: 1.0.0 + serviceAccount: + create: true + name: shuffle-app-myapp + + anotherAppWithExistingServiceAccount: + enabled: true + name: another-app + version: 1.0.0 + serviceAccount: + create: false + name: existing-service-account-name +``` + +All service accounts use the `shuffle-app` role by default. + ## OpenSearch Shuffle uses OpenSearch as its database. This helm chart installs a single-node OpenSearch cluster using [the Bitnami Helm Chart](https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml). @@ -116,7 +215,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia ## Parameters -### Global parameters +##### Global parameters | Name | Description | Value | | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | @@ -126,7 +225,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | | `global.compatibility.omitEmptySeLinuxOptions` | If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object | `false` | -### Common parameters +##### Common parameters | Name | Description | Value | | ------------------------ | --------------------------------------------------------------------------------------- | --------------- | @@ -142,16 +241,17 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `diagnosticMode.command` | Command to override all containers in the chart release | `["sleep"]` | | `diagnosticMode.args` | Args to override all containers in the chart release | `["infinity"]` | -### Shared Shuffle Parameters +##### Shared Shuffle Parameters -| Name | Description | Value | -| --------------------- | ------------------------------------------------------------- | --------------- | -| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` | -| `shuffle.org` | Default shuffle organization | `Shuffle` | -| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `""` | -| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` | +| Name | Description | Value | +| -------------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------- | +| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` | +| `shuffle.org` | Default shuffle organization | `Shuffle` | +| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `docker.io` | +| `shuffle.appBaseImageName` | The base image used for shuffle apps. The final image for an app is //: | `frikky` | +| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` | -### backend Parameters +##### backend Parameters | Name | Description | Value | | ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | @@ -266,7 +366,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `backend.apps.downloadBranch` | The branch from which apps should be downloaded on startup. | `master` | | `backend.apps.forceUpdate` | Force an update of apps on startup. | `false` | -### frontend Parameters +##### frontend Parameters | Name | Description | Value | | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | @@ -372,7 +472,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `frontend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `frontend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | -### orborus Parameters +##### orborus Parameters | Name | Description | Value | | ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | @@ -475,15 +575,44 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `orborus.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | | `orborus.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `orborus.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `orborus.executionConcurrency` | The maximum amount of concurrent workflow executions per worker | `25` | +| `orborus.manageWorkerDeployments` | Whether workers are deployed and managed by orborus. When disabled, every worker is expected to be already deployed (see worker.enableHelmDeployment). | `true` | -### worker Parameters +##### worker Parameters | Name | Description | Value | | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `worker.enableHelmDeployment` | Deploy worker via helm. By default, workers are deployed by Orborus. | `false` | | `worker.image.registry` | worker image registry | `ghcr.io` | | `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` | | `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` | | `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `worker.image.pullPolicy` | worker image pull policy. Only effective with worker.enableHelmDeployment. | `IfNotPresent` | +| `worker.image.pullSecrets` | worker image pull secrets. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.replicaCount` | Number of worker replicas to deploy. Only effective with worker.enableHelmDeployment. | `1` | +| `worker.containerPorts.http` | backend HTTP container port | `33333` | +| `worker.extraContainerPorts` | Optionally specify extra list of additional ports for worker containers. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.livenessProbe.enabled` | Enable livenessProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` | +| `worker.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `worker.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `worker.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `worker.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `worker.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `worker.readinessProbe.enabled` | Enable readinessProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` | +| `worker.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `worker.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `worker.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `worker.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `worker.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `worker.startupProbe.enabled` | Enable startupProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` | +| `worker.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `worker.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `worker.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `worker.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `worker.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `worker.customLivenessProbe` | Custom livenessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.customReadinessProbe` | Custom readinessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.customStartupProbe` | Custom startupProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` | | `worker.resourcesPreset` | Set worker container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if worker.resources is set (worker.resources is recommended for production). | `nano` | | `worker.resources` | Set worker container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | | `worker.podSecurityContext.enabled` | Enable worker pods' Security Context | `true` | @@ -501,6 +630,49 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `worker.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in worker container' Security Context | `false` | | `worker.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in worker container | `["ALL"]` | | `worker.containerSecurityContext.seccompProfile.type` | Set seccomp profile in worker container | `RuntimeDefault` | +| `worker.command` | Override default worker container command (useful when using custom images). Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.args` | Override default worker container args (useful when using custom images). Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.automountServiceAccountToken` | Mount Service Account token in worker pods. Only effective with worker.enableHelmDeployment. | `true` | +| `worker.hostAliases` | worker pods host aliases. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.deploymentAnnotations` | Annotations for worker deployment. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.podLabels` | Extra labels for worker pods. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.podAnnotations` | Annotations for worker pods. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.podAffinityPreset` | Pod affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `""` | +| `worker.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `soft` | +| `worker.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `""` | +| `worker.nodeAffinityPreset.key` | Node label key to match. Ignored if `worker.affinity` is set | `""` | +| `worker.nodeAffinityPreset.values` | Node label values to match. Ignored if `worker.affinity` is set | `[]` | +| `worker.affinity` | Affinity for worker pods assignment. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.nodeSelector` | Node labels for worker pods assignment. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.tolerations` | Tolerations for worker pods assignment. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.updateStrategy.type` | worker deployment strategy type. Only effective with worker.enableHelmDeployment. | `RollingUpdate` | +| `worker.priorityClassName` | worker pods' priorityClassName. Only effective with worker.enableHelmDeployment. | `""` | +| `worker.topologySpreadConstraints` | Topology Spread Constraints for worker pod assignment spread across your cluster among failure-domains. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.schedulerName` | Name of the k8s scheduler (other than default) for worker pods. Only effective with worker.enableHelmDeployment. | `""` | +| `worker.terminationGracePeriodSeconds` | Seconds worker pods need to terminate gracefully. Only effective with worker.enableHelmDeployment. | `""` | +| `worker.lifecycleHooks` | for worker containers to automate configuration before or after startup. Only effective with worker.enableHelmDeployment. | `{}` | +| `worker.extraEnvVars` | Array with extra environment variables to add to worker containers. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. | `""` | +| `worker.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. | `""` | +| `worker.extraVolumes` | Optionally specify extra list of additional volumes for the worker pods. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the worker containers. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.sidecars` | Add additional sidecar containers to the worker pods. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.initContainers` | Add additional init containers to the worker pods. Only effective with worker.enableHelmDeployment. | `[]` | +| `worker.pdb.create` | Enable/disable a Pod Disruption Budget creation. Only effective with worker.enableHelmDeployment. | `true` | +| `worker.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `worker.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `worker.pdb.minAvailable` and `worker.pdb.maxUnavailable` are empty. | `""` | +| `worker.autoscaling.vpa.enabled` | Enable VPA for worker pods. Only effective with worker.enableHelmDeployment. | `false` | +| `worker.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `worker.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `worker.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `worker.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `worker.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `worker.autoscaling.hpa.enabled` | Enable HPA for worker pods. Only effective with worker.enableHelmDeployment. | `false` | +| `worker.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `worker.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `worker.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `worker.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `worker.service.labels` | Extra labels for worker service. Only effective with worker.enableHelmDeployment. | `{}` | | `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | @@ -512,11 +684,40 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | | `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `worker.manageAppDeployments` | Whether apps are deployed and managed by worker. When disabled, every used app is expected to to be already deployed (see apps.enabled). | `true` | -### app Parameters +##### app Parameters | Name | Description | Value | | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | +| `app.image.registry` | app image registry (defaults to shuffle.appRegistry) | `""` | +| `app.image.repository` | app image repository (defaults to shuffle.appBaseImageName) | `""` | +| `app.image.tag` | app image tag (defaults to the apps version) | `""` | +| `app.image.pullPolicy` | default image pull policy for app deployments. Only effective for helm-deployed apps (see apps.enabled). | `IfNotPresent` | +| `app.image.pullSecrets` | default image pull secrets for app deployments. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.replicaCount` | Default number of replicas to deploy for each app. Only effective for helm-deployed apps (see apps.enabled). | `1` | +| `app.extraContainerPorts` | Optionally specify extra list of additional ports for app containers. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.livenessProbe.enabled` | Enable livenessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). | `false` | +| `app.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `app.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `app.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `app.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `app.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `app.readinessProbe.enabled` | Enable readinessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). | `false` | +| `app.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `app.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `app.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `app.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `app.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `app.startupProbe.enabled` | Enable startupProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). | `false` | +| `app.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `app.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `app.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `app.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `app.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `app.customLivenessProbe` | Custom livenessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.customReadinessProbe` | Custom readinessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.customStartupProbe` | Custom startupProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). | `{}` | | `app.resourcesPreset` | Set app container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if app.resources is set (app.resources is recommended for production). | `nano` | | `app.resources` | Set app container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | | `app.podSecurityContext.enabled` | Enable app pods' Security Context | `true` | @@ -534,6 +735,49 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `app.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in app container' Security Context | `false` | | `app.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in app container | `["ALL"]` | | `app.containerSecurityContext.seccompProfile.type` | Set seccomp profile in app container | `RuntimeDefault` | +| `app.command` | Override default app container command (useful when using custom images) | `[]` | +| `app.args` | Override default app container args (useful when using custom images) | `[]` | +| `app.automountServiceAccountToken` | Mount Service Account token in app pods. Only effective for helm-deployed apps (see apps.enabled). | `false` | +| `app.hostAliases` | app pods host aliases. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.deploymentAnnotations` | Annotations for app deployment. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.podLabels` | Extra labels for app pods. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.podAnnotations` | Annotations for app pods. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.podAffinityPreset` | Pod affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). | `""` | +| `app.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). | `soft` | +| `app.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). | `""` | +| `app.nodeAffinityPreset.key` | Node label key to match. Ignored if `app.affinity` is set | `""` | +| `app.nodeAffinityPreset.values` | Node label values to match. Ignored if `app.affinity` is set | `[]` | +| `app.affinity` | Affinity for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.nodeSelector` | Node labels for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.tolerations` | Tolerations for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.updateStrategy.type` | app deployment strategy type. Only effective for helm-deployed apps (see apps.enabled). | `RollingUpdate` | +| `app.priorityClassName` | app pods' priorityClassName. Only effective for helm-deployed apps (see apps.enabled). | `""` | +| `app.topologySpreadConstraints` | Topology Spread Constraints for app pod assignment spread across your cluster among failure-domains. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.schedulerName` | Name of the k8s scheduler (other than default) for app pods. Only effective for helm-deployed apps (see apps.enabled). | `""` | +| `app.terminationGracePeriodSeconds` | Seconds app pods need to terminate gracefully. Only effective for helm-deployed apps (see apps.enabled). | `""` | +| `app.lifecycleHooks` | for app containers to automate configuration before or after startup. Only effective for helm-deployed apps (see apps.enabled). | `{}` | +| `app.extraEnvVars` | Array with extra environment variables to add to app containers. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled). | `""` | +| `app.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled). | `""` | +| `app.extraVolumes` | Optionally specify extra list of additional volumes for the app pods. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the app containers. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.sidecars` | Add additional sidecar containers to the app pods. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.initContainers` | Add additional init containers to the app pods. Only effective for helm-deployed apps (see apps.enabled). | `[]` | +| `app.pdb.create` | Enable/disable a Pod Disruption Budget creation. Only effective for helm-deployed apps (see apps.enabled). | `true` | +| `app.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `app.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `app.pdb.minAvailable` and `app.pdb.maxUnavailable` are empty. | `""` | +| `app.autoscaling.vpa.enabled` | Enable VPA for app pods. Only effective for helm-deployed apps (see apps.enabled). | `false` | +| `app.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `app.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `app.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `app.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `app.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `app.autoscaling.hpa.enabled` | Enable HPA for app pods. Only effective for helm-deployed apps (see apps.enabled). | `false` | +| `app.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `app.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `app.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `app.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `app.service.labels` | Extra labels for app service. Only effective for helm-deployed apps (see apps.enabled). | `{}` | | `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | @@ -545,7 +789,240 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | | `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `app.mountTmpVolume` | Whether a writable /tmp emptyDir volume should be mounted to the app. | `true` | | `app.exposedContainerPort` | The port that shuffle app containers will listen on for new requests. | `80` | +| `app.sdkTimeout` | The timeout in seconds for app actions. | `300` | +| `app.disableLogs` | Do not capture app logs. By default, app logs are captured, so that they are visible in the frontend. | `false` | + +##### Parameters to deploy apps using helm + +| Name | Description | Value | +| ----------------------------- | -------------------------------------------------- | ------- | +| `apps.enabled` | Whether apps should be deployed using helm. | `false` | +| `apps.shuffleTools.enabled` | Whether the shuffle-tools app is enabled | `true` | +| `apps.shuffleTools.version` | The version of the shuffle-tools app to deploy. | `1.2.0` | +| `apps.shuffleSubflow.enabled` | Whether the shuffle-subflow app is enabled | `true` | +| `apps.shuffleSubflow.version` | The version of the shuffle-subflow app to deploy. | `1.1.0` | +| `apps.http.enabled` | Whether the http app is enabled | `true` | +| `apps.http.version` | The version of the http app to deploy. | `1.4.0` | +| `apps.MY_APP.app` | The name of the app (required, e.g. shuffle-tools) | | +| `apps.MY_APP.version` | The version of the app (required, e.g. 1.2.0) | | + +##### Traffic Exposure Parameters + +| Name | Description | Value | +| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- | +| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` | +| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` | +| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` | +| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | +| `ingress.hostname` | Default host for the ingress record | `shuffle.local` | +| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` | +| `ingress.path` | Ingress path for Shuffle frontend | `"/"` | +| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` | +| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` | +| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` | +| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | +| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` | +| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` | +| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | +| `ingress.secrets` | Custom TLS certificates as secrets | `[]` | +| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` | + +##### Istio Parameters + +| Name | Description | Value | +| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ | +| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` | +| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` | +| `istio.hosts` | One or more hosts exposed by Istio | `[]` | +| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` | +| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` | +| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` | +| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` | +| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` | +| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` | +| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` | +| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` | +| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` | +| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` | +| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` | + +##### Persistence Parameters + +| Name | Description | Value | +| ------------------------------------- | ------------------------------------------------- | ------------------- | +| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` | +| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` | +| `persistence.apps.subPath` | The sub path used in the volume | `""` | +| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.apps.size` | The size of the volume | `5Gi` | +| `persistence.apps.annotations` | Annotations for the PVC | `{}` | +| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` | +| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.appBuilder.size` | The size of the volume | `5Gi` | +| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` | +| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` | +| `persistence.files.subPath` | The sub path used in the volume | `""` | +| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.files.size` | The size of the volume | `5Gi` | +| `persistence.files.annotations` | Annotations for the PVC | `{}` | +| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` | + +##### Init Container Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` | +| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnamilegacy/os-shell` | +| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` | +| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | + +##### OpenSearch Parameters + +| Name | Description | Value | +| -------------------- | ----------------------------------------------------- | ------ | +| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` | + +##### Vault Parameters + +| Name | Description | Value | +| --------------- | -------------------------------------------------------------------------- | ----- | +| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` | +| `vault.secrets` | A list of VaultSecrets to create | `[]` | + +##### Other Parameters + +| Name | Description | Value | +| ----------------------------- | -------------------------------------------------- | ------- | +| `apps.enabled` | Whether apps should be deployed using helm. | `false` | +| `apps.shuffleTools.enabled` | Whether the shuffle-tools app is enabled | `true` | +| `apps.shuffleTools.version` | The version of the shuffle-tools app to deploy. | `1.2.0` | +| `apps.shuffleSubflow.enabled` | Whether the shuffle-subflow app is enabled | `true` | +| `apps.shuffleSubflow.version` | The version of the shuffle-subflow app to deploy. | `1.1.0` | +| `apps.http.enabled` | Whether the http app is enabled | `true` | +| `apps.http.version` | The version of the http app to deploy. | `1.4.0` | +| `apps.MY_APP.app` | The name of the app (required, e.g. shuffle-tools) | | +| `apps.MY_APP.version` | The version of the app (required, e.g. 1.2.0) | | + +#### Traffic Exposure Parameters + +| Name | Description | Value | +| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- | +| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` | +| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` | +| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` | +| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | +| `ingress.hostname` | Default host for the ingress record | `shuffle.local` | +| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` | +| `ingress.path` | Ingress path for Shuffle frontend | `"/"` | +| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` | +| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` | +| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` | +| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | +| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` | +| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` | +| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | +| `ingress.secrets` | Custom TLS certificates as secrets | `[]` | +| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` | + +#### Istio Parameters + +| Name | Description | Value | +| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ | +| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` | +| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` | +| `istio.hosts` | One or more hosts exposed by Istio | `[]` | +| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` | +| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` | +| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` | +| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` | +| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` | +| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` | +| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` | +| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` | +| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` | +| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` | +| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` | + +#### Persistence Parameters + +| Name | Description | Value | +| ------------------------------------- | ------------------------------------------------- | ------------------- | +| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` | +| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` | +| `persistence.apps.subPath` | The sub path used in the volume | `""` | +| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.apps.size` | The size of the volume | `5Gi` | +| `persistence.apps.annotations` | Annotations for the PVC | `{}` | +| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` | +| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.appBuilder.size` | The size of the volume | `5Gi` | +| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` | +| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` | +| `persistence.files.subPath` | The sub path used in the volume | `""` | +| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.files.size` | The size of the volume | `5Gi` | +| `persistence.files.annotations` | Annotations for the PVC | `{}` | +| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` | + +#### Init Container Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` | +| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnamilegacy/os-shell` | +| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` | +| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | + +#### OpenSearch Parameters + +| Name | Description | Value | +| -------------------- | ----------------------------------------------------- | ------ | +| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` | + +#### Vault Parameters + +| Name | Description | Value | +| --------------- | -------------------------------------------------------------------------- | ----- | +| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` | +| `vault.secrets` | A list of VaultSecrets to create | `[]` | + +#### Other Parameters + +| Name | Description | Value | +| ----------------------------- | -------------------------------------------------- | ------- | +| `apps.enabled` | Whether apps should be deployed using helm. | `false` | +| `apps.shuffleTools.enabled` | Whether the shuffle-tools app is enabled | `true` | +| `apps.shuffleTools.version` | The version of the shuffle-tools app to deploy. | `1.2.0` | +| `apps.shuffleSubflow.enabled` | Whether the shuffle-subflow app is enabled | `true` | +| `apps.shuffleSubflow.version` | The version of the shuffle-subflow app to deploy. | `1.1.0` | +| `apps.http.enabled` | Whether the http app is enabled | `true` | +| `apps.http.version` | The version of the http app to deploy. | `1.4.0` | +| `apps.MY_APP.app` | The name of the app (required, e.g. shuffle-tools) | | +| `apps.MY_APP.version` | The version of the app (required, e.g. 1.2.0) | | ### Traffic Exposure Parameters @@ -614,19 +1091,19 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia ### Init Container Parameters -| Name | Description | Value | -| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | -| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | -| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` | -| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnami/os-shell` | -| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` | -| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` | -| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` | -| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | -| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` | -| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` | -| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` | +| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnamilegacy/os-shell` | +| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` | +| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | ### OpenSearch Parameters @@ -642,6 +1119,3 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia | `vault.secrets` | A list of VaultSecrets to create | `[]` | ### Other Parameters - - - diff --git a/functions/kubernetes/charts/shuffle/templates/NOTES.txt b/functions/kubernetes/charts/shuffle/templates/NOTES.txt index 10e38886..6a207525 100644 --- a/functions/kubernetes/charts/shuffle/templates/NOTES.txt +++ b/functions/kubernetes/charts/shuffle/templates/NOTES.txt @@ -22,6 +22,6 @@ Access the pod you want to debug by executing To access shuffle using port-forwarding: -1. Run `kubectl port-forward -n shuffle svc/shuffle-frontend 8080:http` +1. Run `kubectl port-forward -n {{ .Release.Namespace }} svc/{{ include "shuffle.frontend.name" . }} 8080:http` 2. Visit http://localhost:8080 with your browser - +3. Create the administrator account, if not already done diff --git a/functions/kubernetes/charts/shuffle/templates/_helpers.tpl b/functions/kubernetes/charts/shuffle/templates/_helpers.tpl index dc93dfc2..b78602bb 100644 --- a/functions/kubernetes/charts/shuffle/templates/_helpers.tpl +++ b/functions/kubernetes/charts/shuffle/templates/_helpers.tpl @@ -1,377 +1,6 @@ -{{/* -Return the common name for backend componentes -*/}} -{{- define "shuffle.backend.name" -}} - {{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}} -{{- end -}} - -{{/* -Return the common name for frontend components -*/}} -{{- define "shuffle.frontend.name" -}} - {{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}} -{{- end -}} - -{{/* -Return the common name for orborus components -*/}} -{{- define "shuffle.orborus.name" -}} - {{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}} -{{- end -}} - -{{/* -Return the common name for worker components -*/}} -{{- define "shuffle.worker.name" -}} - {{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}} -{{- end -}} - -{{/* -Return the common name for app components -*/}} -{{- define "shuffle.app.name" -}} - {{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}} -{{- end -}} - -{{/* -Return the common labels for backend components -The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod. -*/}} -{{- define "shuffle.backend.labels" -}} -{{- include "common.labels.standard" . }} -app.kubernetes.io/component: backend -io.kompose.service: backend -{{- end -}} - -{{/* -Return the common labels for frontend components -*/}} -{{- define "shuffle.frontend.labels" -}} -{{- include "common.labels.standard" . }} -app.kubernetes.io/component: frontend -{{- end -}} - -{{/* -Return the common labels for orborus components -*/}} -{{- define "shuffle.orborus.labels" -}} -{{- include "common.labels.standard" . }} -app.kubernetes.io/component: orborus -{{- end -}} - -{{/* -Return the common labels for worker components -*/}} -{{- define "shuffle.worker.labels" -}} -{{- include "common.labels.standard" . }} -app.kubernetes.io/component: worker -{{- end -}} - -{{/* -Return the common labels for app components -*/}} -{{- define "shuffle.app.labels" -}} -{{- include "common.labels.standard" . }} -app.kubernetes.io/component: app -{{- end -}} - -{{/* -Return the match labels for backend components -*/}} -{{- define "shuffle.backend.matchLabels" -}} -{{- include "common.labels.matchLabels" . }} -app.kubernetes.io/component: backend -{{- end -}} - -{{/* -Return the match labels for frontend components -*/}} -{{- define "shuffle.frontend.matchLabels" -}} -{{- include "common.labels.matchLabels" . }} -app.kubernetes.io/component: frontend -{{- end -}} - -{{/* -Return the match labels for orborus components -*/}} -{{- define "shuffle.orborus.matchLabels" -}} -{{- include "common.labels.matchLabels" . }} -app.kubernetes.io/component: orborus -{{- end -}} - -{{/* -Return the match labels for worker components -NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. -*/}} -{{- define "shuffle.worker.matchLabels" -}} -app.kubernetes.io/name: shuffle-worker -{{- end -}} - -{{/* -Return the match labels for app components -NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. -*/}} -{{- define "shuffle.app.matchLabels" -}} -app.kubernetes.io/name: shuffle-app -{{- end -}} - {{/* Return the proper image name (for the init container volume-permissions image) */}} {{- define "shuffle.volumePermissions.image" -}} {{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global "chart" .Chart ) -}} {{- end -}} - -{{/* -Return the proper Shuffle backend image name -*/}} -{{- define "shuffle.backend.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global "chart" .Chart ) -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the backend pod -*/}} -{{- define "shuffle.backend.imagePullSecrets" -}} -{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}} -{{- end -}} - -{{/* -Return the proper Shuffle frontend image name -*/}} -{{- define "shuffle.frontend.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global "chart" .Chart ) -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the frontend pod -*/}} -{{- define "shuffle.frontend.imagePullSecrets" -}} -{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}} -{{- end -}} - -{{/* -Return the proper Shuffle orborus image name -*/}} -{{- define "shuffle.orborus.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global "chart" .Chart ) -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the orborus pod -*/}} -{{- define "shuffle.orborus.imagePullSecrets" -}} -{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}} -{{- end -}} - -{{/* -Return the proper Shuffle worker image name -*/}} -{{- define "shuffle.worker.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global "chart" .Chart ) -}} -{{- end -}} - -{{/* -Create the name of the service account to use for the Shuffle backend -*/}} -{{- define "shuffle.backend.serviceAccount.name" -}} -{{- if .Values.backend.serviceAccount.create -}} - {{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }} -{{- else -}} - {{ default "default" .Values.backend.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the backend service account -*/}} -{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}} -{{- $pullSecrets := list }} - -{{- range .Values.global.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- range .Values.backend.serviceAccount.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- if (not (empty $pullSecrets)) -}} -imagePullSecrets: -{{- range $pullSecrets | uniq }} - - name: {{ . }} -{{- end }} -{{- end }} -{{- end -}} - -{{/* -Create the name of the service account to use for the Shuffle frontend -*/}} -{{- define "shuffle.frontend.serviceAccount.name" -}} -{{- if .Values.frontend.serviceAccount.create -}} - {{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }} -{{- else -}} - {{ default "default" .Values.frontend.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the frontend service account -*/}} -{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}} -{{- $pullSecrets := list }} - -{{- range .Values.global.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- range .Values.frontend.serviceAccount.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- if (not (empty $pullSecrets)) -}} -imagePullSecrets: -{{- range $pullSecrets | uniq }} - - name: {{ . }} -{{- end }} -{{- end }} -{{- end -}} - -{{/* -Create the name of the service account to use for Shuffle orborus -*/}} -{{- define "shuffle.orborus.serviceAccount.name" -}} -{{- if .Values.orborus.serviceAccount.create -}} - {{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }} -{{- else -}} - {{ default "default" .Values.orborus.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the orborus service account -*/}} -{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}} -{{- $pullSecrets := list }} - -{{- range .Values.global.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- range .Values.orborus.serviceAccount.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- if (not (empty $pullSecrets)) -}} -imagePullSecrets: -{{- range $pullSecrets | uniq }} - - name: {{ . }} -{{- end }} -{{- end }} -{{- end -}} - -{{/* -Create the name of the service account to use for Shuffle workers -*/}} -{{- define "shuffle.worker.serviceAccount.name" -}} -{{- if .Values.worker.serviceAccount.create -}} - {{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }} -{{- else -}} - {{ default "default" .Values.worker.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the worker service account -*/}} -{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}} -{{- $pullSecrets := list }} - -{{- range .Values.global.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- range .Values.worker.serviceAccount.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- if (not (empty $pullSecrets)) -}} -imagePullSecrets: -{{- range $pullSecrets | uniq }} - - name: {{ . }} -{{- end }} -{{- end }} -{{- end -}} - -{{/* -Create the name of the service account to use for Shuffle apps -*/}} -{{- define "shuffle.app.serviceAccount.name" -}} -{{- if .Values.app.serviceAccount.create -}} - {{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }} -{{- else -}} - {{ default "default" .Values.app.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names for the app service account -*/}} -{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}} -{{- $pullSecrets := list }} - -{{- range .Values.global.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- range .Values.app.serviceAccount.imagePullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} - {{- end -}} -{{- end -}} - -{{- if (not (empty $pullSecrets)) -}} -imagePullSecrets: -{{- range $pullSecrets | uniq }} - - name: {{ . }} -{{- end }} -{{- end }} -{{- end -}} diff --git a/functions/kubernetes/charts/shuffle/templates/backend/_helpers.tpl b/functions/kubernetes/charts/shuffle/templates/backend/_helpers.tpl new file mode 100644 index 00000000..48bd6543 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/backend/_helpers.tpl @@ -0,0 +1,116 @@ +{{/* +Return the common name for backend componentes +*/}} +{{- define "shuffle.backend.name" -}} + {{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common labels for backend components +The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod. +*/}} +{{- define "shuffle.backend.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: backend +io.kompose.service: backend +{{- end -}} + +{{/* +Return the match labels for backend components +*/}} +{{- define "shuffle.backend.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: backend +{{- end -}} + +{{/* +Return the proper Shuffle backend image name +*/}} +{{- define "shuffle.backend.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global "chart" .Chart ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the backend pod +*/}} +{{- define "shuffle.backend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}} +{{- end -}} + +{{/* +Create the name of the service account to use for the Shuffle backend +*/}} +{{- define "shuffle.backend.serviceAccount.name" -}} +{{- if .Values.backend.serviceAccount.create -}} + {{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.backend.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the backend service account +*/}} +{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.backend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{- define "shuffle.backend.baseUrl" -}} +http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }} +{{- end -}} + +{{/* +Return the environment variables of shuffle-backend in the format +KEY: VALUE +*/}} +{{- define "shuffle.backend.env" -}} +RUNNING_MODE: kubernetes +IS_KUBERNETES: "true" +SHUFFLE_APP_HOTLOAD_FOLDER: /shuffle-apps +SHUFFLE_FILE_LOCATION: /shuffle-files +BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}" +{{- if .Values.shuffle.baseUrl }} +BASE_URL: "{{ .Values.shuffle.baseUrl }}" +SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}" +{{- else }} +BASE_URL: "{{ include "shuffle.backend.baseUrl" . }}" +{{- end }} +ORG_ID: "{{ .Values.shuffle.org }}" +SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}" +SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}" +SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}" +SHUFFLE_CHAT_DISABLED: "true" +# Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address +SHUFFLE_CLOUDRUN_URL: "{{ include "shuffle.backend.baseUrl" .}}" +SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }} +SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}" +SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}" +SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}" +SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}" +SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}" +TZ: "{{ .Values.shuffle.timezone }}" +REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" # Used by app builder +{{- end -}} \ No newline at end of file diff --git a/functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml b/functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml deleted file mode 100644 index dbbdff94..00000000 --- a/functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "shuffle.backend.name" . }}-env - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}" - {{- if .Values.shuffle.baseUrl }} - BASE_URL: "{{ .Values.shuffle.baseUrl }}" - SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}" - {{- else }} - BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}" - {{- end }} - ORG_ID: "{{ .Values.shuffle.org }}" - SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}" - SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}" - SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}" - SHUFFLE_CHAT_DISABLED: "true" - # Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address - SHUFFLE_CLOUDRUN_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}" - SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }} - SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}" - SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}" - SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}" - SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}" - SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}" - TZ: "{{ .Values.shuffle.timezone }}" - REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" diff --git a/functions/kubernetes/charts/shuffle/templates/backend/backend-dpl.yaml b/functions/kubernetes/charts/shuffle/templates/backend/backend-dpl.yaml index b1cc606c..85650134 100644 --- a/functions/kubernetes/charts/shuffle/templates/backend/backend-dpl.yaml +++ b/functions/kubernetes/charts/shuffle/templates/backend/backend-dpl.yaml @@ -115,20 +115,15 @@ spec: args: {{- include "common.tplvalues.render" (dict "value" .Values.backend.args "context" $) | nindent 12 }} {{- end }} env: - - name: RUNNING_MODE - value: kubernetes - - name: IS_KUBERNETES - value: "true" - - name: SHUFFLE_APP_HOTLOAD_FOLDER - value: /shuffle-apps - - name: SHUFFLE_FILE_LOCATION - value: /shuffle-files + {{- $env := include "shuffle.backend.env" . | fromYaml }} + {{- range $key, $val := $env }} + - name: {{ $key | quote }} + value: {{ $val | quote }} + {{- end }} {{- if .Values.backend.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVars "context" $) | nindent 12 }} {{- end }} envFrom: - - configMapRef: - name: {{ include "shuffle.backend.name" . }}-env {{- if .Values.backend.extraEnvVarsCM }} - configMapRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsCM "context" $) }} diff --git a/functions/kubernetes/charts/shuffle/templates/frontend/_helpers.tpl b/functions/kubernetes/charts/shuffle/templates/frontend/_helpers.tpl new file mode 100644 index 00000000..47d76bfd --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/frontend/_helpers.tpl @@ -0,0 +1,77 @@ +{{/* +Return the common name for frontend components +*/}} +{{- define "shuffle.frontend.name" -}} + {{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common labels for frontend components +*/}} +{{- define "shuffle.frontend.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: frontend +{{- end -}} + +{{/* +Return the match labels for frontend components +*/}} +{{- define "shuffle.frontend.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: frontend +{{- end -}} + +{{/* +Return the proper Shuffle frontend image name +*/}} +{{- define "shuffle.frontend.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global "chart" .Chart ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the frontend pod +*/}} +{{- define "shuffle.frontend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}} +{{- end -}} + +{{/* +Create the name of the service account to use for the Shuffle frontend +*/}} +{{- define "shuffle.frontend.serviceAccount.name" -}} +{{- if .Values.frontend.serviceAccount.create -}} + {{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.frontend.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the frontend service account +*/}} +{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.frontend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/functions/kubernetes/charts/shuffle/templates/orborus/_helpers.tpl b/functions/kubernetes/charts/shuffle/templates/orborus/_helpers.tpl new file mode 100644 index 00000000..3ced6821 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/orborus/_helpers.tpl @@ -0,0 +1,128 @@ +{{/* +Return the common name for orborus components +*/}} +{{- define "shuffle.orborus.name" -}} + {{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common labels for orborus components +*/}} +{{- define "shuffle.orborus.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: orborus +{{- end -}} + +{{/* +Return the match labels for orborus components +*/}} +{{- define "shuffle.orborus.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: orborus +{{- end -}} + +{{/* +Return the proper Shuffle orborus image name +*/}} +{{- define "shuffle.orborus.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global "chart" .Chart ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the orborus pod +*/}} +{{- define "shuffle.orborus.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle orborus +*/}} +{{- define "shuffle.orborus.serviceAccount.name" -}} +{{- if .Values.orborus.serviceAccount.create -}} + {{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.orborus.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the orborus service account +*/}} +{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.orborus.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Return the environment variables of shuffle-orborus in the format +KEY: VALUE +*/}} +{{- define "shuffle.orborus.env" -}} +RUNNING_MODE: kubernetes +IS_KUBERNETES: "true" +ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}" +ORG_ID: "{{ .Values.shuffle.org }}" +TZ: "{{ .Values.shuffle.timezone }}" +BASE_URL: {{ include "shuffle.backend.baseUrl" . | quote }} +KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}" +SHUFFLE_ORBORUS_EXECUTION_CONCURRENCY: {{ .Values.orborus.executionConcurrency | quote }} + +{{- if .Values.orborus.manageWorkerDeployments }} +# Shuffle worker configuration +SHUFFLE_WORKER_IMAGE: {{ include "shuffle.worker.image" . | quote }} +SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME: {{ include "shuffle.worker.serviceAccount.name" . | quote }} +{{- if .Values.worker.podSecurityContext.enabled }} +SHUFFLE_WORKER_POD_SECURITY_CONTEXT: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }} +{{- end }} +{{- if .Values.worker.containerSecurityContext.enabled }} +SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }} +{{- end }} + +# Shuffle worker resources +{{- $workerResources := (.Values.worker.resources | default (include "common.resources.preset" (dict "type" .Values.worker.resourcesPreset) | fromYaml)) -}} +{{- if and $workerResources.requests $workerResources.requests.cpu }} +SHUFFLE_WORKER_CPU_REQUEST: {{ $workerResources.requests.cpu | quote }} +{{- end }} +{{- if and $workerResources.requests $workerResources.requests.memory}} +SHUFFLE_WORKER_MEMORY_REQUEST: {{ $workerResources.requests.memory | quote }} +{{- end }} +{{- if and $workerResources.requests (index $workerResources.requests "ephemeral-storage") }} +SHUFFLE_WORKER_EPHEMERAL_STORAGE_REQUEST: {{ (index $workerResources.requests "ephemeral-storage") | quote }} +{{- end }} +{{- if and $workerResources.limits $workerResources.limits.cpu }} +SHUFFLE_WORKER_CPU_LIMIT: {{ $workerResources.limits.cpu | quote }} +{{- end }} +{{- if and $workerResources.limits $workerResources.limits.memory}} +SHUFFLE_WORKER_MEMORY_LIMIT: {{ $workerResources.limits.memory | quote }} +{{- end }} +{{- if and $workerResources.limits (index $workerResources.limits "ephemeral-storage") }} +SHUFFLE_WORKER_EPHEMERAL_STORAGE_LIMIT: {{ (index $workerResources.limits "ephemeral-storage") | quote }} +{{- end }} + +# Include shuffle worker environment variables. Orborus passes them down to worker, when creating the deployment. +{{ include "shuffle.workerInstance.env" . }} +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml b/functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml deleted file mode 100644 index 70209c21..00000000 --- a/functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml +++ /dev/null @@ -1,78 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "shuffle.orborus.name" . }}-env - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}" - ORG_ID: "{{ .Values.shuffle.org }}" - TZ: "{{ .Values.shuffle.timezone }}" - BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}" - KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}" - REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" - - # Shuffle worker configuration - SHUFFLE_WORKER_IMAGE: {{ include "shuffle.worker.image" . | quote }} - SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME: {{ include "shuffle.worker.serviceAccount.name" . | quote }} - {{- if .Values.worker.podSecurityContext.enabled }} - SHUFFLE_WORKER_POD_SECURITY_CONTEXT: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }} - {{- end }} - {{- if .Values.worker.containerSecurityContext.enabled }} - SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }} - {{- end }} - - # Shuffle worker resources - {{- $workerResources := (.Values.worker.resources | default (include "common.resources.preset" (dict "type" .Values.worker.resourcesPreset) | fromYaml)) -}} - {{- if and $workerResources.requests $workerResources.requests.cpu }} - SHUFFLE_WORKER_CPU_REQUEST: {{ $workerResources.requests.cpu | quote }} - {{- end }} - {{- if and $workerResources.requests $workerResources.requests.memory}} - SHUFFLE_WORKER_MEMORY_REQUEST: {{ $workerResources.requests.memory | quote }} - {{- end }} - {{- if and $workerResources.requests (index $workerResources.requests "ephemeral-storage") }} - SHUFFLE_WORKER_EPHEMERAL_STORAGE_REQUEST: {{ (index $workerResources.requests "ephemeral-storage") | quote }} - {{- end }} - {{- if and $workerResources.limits $workerResources.limits.cpu }} - SHUFFLE_WORKER_CPU_LIMIT: {{ $workerResources.limits.cpu | quote }} - {{- end }} - {{- if and $workerResources.limits $workerResources.limits.memory}} - SHUFFLE_WORKER_MEMORY_LIMIT: {{ $workerResources.limits.memory | quote }} - {{- end }} - {{- if and $workerResources.limits (index $workerResources.limits "ephemeral-storage") }} - SHUFFLE_WORKER_EPHEMERAL_STORAGE_LIMIT: {{ (index $workerResources.limits "ephemeral-storage") | quote }} - {{- end }} - - # Shuffle app configuration - SHUFFLE_APP_EXPOSED_PORT: {{ .Values.app.exposedContainerPort | quote }} - SHUFFLE_APP_SERVICE_ACCOUNT_NAME: {{ include "shuffle.app.serviceAccount.name" . | quote }} - {{- if .Values.app.podSecurityContext.enabled }} - SHUFFLE_APP_POD_SECURITY_CONTEXT: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }} - {{- end }} - {{- if .Values.app.containerSecurityContext.enabled }} - SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }} - {{- end }} - - # Shuffle app resources - {{- $appResources := (.Values.app.resources | default (include "common.resources.preset" (dict "type" .Values.app.resourcesPreset) | fromYaml)) -}} - {{- if and $appResources.requests $appResources.requests.cpu }} - SHUFFLE_APP_CPU_REQUEST: {{ $appResources.requests.cpu | quote }} - {{- end }} - {{- if and $appResources.requests $appResources.requests.memory }} - SHUFFLE_APP_MEMORY_REQUEST: {{ $appResources.requests.memory | quote }} - {{- end }} - {{- if and $appResources.requests (index $appResources.requests "ephemeral-storage") }} - SHUFFLE_APP_EPHEMERAL_STORAGE_REQUEST: {{ (index $appResources.requests "ephemeral-storage") | quote }} - {{- end }} - {{- if and $appResources.limits $appResources.limits.cpu }} - SHUFFLE_APP_CPU_LIMIT: {{ $appResources.limits.cpu | quote }} - {{- end }} - {{- if and $appResources.limits $appResources.limits.memory }} - SHUFFLE_APP_MEMORY_LIMIT: {{ $appResources.limits.memory | quote }} - {{- end }} - {{- if and $appResources.limits (index $appResources.limits "ephemeral-storage") }} - SHUFFLE_APP_EPHEMERAL_STORAGE_LIMIT: {{ (index $appResources.limits "ephemeral-storage") | quote }} - {{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml b/functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml index a786dcd2..da5f502e 100644 --- a/functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml +++ b/functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -82,16 +82,17 @@ spec: args: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.args "context" $) | nindent 12 }} {{- end }} env: - - name: RUNNING_MODE - value: kubernetes - - name: IS_KUBERNETES - value: "true" + - name: CLEANUP + value: "false" # Do not remove resources when restarting orborus + {{- $env := include "shuffle.orborus.env" . | fromYaml }} + {{- range $key, $val := $env }} + - name: {{ $key | quote }} + value: {{ $val | quote }} + {{- end }} {{- if .Values.orborus.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }} {{- end }} envFrom: - - configMapRef: - name: {{ include "shuffle.orborus.name" . }}-env {{- if .Values.orborus.extraEnvVarsCM }} - configMapRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsCM "context" $) }} diff --git a/functions/kubernetes/charts/shuffle/templates/orborus/orborus-role.yaml b/functions/kubernetes/charts/shuffle/templates/orborus/orborus-role.yaml index 90041d89..b3f0ca13 100644 --- a/functions/kubernetes/charts/shuffle/templates/orborus/orborus-role.yaml +++ b/functions/kubernetes/charts/shuffle/templates/orborus/orborus-role.yaml @@ -9,6 +9,7 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} rules: + {{- if .Values.orborus.manageWorkerDeployments }} - verbs: - list - create @@ -26,4 +27,19 @@ rules: - apps resources: - deployments + {{- else }} + - verbs: + - list + apiGroups: + - '' + resources: + - pods + - services + - verbs: + - list + apiGroups: + - apps + resources: + - deployments + {{- end }} {{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-app/_helpers.tpl b/functions/kubernetes/charts/shuffle/templates/shuffle-app/_helpers.tpl new file mode 100644 index 00000000..5963f9c1 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-app/_helpers.tpl @@ -0,0 +1,129 @@ +{{/* +Return the common name for app components. +*/}} +{{- define "shuffle.app.name" -}} + {{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common labels for app components deployed via helm. +NOTE: App deployments and services use shuffle.appInstance.labels instead. +*/}} +{{- define "shuffle.app.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: app +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle apps +*/}} +{{- define "shuffle.app.serviceAccount.name" -}} +{{- if .Values.app.serviceAccount.create -}} + {{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.app.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the app service account +*/}} +{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.app.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Return the match labels for ALL apps. +These match the labels of helm-deployed apps (shuffle.appInstance.labels), +as well as worker-deployed apps (deployK8sApp). +*/}} +{{- define "shuffle.app.matchLabels" -}} +app.kubernetes.io/name: shuffle-app +{{- end -}} + + +{{/* +Return the sanitized name of a shuffle app. +Usage: +{{ include "shuffle.appInstance.name" $app }} +*/}} +{{- define "shuffle.appInstance.name" -}} +{{ .name | replace "_" "-" | lower }} +{{- end -}} + +{{/* +Return the sanitized name of a shuffle app, including the version of the app. +Usage: +{{ include "shuffle.appInstance.fullname" $app }} +*/}} +{{- define "shuffle.appInstance.fullname" -}} +{{ printf "%s-%s" .name .version | replace "." "-" | replace "_" "-" | lower }} +{{- end -}} + +{{/* +Return the labels for a shuffle app deployed by helm. +Usage: +{{ include "shuffle.appInstance.labels" (dict "app" $app "customLabels" .Values.commonLabels "context" $) }} +*/}} +{{- define "shuffle.appInstance.labels" -}} +{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-app" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}} +{{ include "common.labels.standard" (dict "customLabels" $customLabels "context" .context) }} +app.shuffler.io/name: {{ include "shuffle.appInstance.name" .app }} +app.shuffler.io/version: {{ .app.version | quote }} +{{- end -}} + +{{/* +Return the match labels of a single app, deployed via helm. +Usage: +{{ include "shuffle.appInstance.matchLabels" (dict "app" $app "customLabels" .Values.commonLabels "context" $) }} +*/}} +{{- define "shuffle.appInstance.matchLabels" -}} +{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-app" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}} +{{ include "common.labels.matchLabels" (dict "customLabels" $customLabels "context" .context) }} +app.shuffler.io/name: {{ include "shuffle.appInstance.name" .app }} +app.shuffler.io/version: {{ .app.version | quote }} +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition. +Usage: +{{ include "shuffle.appInstance.affinities.pods" (dict "type" "soft" "app" $app "customLabels" $podLabels "context" $) -}} +*/}} +{{- define "shuffle.appInstance.affinities.pods" -}} +{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-app" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}} +{{- $extraMatchLabels := dict "app.shuffler.io/name" (include "shuffle.appInstance.name" .app) "app.shuffler.io/version" (.app.version) }} +{{ include "common.affinities.pods" (dict "type" .type "customLabels" $customLabels "context" .context "extraMatchLabels" $extraMatchLabels )}} +{{- end -}} + +{{/* +Return the environment variables of shuffle apps in the format +KEY: VALUE +*/}} +{{- define "shuffle.appInstance.env" -}} +SHUFFLE_APP_SDK_TIMEOUT: {{ .Values.app.sdkTimeout | quote }} +SHUFFLE_APP_EXPOSED_PORT: {{ .Values.app.exposedContainerPort | quote }} +SHUFFLE_LOGS_DISABLED: {{ .Values.app.disableLogs | quote }} +{{- end -}} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml index a8493002..9c83a6a7 100644 --- a/functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml @@ -9,9 +9,8 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.app.podLabels .Values.commonLabels ) "context" . ) }} podSelector: - matchLabels: {{- include "shuffle.app.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + matchLabels: {{- include "shuffle.app.matchLabels" . | nindent 6 }} policyTypes: - Ingress - Egress diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-apps.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-apps.yaml new file mode 100644 index 00000000..af04851f --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-apps.yaml @@ -0,0 +1,353 @@ +{{- if .Values.apps.enabled }} +{{- range $key, $app := .Values.apps }} +{{- $ignoredKeys := list "enabled" -}} +{{- if and (not ($ignoredKeys | has $key)) $app.enabled }} + +{{/* Merge .Values.app into $app, giving precedence to the values defined on the app. */}} +{{- $appValues := mustDeepCopy (mustMerge $app $.Values.app) -}} + +{{/* use shuffle.appRegistry as default image registry */}} +{{- $_ := set $appValues.image "registry" ($appValues.image.registry | default $.Values.shuffle.appRegistry) -}} +{{/* use shuffle.appBaseImageName as default image repository */}} +{{- $_ := set $appValues.image "repository" ($appValues.image.repository | default (printf "%s/%s" $.Values.shuffle.appBaseImageName $appValues.name)) -}} +{{/* use app version as default tag */}} +{{- $_ := set $appValues.image "tag" ($appValues.image.tag | default $appValues.version) -}} + +{{/* Only create a service account if create is explicitly enabled on that specific app ($app not $appValues). Otherwise the shared shuffle-app service account is used. */}} +{{- $shouldCreateDedicatedServiceAccount := and $app.serviceAccount.create $app.serviceAccount.name -}} +{{- if $shouldCreateDedicatedServiceAccount }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ $app.serviceAccount.name | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or $appValues.serviceAccount.annotations $.Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list $appValues.serviceAccount.annotations $.Values.commonAnnotations) "context" $) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ $appValues.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.app.serviceAccount.imagePullSecrets" $ | nindent 0 }} +{{- if $appValues.rbac.create }} +--- +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" $ }} +metadata: + name: {{ $app.serviceAccount.name | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + name: {{ $app.serviceAccount.name | trunc 63 | trimSuffix "-" }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "shuffle.app.name" $ }} +{{- end }} +{{- end }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "shuffle.appInstance.fullname" $app }} + namespace: {{ include "common.names.namespace" $ | quote }} + {{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list $appValues.service.labels $.Values.commonLabels) "context" $) }} + labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $serviceLabels "context" $ ) | nindent 4 }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" $.Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http + port: 80 + targetPort: {{ $appValues.exposedContainerPort }} + protocol: TCP + appProtocol: http + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list $appValues.podLabels $.Values.commonLabels) "context" $) }} + selector: {{- include "shuffle.appInstance.matchLabels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 6 }} +--- +apiVersion: {{ include "common.capabilities.deployment.apiVersion" $ }} +kind: Deployment +metadata: + name: {{ include "shuffle.appInstance.fullname" $app }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or $appValues.deploymentAnnotations $.Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list $appValues.deploymentAnnotations $.Values.commonAnnotations) "context" $) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not $appValues.autoscaling.hpa.enabled }} + replicas: {{ $appValues.replicaCount }} + {{- end }} + {{- if $appValues.updateStrategy }} + strategy: {{- toYaml $appValues.updateStrategy | nindent 4 }} + {{- end }} + selector: + matchLabels: {{- include "shuffle.appInstance.matchLabels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if $appValues.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" $appValues.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "common.images.renderPullSecrets" (dict "images" (list $appValues.image) "context" $) | nindent 6 }} + {{- if $appValues.serviceAccount.create }} + serviceAccountName: {{ default (include "shuffle.app.name" $) $appValues.serviceAccount.name | trunc 63 | trimSuffix "-" }} + {{- else }} + serviceAccountName: {{ default "default" $appValues.serviceAccount.name }} + {{- end }} + automountServiceAccountToken: {{ $appValues.automountServiceAccountToken }} + {{- if $appValues.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" $appValues.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if $appValues.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" $appValues.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "shuffle.appInstance.affinities.pods" (dict "app" $app "type" $appValues.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "shuffle.appInstance.affinities.pods" (dict "app" $app "type" $appValues.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" $appValues.nodeAffinityPreset.type "key" $appValues.nodeAffinityPreset.key "values" $appValues.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if $appValues.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" $appValues.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if $appValues.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" $appValues.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if $appValues.priorityClassName }} + priorityClassName: {{ $appValues.priorityClassName | quote }} + {{- end }} + {{- if $appValues.schedulerName }} + schedulerName: {{ $appValues.schedulerName | quote }} + {{- end }} + {{- if $appValues.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" $appValues.topologySpreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if $appValues.podSecurityContext.enabled }} + securityContext: {{- omit $appValues.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if $appValues.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ $appValues.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if $appValues.initContainers }} + {{- include "common.tplvalues.render" (dict "value" $appValues.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: {{ include "shuffle.appInstance.fullname" $app }} + image: {{ include "common.images.image" ( dict "imageRoot" $appValues.image "global" $.Values.global "chart" $.Chart ) }} + imagePullPolicy: {{ $appValues.image.pullPolicy }} + {{- if $appValues.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" $appValues.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if $.Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" $.Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if $appValues.command }} + command: {{- include "common.tplvalues.render" (dict "value" $appValues.command "context" $) | nindent 12 }} + {{- end }} + {{- if $.Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" $.Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if $appValues.args }} + args: {{- include "common.tplvalues.render" (dict "value" $appValues.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: AUTHORIZATION + value: "" + - name: EXECUTIONID + value: "" + - name: BASE_URL + value: {{ include "shuffle.worker.baseUrl" $ | quote }} + - name: CALLBACK_URL + value: {{ include "shuffle.backend.baseUrl" $ | quote }} + - name: SHUFFLE_SWARM_CONFIG + value: run # Shuffle Worker requires this to be set even when using K8s instead of swarm + {{- $env := include "shuffle.appInstance.env" $ | fromYaml }} + {{- range $key, $val := $env }} + - name: {{ $key | quote }} + value: {{ $val | quote }} + {{- end }} + {{- if $appValues.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" $appValues.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if $appValues.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" $appValues.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if $appValues.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" $appValues.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if $appValues.resources }} + resources: {{- toYaml $appValues.resources | nindent 12 }} + {{- else if ne $appValues.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" $appValues.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ $appValues.exposedContainerPort }} + {{- if $appValues.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" $appValues.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} + {{- if not $.Values.diagnosticMode.enabled }} + {{- if $appValues.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" $appValues.customLivenessProbe "context" $) | nindent 12 }} + {{- else if $appValues.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit $appValues.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: {{ $appValues.containerPorts.http }} + {{- end }} + {{- if $appValues.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" $appValues.customReadinessProbe "context" $) | nindent 12 }} + {{- else if $appValues.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit $appValues.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: {{ $appValues.containerPorts.http }} + {{- end }} + {{- if $appValues.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" $appValues.customStartupProbe "context" $) | nindent 12 }} + {{- else if $appValues.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit $appValues.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: {{ $appValues.containerPorts.http }} + {{- end }} + {{- end }} + {{- if $appValues.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" $appValues.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + {{- if $appValues.mountTmpVolume }} + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- end }} + {{- if $appValues.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" $appValues.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if $appValues.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" $appValues.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if $appValues.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" $appValues.extraVolumes "context" $) | nindent 8 }} + {{- end }} + +--- +{{- if $appValues.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.appInstance.fullname" $app }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if $appValues.pdb.minAvailable }} + minAvailable: {{ $appValues.pdb.minAvailable }} + {{- end }} + {{- if or $appValues.pdb.maxUnavailable ( not $appValues.pdb.minAvailable ) }} + maxUnavailable: {{ $appValues.pdb.maxUnavailable | default 1 }} + {{- end }} + selector: + matchLabels: {{- include "shuffle.appInstance.matchLabels" ( dict "app" $app "customLabels" $podLabels "context" $ ) | nindent 6 }} +{{- end }} +--- +{{- if $appValues.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" $ }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.appInstance.fullname" $app }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" $ }} + kind: Deployment + name: {{ include "shuffle.appInstance.fullname" $app }} + minReplicas: {{ $appValues.autoscaling.hpa.minReplicas }} + maxReplicas: {{ $appValues.autoscaling.hpa.maxReplicas }} + metrics: + {{- if $appValues.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" $) }} + targetAverageUtilization: {{ $appValues.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ $appValues.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if $appValues.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" $) }} + targetAverageUtilization: {{ $appValues.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ $appValues.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} +--- +{{- if and ($.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") $appValues.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.appInstance.fullname" $app }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "shuffle.appInstance.labels" ( dict "app" $app "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or $appValues.autoscaling.vpa.annotations $.Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list $appValues.autoscaling.vpa.annotations $.Values.commonAnnotations ) "context" $ ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: app + {{- with $appValues.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $appValues.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $appValues.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" $ }} + kind: Deployment + name: {{ include "shuffle.appInstance.fullname" $app }} + {{- if $appValues.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with $appValues.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/_helpers.tpl b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/_helpers.tpl new file mode 100644 index 00000000..8feafa76 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/_helpers.tpl @@ -0,0 +1,182 @@ +{{/* +Return the common name for worker components +*/}} +{{/* +Shuffle currently hardcodes the shuffle-workers:33333 address at some places. +Until that can be properly configured, we make sure that the worker deployment and service +are named exactly the same as the deployment and service that orborus would create. +{{- define "shuffle.worker.name" -}} + {{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} +*/}} +{{- define "shuffle.worker.name" -}} +shuffle-workers +{{- end -}} + +{{/* +Return the common labels for worker components deployed via helm. +NOTE: Worker deployments and services use shuffle.workerInstance.labels instead. +*/}} +{{- define "shuffle.worker.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: worker +{{- end -}} + +{{/* +Return the proper Shuffle worker image name +*/}} +{{- define "shuffle.worker.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global "chart" .Chart ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the worker pod +*/}} +{{- define "shuffle.worker.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.worker.image) "context" $) -}} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle workers +*/}} +{{- define "shuffle.worker.serviceAccount.name" -}} +{{- if .Values.worker.serviceAccount.create -}} + {{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.worker.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names for the worker service account +*/}} +{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.worker.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Return the labels to match ALL workers. +These match the labels of helm-deployed workers (shuffle.workerInstance.labels), +as well as orborus-deployed workers (deployk8sworker). +*/}} +{{- define "shuffle.worker.matchLabels" -}} +app.kubernetes.io/name: shuffle-worker +{{- end -}} + +{{/* +Return the labels for a specific worker instance deployed via helm. +Usage: +{{ include "shuffle.workerInstance.labels" (dict "customLabels" $podLabels "context" $) -}} +*/}} +{{- define "shuffle.workerInstance.labels" -}} +{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-worker" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}} +{{ include "common.labels.standard" (dict "customLabels" $customLabels "context" .context) }} +{{- end -}} + +{{/* +Return the labels to match a helm-deployed worker. +Usage: +{{ include "shuffle.workerInstance.matchLabels" (dict "customLabels" $podLabels "context" $) -}} +*/}} +{{- define "shuffle.workerInstance.matchLabels" -}} +{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-worker" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}} +{{ include "common.labels.matchLabels" (dict "customLabels" $customLabels "context" .context) }} +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition. +Usage: +{{ include "shuffle.workerInstance.affinities.pods" (dict "type" "soft" "customLabels" $podLabels "context" $) -}} +*/}} +{{- define "shuffle.workerInstance.affinities.pods" -}} +{{- $customLabels := mustMerge (dict "app.kubernetes.io/name" "shuffle-worker" "app.kubernetes.io/part-of" "shuffle") (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) -}} +{{ include "common.affinities.pods" (dict "type" .type "customLabels" $customLabels "context" .context )}} +{{- end -}} + +{{- define "shuffle.worker.hostname" -}} +{{- if .Values.worker.enableHelmDeployment -}} +http://{{ include "shuffle.worker.name" . }}.{{ .Release.Namespace }}.svc.cluster.local +{{- else -}} +http://shuffle-workers.{{ .Release.Namespace }}.svc.cluster.local +{{- end -}} +{{- end -}} + +{{- define "shuffle.worker.baseUrl" -}} +{{ include "shuffle.worker.hostname" . }}:{{ .Values.worker.containerPorts.http }} +{{- end -}} + +{{/* +Return the environment variables of shuffle-worker in the format +KEY: VALUE +*/}} +{{- define "shuffle.workerInstance.env" -}} +IS_KUBERNETES: "true" +KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}" +SHUFFLE_SWARM_CONFIG: "run" # Shuffle Worker requires this to be set even when using K8s instead of swarm +BASE_URL: {{ include "shuffle.backend.baseUrl" . | quote }} +SHUFFLE_APP_EXPOSED_PORT: {{ .Values.app.exposedContainerPort | quote }} +WORKER_HOSTNAME: {{ include "shuffle.worker.hostname" . }} + +{{- if .Values.worker.manageAppDeployments }} +# Shuffle app images +REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" +SHUFFLE_BASE_IMAGE_NAME: "{{ .Values.shuffle.appBaseImageName }}" + +# Shuffle app deployment configuration +SHUFFLE_APP_MOUNT_TMP_VOLUME: {{ .Values.app.mountTmpVolume | quote }} +SHUFFLE_APP_SERVICE_ACCOUNT_NAME: {{ include "shuffle.app.serviceAccount.name" . | quote }} +{{- if .Values.app.podSecurityContext.enabled }} +SHUFFLE_APP_POD_SECURITY_CONTEXT: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }} +{{- end }} +{{- if .Values.app.containerSecurityContext.enabled }} +SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }} +{{- end }} + +# Shuffle app resources +{{- $appResources := (.Values.app.resources | default (include "common.resources.preset" (dict "type" .Values.app.resourcesPreset) | fromYaml)) -}} +{{- if and $appResources.requests $appResources.requests.cpu }} +SHUFFLE_APP_CPU_REQUEST: {{ $appResources.requests.cpu | quote }} +{{- end }} +{{- if and $appResources.requests $appResources.requests.memory }} +SHUFFLE_APP_MEMORY_REQUEST: {{ $appResources.requests.memory | quote }} +{{- end }} +{{- if and $appResources.requests (index $appResources.requests "ephemeral-storage") }} +SHUFFLE_APP_EPHEMERAL_STORAGE_REQUEST: {{ (index $appResources.requests "ephemeral-storage") | quote }} +{{- end }} +{{- if and $appResources.limits $appResources.limits.cpu }} +SHUFFLE_APP_CPU_LIMIT: {{ $appResources.limits.cpu | quote }} +{{- end }} +{{- if and $appResources.limits $appResources.limits.memory }} +SHUFFLE_APP_MEMORY_LIMIT: {{ $appResources.limits.memory | quote }} +{{- end }} +{{- if and $appResources.limits (index $appResources.limits "ephemeral-storage") }} +SHUFFLE_APP_EPHEMERAL_STORAGE_LIMIT: {{ (index $appResources.limits "ephemeral-storage") | quote }} +{{- end }} + +# Include shuffle app environment variables. Worker passes them down to apps, when creating their deployment. +{{ include "shuffle.appInstance.env" . }} +{{- end }} +{{- end -}} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-dpl.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-dpl.yaml new file mode 100644 index 00000000..1e724ab3 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-dpl.yaml @@ -0,0 +1,152 @@ +{{- if .Values.worker.enableHelmDeployment }} +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.workerInstance.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.worker.deploymentAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.worker.deploymentAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.worker.autoscaling.hpa.enabled }} + replicas: {{ .Values.worker.replicaCount }} + {{- end }} + {{- if .Values.worker.updateStrategy }} + strategy: {{- toYaml .Values.worker.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.worker.podLabels .Values.commonLabels) "context" .) }} + selector: + matchLabels: {{- include "shuffle.workerInstance.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if .Values.worker.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.worker.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.workerInstance.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "shuffle.worker.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.worker.serviceAccount.name" . }} + automountServiceAccountToken: {{ .Values.worker.automountServiceAccountToken }} + {{- if .Values.worker.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.worker.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.worker.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.worker.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "shuffle.workerInstance.affinities.pods" (dict "type" .Values.worker.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "shuffle.workerInstance.affinities.pods" (dict "type" .Values.worker.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.worker.nodeAffinityPreset.type "key" .Values.worker.nodeAffinityPreset.key "values" .Values.worker.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.worker.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.worker.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.worker.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.worker.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.worker.priorityClassName }} + priorityClassName: {{ .Values.worker.priorityClassName | quote }} + {{- end }} + {{- if .Values.worker.schedulerName }} + schedulerName: {{ .Values.worker.schedulerName | quote }} + {{- end }} + {{- if .Values.worker.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.worker.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.worker.podSecurityContext.enabled }} + securityContext: {{- omit .Values.worker.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.worker.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if .Values.worker.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.worker.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: worker + image: {{ template "shuffle.worker.image" . }} + imagePullPolicy: {{ .Values.worker.image.pullPolicy }} + {{- if .Values.worker.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.worker.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.worker.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.worker.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.worker.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: CLEANUP + value: "false" # Do not remove resources when restarting worker + {{- $env := include "shuffle.workerInstance.env" . | fromYaml }} + {{- range $key, $val := $env }} + - name: {{ $key | quote }} + value: {{ $val | quote }} + {{- end }} + {{- if .Values.worker.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.worker.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.worker.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.worker.resources }} + resources: {{- toYaml .Values.worker.resources | nindent 12 }} + {{- else if ne .Values.worker.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.worker.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ .Values.worker.containerPorts.http }} + {{- if .Values.worker.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.worker.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.worker.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.livenessProbe "enabled") "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.worker.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.worker.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.readinessProbe "enabled") "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.worker.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.worker.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.startupProbe "enabled") "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.worker.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.worker.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.worker.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.worker.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.worker.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if .Values.worker.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumes "context" $) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-hpa.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-hpa.yaml new file mode 100644 index 00000000..4f620f83 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-hpa.yaml @@ -0,0 +1,43 @@ +{{- if and .Values.worker.enableHelmDeployment .Values.worker.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.worker.name" . }} + minReplicas: {{ .Values.worker.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.worker.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.worker.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.worker.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml index 3637d975..514f3815 100644 --- a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml @@ -9,9 +9,8 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }} podSelector: - matchLabels: {{- include "shuffle.worker.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + matchLabels: {{- include "shuffle.worker.matchLabels" . | nindent 6 }} policyTypes: - Ingress - Egress @@ -35,7 +34,7 @@ spec: matchLabels: kubernetes.io/metadata.name: {{ .Release.Namespace }} podSelector: - matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }} + matchLabels: {{- include "shuffle.app.matchLabels" . | nindent 14 }} {{- if .Values.worker.networkPolicy.extraEgress }} {{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraEgress "context" $ ) | nindent 4 }} {{- end }} @@ -57,7 +56,7 @@ spec: matchLabels: kubernetes.io/metadata.name: {{ .Release.Namespace }} podSelector: - matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }} + matchLabels: {{- include "shuffle.app.matchLabels" . | nindent 14 }} {{- end }} {{- if .Values.worker.networkPolicy.extraIngress }} {{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-pdb.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-pdb.yaml new file mode 100644 index 00000000..7bb2218e --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-pdb.yaml @@ -0,0 +1,21 @@ +{{- if .Values.worker.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.worker.pdb.minAvailable }} + minAvailable: {{ .Values.worker.pdb.minAvailable }} + {{- end }} + {{- if or .Values.worker.pdb.maxUnavailable ( not .Values.worker.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.worker.pdb.maxUnavailable | default 1 }} + {{- end }} + selector: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "shuffle.workerInstance.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 6 }} +{{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml index fdef5855..89dc3d4c 100644 --- a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml @@ -9,6 +9,7 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} rules: + {{- if .Values.worker.manageAppDeployments }} - apiGroups: [""] resources: ["pods"] verbs: ["list", "delete"] @@ -18,4 +19,12 @@ rules: - apiGroups: ["apps"] resources: ["deployments"] verbs: ["list", "create"] + {{- else }} + - apiGroups: [""] + resources: ["pods"] + verbs: ["list"] + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["list"] +{{- end }} {{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-svc.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-svc.yaml new file mode 100644 index 00000000..3f116f27 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-svc.yaml @@ -0,0 +1,22 @@ +{{- if .Values.worker.enableHelmDeployment }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.worker.service.labels .Values.commonLabels) "context" .) }} + labels: {{- include "shuffle.workerInstance.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http + port: {{ .Values.worker.containerPorts.http }} + targetPort: http + protocol: TCP + appProtocol: http + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "shuffle.workerInstance.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 4 }} +{{- end }} diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-vpa.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-vpa.yaml new file mode 100644 index 00000000..fbad0237 --- /dev/null +++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-vpa.yaml @@ -0,0 +1,38 @@ +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") (and .Values.worker.enableHelmDeployment .Values.worker.autoscaling.vpa.enabled) }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.worker.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: worker + {{- with .Values.worker.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.worker.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.worker.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.worker.name" . }} + {{- if .Values.worker.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.worker.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/functions/kubernetes/charts/shuffle/values.schema.json b/functions/kubernetes/charts/shuffle/values.schema.json index c2f9821c..ca262866 100644 --- a/functions/kubernetes/charts/shuffle/values.schema.json +++ b/functions/kubernetes/charts/shuffle/values.schema.json @@ -130,7 +130,12 @@ "appRegistry": { "type": "string", "description": "The registry from / to which shuffle apps are pulled / pushed", - "default": "" + "default": "docker.io" + }, + "appBaseImageName": { + "type": "string", + "description": "The base image used for shuffle apps. The final image for an app is //:", + "default": "frikky" }, "timezone": { "type": "string", @@ -2053,12 +2058,27 @@ "items": {} } } + }, + "executionConcurrency": { + "type": "number", + "description": "The maximum amount of concurrent workflow executions per worker", + "default": 25 + }, + "manageWorkerDeployments": { + "type": "boolean", + "description": "Whether workers are deployed and managed by orborus. When disabled, every worker is expected to be already deployed (see worker.enableHelmDeployment).", + "default": true } } }, "worker": { "type": "object", "properties": { + "enableHelmDeployment": { + "type": "boolean", + "description": "Deploy worker via helm. By default, workers are deployed by Orborus.", + "default": false + }, "image": { "type": "object", "properties": { @@ -2081,9 +2101,161 @@ "type": "string", "description": "worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "worker image pull policy. Only effective with worker.enableHelmDeployment.", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "worker image pull secrets. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} } } }, + "replicaCount": { + "type": "number", + "description": "Number of worker replicas to deploy. Only effective with worker.enableHelmDeployment.", + "default": 1 + }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "backend HTTP container port", + "default": 33333 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for worker containers. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on worker containers. Only effective with worker.enableHelmDeployment.", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on worker containers. Only effective with worker.enableHelmDeployment.", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on worker containers. Only effective with worker.enableHelmDeployment.", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one. Only effective with worker.enableHelmDeployment.", + "default": {} + }, "resourcesPreset": { "type": "string", "description": "Set worker container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if worker.resources is set (worker.resources is recommended for production).", @@ -2191,6 +2363,273 @@ } } }, + "command": { + "type": "array", + "description": "Override default worker container command (useful when using custom images). Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default worker container args (useful when using custom images). Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in worker pods. Only effective with worker.enableHelmDeployment.", + "default": true + }, + "hostAliases": { + "type": "array", + "description": "worker pods host aliases. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for worker deployment. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for worker pods. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for worker pods. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment.", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment.", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment.", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `worker.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `worker.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for worker pods assignment. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for worker pods assignment. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for worker pods assignment. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "worker deployment strategy type. Only effective with worker.enableHelmDeployment.", + "default": "RollingUpdate" + } + } + }, + "priorityClassName": { + "type": "string", + "description": "worker pods' priorityClassName. Only effective with worker.enableHelmDeployment.", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for worker pod assignment spread across your cluster among failure-domains. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for worker pods. Only effective with worker.enableHelmDeployment.", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds worker pods need to terminate gracefully. Only effective with worker.enableHelmDeployment.", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for worker containers to automate configuration before or after startup. Only effective with worker.enableHelmDeployment.", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to worker containers. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment.", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment.", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the worker pods. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the worker containers. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the worker pods. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the worker pods. Only effective with worker.enableHelmDeployment.", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation. Only effective with worker.enableHelmDeployment.", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `worker.pdb.minAvailable` and `worker.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for worker pods. Only effective with worker.enableHelmDeployment.", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for worker pods. Only effective with worker.enableHelmDeployment.", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "service": { + "type": "object", + "properties": { + "labels": { + "type": "object", + "description": "Extra labels for worker service. Only effective with worker.enableHelmDeployment.", + "default": {} + } + } + }, "serviceAccount": { "type": "object", "properties": { @@ -2263,12 +2702,179 @@ "items": {} } } + }, + "manageAppDeployments": { + "type": "boolean", + "description": "Whether apps are deployed and managed by worker. When disabled, every used app is expected to to be already deployed (see apps.enabled).", + "default": true } } }, "app": { "type": "object", "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "app image registry (defaults to shuffle.appRegistry)", + "default": "" + }, + "repository": { + "type": "string", + "description": "app image repository (defaults to shuffle.appBaseImageName)", + "default": "" + }, + "tag": { + "type": "string", + "description": "app image tag (defaults to the apps version)", + "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "default image pull policy for app deployments. Only effective for helm-deployed apps (see apps.enabled).", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "default image pull secrets for app deployments. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + } + } + }, + "replicaCount": { + "type": "number", + "description": "Default number of replicas to deploy for each app. Only effective for helm-deployed apps (see apps.enabled).", + "default": 1 + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, "resourcesPreset": { "type": "string", "description": "Set app container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if app.resources is set (app.resources is recommended for production).", @@ -2376,6 +2982,273 @@ } } }, + "command": { + "type": "array", + "description": "Override default app container command (useful when using custom images)", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default app container args (useful when using custom images)", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": false + }, + "hostAliases": { + "type": "array", + "description": "app pods host aliases. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for app deployment. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled).", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled).", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled).", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `app.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `app.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for app pods assignment. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for app pods assignment. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for app pods assignment. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "app deployment strategy type. Only effective for helm-deployed apps (see apps.enabled).", + "default": "RollingUpdate" + } + } + }, + "priorityClassName": { + "type": "string", + "description": "app pods' priorityClassName. Only effective for helm-deployed apps (see apps.enabled).", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for app pod assignment spread across your cluster among failure-domains. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds app pods need to terminate gracefully. Only effective for helm-deployed apps (see apps.enabled).", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for app containers to automate configuration before or after startup. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the app containers. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation. Only effective for helm-deployed apps (see apps.enabled).", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `app.pdb.minAvailable` and `app.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for app pods. Only effective for helm-deployed apps (see apps.enabled).", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "service": { + "type": "object", + "properties": { + "labels": { + "type": "object", + "description": "Extra labels for app service. Only effective for helm-deployed apps (see apps.enabled).", + "default": {} + } + } + }, "serviceAccount": { "type": "object", "properties": { @@ -2449,10 +3322,80 @@ } } }, + "mountTmpVolume": { + "type": "boolean", + "description": "Whether a writable /tmp emptyDir volume should be mounted to the app.", + "default": true + }, "exposedContainerPort": { "type": "number", - "description": "The port that shuffle app containers will listen on for new requests. ", + "description": "The port that shuffle app containers will listen on for new requests.", "default": 80 + }, + "sdkTimeout": { + "type": "number", + "description": "The timeout in seconds for app actions.", + "default": 300 + }, + "disableLogs": { + "type": "boolean", + "description": "Do not capture app logs. By default, app logs are captured, so that they are visible in the frontend.", + "default": false + } + } + }, + "apps": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Whether apps should be deployed using helm.", + "default": false + }, + "shuffleTools": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Whether the shuffle-tools app is enabled", + "default": true + }, + "version": { + "type": "string", + "description": "The version of the shuffle-tools app to deploy.", + "default": "1.2.0" + } + } + }, + "shuffleSubflow": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Whether the shuffle-subflow app is enabled", + "default": true + }, + "version": { + "type": "string", + "description": "The version of the shuffle-subflow app to deploy.", + "default": "1.1.0" + } + } + }, + "http": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Whether the http app is enabled", + "default": true + }, + "version": { + "type": "string", + "description": "The version of the http app to deploy.", + "default": "1.4.0" + } + } } } }, @@ -2793,7 +3736,7 @@ "repository": { "type": "string", "description": "OS Shell + Utility image repository", - "default": "bitnami/os-shell" + "default": "bitnamilegacy/os-shell" }, "tag": { "type": "string", diff --git a/functions/kubernetes/charts/shuffle/values.yaml b/functions/kubernetes/charts/shuffle/values.yaml index 6e1b6b8f..590d2c10 100644 --- a/functions/kubernetes/charts/shuffle/values.yaml +++ b/functions/kubernetes/charts/shuffle/values.yaml @@ -74,7 +74,7 @@ diagnosticMode: shuffle: ## @param shuffle.baseUrl The external base URL under which Shuffle is reachable. ## - #baseUrl: "" + baseUrl: "" ## ref: https://shuffler.io/docs/organizations ## This chart only supports single-tenant deployments at the moment @@ -84,7 +84,11 @@ shuffle: ## @param shuffle.appRegistry The registry from / to which shuffle apps are pulled / pushed ## - appRegistry: "" + appRegistry: "docker.io" + + ## @param shuffle.appBaseImageName The base image used for shuffle apps. The final image for an app is //: + ## + appBaseImageName: "frikky" ## @param shuffle.timezone The timezone used by Shuffle ## @@ -317,7 +321,7 @@ backend: ## Can be set to RollingUpdate or Recreate ## Backend uses ReadWriteOnce volumes by default, which is incompatible with RollingUpdate ## - type: Recreate + type: Recreate ## @param backend.priorityClassName backend pods' priorityClassName ## priorityClassName: "" @@ -525,8 +529,6 @@ backend: ## @param backend.openSearch.username The username that is used for authenticating with OpenSearch ## username: admin - - password: StrongShufflePassword321! ## @param backend.openSearch.certificateFile The path to a custom OpenSearch certificate file ## certificateFile: "" @@ -887,16 +889,6 @@ frontend: ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## labels: {} - type: NodePort - ports: - - name: http - port: 80 - targetPort: 3001 - nodePort: 30080 - - name: https - port: 443 - targetPort: 3443 - nodePort: 30443 ## ServiceAccount configuration ## @@ -968,7 +960,7 @@ orborus: image: registry: ghcr.io repository: shuffle/shuffle-orborus - tag: "nightly" + tag: "" digest: "" ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' @@ -1111,7 +1103,7 @@ orborus: ## args: [] ## @param orborus.automountServiceAccountToken Mount Service Account token in orborus pods - ## NOTE: orborus requires the service account credentials to be mounted + ## NOTE: orborus requires the service account credentials to be mounted if manageWorkerDeployments is enabled. ## automountServiceAccountToken: true ## @param orborus.hostAliases orborus pods host aliases @@ -1199,17 +1191,7 @@ orborus: ## - name: FOO ## value: "bar" ## - extraEnvVars: - - name: SHUFFLE_APP_SDK_TIMEOUT - value: "300" - - name: SHUFFLE_ORBORUS_EXCUTION_CONCURRENCY - value: "7" - - name: SHUFFLE_STATS_DISABLED - value: "true" - - name: KUBERNETES_NAMESPACE - value: "shuffle" - - name: SHUFFLE_BASE_IMAGE_NAME - value: "frikky/shuffle" + extraEnvVars: [] ## @param orborus.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for orborus containers ## extraEnvVarsCM: "" @@ -1347,21 +1329,116 @@ orborus: ## extraEgress: [] + ## @param orborus.executionConcurrency The maximum amount of concurrent workflow executions per worker + ## + executionConcurrency: 25 + + ## @param orborus.manageWorkerDeployments Whether workers are deployed and managed by orborus. When disabled, every worker is expected to be already deployed (see worker.enableHelmDeployment). + ## This effectively removes required RBAC permissions from the shuffle-orborus service account to create deployments and services. + ## Orborus might still attempt to create kubernetes objects, resulting in an error. There is currently no way to tell orborus, that it should not manage k8s resources. + ## You likely want to disable worker.enableHelmDeployment when enabling this. + manageWorkerDeployments: true + ## @section worker Parameters ## worker: + ## @param worker.enableHelmDeployment Deploy worker via helm. By default, workers are deployed by Orborus. + ## You might want to disable orborus.manageWorkerDeployments when enabling this. + enableHelmDeployment: false + ## worker image ## @param worker.image.registry worker image registry ## @param worker.image.repository worker image repository ## @param worker.image.tag worker image tag (immutable tags are recommended, defaults to appVersion) ## @param worker.image.digest worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## @param worker.image.pullPolicy worker image pull policy. Only effective with worker.enableHelmDeployment. + ## @param worker.image.pullSecrets worker image pull secrets. Only effective with worker.enableHelmDeployment. ## image: registry: ghcr.io repository: shuffle/shuffle-worker tag: "" digest: "" - + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param worker.replicaCount Number of worker replicas to deploy. Only effective with worker.enableHelmDeployment. + ## + replicaCount: 1 + ## @param worker.containerPorts.http backend HTTP container port + ## + containerPorts: + http: 33333 + ## @param worker.extraContainerPorts Optionally specify extra list of additional ports for worker containers. Only effective with worker.enableHelmDeployment. + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] + ## Configure extra options for worker containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param worker.livenessProbe.enabled Enable livenessProbe on worker containers. Only effective with worker.enableHelmDeployment. + ## @param worker.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param worker.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param worker.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param worker.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param worker.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param worker.readinessProbe.enabled Enable readinessProbe on worker containers. Only effective with worker.enableHelmDeployment. + ## @param worker.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param worker.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param worker.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param worker.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param worker.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param worker.startupProbe.enabled Enable startupProbe on worker containers. Only effective with worker.enableHelmDeployment. + ## @param worker.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param worker.startupProbe.periodSeconds Period seconds for startupProbe + ## @param worker.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param worker.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param worker.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param worker.customLivenessProbe Custom livenessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. + ## + customLivenessProbe: {} + ## @param worker.customReadinessProbe Custom readinessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. + ## + customReadinessProbe: {} + ## @param worker.customStartupProbe Custom startupProbe that overrides the default one. Only effective with worker.enableHelmDeployment. + ## + customStartupProbe: {} ## worker resource requests and limits ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ ## @param worker.resourcesPreset Set worker container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if worker.resources is set (worker.resources is recommended for production). @@ -1394,7 +1471,7 @@ worker: sysctls: [] supplementalGroups: [] fsGroup: 1001 - + ## Configure Container Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container ## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context @@ -1421,6 +1498,187 @@ worker: drop: ["ALL"] seccompProfile: type: "RuntimeDefault" + ## @param worker.command Override default worker container command (useful when using custom images). Only effective with worker.enableHelmDeployment. + ## + command: [] + ## @param worker.args Override default worker container args (useful when using custom images). Only effective with worker.enableHelmDeployment. + ## + args: [] + ## @param worker.automountServiceAccountToken Mount Service Account token in worker pods. Only effective with worker.enableHelmDeployment. + ## NOTE: worker requires the service account credentials to be mounted if manageAppDeployments is enabled. + ## + automountServiceAccountToken: true + ## @param worker.hostAliases worker pods host aliases. Only effective with worker.enableHelmDeployment. + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param worker.deploymentAnnotations Annotations for worker deployment. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param worker.podLabels Extra labels for worker pods. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param worker.podAnnotations Annotations for worker pods. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param worker.podAffinityPreset Pod affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param worker.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node worker.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param worker.nodeAffinityPreset.type Node affinity preset type. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. + ## + type: "" + ## @param worker.nodeAffinityPreset.key Node label key to match. Ignored if `worker.affinity` is set + ## + key: "" + ## @param worker.nodeAffinityPreset.values Node label values to match. Ignored if `worker.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param worker.affinity Affinity for worker pods assignment. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `worker.podAffinityPreset`, `worker.podAntiAffinityPreset`, and `worker.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param worker.nodeSelector Node labels for worker pods assignment. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param worker.tolerations Tolerations for worker pods assignment. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param worker.updateStrategy.type worker deployment strategy type. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## + updateStrategy: + ## Can be set to RollingUpdate or Recreate + ## + type: RollingUpdate + ## @param worker.priorityClassName worker pods' priorityClassName. Only effective with worker.enableHelmDeployment. + ## + priorityClassName: "" + ## @param worker.topologySpreadConstraints Topology Spread Constraints for worker pod assignment spread across your cluster among failure-domains. Only effective with worker.enableHelmDeployment. + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param worker.schedulerName Name of the k8s scheduler (other than default) for worker pods. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param worker.terminationGracePeriodSeconds Seconds worker pods need to terminate gracefully. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param worker.lifecycleHooks for worker containers to automate configuration before or after startup. Only effective with worker.enableHelmDeployment. + ## + lifecycleHooks: {} + ## @param worker.extraEnvVars Array with extra environment variables to add to worker containers. Only effective with worker.enableHelmDeployment. + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param worker.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. + ## + extraEnvVarsCM: "" + ## @param worker.extraEnvVarsSecret Name of existing Secret containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. + ## + extraEnvVarsSecret: "" + ## @param worker.extraVolumes Optionally specify extra list of additional volumes for the worker pods. Only effective with worker.enableHelmDeployment. + ## + extraVolumes: [] + ## @param worker.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the worker containers. Only effective with worker.enableHelmDeployment. + ## + extraVolumeMounts: [] + ## @param worker.sidecars Add additional sidecar containers to the worker pods. Only effective with worker.enableHelmDeployment. + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param worker.initContainers Add additional init containers to the worker pods. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param worker.pdb.create Enable/disable a Pod Disruption Budget creation. Only effective with worker.enableHelmDeployment. + ## @param worker.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param worker.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `worker.pdb.minAvailable` and `worker.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param worker.autoscaling.vpa.enabled Enable VPA for worker pods. Only effective with worker.enableHelmDeployment. + ## @param worker.autoscaling.vpa.annotations Annotations for VPA resource + ## @param worker.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param worker.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param worker.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param worker.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param worker.autoscaling.hpa.enabled Enable HPA for worker pods. Only effective with worker.enableHelmDeployment. + ## @param worker.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param worker.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param worker.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param worker.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## Service configuration + ## + service: + ## @param worker.service.labels Extra labels for worker service. Only effective with worker.enableHelmDeployment. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + labels: {} ## ServiceAccount configuration ## @@ -1481,9 +1739,100 @@ worker: ## extraEgress: [] + ## @param worker.manageAppDeployments Whether apps are deployed and managed by worker. When disabled, every used app is expected to to be already deployed (see apps.enabled). + ## This effectively removes required RBAC permissions from the shuffle-worker service account to create deployments and services. + ## The worker might still attempt to create kubernetes objects, resulting in an error. There is currently no way to tell the worker, that it should not manage k8s resources. + manageAppDeployments: true + ## @section app Parameters ## app: + ## @param app.image.registry app image registry (defaults to shuffle.appRegistry) + ## @param app.image.repository app image repository (defaults to shuffle.appBaseImageName) + ## @param app.image.tag app image tag (defaults to the apps version) + ## @param app.image.pullPolicy default image pull policy for app deployments. Only effective for helm-deployed apps (see apps.enabled). + ## @param app.image.pullSecrets default image pull secrets for app deployments. Only effective for helm-deployed apps (see apps.enabled). + ## + image: + registry: "" + repository: "" + tag: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param app.replicaCount Default number of replicas to deploy for each app. Only effective for helm-deployed apps (see apps.enabled). + ## + replicaCount: 1 + ## @param app.extraContainerPorts Optionally specify extra list of additional ports for app containers. Only effective for helm-deployed apps (see apps.enabled). + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] + ## Configure extra options for app containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param app.livenessProbe.enabled Enable livenessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). + ## @param app.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param app.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param app.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param app.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param app.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param app.readinessProbe.enabled Enable readinessProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). + ## @param app.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param app.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param app.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param app.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param app.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param app.startupProbe.enabled Enable startupProbe on app containers. Only effective for helm-deployed apps (see apps.enabled). + ## @param app.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param app.startupProbe.periodSeconds Period seconds for startupProbe + ## @param app.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param app.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param app.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param app.customLivenessProbe Custom livenessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). + ## + customLivenessProbe: {} + ## @param app.customReadinessProbe Custom readinessProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). + ## + customReadinessProbe: {} + ## @param app.customStartupProbe Custom startupProbe that overrides the default one. Only effective for helm-deployed apps (see apps.enabled). + ## + customStartupProbe: {} ## app resource requests and limits ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ ## @param app.resourcesPreset Set app container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if app.resources is set (app.resources is recommended for production). @@ -1516,7 +1865,7 @@ app: sysctls: [] supplementalGroups: [] fsGroup: 1001 - + ## Configure Container Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container ## @param app.containerSecurityContext.enabled Enabled app container' Security Context @@ -1543,7 +1892,188 @@ app: drop: ["ALL"] seccompProfile: type: "RuntimeDefault" - + ## @param app.command Override default app container command (useful when using custom images) + ## + command: [] + ## @param app.args Override default app container args (useful when using custom images) + ## + args: [] + ## @param app.automountServiceAccountToken Mount Service Account token in app pods. Only effective for helm-deployed apps (see apps.enabled). + ## + automountServiceAccountToken: false + + ## @param app.hostAliases app pods host aliases. Only effective for helm-deployed apps (see apps.enabled). + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param app.deploymentAnnotations Annotations for app deployment. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param app.podLabels Extra labels for app pods. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param app.podAnnotations Annotations for app pods. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param app.podAffinityPreset Pod affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param app.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node app.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param app.nodeAffinityPreset.type Node affinity preset type. Ignored if `app.affinity` is set. Allowed values: `soft` or `hard`. Only effective for helm-deployed apps (see apps.enabled). + ## + type: "" + ## @param app.nodeAffinityPreset.key Node label key to match. Ignored if `app.affinity` is set + ## + key: "" + ## @param app.nodeAffinityPreset.values Node label values to match. Ignored if `app.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param app.affinity Affinity for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `app.podAffinityPreset`, `app.podAntiAffinityPreset`, and `app.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param app.nodeSelector Node labels for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param app.tolerations Tolerations for app pods assignment. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param app.updateStrategy.type app deployment strategy type. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## + updateStrategy: + ## Can be set to RollingUpdate or Recreate + ## + type: RollingUpdate + ## @param app.priorityClassName app pods' priorityClassName. Only effective for helm-deployed apps (see apps.enabled). + ## + priorityClassName: "" + ## @param app.topologySpreadConstraints Topology Spread Constraints for app pod assignment spread across your cluster among failure-domains. Only effective for helm-deployed apps (see apps.enabled). + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param app.schedulerName Name of the k8s scheduler (other than default) for app pods. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param app.terminationGracePeriodSeconds Seconds app pods need to terminate gracefully. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param app.lifecycleHooks for app containers to automate configuration before or after startup. Only effective for helm-deployed apps (see apps.enabled). + ## + lifecycleHooks: {} + ## @param app.extraEnvVars Array with extra environment variables to add to app containers. Only effective for helm-deployed apps (see apps.enabled). + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param app.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled). + ## + extraEnvVarsCM: "" + ## @param app.extraEnvVarsSecret Name of existing Secret containing extra env vars for app containers. Only effective for helm-deployed apps (see apps.enabled). + ## + extraEnvVarsSecret: "" + ## @param app.extraVolumes Optionally specify extra list of additional volumes for the app pods. Only effective for helm-deployed apps (see apps.enabled). + ## + extraVolumes: [] + ## @param app.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the app containers. Only effective for helm-deployed apps (see apps.enabled). + ## + extraVolumeMounts: [] + ## @param app.sidecars Add additional sidecar containers to the app pods. Only effective for helm-deployed apps (see apps.enabled). + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param app.initContainers Add additional init containers to the app pods. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param app.pdb.create Enable/disable a Pod Disruption Budget creation. Only effective for helm-deployed apps (see apps.enabled). + ## @param app.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param app.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `app.pdb.minAvailable` and `app.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param app.autoscaling.vpa.enabled Enable VPA for app pods. Only effective for helm-deployed apps (see apps.enabled). + ## @param app.autoscaling.vpa.annotations Annotations for VPA resource + ## @param app.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param app.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param app.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param app.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param app.autoscaling.hpa.enabled Enable HPA for app pods. Only effective for helm-deployed apps (see apps.enabled). + ## @param app.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param app.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param app.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param app.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## Service configuration + ## + service: + ## @param app.service.labels Extra labels for app service. Only effective for helm-deployed apps (see apps.enabled). + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + labels: {} + ## ServiceAccount configuration ## serviceAccount: @@ -1594,9 +2124,79 @@ app: ## extraEgress: [] - ## @param app.exposedContainerPort The port that shuffle app containers will listen on for new requests. + ## @param app.mountTmpVolume Whether a writable /tmp emptyDir volume should be mounted to the app. + ## + mountTmpVolume: true + ## @param app.exposedContainerPort The port that shuffle app containers will listen on for new requests. ## exposedContainerPort: 80 + ## @param app.sdkTimeout The timeout in seconds for app actions. + ## + sdkTimeout: 300 + ## @param app.disableLogs Do not capture app logs. By default, app logs are captured, so that they are visible in the frontend. + ## + disableLogs: false + +## @section Parameters to deploy apps using helm +## +apps: + ## @param apps.enabled Whether apps should be deployed using helm. + ## By default, workers create deployments and services for apps when they are first needed (or during startup for some selected apps). + ## Deploying apps via workers has some drawbacks, such as: + ## - A workflow fails when the app is not deployed when the workflow gets executed (see https://github.com/Shuffle/Shuffle/issues/1739) + ## - There is no way to set different service accounts, security contexts, resources, env variables, volume mounts, or replicas for different apps + ## - Worker needs elevated permissions in Kubernetes + ## Note that you can deploy some apps via helm, while keeping the flexibility of letting workers deploy apps if they are not already deployed. + ## If you deploy all needed apps via helm and dont want workers to create additional deployments, set worker.manageAppDeployments to false. + ## + enabled: false + + shuffleTools: + ## @param apps.shuffleTools.enabled Whether the shuffle-tools app is enabled + ## + enabled: true + ## @skip apps.shuffleTools.name + ## + name: shuffle-tools + ## @param apps.shuffleTools.version The version of the shuffle-tools app to deploy. + ## + version: 1.2.0 + # You can override .app.* values here, e.g. replicaCount, resources or image. + + shuffleSubflow: + ## @param apps.shuffleSubflow.enabled Whether the shuffle-subflow app is enabled + ## + enabled: true + ## @skip apps.shuffleSubflow.name + ## + name: shuffle-subflow + ## @param apps.shuffleSubflow.version The version of the shuffle-subflow app to deploy. + ## + version: 1.1.0 + # You can override .app.* values here, e.g. replicaCount, resources or image. + + http: + ## @param apps.http.enabled Whether the http app is enabled + ## + enabled: true + ## @skip apps.http.name + ## + name: http + ## @param apps.http.version The version of the http app to deploy. + ## + version: 1.4.0 + # You can override .app.* values here, e.g. replicaCount, resources or image. + + ## @extra apps.MY_APP.app [string] The name of the app (required, e.g. shuffle-tools) + ## @extra apps.MY_APP.version [string] The version of the app (required, e.g. 1.2.0) + ## Add your own apps here. The key of the app does not matter, as long as it is unique. + ## myApp: + ## enabled: true + ## name: my-app + ## version: 1.0.0 + ## ... Overwrite .app.* values here, e.g.: + ## replicaCount: 3 + ## resources: {} ## @section Traffic Exposure Parameters ## @@ -1893,6 +2493,8 @@ volumePermissions: ## OpenSearch chart configuration ## ref: https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml ## @param opensearch.enabled Switch to enable or disable the opensearch helm chart +## @skip opensearch.sysctlImage +## @skip opensearch.image ## @skip opensearch.master ## @skip opensearch.data ## @skip opensearch.coordinating @@ -1901,15 +2503,12 @@ volumePermissions: ## opensearch: enabled: true - sysctlImage: enabled: false - image: registry: docker.io repository: bitnamilegacy/opensearch tag: "3.2.0" - master: replicaCount: 1 data: diff --git a/functions/onprem/orborus/go.mod b/functions/onprem/orborus/go.mod index 0c44b65b..a5a20284 100644 --- a/functions/onprem/orborus/go.mod +++ b/functions/onprem/orborus/go.mod @@ -10,7 +10,7 @@ require ( github.com/docker/docker v28.3.3+incompatible github.com/docker/go-connections v0.5.0 github.com/satori/go.uuid v1.2.0 - github.com/shuffle/shuffle-shared v0.9.79 + github.com/shuffle/shuffle-shared v0.9.82 k8s.io/api v0.34.2 k8s.io/apimachinery v0.34.2 ) diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go index d34174e2..99639e72 100755 --- a/functions/onprem/orborus/orborus.go +++ b/functions/onprem/orborus/orborus.go @@ -1159,6 +1159,7 @@ func fixk8sRoles() { } } +// TODO: Check if deployment or service already exist by labels and only create if not already exists func deployK8sWorker(image string, identifier string, env []string) error { env = append(env, fmt.Sprintf("IS_KUBERNETES=true")) env = append(env, fmt.Sprintf("KUBERNETES_NAMESPACE=%s", os.Getenv("KUBERNETES_NAMESPACE"))) diff --git a/functions/onprem/worker/README.md b/functions/onprem/worker/README.md index ba6c2a9d..49c03311 100644 --- a/functions/onprem/worker/README.md +++ b/functions/onprem/worker/README.md @@ -1,6 +1,10 @@ # Worker A worker implementation in Golang. This runs ALL Shuffle workflows onprem. In general receives jobs from Orborus. +## Standalone run (testing) + +`go run worker.go standalone ` + ## Development The ideal way to test the Worker is with a single workflow execution, standalone. Here are some environment variables you can use: diff --git a/functions/onprem/worker/go.mod b/functions/onprem/worker/go.mod index 36e50a50..7c833001 100644 --- a/functions/onprem/worker/go.mod +++ b/functions/onprem/worker/go.mod @@ -11,8 +11,8 @@ require ( github.com/docker/docker v28.3.3+incompatible github.com/gorilla/mux v1.8.1 github.com/satori/go.uuid v1.2.0 - github.com/shuffle/shuffle-shared v0.9.76 - github.com/shuffle/singul v0.0.20 + github.com/shuffle/shuffle-shared v0.9.82 + github.com/shuffle/singul v0.0.24 k8s.io/api v0.34.2 k8s.io/apimachinery v0.34.2 k8s.io/client-go v0.34.2 @@ -60,7 +60,7 @@ require ( github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/frikky/kin-openapi v0.42.0 // indirect - github.com/frikky/schemaless v0.0.25 // indirect + github.com/frikky/schemaless v0.0.28 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/ghodss/yaml v1.0.0 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect diff --git a/functions/onprem/worker/worker.go b/functions/onprem/worker/worker.go index eb3db030..707ca7b6 100644 --- a/functions/onprem/worker/worker.go +++ b/functions/onprem/worker/worker.go @@ -1498,11 +1498,77 @@ func handleExecutionResult(workflowExecution shuffle.WorkflowExecution) { action, _ = singul.HandleSingulStartnode(workflowExecution, action, []string{}) parsedAppname := strings.Replace(strings.ToLower(action.AppName), " ", "-", -1) - //if strings.ToLower(parsedAppname) == "singul" { - // parsedAppname = "shuffle-ai" - // appversion = "1.0.0" - // appname = "shuffle-ai" - //} + // if strings.ToLower(parsedAppname) == "singul" { + // parsedAppname = "shuffle-ai" + // appversion = "1.0.0" + // appname = "shuffle-ai" + // } + + if parsedAppname == "ai-agent" { + log.Printf("[INFO][%s] Running AI Agent action %s via backend API", workflowExecution.ExecutionId, action.ID) + + fullUrl := fmt.Sprintf("%s/api/v1/agent?execution_id=%s&authorization=%s&action_id=%s", + baseUrl, workflowExecution.ExecutionId, workflowExecution.Authorization, action.ID) + + serverUrl := os.Getenv("SHUFFLE_BACKEND_URL") + if len(serverUrl) > 0 { + fullUrl = fmt.Sprintf("%s/api/v1/agent?execution_id=%s&authorization=%s&action_id=%s", + serverUrl, workflowExecution.ExecutionId, workflowExecution.Authorization, action.ID) + } + + inputParamValue := "" + for _, param := range action.Parameters { + if strings.ToLower(param.Name) == "input" { + inputParamValue = param.Value + break + } + } + + requestBody := map[string]interface{}{ + "id": action.ID, + "params": map[string]interface{}{ + "tool_name": action.AppName, + "tool_id": action.AppID, + "environment": action.Environment, + "input": map[string]interface{}{ + "text": inputParamValue, + }, + }, + } + + requestBodyBytes, err := json.Marshal(requestBody) + if err != nil { + log.Printf("[ERROR][%s] Failed marshalling request body: %s", workflowExecution.ExecutionId, err) + continue + } + + req, err := http.NewRequest("POST", fullUrl, bytes.NewBuffer(requestBodyBytes)) + if err != nil { + log.Printf("[ERROR][%s] Failed creating AI Agent request: %s", workflowExecution.ExecutionId, err) + continue + } + + req.Header.Set("Content-Type", "application/json") + + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + if err != nil { + log.Printf("[ERROR][%s] Failed triggering AI Agent (timeout/error): %s", workflowExecution.ExecutionId, err) + log.Printf("[INFO][%s] Exiting execution handler - backend will requeue when agent completes", workflowExecution.ExecutionId) + return + } + + defer resp.Body.Close() + // body, err := ioutil.ReadAll(resp.Body) + // if err != nil { + // log.Printf("[ERROR][%s] Failed reading AI Agent response: %s", workflowExecution.ExecutionId, err) + // } else { + // log.Printf("[INFO][%s] AI Agent triggered: %s", workflowExecution.ExecutionId, string(body)) + // } + + log.Printf("[INFO][%s] AI Agent triggered successfully - exiting execution handler, backend will requeue when agent completes", workflowExecution.ExecutionId) + return + } imageName := fmt.Sprintf("%s:%s_%s", baseimagename, parsedAppname, action.AppVersion) if strings.Contains(imageName, " ") {