From 8a523adaba4e8d0bb8affe115a5782206dca8c53 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Tue, 31 Dec 2024 02:42:51 +0100 Subject: [PATCH 01/13] add shuffle helm chart remove gitlab ci file --- charts/shuffle/.gitignore | 3 + charts/shuffle/.helmignore | 23 + charts/shuffle/.yamllint | 11 + charts/shuffle/Chart.yaml | 14 + charts/shuffle/README.md | 570 ++++ charts/shuffle/templates/NOTES.txt | 25 + charts/shuffle/templates/_helpers.tpl | 215 ++ .../backend/backend-apps-claim-pvc.yaml | 28 + .../templates/backend/backend-apps-pvc.yaml | 30 + .../templates/backend/backend-cm-env.yaml | 30 + .../templates/backend/backend-dpl.yaml | 221 ++ .../templates/backend/backend-files-pvc.yaml | 30 + .../templates/backend/backend-hpa.yaml | 43 + .../backend/backend-network-policy.yaml | 66 + .../templates/backend/backend-pdb.yaml | 21 + .../backend/backend-role-binding.yaml | 18 + .../templates/backend/backend-role.yaml | 18 + .../backend/backend-service-account.yaml | 13 + .../templates/backend/backend-svc.yaml | 18 + .../templates/backend/backend-vpa.yaml | 38 + charts/shuffle/templates/extra-list.yaml | 4 + .../templates/frontend/frontend-cm-env.yaml | 10 + .../templates/frontend/frontend-dpl.yaml | 151 + .../templates/frontend/frontend-hpa.yaml | 43 + .../frontend/frontend-network-policy.yaml | 44 + .../templates/frontend/frontend-pdb.yaml | 21 + .../frontend/frontend-service-account.yaml | 13 + .../templates/frontend/frontend-svc.yaml | 18 + .../templates/frontend/frontend-vpa.yaml | 38 + charts/shuffle/templates/ingress/ingress.yaml | 60 + .../shuffle/templates/ingress/tls-secret.yaml | 39 + charts/shuffle/templates/istio/gateway.yaml | 39 + .../templates/istio/virtual-service.yaml | 30 + .../orborus-app-network-policy.yaml | 61 + .../orborus-app/orborus-app-role-binding.yaml | 20 + .../orborus-app/orborus-app-role.yaml | 15 + .../orborus-app-service-account.yaml | 13 + .../orborus-worker-network-policy.yaml | 69 + .../orborus-worker-role-binding.yaml | 20 + .../orborus-worker/orborus-worker-role.yaml | 21 + .../orborus-worker-service-account.yaml | 13 + .../templates/orborus/orborus-cm-env.yaml | 19 + .../templates/orborus/orborus-dpl.yaml | 155 + .../templates/orborus/orborus-hpa.yaml | 43 + .../orborus/orborus-network-policy.yaml | 72 + .../templates/orborus/orborus-pdb.yaml | 21 + .../orborus/orborus-role-binding.yaml | 18 + .../templates/orborus/orborus-role.yaml | 29 + .../orborus/orborus-service-account.yaml | 13 + .../templates/orborus/orborus-vpa.yaml | 38 + charts/shuffle/templates/vault-secrets.yaml | 19 + charts/shuffle/values.schema.json | 2562 +++++++++++++++++ charts/shuffle/values.yaml | 1772 ++++++++++++ 53 files changed, 6938 insertions(+) create mode 100644 charts/shuffle/.gitignore create mode 100644 charts/shuffle/.helmignore create mode 100644 charts/shuffle/.yamllint create mode 100644 charts/shuffle/Chart.yaml create mode 100644 charts/shuffle/README.md create mode 100644 charts/shuffle/templates/NOTES.txt create mode 100644 charts/shuffle/templates/_helpers.tpl create mode 100644 charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml create mode 100644 charts/shuffle/templates/backend/backend-apps-pvc.yaml create mode 100644 charts/shuffle/templates/backend/backend-cm-env.yaml create mode 100644 charts/shuffle/templates/backend/backend-dpl.yaml create mode 100644 charts/shuffle/templates/backend/backend-files-pvc.yaml create mode 100644 charts/shuffle/templates/backend/backend-hpa.yaml create mode 100644 charts/shuffle/templates/backend/backend-network-policy.yaml create mode 100644 charts/shuffle/templates/backend/backend-pdb.yaml create mode 100644 charts/shuffle/templates/backend/backend-role-binding.yaml create mode 100644 charts/shuffle/templates/backend/backend-role.yaml create mode 100644 charts/shuffle/templates/backend/backend-service-account.yaml create mode 100644 charts/shuffle/templates/backend/backend-svc.yaml create mode 100644 charts/shuffle/templates/backend/backend-vpa.yaml create mode 100644 charts/shuffle/templates/extra-list.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-cm-env.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-dpl.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-hpa.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-network-policy.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-pdb.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-service-account.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-svc.yaml create mode 100644 charts/shuffle/templates/frontend/frontend-vpa.yaml create mode 100644 charts/shuffle/templates/ingress/ingress.yaml create mode 100644 charts/shuffle/templates/ingress/tls-secret.yaml create mode 100644 charts/shuffle/templates/istio/gateway.yaml create mode 100644 charts/shuffle/templates/istio/virtual-service.yaml create mode 100644 charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml create mode 100644 charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml create mode 100644 charts/shuffle/templates/orborus-app/orborus-app-role.yaml create mode 100644 charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml create mode 100644 charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml create mode 100644 charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml create mode 100644 charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml create mode 100644 charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-cm-env.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-dpl.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-hpa.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-network-policy.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-pdb.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-role-binding.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-role.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-service-account.yaml create mode 100644 charts/shuffle/templates/orborus/orborus-vpa.yaml create mode 100644 charts/shuffle/templates/vault-secrets.yaml create mode 100644 charts/shuffle/values.schema.json create mode 100644 charts/shuffle/values.yaml diff --git a/charts/shuffle/.gitignore b/charts/shuffle/.gitignore new file mode 100644 index 00000000..1fab0544 --- /dev/null +++ b/charts/shuffle/.gitignore @@ -0,0 +1,3 @@ +.DS_Store +*.tgz +charts/ diff --git a/charts/shuffle/.helmignore b/charts/shuffle/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/shuffle/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/shuffle/.yamllint b/charts/shuffle/.yamllint new file mode 100644 index 00000000..8b3ce4aa --- /dev/null +++ b/charts/shuffle/.yamllint @@ -0,0 +1,11 @@ +--- +extends: default + +rules: + line-length: disable + braces: disable + comments: + require-starting-space: true + ignore-shebangs: true + min-spaces-from-content: 1 + diff --git a/charts/shuffle/Chart.yaml b/charts/shuffle/Chart.yaml new file mode 100644 index 00000000..3d74f418 --- /dev/null +++ b/charts/shuffle/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v2 +name: shuffle +description: A Helm chart for deploying Shuffle on Kubernetes +type: application +version: 0.0.0 +appVersion: nightly +dependencies: + - name: common + version: ^2.23.0 + repository: oci://registry-1.docker.io/bitnamicharts + - name: opensearch + version: ^1.3.0 + repository: oci://registry-1.docker.io/bitnamicharts + condition: opensearch.enabled diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md new file mode 100644 index 00000000..5b5ebe55 --- /dev/null +++ b/charts/shuffle/README.md @@ -0,0 +1,570 @@ +# Shuffle Helm chart + +## Chart Template + +The Bitnami Chart Template was used for creating this chart: + +https://github.com/bitnami/charts/tree/7e44e64626f5b1fc6d56889cdfdeadc1f62c7cf1/template/CHART_NAME + +Original license text: + +``` +Copyright Broadcom, Inc. All Rights Reserved. + +SPDX-License-Identifier: APACHE-2.0 +``` + +## Usage + +```sh +# Lint chart +helm lint . + +# Package chart +helm package . + +# Install (the shuffle namespace is hardcoded into the shuffle source code) +helm install shuffle oci://TODO -n shuffle +``` + +## Secret Parameters + +The helm chart was designed to not contain any secret data and does not allow configuring secret data using helm values. +Instead, secret values must be passed to services using `extraEnvVarsSecret`. The secrets need to be manually created. + +### Creating secrets using vault-secrets-operator + +If you are using [vault-secret-operator by Rico Berger](https://github.com/ricoberger/vault-secrets-operator), +then you can create VaultSecret resources via Helm. +Note that the resulting (Vault)Secret is prefixed with the release name of the chart. + +```yaml +vault: + secrets: + - name: backend-env + type: Opaque + path: shuffle/backend/env +``` + +### Mounting env variables into a service + +After creating a secret which holds the environment variables (either manually or via a VaultSecret), you can then +use that secret to mount environment variables into a service via the `extraEnvVarsSecret` value. + +You can use helm templates for generating the secret name as shown in the example below. + +```yaml +backend: + extraEnvVarsSecret: "{{ include \"common.names.fullname\" . }}-backend-env" +``` + +### Backend + +A list of environment variables containing secret values for the backend. + +```yaml +# OpenSearch password +SHUFFLE_OPENSEARCH_PASSWORD: "" + +# Basic auth credentials for downloading apps from git +SHUFFLE_DOWNLOAD_AUTH_USERNAME: "" +SHUFFLE_DOWNLOAD_AUTH_PASSWORD: "" + +# Automatically create the initial admin user. Username and password have a min length of 3. +# If not set, you are prompted with an admin user creation dialog when visiting the shuffle frontend for the first time. +SHUFFLE_DEFAULT_USERNAME: admin +SHUFFLE_DEFAULT_PASSWORD: MySecretAdminPassword1234! +SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uuid v4 + +# Encryption modifier. This HAS to be set to encrypt any authentication being used in Shuffle. +# This is put together with other relevant values to ensure multiple parts are needed to decrypt. +# If this key is lost or changed, you will have to reauthenticate all apps. +# The encryption modifier is added to encrypted values to prevent rainbow table attacks. It can be any random string. +SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" +``` + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | +| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | +| `global.compatibility.omitEmptySeLinuxOptions` | If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object | `false` | + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.name | `""` | +| `fullnameOverride` | String to fully override common.names.fullname | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the chart release | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the chart release | `["infinity"]` | + +### Shared Shuffle Parameters + +| Name | Description | Value | +| --------------------- | ------------------------------------------------------------- | --------------- | +| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` | +| `shuffle.org` | Default shuffle organization | `Shuffle` | +| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `""` | +| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` | + +### backend Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | +| `backend.image.registry` | backend image registry | `ghcr.io` | +| `backend.image.repository` | backend image repository | `shuffle/shuffle-backend` | +| `backend.image.digest` | backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `backend.image.pullPolicy` | backend image pull policy | `IfNotPresent` | +| `backend.image.pullSecrets` | backend image pull secrets | `[]` | +| `backend.replicaCount` | Number of backend replicas to deploy | `1` | +| `backend.livenessProbe.enabled` | Enable livenessProbe on backend containers | `false` | +| `backend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `backend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `backend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `backend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `backend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `backend.readinessProbe.enabled` | Enable readinessProbe on backend containers | `false` | +| `backend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `backend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `backend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `backend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `backend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `backend.startupProbe.enabled` | Enable startupProbe on backend containers | `false` | +| `backend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `backend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `backend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `backend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `backend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `backend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `backend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `backend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `backend.resourcesPreset` | Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production). | `small` | +| `backend.resources` | Set backend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `backend.podSecurityContext.enabled` | Enable backend pods' Security Context | `true` | +| `backend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for backend pods | `Always` | +| `backend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for backend pods | `[]` | +| `backend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for backend pods | `[]` | +| `backend.podSecurityContext.fsGroup` | Set fsGroup in backend pods' Security Context | `1001` | +| `backend.containerSecurityContext.enabled` | Enabled backend container' Security Context | `true` | +| `backend.containerSecurityContext.seLinuxOptions` | Set SELinux options in backend container | `{}` | +| `backend.containerSecurityContext.runAsUser` | Set runAsUser in backend container' Security Context | `1000` | +| `backend.containerSecurityContext.runAsGroup` | Set runAsGroup in backend container' Security Context | `1000` | +| `backend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in backend container' Security Context | `true` | +| `backend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in backend container' Security Context | `true` | +| `backend.containerSecurityContext.privileged` | Set privileged in backend container' Security Context | `false` | +| `backend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in backend container' Security Context | `false` | +| `backend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in backend container | `["ALL"]` | +| `backend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in backend container | `RuntimeDefault` | +| `backend.command` | Override default backend container command (useful when using custom images) | `[]` | +| `backend.args` | Override default backend container args (useful when using custom images) | `[]` | +| `backend.automountServiceAccountToken` | Mount Service Account token in backend pods | `true` | +| `backend.hostAliases` | backend pods host aliases | `[]` | +| `backend.daemonsetAnnotations` | Annotations for backend daemonset | `{}` | +| `backend.deploymentAnnotations` | Annotations for backend deployment | `{}` | +| `backend.statefulsetAnnotations` | Annotations for backend statefulset | `{}` | +| `backend.podLabels` | Extra labels for backend pods | `{}` | +| `backend.podAnnotations` | Annotations for backend pods | `{}` | +| `backend.podAffinityPreset` | Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `backend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `backend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `backend.nodeAffinityPreset.key` | Node label key to match. Ignored if `backend.affinity` is set | `""` | +| `backend.nodeAffinityPreset.values` | Node label values to match. Ignored if `backend.affinity` is set | `[]` | +| `backend.affinity` | Affinity for backend pods assignment | `{}` | +| `backend.nodeSelector` | Node labels for backend pods assignment | `{}` | +| `backend.tolerations` | Tolerations for backend pods assignment | `[]` | +| `backend.updateStrategy.type` | backend deployment strategy type | `RollingUpdate` | +| `backend.updateStrategy.type` | backend statefulset strategy type | `RollingUpdate` | +| `backend.podManagementPolicy` | Pod management policy for backend statefulset | `OrderedReady` | +| `backend.priorityClassName` | backend pods' priorityClassName | `""` | +| `backend.topologySpreadConstraints` | Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | `[]` | +| `backend.schedulerName` | Name of the k8s scheduler (other than default) for backend pods | `""` | +| `backend.terminationGracePeriodSeconds` | Seconds backend pods need to terminate gracefully | `""` | +| `backend.lifecycleHooks` | for backend containers to automate configuration before or after startup | `{}` | +| `backend.extraEnvVars` | Array with extra environment variables to add to backend containers | `[]` | +| `backend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for backend containers | `""` | +| `backend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for backend containers | `""` | +| `backend.extraVolumes` | Optionally specify extra list of additional volumes for the backend pods | `[]` | +| `backend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the backend containers | `[]` | +| `backend.sidecars` | Add additional sidecar containers to the backend pods | `[]` | +| `backend.initContainers` | Add additional init containers to the backend pods | `[]` | +| `backend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `backend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `backend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty. | `""` | +| `backend.autoscaling.vpa.enabled` | Enable VPA for backend pods | `false` | +| `backend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `backend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `backend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `backend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `backend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `backend.autoscaling.hpa.enabled` | Enable HPA for backend pods | `false` | +| `backend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `backend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `backend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `backend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `backend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `backend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `backend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `backend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `backend.cleanupSchedule` | The interval in seconds at which the cleanup job runs | `300` | +| `backend.openSearch.url` | The URL at which OpenSearch is available | `http://{{ .Release.Name }}-opensearch:9200` | +| `backend.openSearch.username` | The username that is used for authenticating with OpenSearch | `admin` | +| `backend.openSearch.certificateFile` | The path to a custom OpenSearch certificate file | `""` | +| `backend.openSearch.skipSSLVerify` | Skip SSL verification | `false` | +| `backend.openSearch.indexPrefix` | A prefix for OpenSearch indices | `""` | +| `backend.apps.downloadLocation` | The location to a git repository from which default appps are downloaded on startup. | `https://github.com/shuffle/python-apps` | +| `backend.apps.downloadBranch` | The branch from which apps should be downloaded on startup. | `master` | +| `backend.apps.forceUpdate` | Force an update of apps on startup. | `false` | + +### frontend Parameters + +| Name | Description | Value | +| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | +| `frontend.image.registry` | frontend image registry | `ghcr.io` | +| `frontend.image.repository` | frontend image repository | `shuffle/shuffle-frontend` | +| `frontend.image.digest` | frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `frontend.image.pullPolicy` | frontend image pull policy | `IfNotPresent` | +| `frontend.image.pullSecrets` | frontend image pull secrets | `[]` | +| `frontend.replicaCount` | Number of frontend replicas to deploy | `1` | +| `frontend.livenessProbe.enabled` | Enable livenessProbe on frontend containers | `false` | +| `frontend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `frontend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `frontend.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `frontend.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `frontend.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `frontend.readinessProbe.enabled` | Enable readinessProbe on frontend containers | `false` | +| `frontend.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `frontend.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `frontend.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `frontend.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `frontend.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `frontend.startupProbe.enabled` | Enable startupProbe on frontend containers | `false` | +| `frontend.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `frontend.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `frontend.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `frontend.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `frontend.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `frontend.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `frontend.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `frontend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `frontend.resourcesPreset` | Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). | `nano` | +| `frontend.resources` | Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `true` | +| `frontend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for frontend pods | `Always` | +| `frontend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for frontend pods | `[]` | +| `frontend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for frontend pods | `[]` | +| `frontend.podSecurityContext.fsGroup` | Set fsGroup in frontend pods' Security Context | `1001` | +| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `true` | +| `frontend.containerSecurityContext.seLinuxOptions` | Set SELinux options in frontend container | `{}` | +| `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `101` | +| `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `101` | +| `frontend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in frontend container' Security Context | `true` | +| `frontend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in frontend container' Security Context | `true` | +| `frontend.containerSecurityContext.privileged` | Set privileged in frontend container' Security Context | `false` | +| `frontend.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in frontend container' Security Context | `false` | +| `frontend.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in frontend container | `["ALL"]` | +| `frontend.containerSecurityContext.seccompProfile.type` | Set seccomp profile in frontend container | `RuntimeDefault` | +| `frontend.command` | Override default frontend container command (useful when using custom images) | `[]` | +| `frontend.args` | Override default frontend container args (useful when using custom images) | `[]` | +| `frontend.automountServiceAccountToken` | Mount Service Account token in frontend pods | `false` | +| `frontend.hostAliases` | frontend pods host aliases | `[]` | +| `frontend.daemonsetAnnotations` | Annotations for frontend daemonset | `{}` | +| `frontend.deploymentAnnotations` | Annotations for frontend deployment | `{}` | +| `frontend.statefulsetAnnotations` | Annotations for frontend statefulset | `{}` | +| `frontend.podLabels` | Extra labels for frontend pods | `{}` | +| `frontend.podAnnotations` | Annotations for frontend pods | `{}` | +| `frontend.podAffinityPreset` | Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `frontend.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `frontend.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `frontend.nodeAffinityPreset.key` | Node label key to match. Ignored if `frontend.affinity` is set | `""` | +| `frontend.nodeAffinityPreset.values` | Node label values to match. Ignored if `frontend.affinity` is set | `[]` | +| `frontend.affinity` | Affinity for frontend pods assignment | `{}` | +| `frontend.nodeSelector` | Node labels for frontend pods assignment | `{}` | +| `frontend.tolerations` | Tolerations for frontend pods assignment | `[]` | +| `frontend.updateStrategy.type` | frontend deployment strategy type | `RollingUpdate` | +| `frontend.updateStrategy.type` | frontend statefulset strategy type | `RollingUpdate` | +| `frontend.podManagementPolicy` | Pod management policy for frontend statefulset | `OrderedReady` | +| `frontend.priorityClassName` | frontend pods' priorityClassName | `""` | +| `frontend.topologySpreadConstraints` | Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains | `[]` | +| `frontend.schedulerName` | Name of the k8s scheduler (other than default) for frontend pods | `""` | +| `frontend.terminationGracePeriodSeconds` | Seconds frontend pods need to terminate gracefully | `""` | +| `frontend.lifecycleHooks` | for frontend containers to automate configuration before or after startup | `{}` | +| `frontend.extraEnvVars` | Array with extra environment variables to add to frontend containers | `[]` | +| `frontend.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for frontend containers | `""` | +| `frontend.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for frontend containers | `""` | +| `frontend.extraVolumes` | Optionally specify extra list of additional volumes for the frontend pods | `[]` | +| `frontend.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the frontend containers | `[]` | +| `frontend.sidecars` | Add additional sidecar containers to the frontend pods | `[]` | +| `frontend.initContainers` | Add additional init containers to the frontend pods | `[]` | +| `frontend.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `frontend.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `frontend.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty. | `""` | +| `frontend.autoscaling.vpa.enabled` | Enable VPA for frontend pods | `false` | +| `frontend.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `frontend.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `frontend.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `frontend.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `frontend.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `frontend.autoscaling.hpa.enabled` | Enable HPA for frontend pods | `false` | +| `frontend.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `frontend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `frontend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `frontend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `frontend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `frontend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `frontend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### orborus Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| `orborus.image.registry` | orborus image registry | `ghcr.io` | +| `orborus.image.repository` | orborus image repository | `shuffle/shuffle-orborus` | +| `orborus.image.digest` | orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `orborus.image.pullPolicy` | orborus image pull policy | `IfNotPresent` | +| `orborus.image.pullSecrets` | orborus image pull secrets | `[]` | +| `orborus.replicaCount` | Number of orborus replicas to deploy | `1` | +| `orborus.livenessProbe.enabled` | Enable livenessProbe on orborus containers | `false` | +| `orborus.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `orborus.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | +| `orborus.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `orborus.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` | +| `orborus.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `orborus.readinessProbe.enabled` | Enable readinessProbe on orborus containers | `false` | +| `orborus.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `orborus.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `orborus.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `orborus.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `orborus.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `orborus.startupProbe.enabled` | Enable startupProbe on orborus containers | `false` | +| `orborus.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `orborus.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` | +| `orborus.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `orborus.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` | +| `orborus.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `orborus.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `orborus.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `orborus.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `orborus.resourcesPreset` | Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production). | `nano` | +| `orborus.resources` | Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `orborus.podSecurityContext.enabled` | Enable orborus pods' Security Context | `true` | +| `orborus.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for orborus pods | `Always` | +| `orborus.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for orborus pods | `[]` | +| `orborus.podSecurityContext.supplementalGroups` | Set filesystem extra groups for orborus pods | `[]` | +| `orborus.podSecurityContext.fsGroup` | Set fsGroup in orborus pods' Security Context | `1001` | +| `orborus.containerSecurityContext.enabled` | Enabled orborus container' Security Context | `true` | +| `orborus.containerSecurityContext.seLinuxOptions` | Set SELinux options in orborus container | `{}` | +| `orborus.containerSecurityContext.runAsUser` | Set runAsUser in orborus container' Security Context | `101` | +| `orborus.containerSecurityContext.runAsGroup` | Set runAsGroup in orborus container' Security Context | `101` | +| `orborus.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in orborus container' Security Context | `true` | +| `orborus.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in orborus container' Security Context | `true` | +| `orborus.containerSecurityContext.privileged` | Set privileged in orborus container' Security Context | `false` | +| `orborus.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in orborus container' Security Context | `false` | +| `orborus.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in orborus container | `["ALL"]` | +| `orborus.containerSecurityContext.seccompProfile.type` | Set seccomp profile in orborus container | `RuntimeDefault` | +| `orborus.command` | Override default orborus container command (useful when using custom images) | `[]` | +| `orborus.args` | Override default orborus container args (useful when using custom images) | `[]` | +| `orborus.automountServiceAccountToken` | Mount Service Account token in orborus pods | `true` | +| `orborus.hostAliases` | orborus pods host aliases | `[]` | +| `orborus.daemonsetAnnotations` | Annotations for orborus daemonset | `{}` | +| `orborus.deploymentAnnotations` | Annotations for orborus deployment | `{}` | +| `orborus.statefulsetAnnotations` | Annotations for orborus statefulset | `{}` | +| `orborus.podLabels` | Extra labels for orborus pods | `{}` | +| `orborus.podAnnotations` | Annotations for orborus pods | `{}` | +| `orborus.podAffinityPreset` | Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `orborus.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `orborus.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `orborus.nodeAffinityPreset.key` | Node label key to match. Ignored if `orborus.affinity` is set | `""` | +| `orborus.nodeAffinityPreset.values` | Node label values to match. Ignored if `orborus.affinity` is set | `[]` | +| `orborus.affinity` | Affinity for orborus pods assignment | `{}` | +| `orborus.nodeSelector` | Node labels for orborus pods assignment | `{}` | +| `orborus.tolerations` | Tolerations for orborus pods assignment | `[]` | +| `orborus.updateStrategy.type` | orborus deployment strategy type | `RollingUpdate` | +| `orborus.updateStrategy.type` | orborus statefulset strategy type | `RollingUpdate` | +| `orborus.podManagementPolicy` | Pod management policy for orborus statefulset | `OrderedReady` | +| `orborus.priorityClassName` | orborus pods' priorityClassName | `""` | +| `orborus.topologySpreadConstraints` | Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains | `[]` | +| `orborus.schedulerName` | Name of the k8s scheduler (other than default) for orborus pods | `""` | +| `orborus.terminationGracePeriodSeconds` | Seconds orborus pods need to terminate gracefully | `""` | +| `orborus.lifecycleHooks` | for orborus containers to automate configuration before or after startup | `{}` | +| `orborus.extraEnvVars` | Array with extra environment variables to add to orborus containers | `[]` | +| `orborus.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for orborus containers | `""` | +| `orborus.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for orborus containers | `""` | +| `orborus.extraVolumes` | Optionally specify extra list of additional volumes for the orborus pods | `[]` | +| `orborus.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the orborus containers | `[]` | +| `orborus.sidecars` | Add additional sidecar containers to the orborus pods | `[]` | +| `orborus.initContainers` | Add additional init containers to the orborus pods | `[]` | +| `orborus.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `orborus.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `orborus.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty. | `""` | +| `orborus.autoscaling.vpa.enabled` | Enable VPA for orborus pods | `false` | +| `orborus.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `orborus.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `orborus.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `orborus.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `orborus.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `orborus.autoscaling.hpa.enabled` | Enable HPA for orborus pods | `false` | +| `orborus.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `orborus.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `orborus.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `orborus.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | +| `orborus.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `orborus.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `orborus.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `orborus.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `orborus.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### worker Parameters + +| Name | Description | Value | +| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `worker.image.registry` | worker image registry | `ghcr.io` | +| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` | +| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### app Parameters + +| Name | Description | Value | +| ------------------------------------------------- | ---------------------------------------------------------------------------------- | ------ | +| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | + +### Traffic Exposure Parameters + +| Name | Description | Value | +| -------------------------- | ----------------------------------------------------------------------------------------------------- | --------------- | +| `ingress.enabled` | Enable ingress record generation for frontend and backend | `false` | +| `ingress.pathType` | Ingress path type for the frontend path | `Prefix` | +| `ingress.backendPathType` | Ingress path type for the backend path | `Prefix` | +| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | +| `ingress.hostname` | Default host for the ingress record | `shuffle.local` | +| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `nginx` | +| `ingress.path` | Ingress path for Shuffle frontend | `"/"` | +| `ingress.backendPath` | Ingress path for Shuffle backend | `"/api/"` | +| `ingress.annotations` | Additional annotations for the Ingress resource. | `{}` | +| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` | +| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | +| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` | +| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` | +| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | +| `ingress.secrets` | Custom TLS certificates as secrets | `[]` | +| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` | + +### Istio Parameters + +| Name | Description | Value | +| --------------------------------------- | ------------------------------------------------------------------------------- | ------------------------ | +| `istio.enabled` | Enable creation of an Istio Gateway and VirtualService for frontend and backend | `false` | +| `istio.apiVersion` | The istio apiVersion to use for Gateway and VirtualService resources | `networking.istio.io/v1` | +| `istio.hosts` | One or more hosts exposed by Istio | `[]` | +| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` | +| `istio.gateway.selector` | The selector matches the ingress gateway pod labels | `{ istio: ingress }` | +| `istio.gateway.http.enabled` | Enable HTTP server port 80 | `true` | +| `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` | +| `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` | +| `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` | +| `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` | +| `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` | + +### Persistence Parameters + +| Name | Description | Value | +| ------------------------------------- | ------------------------------------------------- | ------------------- | +| `persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` | +| `persistence.apps.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.apps.storageClass` | PVC Storage Class for shuffle-apps volume | `""` | +| `persistence.apps.subPath` | The sub path used in the volume | `""` | +| `persistence.apps.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.apps.size` | The size of the volume | `5Gi` | +| `persistence.apps.annotations` | Annotations for the PVC | `{}` | +| `persistence.apps.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.appBuilder.storageClass` | PVC Storage Class for backend-apps-claim volume | `""` | +| `persistence.appBuilder.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.appBuilder.size` | The size of the volume | `5Gi` | +| `persistence.appBuilder.annotations` | Annotations for the PVC | `{}` | +| `persistence.appBuilder.selector` | Selector to match an existing Persistent Volume | `{}` | +| `persistence.files.existingClaim` | Name of an existing PVC to use | `""` | +| `persistence.files.storageClass` | PVC Storage Class for shuffle-files volume | `""` | +| `persistence.files.subPath` | The sub path used in the volume | `""` | +| `persistence.files.accessModes` | The access mode of the volume | `["ReadWriteOnce"]` | +| `persistence.files.size` | The size of the volume | `5Gi` | +| `persistence.files.annotations` | Annotations for the PVC | `{}` | +| `persistence.files.selector` | Selector to match an existing Persistent Volume | `{}` | + +### Init Container Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | +| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` | +| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnami/os-shell` | +| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | + +### OpenSearch Parameters + +| Name | Description | Value | +| -------------------- | ----------------------------------------------------- | ------ | +| `opensearch.enabled` | Switch to enable or disable the opensearch helm chart | `true` | + +### Vault Parameters + +| Name | Description | Value | +| --------------- | -------------------------------------------------------------------------- | ----- | +| `vault.role` | Specify the Vault role, which should be used to get the secret from Vault. | `""` | +| `vault.secrets` | A list of VaultSecrets to create | `[]` | + +### Other Parameters + diff --git a/charts/shuffle/templates/NOTES.txt b/charts/shuffle/templates/NOTES.txt new file mode 100644 index 00000000..1091d443 --- /dev/null +++ b/charts/shuffle/templates/NOTES.txt @@ -0,0 +1,25 @@ +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +** Please be patient while the chart is being deployed ** + +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ include "common.names.namespace" . | quote }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ include "common.names.namespace" . | quote }} -ti -- bash + +{{- end }} + +TODO + +{{- include "common.warnings.rollingTag" .Values.backend.image }} diff --git a/charts/shuffle/templates/_helpers.tpl b/charts/shuffle/templates/_helpers.tpl new file mode 100644 index 00000000..0e90cbe9 --- /dev/null +++ b/charts/shuffle/templates/_helpers.tpl @@ -0,0 +1,215 @@ +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "shuffle.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image .Values.frontend.image .Values.orborus.image .Values.worker.image .Values.volumePermissions.image) "context" $) -}} +{{- end -}} + +{{/* +Return the common name for backend componentes +*/}} +{{- define "shuffle.backend.name" -}} + {{- printf "%s-backend" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for frontend components +*/}} +{{- define "shuffle.frontend.name" -}} + {{- printf "%s-frontend" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for orborus components +*/}} +{{- define "shuffle.orborus.name" -}} + {{- printf "%s-orborus" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for worker components +*/}} +{{- define "shuffle.worker.name" -}} + {{- printf "%s-worker" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common name for app components +*/}} +{{- define "shuffle.app.name" -}} + {{- printf "%s-app" (include "common.names.fullname" .) | trunc 63 -}} +{{- end -}} + +{{/* +Return the common labels for backend components +The shuffle app builder requires the io.kompose.service=backend label to be set on the backend pod. +*/}} +{{- define "shuffle.backend.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: backend +io.kompose.service: backend +{{- end -}} + +{{/* +Return the common labels for frontend components +*/}} +{{- define "shuffle.frontend.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: frontend +{{- end -}} + +{{/* +Return the common labels for orborus components +*/}} +{{- define "shuffle.orborus.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: orborus +{{- end -}} + +{{/* +Return the common labels for worker components +*/}} +{{- define "shuffle.worker.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: worker +{{- end -}} + +{{/* +Return the common labels for app components +*/}} +{{- define "shuffle.app.labels" -}} +{{- include "common.labels.standard" . }} +app.kubernetes.io/component: app +{{- end -}} + +{{/* +Return the match labels for backend components +*/}} +{{- define "shuffle.backend.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: backend +{{- end -}} + +{{/* +Return the match labels for frontend components +*/}} +{{- define "shuffle.frontend.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: frontend +{{- end -}} + +{{/* +Return the match labels for orborus components +*/}} +{{- define "shuffle.orborus.matchLabels" -}} +{{- include "common.labels.matchLabels" . }} +app.kubernetes.io/component: orborus +{{- end -}} + +{{/* +Return the match labels for worker components +NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. +*/}} +{{- define "shuffle.worker.matchLabels" -}} +container: shuffle-worker +{{- end -}} + +{{/* +Return the match labels for app components +NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. +*/}} +{{- define "shuffle.app.matchLabels" -}} +app: shuffle-app +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "shuffle.volumePermissions.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Shuffle backend image name +*/}} +{{- define "shuffle.backend.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Shuffle frontend image name +*/}} +{{- define "shuffle.frontend.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Shuffle orborus image name +*/}} +{{- define "shuffle.orborus.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Shuffle worker image name +*/}} +{{- define "shuffle.worker.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.worker.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Create the name of the service account to use for the Shuffle backend +*/}} +{{- define "shuffle.backend.serviceAccountName" -}} +{{- if .Values.backend.serviceAccount.create -}} + {{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.backend.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use for the Shuffle frontend +*/}} +{{- define "shuffle.frontend.serviceAccountName" -}} +{{- if .Values.frontend.serviceAccount.create -}} + {{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.frontend.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle orborus +*/}} +{{- define "shuffle.orborus.serviceAccountName" -}} +{{- if .Values.orborus.serviceAccount.create -}} + {{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.orborus.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle workers +*/}} +{{- define "shuffle.worker.serviceAccountName" -}} +{{- if .Values.worker.serviceAccount.create -}} + {{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.worker.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use for Shuffle apps +*/}} +{{- define "shuffle.app.serviceAccountName" -}} +{{- if .Values.app.serviceAccount.create -}} + {{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }} +{{- else -}} + {{ default "default" .Values.app.serviceAccount.name }} +{{- end -}} +{{- end -}} + + diff --git a/charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml b/charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml new file mode 100644 index 00000000..e0e8ef7d --- /dev/null +++ b/charts/shuffle/templates/backend/backend-apps-claim-pvc.yaml @@ -0,0 +1,28 @@ +# This PVC is always enabled, regardless of .Values.persistence.enabled, +# as app building does not work without it. +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: backend-apps-claim # Hardcoded by shuffle-app-builder + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} + helm.sh/resource-policy: keep + {{- end }} + {{- if or .Values.persistence.appBuilder.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.appBuilder.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + accessModes: + {{- range .Values.persistence.appBuilder.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.appBuilder.size }} + {{- if .Values.persistence.appBuilder.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.appBuilder.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.appBuilder "global" .Values.global ) | nindent 2 }} diff --git a/charts/shuffle/templates/backend/backend-apps-pvc.yaml b/charts/shuffle/templates/backend/backend-apps-pvc.yaml new file mode 100644 index 00000000..b26dfdf3 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-apps-pvc.yaml @@ -0,0 +1,30 @@ +{{- if .Values.persistence.enabled }} +{{- if (not .Values.persistence.apps.existingClaim) }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ printf "%s-apps" (include "shuffle.backend.name" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} + helm.sh/resource-policy: keep + {{- end }} + {{- if or .Values.persistence.apps.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.apps.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + accessModes: + {{- range .Values.persistence.apps.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.apps.size }} + {{- if .Values.persistence.apps.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.apps.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.apps "global" .Values.global ) | nindent 2 }} +{{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-cm-env.yaml b/charts/shuffle/templates/backend/backend-cm-env.yaml new file mode 100644 index 00000000..e7138dc0 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-cm-env.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "shuffle.backend.name" . }}-env + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + BACKEND_PORT: "5001" + {{- if .Values.shuffle.baseUrl }} + BASE_URL: "{{ .Values.shuffle.baseUrl }}" + SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}" + {{- else }} + BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001" + {{- end }} + ORG_ID: "{{ .Values.shuffle.org }}" + SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}" + SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}" + SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}" + SHUFFLE_CHAT_DISABLED: "true" + SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }} + SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}" + SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}" + SHUFFLE_OPENSEARCH_SKIPSSL_VERIFY: "{{ .Values.backend.openSearch.skipSSLVerify }}" + SHUFFLE_OPENSEARCH_INDEX_PREFIX: "{{ .Values.backend.openSearch.indexPrefix }}" + SHUFFLE_RERUN_SCHEDULE: "{{ .Values.backend.cleanupSchedule }}" + TZ: "{{ .Values.shuffle.timezone }}" + REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" diff --git a/charts/shuffle/templates/backend/backend-dpl.yaml b/charts/shuffle/templates/backend/backend-dpl.yaml new file mode 100644 index 00000000..8a4cfc36 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-dpl.yaml @@ -0,0 +1,221 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.backend.deploymentAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.deploymentAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.backend.autoscaling.hpa.enabled }} + replicas: {{ .Values.backend.replicaCount }} + {{- end }} + {{- if .Values.backend.updateStrategy }} + strategy: {{- toYaml .Values.backend.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }} + selector: + matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if .Values.backend.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "shuffle.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.backend.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }} + {{- if .Values.backend.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.backend.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backend.podAntiAffinityPreset "component" "backend" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.backend.nodeAffinityPreset.type "key" .Values.backend.nodeAffinityPreset.key "values" .Values.backend.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.backend.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.backend.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.backend.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backend.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.backend.priorityClassName }} + priorityClassName: {{ .Values.backend.priorityClassName | quote }} + {{- end }} + {{- if .Values.backend.schedulerName }} + schedulerName: {{ .Values.backend.schedulerName | quote }} + {{- end }} + {{- if .Values.backend.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.backend.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.backend.podSecurityContext.enabled }} + securityContext: {{- omit .Values.backend.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.backend.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.backend.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: {{ include "shuffle.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /app/generated && \ + chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-apps && \ + chown -vR {{ .Values.backend.containerSecurityContext.runAsUser }}:{{ .Values.backend.podSecurityContext.fsGroup }} /shuffle-files + {{- if .Values.volumePermissions.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} + {{- end }} + volumeMounts: + - name: shuffle-app-builder + mountPath: /app/generated + - name: shuffle-apps + mountPath: /shuffle-apps + {{- if .Values.persistence.apps.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + - name: shuffle-files + mountPath: /shuffle-files + {{- if .Values.persistence.files.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + {{- end }} + {{- if .Values.backend.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: backend + image: {{ template "shuffle.backend.image" . }} + imagePullPolicy: {{ .Values.backend.image.pullPolicy }} + {{- if .Values.backend.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backend.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.backend.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.backend.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.backend.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.backend.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: RUNNING_MODE + value: kubernetes + - name: IS_KUBERNETES + value: "true" + - name: SHUFFLE_APP_HOTLOAD_FOLDER + value: /shuffle-apps + - name: SHUFFLE_FILE_LOCATION + value: /shuffle-files + {{- if .Values.backend.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ include "shuffle.backend.name" . }}-env + {{- if .Values.backend.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.backend.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.backend.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.backend.resources }} + resources: {{- toYaml .Values.backend.resources | nindent 12 }} + {{- else if ne .Values.backend.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.backend.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: 5001 + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.backend.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.backend.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: 5001 + {{- end }} + {{- if .Values.backend.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.backend.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: 5001 + {{- end }} + {{- if .Values.backend.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.backend.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /api/v1/health + port: 5001 + {{- end }} + {{- end }} + {{- if .Values.backend.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.backend.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: shuffle-app-builder + mountPath: /app/generated + - name: shuffle-apps + mountPath: /shuffle-apps + {{- if .Values.persistence.apps.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + - name: shuffle-files + mountPath: /shuffle-files + {{- if .Values.persistence.files.subPath }} + subPath: {{ .Values.persistence.apps.subPath }} + {{- end }} + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.backend.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.backend.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backend.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + - name: shuffle-app-builder + persistentVolumeClaim: + claimName: backend-apps-claim + - name: shuffle-apps + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ default (printf "%s-apps" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }} + {{- else }} + emptyDir: {} + {{- end }} + - name: shuffle-files + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ default (printf "%s-files" (include "shuffle.backend.name" .)) .Values.persistence.apps.existingClaim }} + {{- else }} + emptyDir: {} + {{- end }} + {{- if .Values.backend.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/charts/shuffle/templates/backend/backend-files-pvc.yaml b/charts/shuffle/templates/backend/backend-files-pvc.yaml new file mode 100644 index 00000000..86faac82 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-files-pvc.yaml @@ -0,0 +1,30 @@ +{{- if .Values.persistence.enabled }} +{{- if (not .Values.persistence.files.existingClaim) }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ printf "%s-files" (include "shuffle.backend.name" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + annotations: + {{- if eq .Values.persistence.resourcePolicy "keep" }} + helm.sh/resource-policy: keep + {{- end }} + {{- if or .Values.persistence.files.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.files.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + accessModes: + {{- range .Values.persistence.files.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.files.size }} + {{- if .Values.persistence.files.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.files.selector "context" $) | nindent 2 }} + {{- end }} + {{- include "common.storage.class" ( dict "persistence" .Values.persistence.files "global" .Values.global ) | nindent 2 }} +{{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-hpa.yaml b/charts/shuffle/templates/backend/backend-hpa.yaml new file mode 100644 index 00000000..bd099242 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-hpa.yaml @@ -0,0 +1,43 @@ +{{- if .Values.backend.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.backend.name" . }} + minReplicas: {{ .Values.backend.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.backend.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.backend.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.backend.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.backend.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-network-policy.yaml b/charts/shuffle/templates/backend/backend-network-policy.yaml new file mode 100644 index 00000000..47d7bd3b --- /dev/null +++ b/charts/shuffle/templates/backend/backend-network-policy.yaml @@ -0,0 +1,66 @@ +{{- if .Values.backend.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.backend.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + {{- if .Values.backend.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: 5001 + protocol: TCP + {{- if not .Values.backend.networkPolicy.allowExternal }} + from: + # Allow traffic from orborus + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }} + + # Allow traffic from workers + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + + # Allow traffic from apps + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.backend.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-pdb.yaml b/charts/shuffle/templates/backend/backend-pdb.yaml new file mode 100644 index 00000000..5b253ca6 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-pdb.yaml @@ -0,0 +1,21 @@ +{{- if .Values.backend.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.backend.pdb.minAvailable }} + minAvailable: {{ .Values.backend.pdb.minAvailable }} + {{- end }} + {{- if or .Values.backend.pdb.maxUnavailable ( not .Values.backend.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.backend.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "shuffle.backend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-role-binding.yaml b/charts/shuffle/templates/backend/backend-role-binding.yaml new file mode 100644 index 00000000..ffbe3ce0 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-role-binding.yaml @@ -0,0 +1,18 @@ +{{ if .Values.backend.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + name: {{ include "shuffle.backend.serviceAccountName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "shuffle.backend.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-role.yaml b/charts/shuffle/templates/backend/backend-role.yaml new file mode 100644 index 00000000..790ea462 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-role.yaml @@ -0,0 +1,18 @@ +{{ if .Values.backend.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list"] + - apiGroups: ["batch"] + resources: ["jobs"] + verbs: ["get", "create", "delete"] +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-service-account.yaml b/charts/shuffle/templates/backend/backend-service-account.yaml new file mode 100644 index 00000000..efe96b6a --- /dev/null +++ b/charts/shuffle/templates/backend/backend-service-account.yaml @@ -0,0 +1,13 @@ +{{- if .Values.backend.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.backend.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.backend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/shuffle/templates/backend/backend-svc.yaml b/charts/shuffle/templates/backend/backend-svc.yaml new file mode 100644 index 00000000..c41aa3bb --- /dev/null +++ b/charts/shuffle/templates/backend/backend-svc.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http + port: 5001 + targetPort: http + protocol: TCP + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }} + selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/backend/backend-vpa.yaml b/charts/shuffle/templates/backend/backend-vpa.yaml new file mode 100644 index 00000000..dfdd0bf5 --- /dev/null +++ b/charts/shuffle/templates/backend/backend-vpa.yaml @@ -0,0 +1,38 @@ +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.backend.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.backend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: backend + {{- with .Values.backend.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.backend.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.backend.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "backend.names.name" . }} + {{- if .Values.backend.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.backend.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/extra-list.yaml b/charts/shuffle/templates/extra-list.yaml new file mode 100644 index 00000000..9ac65f9e --- /dev/null +++ b/charts/shuffle/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-cm-env.yaml b/charts/shuffle/templates/frontend/frontend-cm-env.yaml new file mode 100644 index 00000000..9d9f8e72 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-cm-env.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "shuffle.frontend.name" . }}-env + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: diff --git a/charts/shuffle/templates/frontend/frontend-dpl.yaml b/charts/shuffle/templates/frontend/frontend-dpl.yaml new file mode 100644 index 00000000..659167df --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-dpl.yaml @@ -0,0 +1,151 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.frontend.deploymentAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.deploymentAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.frontend.autoscaling.hpa.enabled }} + replicas: {{ .Values.frontend.replicaCount }} + {{- end }} + {{- if .Values.frontend.updateStrategy }} + strategy: {{- toYaml .Values.frontend.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }} + selector: + matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if .Values.frontend.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "shuffle.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.frontend.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }} + {{- if .Values.frontend.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.frontend.podAntiAffinityPreset "component" "frontend" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.frontend.nodeAffinityPreset.type "key" .Values.frontend.nodeAffinityPreset.key "values" .Values.frontend.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.frontend.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.priorityClassName }} + priorityClassName: {{ .Values.frontend.priorityClassName | quote }} + {{- end }} + {{- if .Values.frontend.schedulerName }} + schedulerName: {{ .Values.frontend.schedulerName | quote }} + {{- end }} + {{- if .Values.frontend.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.frontend.podSecurityContext.enabled }} + securityContext: {{- omit .Values.frontend.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.frontend.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.frontend.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if .Values.frontend.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: frontend + image: {{ template "shuffle.frontend.image" . }} + imagePullPolicy: {{ .Values.frontend.image.pullPolicy }} + {{- if .Values.frontend.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.frontend.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.frontend.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.frontend.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.args "context" $) | nindent 12 }} + {{- end }} + env: + {{- if .Values.frontend.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ include "shuffle.frontend.name" . }}-env + {{- if .Values.frontend.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.frontend.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.frontend.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.frontend.resources }} + resources: {{- toYaml .Values.frontend.resources | nindent 12 }} + {{- else if ne .Values.frontend.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.frontend.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: 8080 + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.frontend.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.frontend.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: 8080 + {{- end }} + {{- if .Values.frontend.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.frontend.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: 8080 + {{- end }} + {{- if .Values.frontend.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.frontend.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: 8080 + {{- end }} + {{- end }} + {{- if .Values.frontend.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.frontend.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.frontend.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if .Values.frontend.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-hpa.yaml b/charts/shuffle/templates/frontend/frontend-hpa.yaml new file mode 100644 index 00000000..d1b31e11 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-hpa.yaml @@ -0,0 +1,43 @@ +{{- if .Values.frontend.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.frontend.name" . }} + minReplicas: {{ .Values.frontend.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.frontend.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.frontend.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.frontend.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.frontend.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-network-policy.yaml b/charts/shuffle/templates/frontend/frontend-network-policy.yaml new file mode 100644 index 00000000..b8143312 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-network-policy.yaml @@ -0,0 +1,44 @@ +{{- if .Values.frontend.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.frontend.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + {{- if .Values.frontend.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + {{ if .Values.frontend.networkPolicy.allowExternal }} + - ports: + - port: 8080 + {{- end }} + {{- if .Values.frontend.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-pdb.yaml b/charts/shuffle/templates/frontend/frontend-pdb.yaml new file mode 100644 index 00000000..b1c2eb28 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-pdb.yaml @@ -0,0 +1,21 @@ +{{- if .Values.frontend.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.frontend.pdb.minAvailable }} + minAvailable: {{ .Values.frontend.pdb.minAvailable }} + {{- end }} + {{- if or .Values.frontend.pdb.maxUnavailable ( not .Values.frontend.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.frontend.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "shuffle.frontend.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-service-account.yaml b/charts/shuffle/templates/frontend/frontend-service-account.yaml new file mode 100644 index 00000000..a55fad19 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-service-account.yaml @@ -0,0 +1,13 @@ +{{- if .Values.frontend.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.frontend.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-svc.yaml b/charts/shuffle/templates/frontend/frontend-svc.yaml new file mode 100644 index 00000000..8a5ca84c --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-svc.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http + port: 8080 + targetPort: http + protocol: TCP + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }} + selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/frontend/frontend-vpa.yaml b/charts/shuffle/templates/frontend/frontend-vpa.yaml new file mode 100644 index 00000000..8dd26333 --- /dev/null +++ b/charts/shuffle/templates/frontend/frontend-vpa.yaml @@ -0,0 +1,38 @@ +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.frontend.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.frontend.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: frontend + {{- with .Values.frontend.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.frontend.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.frontend.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "frontend.names.name" . }} + {{- if .Values.frontend.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.frontend.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/ingress/ingress.yaml b/charts/shuffle/templates/ingress/ingress.yaml new file mode 100644 index 00000000..cd08c0f9 --- /dev/null +++ b/charts/shuffle/templates/ingress/ingress.yaml @@ -0,0 +1,60 @@ +{{- if .Values.ingress.enabled }} +apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.ingress.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.ingress.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }} + ingressClassName: {{ .Values.ingress.ingressClassName | quote }} + {{- end }} + rules: + {{- if .Values.ingress.hostname }} + - host: {{ .Values.ingress.hostname }} + http: + paths: + {{- if .Values.ingress.extraPaths }} + {{- toYaml .Values.ingress.extraPaths | nindent 10 }} + {{- end }} + - path: {{ .Values.ingress.path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.frontend.name" .) "servicePort" "http" "context" $) | nindent 14 }} + - path: {{ .Values.ingress.backendPath }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.ingress.backendPathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "shuffle.backend.name" .) "servicePort" "http" "context" $) | nindent 14 }} + + {{- end }} + {{- range .Values.ingress.extraHosts }} + - host: {{ .name | quote }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "http" "context" $) | nindent 14 }} + {{- end }} + {{- if .Values.ingress.extraRules }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }} + {{- end }} + {{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned)) .Values.ingress.extraTls }} + tls: + {{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned) }} + - hosts: + - {{ .Values.ingress.hostname | quote }} + secretName: {{ printf "%s-tls" .Values.ingress.hostname }} + {{- end }} + {{- if .Values.ingress.extraTls }} + {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/ingress/tls-secret.yaml b/charts/shuffle/templates/ingress/tls-secret.yaml new file mode 100644 index 00000000..4e35a9aa --- /dev/null +++ b/charts/shuffle/templates/ingress/tls-secret.yaml @@ -0,0 +1,39 @@ +{{- if .Values.ingress.enabled }} +{{- if .Values.ingress.secrets }} +{{- range .Values.ingress.secrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + namespace: {{ include "common.names.namespace" $ | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} +--- +{{- end }} +{{- end }} +{{- if and .Values.ingress.tls .Values.ingress.selfSigned }} +{{- $secretName := printf "%s-tls" .Values.ingress.hostname }} +{{- $ca := genCA "shuffle-ca" 365 }} +{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }} + tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }} + ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} +{{- end }} +{{- end }} diff --git a/charts/shuffle/templates/istio/gateway.yaml b/charts/shuffle/templates/istio/gateway.yaml new file mode 100644 index 00000000..fe80084f --- /dev/null +++ b/charts/shuffle/templates/istio/gateway.yaml @@ -0,0 +1,39 @@ +{{- if .Values.istio.enabled }} +apiVersion: "{{ .Values.istio.apiVersion }}" +kind: Gateway +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.gateway.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + selector: {{- include "common.tplvalues.render" ( dict "value" .Values.istio.gateway.selector "context" $ ) | nindent 4 }} + servers: + {{- if .Values.istio.gateway.http.enabled }} + - name: "{{ include "common.names.fullname" . }}-http" + port: + number: 80 + name: http + protocol: HTTP + hosts: {{ .Values.istio.hosts }} + tls: + httpsRedirect: {{ .Values.istio.gateway.http.httpsRedirect }} + {{- end }} + {{- if .Values.istio.gateway.https.enabled }} + - name: "{{ include "common.names.fullname" . }}-https" + port: + number: 443 + name: https + protocol: HTTPS + hosts: {{ .Values.istio.hosts }} + tls: + credentialName: {{ .Values.istio.gateway.https.tlsCredentialName }} + mode: SIMPLE + {{- end }} + {{- if .Values.istio.gateway.extraServers }} + {{- include "common.tplvalues.render" (dict "value" .Values.istio.gateway.extraServers "context" $) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/istio/virtual-service.yaml b/charts/shuffle/templates/istio/virtual-service.yaml new file mode 100644 index 00000000..ed74004b --- /dev/null +++ b/charts/shuffle/templates/istio/virtual-service.yaml @@ -0,0 +1,30 @@ +{{- if .Values.istio.enabled }} +apiVersion: "{{ .Values.istio.apiVersion }}" +kind: VirtualService +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.istio.gateway.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.istio.virtualService.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + hosts: {{ .Values.istio.hosts }} + gateways: + - {{ include "common.names.fullname" . }} + http: + - match: + - uri: + prefix: /api + route: + - destination: + host: {{ include "shuffle.backend.name" . }} + port: + number: 5001 + - route: + - destination: + host: {{ include "shuffle.frontend.name" . }} + port: + number: 8080 + {{- end }} diff --git a/charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml b/charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml new file mode 100644 index 00000000..d4a24fe6 --- /dev/null +++ b/charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml @@ -0,0 +1,61 @@ +{{- if .Values.app.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.app.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.app.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.app.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.app.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + # Allow access to workers + - ports: + - port: 33333 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- if .Values.app.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + {{- if .Values.app.networkPolicy.allowExternal }} + - {} + {{- else }} + # Allow access from workers. Apps will typicaly use port 80/TCP, but this is not enforced. + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.app.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml b/charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml new file mode 100644 index 00000000..91115fb4 --- /dev/null +++ b/charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml @@ -0,0 +1,20 @@ +{{ if .Values.app.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.app.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +# Deployed shuffle apps will use the default service account. There is currently no way to change that. +# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260 +subjects: + - kind: ServiceAccount + name: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "shuffle.app.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/orborus-app/orborus-app-role.yaml b/charts/shuffle/templates/orborus-app/orborus-app-role.yaml new file mode 100644 index 00000000..8be2a6f0 --- /dev/null +++ b/charts/shuffle/templates/orborus-app/orborus-app-role.yaml @@ -0,0 +1,15 @@ +{{ if .Values.app.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.app.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: [""] + resources: [""] + verbs: [""] +{{- end }} diff --git a/charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml b/charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml new file mode 100644 index 00000000..f5e4befe --- /dev/null +++ b/charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml @@ -0,0 +1,13 @@ +{{- if .Values.app.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.app.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.app.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml b/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml new file mode 100644 index 00000000..f4ee4aba --- /dev/null +++ b/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml @@ -0,0 +1,69 @@ +{{- if .Values.worker.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.worker.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.worker.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + # Allow access to orborus + - ports: + - port: 8080 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }} + # Allow arbitrary connections to apps. Apps will typically use port 80/TCP, but this is not enforced. + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }} + {{- if .Values.worker.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: 33333 + protocol: TCP + {{- if not .Values.worker.networkPolicy.allowExternal }} + from: + # Allow traffic from orborus + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.worker.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml b/charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml new file mode 100644 index 00000000..71479700 --- /dev/null +++ b/charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml @@ -0,0 +1,20 @@ +{{ if .Values.worker.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +# Deployed shuffle workers will use the default service account. There is currently no way to change that. +# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260 +subjects: + - kind: ServiceAccount + name: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "shuffle.worker.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml b/charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml new file mode 100644 index 00000000..fdef5855 --- /dev/null +++ b/charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml @@ -0,0 +1,21 @@ +{{ if .Values.worker.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "shuffle.worker.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "delete"] + - apiGroups: [""] + resources: ["services"] + verbs: ["create"] + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["list", "create"] +{{- end }} diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml b/charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml new file mode 100644 index 00000000..e27395f0 --- /dev/null +++ b/charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml @@ -0,0 +1,13 @@ +{{- if .Values.worker.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.worker.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.worker.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-cm-env.yaml b/charts/shuffle/templates/orborus/orborus-cm-env.yaml new file mode 100644 index 00000000..b49ce510 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-cm-env.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "shuffle.orborus.name" . }}-env + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}" + ORG_ID: "{{ .Values.shuffle.org }}" + TZ: "{{ .Values.shuffle.timezone }}" + BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001" + KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}" + KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccountName" . }} + SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}" + REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" + SHUFFLE_SWARM_CONFIG: run diff --git a/charts/shuffle/templates/orborus/orborus-dpl.yaml b/charts/shuffle/templates/orborus/orborus-dpl.yaml new file mode 100644 index 00000000..b63c7a8b --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -0,0 +1,155 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.orborus.deploymentAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.deploymentAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.orborus.autoscaling.hpa.enabled }} + replicas: {{ .Values.orborus.replicaCount }} + {{- end }} + {{- if .Values.orborus.updateStrategy }} + strategy: {{- toYaml .Values.orborus.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.podLabels .Values.commonLabels) "context" .) }} + selector: + matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + template: + metadata: + {{- if .Values.orborus.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + spec: + {{- include "shuffle.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.orborus.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }} + {{- if .Values.orborus.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.orborus.podAntiAffinityPreset "component" "orborus" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.orborus.nodeAffinityPreset.type "key" .Values.orborus.nodeAffinityPreset.key "values" .Values.orborus.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.orborus.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.priorityClassName }} + priorityClassName: {{ .Values.orborus.priorityClassName | quote }} + {{- end }} + {{- if .Values.orborus.schedulerName }} + schedulerName: {{ .Values.orborus.schedulerName | quote }} + {{- end }} + {{- if .Values.orborus.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.orborus.podSecurityContext.enabled }} + securityContext: {{- omit .Values.orborus.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.orborus.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.orborus.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if .Values.orborus.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: orborus + image: {{ template "shuffle.orborus.image" . }} + imagePullPolicy: {{ .Values.orborus.image.pullPolicy }} + {{- if .Values.orborus.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.orborus.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.orborus.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.orborus.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: RUNNING_MODE + value: kubernetes + - name: IS_KUBERNETES + value: "true" + {{- if .Values.orborus.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ include "shuffle.orborus.name" . }}-env + {{- if .Values.orborus.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.orborus.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.orborus.resources }} + resources: {{- toYaml .Values.orborus.resources | nindent 12 }} + {{- else if ne .Values.orborus.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.orborus.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: 8080 + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.orborus.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.orborus.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: 8080 + {{- end }} + {{- if .Values.orborus.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.orborus.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: 8080 + {{- end }} + {{- if .Values.orborus.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.orborus.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: 8080 + {{- end }} + {{- end }} + {{- if .Values.orborus.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.orborus.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.orborus.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if .Values.orborus.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-hpa.yaml b/charts/shuffle/templates/orborus/orborus-hpa.yaml new file mode 100644 index 00000000..12bf073f --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-hpa.yaml @@ -0,0 +1,43 @@ +{{- if .Values.orborus.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "shuffle.orborus.name" . }} + minReplicas: {{ .Values.orborus.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.orborus.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.orborus.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.orborus.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.orborus.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-network-policy.yaml b/charts/shuffle/templates/orborus/orborus-network-policy.yaml new file mode 100644 index 00000000..6e03b9e3 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-network-policy.yaml @@ -0,0 +1,72 @@ +{{- if .Values.orborus.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.orborus.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow DNS resolution with an in-cluster DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + # Allow access to backend + - ports: + - port: 5001 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }} + # Allow access to workers + - ports: + - port: 33333 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- if .Values.orborus.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: 8080 + protocol: TCP + {{- if not .Values.orborus.networkPolicy.allowExternal }} + from: + # Allow traffic from workers + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: {{ .Release.Namespace }} + podSelector: + matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.orborus.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.orborus.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-pdb.yaml b/charts/shuffle/templates/orborus/orborus-pdb.yaml new file mode 100644 index 00000000..827b01bc --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-pdb.yaml @@ -0,0 +1,21 @@ +{{- if .Values.orborus.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.orborus.pdb.minAvailable }} + minAvailable: {{ .Values.orborus.pdb.minAvailable }} + {{- end }} + {{- if or .Values.orborus.pdb.maxUnavailable ( not .Values.orborus.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.orborus.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "shuffle.orborus.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-role-binding.yaml b/charts/shuffle/templates/orborus/orborus-role-binding.yaml new file mode 100644 index 00000000..f4c2689e --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-role-binding.yaml @@ -0,0 +1,18 @@ +{{ if .Values.orborus.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + name: {{ include "shuffle.orborus.serviceAccountName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "shuffle.orborus.name" . }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-role.yaml b/charts/shuffle/templates/orborus/orborus-role.yaml new file mode 100644 index 00000000..90041d89 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-role.yaml @@ -0,0 +1,29 @@ +{{ if .Values.orborus.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - verbs: + - list + - create + - delete + apiGroups: + - '' + resources: + - pods + - services + - verbs: + - list + - create + - delete + apiGroups: + - apps + resources: + - deployments +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-service-account.yaml b/charts/shuffle/templates/orborus/orborus-service-account.yaml new file mode 100644 index 00000000..4a5c7f3a --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-service-account.yaml @@ -0,0 +1,13 @@ +{{- if .Values.orborus.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shuffle.orborus.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.orborus.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-vpa.yaml b/charts/shuffle/templates/orborus/orborus-vpa.yaml new file mode 100644 index 00000000..a1a7c386 --- /dev/null +++ b/charts/shuffle/templates/orborus/orborus-vpa.yaml @@ -0,0 +1,38 @@ +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.orborus.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ include "shuffle.orborus.name" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.orborus.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: orborus + {{- with .Values.orborus.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.orborus.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.orborus.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} + kind: Deployment + name: {{ include "orborus.names.name" . }} + {{- if .Values.orborus.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.orborus.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/templates/vault-secrets.yaml b/charts/shuffle/templates/vault-secrets.yaml new file mode 100644 index 00000000..0755f20a --- /dev/null +++ b/charts/shuffle/templates/vault-secrets.yaml @@ -0,0 +1,19 @@ +{{ range $index, $element := .Values.vault.secrets }} +{{- $vaultRole := $element.vaultRole | default $.Values.vault.role }} +--- +apiVersion: ricoberger.de/v1alpha1 +kind: VaultSecret +metadata: + name: {{ include "common.names.fullname" $ }}-{{ $element.name }} +spec: + type: {{ $element.type }} + path: {{ $element.path }} + {{- if $vaultRole }} + vaultRole: {{ $vaultRole }} + {{- end }} + {{- range $k, $v := $element }} + {{- if (not (has $k (list "name" "type" "path" "vaultRole"))) }} + {{ $k }}: {{ $v }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json new file mode 100644 index 00000000..62e2dff2 --- /dev/null +++ b/charts/shuffle/values.schema.json @@ -0,0 +1,2562 @@ +{ + "title": "Chart Values", + "type": "object", + "properties": { + "global": { + "type": "object", + "properties": { + "imageRegistry": { + "type": "string", + "description": "Global Docker image registry", + "default": "" + }, + "imagePullSecrets": { + "type": "array", + "description": "Global Docker registry secret names as an array", + "default": [], + "items": {} + }, + "defaultStorageClass": { + "type": "string", + "description": "Global default StorageClass for Persistent Volume(s)", + "default": "" + }, + "compatibility": { + "type": "object", + "properties": { + "openshift": { + "type": "object", + "properties": { + "adaptSecurityContext": { + "type": "string", + "description": "Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)", + "default": "auto" + } + } + }, + "omitEmptySeLinuxOptions": { + "type": "boolean", + "description": "If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object", + "default": false + } + } + } + } + }, + "kubeVersion": { + "type": "string", + "description": "Override Kubernetes version", + "default": "" + }, + "nameOverride": { + "type": "string", + "description": "String to partially override common.names.name", + "default": "" + }, + "fullnameOverride": { + "type": "string", + "description": "String to fully override common.names.fullname", + "default": "" + }, + "namespaceOverride": { + "type": "string", + "description": "String to fully override common.names.namespace", + "default": "" + }, + "commonLabels": { + "type": "object", + "description": "Labels to add to all deployed objects", + "default": {} + }, + "commonAnnotations": { + "type": "object", + "description": "Annotations to add to all deployed objects", + "default": {} + }, + "clusterDomain": { + "type": "string", + "description": "Kubernetes cluster domain name", + "default": "cluster.local" + }, + "extraDeploy": { + "type": "array", + "description": "Array of extra objects to deploy with the release", + "default": [], + "items": {} + }, + "diagnosticMode": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable diagnostic mode (all probes will be disabled and the command will be overridden)", + "default": false + }, + "command": { + "type": "array", + "description": "Command to override all containers in the chart release", + "default": [ + "sleep" + ], + "items": { + "type": "string" + } + }, + "args": { + "type": "array", + "description": "Args to override all containers in the chart release", + "default": [ + "infinity" + ], + "items": { + "type": "string" + } + } + } + }, + "shuffle": { + "type": "object", + "properties": { + "baseUrl": { + "type": "string", + "description": "The external base URL under which Shuffle is reachable.", + "default": "" + }, + "org": { + "type": "string", + "description": "Default shuffle organization", + "default": "Shuffle" + }, + "appRegistry": { + "type": "string", + "description": "The registry from / to which shuffle apps are pulled / pushed", + "default": "" + }, + "timezone": { + "type": "string", + "description": "The timezone used by Shuffle", + "default": "Europe/Berlin" + } + } + }, + "backend": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "backend image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "backend image repository", + "default": "shuffle/shuffle-backend" + }, + "digest": { + "type": "string", + "description": "backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "backend image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "backend image pull secrets", + "default": [], + "items": {} + } + } + }, + "replicaCount": { + "type": "number", + "description": "Number of backend replicas to deploy", + "default": 1 + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on backend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on backend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on backend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one", + "default": {} + }, + "resourcesPreset": { + "type": "string", + "description": "Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production).", + "default": "small" + }, + "resources": { + "type": "object", + "description": "Set backend container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable backend pods' Security Context", + "default": true + }, + "fsGroupChangePolicy": { + "type": "string", + "description": "Set filesystem group change policy for backend pods", + "default": "Always" + }, + "sysctls": { + "type": "array", + "description": "Set kernel settings using the sysctl interface for backend pods", + "default": [], + "items": {} + }, + "supplementalGroups": { + "type": "array", + "description": "Set filesystem extra groups for backend pods", + "default": [], + "items": {} + }, + "fsGroup": { + "type": "number", + "description": "Set fsGroup in backend pods' Security Context", + "default": 1001 + } + } + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled backend container' Security Context", + "default": true + }, + "runAsUser": { + "type": "number", + "description": "Set runAsUser in backend container' Security Context", + "default": 1000 + }, + "runAsGroup": { + "type": "number", + "description": "Set runAsGroup in backend container' Security Context", + "default": 1000 + }, + "runAsNonRoot": { + "type": "boolean", + "description": "Set runAsNonRoot in backend container' Security Context", + "default": true + }, + "readOnlyRootFilesystem": { + "type": "boolean", + "description": "Set readOnlyRootFilesystem in backend container' Security Context", + "default": true + }, + "privileged": { + "type": "boolean", + "description": "Set privileged in backend container' Security Context", + "default": false + }, + "allowPrivilegeEscalation": { + "type": "boolean", + "description": "Set allowPrivilegeEscalation in backend container' Security Context", + "default": false + }, + "capabilities": { + "type": "object", + "properties": { + "drop": { + "type": "array", + "description": "List of capabilities to be dropped in backend container", + "default": [ + "ALL" + ], + "items": { + "type": "string" + } + } + } + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Set seccomp profile in backend container", + "default": "RuntimeDefault" + } + } + } + } + }, + "command": { + "type": "array", + "description": "Override default backend container command (useful when using custom images)", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default backend container args (useful when using custom images)", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in backend pods", + "default": true + }, + "hostAliases": { + "type": "array", + "description": "backend pods host aliases", + "default": [], + "items": {} + }, + "daemonsetAnnotations": { + "type": "object", + "description": "Annotations for backend daemonset", + "default": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for backend deployment", + "default": {} + }, + "statefulsetAnnotations": { + "type": "object", + "description": "Annotations for backend statefulset", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for backend pods", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for backend pods", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `backend.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `backend.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for backend pods assignment", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for backend pods assignment", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for backend pods assignment", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "backend statefulset strategy type", + "default": "RollingUpdate" + } + } + }, + "podManagementPolicy": { + "type": "string", + "description": "Pod management policy for backend statefulset", + "default": "OrderedReady" + }, + "priorityClassName": { + "type": "string", + "description": "backend pods' priorityClassName", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for backend pods", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds backend pods need to terminate gracefully", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for backend containers to automate configuration before or after startup", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to backend containers", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for backend containers", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for backend containers", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the backend pods", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the backend containers", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the backend pods", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the backend pods", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for backend pods", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for backend pods", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the server service account", + "default": true + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + }, + "cleanupSchedule": { + "type": "number", + "description": "The interval in seconds at which the cleanup job runs", + "default": 300 + }, + "openSearch": { + "type": "object", + "properties": { + "url": { + "type": "string", + "description": "The URL at which OpenSearch is available", + "default": "http://{{ .Release.Name }}-opensearch:9200" + }, + "username": { + "type": "string", + "description": "The username that is used for authenticating with OpenSearch", + "default": "admin" + }, + "certificateFile": { + "type": "string", + "description": "The path to a custom OpenSearch certificate file", + "default": "" + }, + "skipSSLVerify": { + "type": "boolean", + "description": "Skip SSL verification", + "default": false + }, + "indexPrefix": { + "type": "string", + "description": "A prefix for OpenSearch indices", + "default": "" + } + } + }, + "apps": { + "type": "object", + "properties": { + "downloadLocation": { + "type": "string", + "description": "The location to a git repository from which default appps are downloaded on startup.", + "default": "https://github.com/shuffle/python-apps" + }, + "downloadBranch": { + "type": "string", + "description": "The branch from which apps should be downloaded on startup.", + "default": "master" + }, + "forceUpdate": { + "type": "boolean", + "description": "Force an update of apps on startup.", + "default": false + } + } + } + } + }, + "frontend": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "frontend image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "frontend image repository", + "default": "shuffle/shuffle-frontend" + }, + "digest": { + "type": "string", + "description": "frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "frontend image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "frontend image pull secrets", + "default": [], + "items": {} + } + } + }, + "replicaCount": { + "type": "number", + "description": "Number of frontend replicas to deploy", + "default": 1 + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on frontend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on frontend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on frontend containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one", + "default": {} + }, + "resourcesPreset": { + "type": "string", + "description": "Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production).", + "default": "nano" + }, + "resources": { + "type": "object", + "description": "Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable frontend pods' Security Context", + "default": true + }, + "fsGroupChangePolicy": { + "type": "string", + "description": "Set filesystem group change policy for frontend pods", + "default": "Always" + }, + "sysctls": { + "type": "array", + "description": "Set kernel settings using the sysctl interface for frontend pods", + "default": [], + "items": {} + }, + "supplementalGroups": { + "type": "array", + "description": "Set filesystem extra groups for frontend pods", + "default": [], + "items": {} + }, + "fsGroup": { + "type": "number", + "description": "Set fsGroup in frontend pods' Security Context", + "default": 1001 + } + } + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled frontend container' Security Context", + "default": true + }, + "runAsUser": { + "type": "number", + "description": "Set runAsUser in frontend container' Security Context", + "default": 101 + }, + "runAsGroup": { + "type": "number", + "description": "Set runAsGroup in frontend container' Security Context", + "default": 101 + }, + "runAsNonRoot": { + "type": "boolean", + "description": "Set runAsNonRoot in frontend container' Security Context", + "default": true + }, + "readOnlyRootFilesystem": { + "type": "boolean", + "description": "Set readOnlyRootFilesystem in frontend container' Security Context", + "default": true + }, + "privileged": { + "type": "boolean", + "description": "Set privileged in frontend container' Security Context", + "default": false + }, + "allowPrivilegeEscalation": { + "type": "boolean", + "description": "Set allowPrivilegeEscalation in frontend container' Security Context", + "default": false + }, + "capabilities": { + "type": "object", + "properties": { + "drop": { + "type": "array", + "description": "List of capabilities to be dropped in frontend container", + "default": [ + "ALL" + ], + "items": { + "type": "string" + } + } + } + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Set seccomp profile in frontend container", + "default": "RuntimeDefault" + } + } + } + } + }, + "command": { + "type": "array", + "description": "Override default frontend container command (useful when using custom images)", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default frontend container args (useful when using custom images)", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in frontend pods", + "default": false + }, + "hostAliases": { + "type": "array", + "description": "frontend pods host aliases", + "default": [], + "items": {} + }, + "daemonsetAnnotations": { + "type": "object", + "description": "Annotations for frontend daemonset", + "default": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for frontend deployment", + "default": {} + }, + "statefulsetAnnotations": { + "type": "object", + "description": "Annotations for frontend statefulset", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for frontend pods", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for frontend pods", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `frontend.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `frontend.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for frontend pods assignment", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for frontend pods assignment", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for frontend pods assignment", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "frontend statefulset strategy type", + "default": "RollingUpdate" + } + } + }, + "podManagementPolicy": { + "type": "string", + "description": "Pod management policy for frontend statefulset", + "default": "OrderedReady" + }, + "priorityClassName": { + "type": "string", + "description": "frontend pods' priorityClassName", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for frontend pods", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds frontend pods need to terminate gracefully", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for frontend containers to automate configuration before or after startup", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to frontend containers", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for frontend containers", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for frontend containers", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the frontend pods", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the frontend containers", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the frontend pods", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the frontend pods", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for frontend pods", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for frontend pods", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the server service account", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "orborus": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "orborus image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "orborus image repository", + "default": "shuffle/shuffle-orborus" + }, + "digest": { + "type": "string", + "description": "orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + }, + "pullPolicy": { + "type": "string", + "description": "orborus image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "orborus image pull secrets", + "default": [], + "items": {} + } + } + }, + "replicaCount": { + "type": "number", + "description": "Number of orborus replicas to deploy", + "default": 1 + }, + "livenessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable livenessProbe on orborus containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for livenessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for livenessProbe", + "default": 15 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for livenessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for livenessProbe", + "default": 4 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for livenessProbe", + "default": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable readinessProbe on orborus containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for readinessProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for readinessProbe", + "default": 5 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for readinessProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for readinessProbe", + "default": 3 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for readinessProbe", + "default": 1 + } + } + }, + "startupProbe": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable startupProbe on orborus containers", + "default": false + }, + "initialDelaySeconds": { + "type": "number", + "description": "Initial delay seconds for startupProbe", + "default": 0 + }, + "periodSeconds": { + "type": "number", + "description": "Period seconds for startupProbe", + "default": 1 + }, + "timeoutSeconds": { + "type": "number", + "description": "Timeout seconds for startupProbe", + "default": 1 + }, + "failureThreshold": { + "type": "number", + "description": "Failure threshold for startupProbe", + "default": 60 + }, + "successThreshold": { + "type": "number", + "description": "Success threshold for startupProbe", + "default": 1 + } + } + }, + "customLivenessProbe": { + "type": "object", + "description": "Custom livenessProbe that overrides the default one", + "default": {} + }, + "customReadinessProbe": { + "type": "object", + "description": "Custom readinessProbe that overrides the default one", + "default": {} + }, + "customStartupProbe": { + "type": "object", + "description": "Custom startupProbe that overrides the default one", + "default": {} + }, + "resourcesPreset": { + "type": "string", + "description": "Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production).", + "default": "nano" + }, + "resources": { + "type": "object", + "description": "Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable orborus pods' Security Context", + "default": true + }, + "fsGroupChangePolicy": { + "type": "string", + "description": "Set filesystem group change policy for orborus pods", + "default": "Always" + }, + "sysctls": { + "type": "array", + "description": "Set kernel settings using the sysctl interface for orborus pods", + "default": [], + "items": {} + }, + "supplementalGroups": { + "type": "array", + "description": "Set filesystem extra groups for orborus pods", + "default": [], + "items": {} + }, + "fsGroup": { + "type": "number", + "description": "Set fsGroup in orborus pods' Security Context", + "default": 1001 + } + } + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled orborus container' Security Context", + "default": true + }, + "runAsUser": { + "type": "number", + "description": "Set runAsUser in orborus container' Security Context", + "default": 101 + }, + "runAsGroup": { + "type": "number", + "description": "Set runAsGroup in orborus container' Security Context", + "default": 101 + }, + "runAsNonRoot": { + "type": "boolean", + "description": "Set runAsNonRoot in orborus container' Security Context", + "default": true + }, + "readOnlyRootFilesystem": { + "type": "boolean", + "description": "Set readOnlyRootFilesystem in orborus container' Security Context", + "default": true + }, + "privileged": { + "type": "boolean", + "description": "Set privileged in orborus container' Security Context", + "default": false + }, + "allowPrivilegeEscalation": { + "type": "boolean", + "description": "Set allowPrivilegeEscalation in orborus container' Security Context", + "default": false + }, + "capabilities": { + "type": "object", + "properties": { + "drop": { + "type": "array", + "description": "List of capabilities to be dropped in orborus container", + "default": [ + "ALL" + ], + "items": { + "type": "string" + } + } + } + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Set seccomp profile in orborus container", + "default": "RuntimeDefault" + } + } + } + } + }, + "command": { + "type": "array", + "description": "Override default orborus container command (useful when using custom images)", + "default": [], + "items": {} + }, + "args": { + "type": "array", + "description": "Override default orborus container args (useful when using custom images)", + "default": [], + "items": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Mount Service Account token in orborus pods", + "default": true + }, + "hostAliases": { + "type": "array", + "description": "orborus pods host aliases", + "default": [], + "items": {} + }, + "daemonsetAnnotations": { + "type": "object", + "description": "Annotations for orborus daemonset", + "default": {} + }, + "deploymentAnnotations": { + "type": "object", + "description": "Annotations for orborus deployment", + "default": {} + }, + "statefulsetAnnotations": { + "type": "object", + "description": "Annotations for orborus statefulset", + "default": {} + }, + "podLabels": { + "type": "object", + "description": "Extra labels for orborus pods", + "default": {} + }, + "podAnnotations": { + "type": "object", + "description": "Annotations for orborus pods", + "default": {} + }, + "podAffinityPreset": { + "type": "string", + "description": "Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "podAntiAffinityPreset": { + "type": "string", + "description": "Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard`", + "default": "soft" + }, + "nodeAffinityPreset": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard`", + "default": "" + }, + "key": { + "type": "string", + "description": "Node label key to match. Ignored if `orborus.affinity` is set", + "default": "" + }, + "values": { + "type": "array", + "description": "Node label values to match. Ignored if `orborus.affinity` is set", + "default": [], + "items": {} + } + } + }, + "affinity": { + "type": "object", + "description": "Affinity for orborus pods assignment", + "default": {} + }, + "nodeSelector": { + "type": "object", + "description": "Node labels for orborus pods assignment", + "default": {} + }, + "tolerations": { + "type": "array", + "description": "Tolerations for orborus pods assignment", + "default": [], + "items": {} + }, + "updateStrategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "description": "orborus statefulset strategy type", + "default": "RollingUpdate" + } + } + }, + "podManagementPolicy": { + "type": "string", + "description": "Pod management policy for orborus statefulset", + "default": "OrderedReady" + }, + "priorityClassName": { + "type": "string", + "description": "orborus pods' priorityClassName", + "default": "" + }, + "topologySpreadConstraints": { + "type": "array", + "description": "Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains", + "default": [], + "items": {} + }, + "schedulerName": { + "type": "string", + "description": "Name of the k8s scheduler (other than default) for orborus pods", + "default": "" + }, + "terminationGracePeriodSeconds": { + "type": "string", + "description": "Seconds orborus pods need to terminate gracefully", + "default": "" + }, + "lifecycleHooks": { + "type": "object", + "description": "for orborus containers to automate configuration before or after startup", + "default": {} + }, + "extraEnvVars": { + "type": "array", + "description": "Array with extra environment variables to add to orborus containers", + "default": [], + "items": {} + }, + "extraEnvVarsCM": { + "type": "string", + "description": "Name of existing ConfigMap containing extra env vars for orborus containers", + "default": "" + }, + "extraEnvVarsSecret": { + "type": "string", + "description": "Name of existing Secret containing extra env vars for orborus containers", + "default": "" + }, + "extraVolumes": { + "type": "array", + "description": "Optionally specify extra list of additional volumes for the orborus pods", + "default": [], + "items": {} + }, + "extraVolumeMounts": { + "type": "array", + "description": "Optionally specify extra list of additional volumeMounts for the orborus containers", + "default": [], + "items": {} + }, + "sidecars": { + "type": "array", + "description": "Add additional sidecar containers to the orborus pods", + "default": [], + "items": {} + }, + "initContainers": { + "type": "array", + "description": "Add additional init containers to the orborus pods", + "default": [], + "items": {} + }, + "pdb": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Enable/disable a Pod Disruption Budget creation", + "default": true + }, + "minAvailable": { + "type": "string", + "description": "Minimum number/percentage of pods that should remain scheduled", + "default": "" + }, + "maxUnavailable": { + "type": "string", + "description": "Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty.", + "default": "" + } + } + }, + "autoscaling": { + "type": "object", + "properties": { + "vpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable VPA for orborus pods", + "default": false + }, + "annotations": { + "type": "object", + "description": "Annotations for VPA resource", + "default": {} + }, + "controlledResources": { + "type": "array", + "description": "VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory", + "default": [], + "items": {} + }, + "maxAllowed": { + "type": "object", + "description": "VPA Max allowed resources for the pod", + "default": {} + }, + "minAllowed": { + "type": "object", + "description": "VPA Min allowed resources for the pod", + "default": {} + }, + "updatePolicy": { + "type": "object", + "properties": { + "updateMode": { + "type": "string", + "description": "Autoscaling update policy", + "default": "Auto" + } + } + } + } + }, + "hpa": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HPA for orborus pods", + "default": false + }, + "minReplicas": { + "type": "string", + "description": "Minimum number of replicas", + "default": "" + }, + "maxReplicas": { + "type": "string", + "description": "Maximum number of replicas", + "default": "" + }, + "targetCPU": { + "type": "string", + "description": "Target CPU utilization percentage", + "default": "" + }, + "targetMemory": { + "type": "string", + "description": "Target Memory utilization percentage", + "default": "" + } + } + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the server service account", + "default": true + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "worker": { + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "worker image registry", + "default": "ghcr.io" + }, + "repository": { + "type": "string", + "description": "worker image repository", + "default": "shuffle/shuffle-worker" + }, + "digest": { + "type": "string", + "description": "worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)", + "default": "" + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the server service account", + "default": true + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "app": { + "type": "object", + "properties": { + "serviceAccount": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether a ServiceAccount should be created", + "default": true + }, + "name": { + "type": "string", + "description": "The name of the ServiceAccount to use.", + "default": "" + }, + "annotations": { + "type": "object", + "description": "Additional Service Account annotations (evaluated as a template)", + "default": {} + }, + "automountServiceAccountToken": { + "type": "boolean", + "description": "Automount service account token for the server service account", + "default": true + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean", + "description": "Specifies whether RBAC resources should be created", + "default": true + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Specifies whether a NetworkPolicy should be created", + "default": true + }, + "allowExternal": { + "type": "boolean", + "description": "Don't require server label for connections", + "default": true + }, + "allowExternalEgress": { + "type": "boolean", + "description": "Allow the pod to access any range of port and all destinations.", + "default": true + }, + "extraIngress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy", + "default": [], + "items": {} + }, + "extraEgress": { + "type": "array", + "description": "Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)", + "default": [], + "items": {} + } + } + } + } + }, + "ingress": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable ingress record generation for frontend and backend", + "default": false + }, + "pathType": { + "type": "string", + "description": "Ingress path type for the frontend path", + "default": "Prefix" + }, + "backendPathType": { + "type": "string", + "description": "Ingress path type for the backend path", + "default": "Prefix" + }, + "apiVersion": { + "type": "string", + "description": "Force Ingress API version (automatically detected if not set)", + "default": "" + }, + "hostname": { + "type": "string", + "description": "Default host for the ingress record", + "default": "shuffle.local" + }, + "ingressClassName": { + "type": "string", + "description": "IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)", + "default": "nginx" + }, + "path": { + "type": "string", + "description": "Ingress path for Shuffle frontend", + "default": "\"/\"" + }, + "backendPath": { + "type": "string", + "description": "Ingress path for Shuffle backend", + "default": "\"/api/\"" + }, + "annotations": { + "type": "object", + "description": "Additional annotations for the Ingress resource.", + "default": {} + }, + "tls": { + "type": "boolean", + "description": "Enable TLS configuration for the host defined at `ingress.hostname` parameter", + "default": false + }, + "selfSigned": { + "type": "boolean", + "description": "Create a TLS secret for this ingress record using self-signed certificates generated by Helm", + "default": false + }, + "extraHosts": { + "type": "array", + "description": "An array with additional hostname(s) to be covered with the ingress record", + "default": [], + "items": {} + }, + "extraPaths": { + "type": "array", + "description": "An array with additional arbitrary paths that may need to be added to the ingress under the main host", + "default": [], + "items": {} + }, + "extraTls": { + "type": "array", + "description": "TLS configuration for additional hostname(s) to be covered with this ingress record", + "default": [], + "items": {} + }, + "secrets": { + "type": "array", + "description": "Custom TLS certificates as secrets", + "default": [], + "items": {} + }, + "extraRules": { + "type": "array", + "description": "Additional rules to be covered with this ingress record", + "default": [], + "items": {} + } + } + }, + "istio": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable creation of an Istio Gateway and VirtualService for frontend and backend", + "default": false + }, + "apiVersion": { + "type": "string", + "description": "The istio apiVersion to use for Gateway and VirtualService resources", + "default": "networking.istio.io/v1" + }, + "hosts": { + "type": "array", + "description": "One or more hosts exposed by Istio", + "default": [], + "items": {} + }, + "gateway": { + "type": "object", + "properties": { + "annotations": { + "type": "object", + "description": "Additional annotations for the Gateway resource", + "default": {} + }, + "http": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HTTP server port 80", + "default": true + }, + "httpsRedirect": { + "type": "boolean", + "description": "If set to true, a 301 redirect is send for all HTTP connections", + "default": false + } + } + }, + "https": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable HTTPS server on port 443", + "default": false + }, + "tlsCredentialName": { + "type": "string", + "description": "The name of the secret that holds the TLS certs including the CA certificates.", + "default": "" + } + } + }, + "extraServers": { + "type": "array", + "description": "Additional servers for the Gateway resource", + "default": [], + "items": {} + } + } + }, + "virtualService": { + "type": "object", + "properties": { + "annotations": { + "type": "object", + "description": "Additional annotations for the VirtualService resource.", + "default": {} + } + } + } + } + }, + "persistence": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable persistence using Persistent Volume Claims", + "default": true + }, + "apps": { + "type": "object", + "properties": { + "existingClaim": { + "type": "string", + "description": "Name of an existing PVC to use", + "default": "" + }, + "storageClass": { + "type": "string", + "description": "PVC Storage Class for shuffle-apps volume", + "default": "" + }, + "subPath": { + "type": "string", + "description": "The sub path used in the volume", + "default": "" + }, + "accessModes": { + "type": "array", + "description": "The access mode of the volume", + "default": [ + "ReadWriteOnce" + ], + "items": { + "type": "string" + } + }, + "size": { + "type": "string", + "description": "The size of the volume", + "default": "5Gi" + }, + "annotations": { + "type": "object", + "description": "Annotations for the PVC", + "default": {} + }, + "selector": { + "type": "object", + "description": "Selector to match an existing Persistent Volume", + "default": {} + } + } + }, + "appBuilder": { + "type": "object", + "properties": { + "storageClass": { + "type": "string", + "description": "PVC Storage Class for backend-apps-claim volume", + "default": "" + }, + "accessModes": { + "type": "array", + "description": "The access mode of the volume", + "default": [ + "ReadWriteOnce" + ], + "items": { + "type": "string" + } + }, + "size": { + "type": "string", + "description": "The size of the volume", + "default": "5Gi" + }, + "annotations": { + "type": "object", + "description": "Annotations for the PVC", + "default": {} + }, + "selector": { + "type": "object", + "description": "Selector to match an existing Persistent Volume", + "default": {} + } + } + }, + "files": { + "type": "object", + "properties": { + "existingClaim": { + "type": "string", + "description": "Name of an existing PVC to use", + "default": "" + }, + "storageClass": { + "type": "string", + "description": "PVC Storage Class for shuffle-files volume", + "default": "" + }, + "subPath": { + "type": "string", + "description": "The sub path used in the volume", + "default": "" + }, + "accessModes": { + "type": "array", + "description": "The access mode of the volume", + "default": [ + "ReadWriteOnce" + ], + "items": { + "type": "string" + } + }, + "size": { + "type": "string", + "description": "The size of the volume", + "default": "5Gi" + }, + "annotations": { + "type": "object", + "description": "Annotations for the PVC", + "default": {} + }, + "selector": { + "type": "object", + "description": "Selector to match an existing Persistent Volume", + "default": {} + } + } + } + } + }, + "volumePermissions": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup`", + "default": false + }, + "image": { + "type": "object", + "properties": { + "registry": { + "type": "string", + "description": "OS Shell + Utility image registry", + "default": "docker.io" + }, + "repository": { + "type": "string", + "description": "OS Shell + Utility image repository", + "default": "bitnami/os-shell" + }, + "pullPolicy": { + "type": "string", + "description": "OS Shell + Utility image pull policy", + "default": "IfNotPresent" + }, + "pullSecrets": { + "type": "array", + "description": "OS Shell + Utility image pull secrets", + "default": [], + "items": {} + } + } + }, + "resourcesPreset": { + "type": "string", + "description": "Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).", + "default": "nano" + }, + "resources": { + "type": "object", + "description": "Set init container requests and limits for different resources like CPU or memory (essential for production workloads)", + "default": {} + }, + "containerSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled init container' Security Context", + "default": true + }, + "runAsUser": { + "type": "number", + "description": "Set init container's Security Context runAsUser", + "default": 0 + } + } + } + } + }, + "opensearch": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Switch to enable or disable the opensearch helm chart", + "default": true + } + } + }, + "vault": { + "type": "object", + "properties": { + "role": { + "type": "string", + "description": "Specify the Vault role, which should be used to get the secret from Vault.", + "default": "" + }, + "secrets": { + "type": "array", + "description": "A list of VaultSecrets to create", + "default": [], + "items": {} + } + } + } + } +} \ No newline at end of file diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml new file mode 100644 index 00000000..0e551a45 --- /dev/null +++ b/charts/shuffle/values.yaml @@ -0,0 +1,1772 @@ +--- +## @section Global parameters +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass +## + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s) +## +global: + imageRegistry: "" + ## e.g: + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + defaultStorageClass: "" + ## Compatibility adaptations for Kubernetes platforms + ## + compatibility: + ## Compatibility adaptations for Openshift + ## + openshift: + ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) + ## + adaptSecurityContext: auto + ## @param global.compatibility.omitEmptySeLinuxOptions If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object + ## + omitEmptySeLinuxOptions: false + +## @section Common parameters +## + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.name +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname +## +fullnameOverride: "" +## @param namespaceOverride String to fully override common.names.namespace +## +namespaceOverride: "" +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} +## @param clusterDomain Kubernetes cluster domain name +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release +## +extraDeploy: [] +## Diagnostic mode +## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) +## @param diagnosticMode.command Command to override all containers in the chart release +## @param diagnosticMode.args Args to override all containers in the chart release +## +diagnosticMode: + enabled: false + command: + - sleep + args: + - infinity + +## @section Shared Shuffle Parameters +## +shuffle: + ## @param shuffle.baseUrl The external base URL under which Shuffle is reachable. + ## + baseUrl: "" + + ## ref: https://shuffler.io/docs/organizations + ## This chart only supports single-tenant deployments at the moment + ## @param shuffle.org Default shuffle organization + ## + org: Shuffle + + ## @param shuffle.appRegistry The registry from / to which shuffle apps are pulled / pushed + ## + appRegistry: "" + + ## @param shuffle.timezone The timezone used by Shuffle + ## + timezone: Europe/Berlin + +## @section backend Parameters +## +backend: + ## backend image + ## @param backend.image.registry backend image registry + ## @param backend.image.repository backend image repository + ## @skip backend.image.tag backend image tag (immutable tags are recommended) + ## @param backend.image.digest backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## @param backend.image.pullPolicy backend image pull policy + ## @param backend.image.pullSecrets backend image pull secrets + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-backend + tag: nightly + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param backend.replicaCount Number of backend replicas to deploy + ## + replicaCount: 1 + ## Configure extra options for backend containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param backend.livenessProbe.enabled Enable livenessProbe on backend containers + ## @param backend.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param backend.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param backend.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param backend.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param backend.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param backend.readinessProbe.enabled Enable readinessProbe on backend containers + ## @param backend.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param backend.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param backend.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param backend.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param backend.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param backend.startupProbe.enabled Enable startupProbe on backend containers + ## @param backend.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param backend.startupProbe.periodSeconds Period seconds for startupProbe + ## @param backend.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param backend.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param backend.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param backend.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param backend.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param backend.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## backend resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param backend.resourcesPreset Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## Shuffle gets OOM killed with 256M memory during startup. Up to 360MiB of memory usage were observed during testing. + ## The small preset grants 512M. + ## + resourcesPreset: "small" + ## @param backend.resources Set backend container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param backend.podSecurityContext.enabled Enable backend pods' Security Context + ## @param backend.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for backend pods + ## @param backend.podSecurityContext.sysctls Set kernel settings using the sysctl interface for backend pods + ## @param backend.podSecurityContext.supplementalGroups Set filesystem extra groups for backend pods + ## @param backend.podSecurityContext.fsGroup Set fsGroup in backend pods' Security Context + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param backend.containerSecurityContext.enabled Enabled backend container' Security Context + ## @param backend.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in backend container + ## @param backend.containerSecurityContext.runAsUser Set runAsUser in backend container' Security Context + ## @param backend.containerSecurityContext.runAsGroup Set runAsGroup in backend container' Security Context + ## @param backend.containerSecurityContext.runAsNonRoot Set runAsNonRoot in backend container' Security Context + ## @param backend.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in backend container' Security Context + ## @param backend.containerSecurityContext.privileged Set privileged in backend container' Security Context + ## @param backend.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in backend container' Security Context + ## @param backend.containerSecurityContext.capabilities.drop List of capabilities to be dropped in backend container + ## @param backend.containerSecurityContext.seccompProfile.type Set seccomp profile in backend container + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + + ## @param backend.command Override default backend container command (useful when using custom images) + ## + command: [] + ## @param backend.args Override default backend container args (useful when using custom images) + ## + args: [] + ## @param backend.automountServiceAccountToken Mount Service Account token in backend pods + ## NOTE: backend requires the service account credentials to be mounted + ## + automountServiceAccountToken: true + ## @param backend.hostAliases backend pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param backend.daemonsetAnnotations Annotations for backend daemonset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + daemonsetAnnotations: {} + ## @param backend.deploymentAnnotations Annotations for backend deployment + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param backend.statefulsetAnnotations Annotations for backend statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param backend.podLabels Extra labels for backend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param backend.podAnnotations Annotations for backend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param backend.podAffinityPreset Pod affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param backend.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node backend.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param backend.nodeAffinityPreset.type Node affinity preset type. Ignored if `backend.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param backend.nodeAffinityPreset.key Node label key to match. Ignored if `backend.affinity` is set + ## + key: "" + ## @param backend.nodeAffinityPreset.values Node label values to match. Ignored if `backend.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param backend.affinity Affinity for backend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `backend.podAffinityPreset`, `backend.podAntiAffinityPreset`, and `backend.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param backend.nodeSelector Node labels for backend pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param backend.tolerations Tolerations for backend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## ONLY FOR DEPLOYMENTS: + ## @param backend.updateStrategy.type backend deployment strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ONLY FOR STATEFULSETS: + ## @param backend.updateStrategy.type backend statefulset strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## ONLY FOR DEPLOYMENTS: + ## Can be set to RollingUpdate or Recreate + ## ONLY FOR STATEFULSETS: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## ONLY FOR STATEFULSETS: + ## @param backend.podManagementPolicy Pod management policy for backend statefulset + ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies + ## + podManagementPolicy: OrderedReady + ## @param backend.priorityClassName backend pods' priorityClassName + ## + priorityClassName: "" + ## @param backend.topologySpreadConstraints Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param backend.schedulerName Name of the k8s scheduler (other than default) for backend pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param backend.terminationGracePeriodSeconds Seconds backend pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param backend.lifecycleHooks for backend containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param backend.extraEnvVars Array with extra environment variables to add to backend containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param backend.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for backend containers + ## + extraEnvVarsCM: "" + ## @param backend.extraEnvVarsSecret Name of existing Secret containing extra env vars for backend containers + ## + extraEnvVarsSecret: "" + ## @param backend.extraVolumes Optionally specify extra list of additional volumes for the backend pods + ## + extraVolumes: [] + ## @param backend.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the backend containers + ## + extraVolumeMounts: [] + ## @param backend.sidecars Add additional sidecar containers to the backend pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param backend.initContainers Add additional init containers to the backend pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param backend.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param backend.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param backend.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `backend.pdb.minAvailable` and `backend.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param backend.autoscaling.vpa.enabled Enable VPA for backend pods + ## @param backend.autoscaling.vpa.annotations Annotations for VPA resource + ## @param backend.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param backend.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param backend.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param backend.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param backend.autoscaling.hpa.enabled Enable HPA for backend pods + ## @param backend.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param backend.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param backend.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param backend.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param backend.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param backend.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param backend.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param backend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## + automountServiceAccountToken: true + + ## RBAC configuration + ## + rbac: + ## @param backend.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param backend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param backend.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param backend.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param backend.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## NOTE: You likely want to allow access from your ingress, e.g.: + ## extraIngress: + ## - ports: + ## - protocol: TCP + ## port: 5001 + ## from: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-ingress + ## podSelector: + ## matchLabels: + ## istio: ingress + ## + extraIngress: [] + ## @param backend.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## NOTE: You likely want to allow access to OpenSearch and cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## - ports: + ## - protocol: TCP + ## port: 9200 + ## - protocol: TCP + ## port: 9300 + ## to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: shuffle + ## podSelector: + ## matchLabels: + ## app.kubernetes.io/name: opensearch + ## + extraEgress: [] + + ## @param backend.cleanupSchedule The interval in seconds at which the cleanup job runs + ## + cleanupSchedule: 300 + + ## OpenSearch configuration + ## + openSearch: + ## @param backend.openSearch.url The URL at which OpenSearch is available + ## + url: "http://{{ .Release.Name }}-opensearch:9200" + ## @param backend.openSearch.username The username that is used for authenticating with OpenSearch + ## + username: admin + ## @param backend.openSearch.certificateFile The path to a custom OpenSearch certificate file + ## + certificateFile: "" + ## @param backend.openSearch.skipSSLVerify Skip SSL verification + ## + skipSSLVerify: false + ## @param backend.openSearch.indexPrefix A prefix for OpenSearch indices + ## + indexPrefix: "" + + ## App configuration + ## + apps: + ## @param backend.apps.downloadLocation The location to a git repository from which default appps are downloaded on startup. + ## + downloadLocation: https://github.com/shuffle/python-apps + ## @param backend.apps.downloadBranch The branch from which apps should be downloaded on startup. + ## + downloadBranch: master + ## @param backend.apps.forceUpdate Force an update of apps on startup. + ## + forceUpdate: false + +## @section frontend Parameters +## +frontend: + ## frontend image + ## @param frontend.image.registry frontend image registry + ## @param frontend.image.repository frontend image repository + ## @skip frontend.image.tag frontend image tag (immutable tags are recommended) + ## @param frontend.image.digest frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## @param frontend.image.pullPolicy frontend image pull policy + ## @param frontend.image.pullSecrets frontend image pull secrets + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-frontend + tag: nightly + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param frontend.replicaCount Number of frontend replicas to deploy + ## + replicaCount: 1 + ## Configure extra options for frontend containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param frontend.livenessProbe.enabled Enable livenessProbe on frontend containers + ## @param frontend.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param frontend.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param frontend.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param frontend.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param frontend.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param frontend.readinessProbe.enabled Enable readinessProbe on frontend containers + ## @param frontend.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param frontend.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param frontend.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param frontend.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param frontend.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param frontend.startupProbe.enabled Enable startupProbe on frontend containers + ## @param frontend.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param frontend.startupProbe.periodSeconds Period seconds for startupProbe + ## @param frontend.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param frontend.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param frontend.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param frontend.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param frontend.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param frontend.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## frontend resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param frontend.resourcesPreset Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param frontend.resources Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param frontend.podSecurityContext.enabled Enable frontend pods' Security Context + ## @param frontend.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for frontend pods + ## @param frontend.podSecurityContext.sysctls Set kernel settings using the sysctl interface for frontend pods + ## @param frontend.podSecurityContext.supplementalGroups Set filesystem extra groups for frontend pods + ## @param frontend.podSecurityContext.fsGroup Set fsGroup in frontend pods' Security Context + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param frontend.containerSecurityContext.enabled Enabled frontend container' Security Context + ## @param frontend.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in frontend container + ## @param frontend.containerSecurityContext.runAsUser Set runAsUser in frontend container' Security Context + ## @param frontend.containerSecurityContext.runAsGroup Set runAsGroup in frontend container' Security Context + ## @param frontend.containerSecurityContext.runAsNonRoot Set runAsNonRoot in frontend container' Security Context + ## @param frontend.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in frontend container' Security Context + ## @param frontend.containerSecurityContext.privileged Set privileged in frontend container' Security Context + ## @param frontend.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in frontend container' Security Context + ## @param frontend.containerSecurityContext.capabilities.drop List of capabilities to be dropped in frontend container + ## @param frontend.containerSecurityContext.seccompProfile.type Set seccomp profile in frontend container + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 101 + runAsGroup: 101 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + + ## @param frontend.command Override default frontend container command (useful when using custom images) + ## + command: [] + ## @param frontend.args Override default frontend container args (useful when using custom images) + ## + args: [] + ## @param frontend.automountServiceAccountToken Mount Service Account token in frontend pods + ## + automountServiceAccountToken: false + ## @param frontend.hostAliases frontend pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param frontend.daemonsetAnnotations Annotations for frontend daemonset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + daemonsetAnnotations: {} + ## @param frontend.deploymentAnnotations Annotations for frontend deployment + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param frontend.statefulsetAnnotations Annotations for frontend statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param frontend.podLabels Extra labels for frontend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param frontend.podAnnotations Annotations for frontend pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param frontend.podAffinityPreset Pod affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param frontend.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node frontend.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param frontend.nodeAffinityPreset.type Node affinity preset type. Ignored if `frontend.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param frontend.nodeAffinityPreset.key Node label key to match. Ignored if `frontend.affinity` is set + ## + key: "" + ## @param frontend.nodeAffinityPreset.values Node label values to match. Ignored if `frontend.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param frontend.affinity Affinity for frontend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `frontend.podAffinityPreset`, `frontend.podAntiAffinityPreset`, and `frontend.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param frontend.nodeSelector Node labels for frontend pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param frontend.tolerations Tolerations for frontend pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## ONLY FOR DEPLOYMENTS: + ## @param frontend.updateStrategy.type frontend deployment strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ONLY FOR STATEFULSETS: + ## @param frontend.updateStrategy.type frontend statefulset strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## ONLY FOR DEPLOYMENTS: + ## Can be set to RollingUpdate or Recreate + ## ONLY FOR STATEFULSETS: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## ONLY FOR STATEFULSETS: + ## @param frontend.podManagementPolicy Pod management policy for frontend statefulset + ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies + ## + podManagementPolicy: OrderedReady + ## @param frontend.priorityClassName frontend pods' priorityClassName + ## + priorityClassName: "" + ## @param frontend.topologySpreadConstraints Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param frontend.schedulerName Name of the k8s scheduler (other than default) for frontend pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param frontend.terminationGracePeriodSeconds Seconds frontend pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param frontend.lifecycleHooks for frontend containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param frontend.extraEnvVars Array with extra environment variables to add to frontend containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param frontend.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for frontend containers + ## + extraEnvVarsCM: "" + ## @param frontend.extraEnvVarsSecret Name of existing Secret containing extra env vars for frontend containers + ## + extraEnvVarsSecret: "" + ## @param frontend.extraVolumes Optionally specify extra list of additional volumes for the frontend pods + ## + extraVolumes: [] + ## @param frontend.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the frontend containers + ## + extraVolumeMounts: [] + ## @param frontend.sidecars Add additional sidecar containers to the frontend pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param frontend.initContainers Add additional init containers to the frontend pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param frontend.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param frontend.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param frontend.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `frontend.pdb.minAvailable` and `frontend.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param frontend.autoscaling.vpa.enabled Enable VPA for frontend pods + ## @param frontend.autoscaling.vpa.annotations Annotations for VPA resource + ## @param frontend.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param frontend.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param frontend.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param frontend.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param frontend.autoscaling.hpa.enabled Enable HPA for frontend pods + ## @param frontend.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param frontend.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param frontend.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param frontend.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param frontend.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param frontend.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param frontend.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param frontend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## + automountServiceAccountToken: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param frontend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param frontend.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param frontend.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param frontend.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## NOTE: You likely want to allow access from your ingress, e.g.: + ## extraIngress: + ## - ports: + ## - protocol: TCP + ## port: 5001 + ## from: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-ingress + ## podSelector: + ## matchLabels: + ## istio: ingress + ## + extraIngress: [] + ## @param frontend.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## + extraEgress: [] + +## @section orborus Parameters +## +orborus: + ## orborus image + ## @param orborus.image.registry orborus image registry + ## @param orborus.image.repository orborus image repository + ## @skip orborus.image.tag orborus image tag (immutable tags are recommended) + ## @param orborus.image.digest orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## @param orborus.image.pullPolicy orborus image pull policy + ## @param orborus.image.pullSecrets orborus image pull secrets + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-orborus + tag: nightly + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param orborus.replicaCount Number of orborus replicas to deploy + ## + replicaCount: 1 + ## Configure extra options for orborus containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param orborus.livenessProbe.enabled Enable livenessProbe on orborus containers + ## @param orborus.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param orborus.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param orborus.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param orborus.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param orborus.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 15 + timeoutSeconds: 1 + failureThreshold: 4 + successThreshold: 1 + ## @param orborus.readinessProbe.enabled Enable readinessProbe on orborus containers + ## @param orborus.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param orborus.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param orborus.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param orborus.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param orborus.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param orborus.startupProbe.enabled Enable startupProbe on orborus containers + ## @param orborus.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param orborus.startupProbe.periodSeconds Period seconds for startupProbe + ## @param orborus.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param orborus.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param orborus.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 1 + failureThreshold: 60 + successThreshold: 1 + ## @param orborus.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param orborus.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param orborus.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## orborus resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param orborus.resourcesPreset Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param orborus.resources Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param orborus.podSecurityContext.enabled Enable orborus pods' Security Context + ## @param orborus.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for orborus pods + ## @param orborus.podSecurityContext.sysctls Set kernel settings using the sysctl interface for orborus pods + ## @param orborus.podSecurityContext.supplementalGroups Set filesystem extra groups for orborus pods + ## @param orborus.podSecurityContext.fsGroup Set fsGroup in orborus pods' Security Context + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param orborus.containerSecurityContext.enabled Enabled orborus container' Security Context + ## @param orborus.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in orborus container + ## @param orborus.containerSecurityContext.runAsUser Set runAsUser in orborus container' Security Context + ## @param orborus.containerSecurityContext.runAsGroup Set runAsGroup in orborus container' Security Context + ## @param orborus.containerSecurityContext.runAsNonRoot Set runAsNonRoot in orborus container' Security Context + ## @param orborus.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in orborus container' Security Context + ## @param orborus.containerSecurityContext.privileged Set privileged in orborus container' Security Context + ## @param orborus.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in orborus container' Security Context + ## @param orborus.containerSecurityContext.capabilities.drop List of capabilities to be dropped in orborus container + ## @param orborus.containerSecurityContext.seccompProfile.type Set seccomp profile in orborus container + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 101 + runAsGroup: 101 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + + ## @param orborus.command Override default orborus container command (useful when using custom images) + ## + command: [] + ## @param orborus.args Override default orborus container args (useful when using custom images) + ## + args: [] + ## @param orborus.automountServiceAccountToken Mount Service Account token in orborus pods + ## NOTE: orborus requires the service account credentials to be mounted + ## + automountServiceAccountToken: true + ## @param orborus.hostAliases orborus pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param orborus.daemonsetAnnotations Annotations for orborus daemonset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + daemonsetAnnotations: {} + ## @param orborus.deploymentAnnotations Annotations for orborus deployment + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + deploymentAnnotations: {} + ## @param orborus.statefulsetAnnotations Annotations for orborus statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param orborus.podLabels Extra labels for orborus pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param orborus.podAnnotations Annotations for orborus pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param orborus.podAffinityPreset Pod affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param orborus.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node orborus.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param orborus.nodeAffinityPreset.type Node affinity preset type. Ignored if `orborus.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param orborus.nodeAffinityPreset.key Node label key to match. Ignored if `orborus.affinity` is set + ## + key: "" + ## @param orborus.nodeAffinityPreset.values Node label values to match. Ignored if `orborus.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param orborus.affinity Affinity for orborus pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `orborus.podAffinityPreset`, `orborus.podAntiAffinityPreset`, and `orborus.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param orborus.nodeSelector Node labels for orborus pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param orborus.tolerations Tolerations for orborus pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## ONLY FOR DEPLOYMENTS: + ## @param orborus.updateStrategy.type orborus deployment strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ONLY FOR STATEFULSETS: + ## @param orborus.updateStrategy.type orborus statefulset strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## ONLY FOR DEPLOYMENTS: + ## Can be set to RollingUpdate or Recreate + ## ONLY FOR STATEFULSETS: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## ONLY FOR STATEFULSETS: + ## @param orborus.podManagementPolicy Pod management policy for orborus statefulset + ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies + ## + podManagementPolicy: OrderedReady + ## @param orborus.priorityClassName orborus pods' priorityClassName + ## + priorityClassName: "" + ## @param orborus.topologySpreadConstraints Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param orborus.schedulerName Name of the k8s scheduler (other than default) for orborus pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param orborus.terminationGracePeriodSeconds Seconds orborus pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param orborus.lifecycleHooks for orborus containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param orborus.extraEnvVars Array with extra environment variables to add to orborus containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param orborus.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for orborus containers + ## + extraEnvVarsCM: "" + ## @param orborus.extraEnvVarsSecret Name of existing Secret containing extra env vars for orborus containers + ## + extraEnvVarsSecret: "" + ## @param orborus.extraVolumes Optionally specify extra list of additional volumes for the orborus pods + ## + extraVolumes: [] + ## @param orborus.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the orborus containers + ## + extraVolumeMounts: [] + ## @param orborus.sidecars Add additional sidecar containers to the orborus pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param orborus.initContainers Add additional init containers to the orborus pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param orborus.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param orborus.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param orborus.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `orborus.pdb.minAvailable` and `orborus.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param orborus.autoscaling.vpa.enabled Enable VPA for orborus pods + ## @param orborus.autoscaling.vpa.annotations Annotations for VPA resource + ## @param orborus.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param orborus.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param orborus.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param orborus.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param orborus.autoscaling.hpa.enabled Enable HPA for orborus pods + ## @param orborus.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param orborus.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param orborus.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param orborus.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param orborus.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param orborus.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param orborus.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param orborus.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## + automountServiceAccountToken: true + + ## RBAC configuration + ## + rbac: + ## @param orborus.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param orborus.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param orborus.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param orborus.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param orborus.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: [] + ## @param orborus.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## NOTE: You likely want to allow access to cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## + extraEgress: [] + +## @section worker Parameters +## +worker: + ## worker image + ## @param worker.image.registry worker image registry + ## @param worker.image.repository worker image repository + ## @skip worker.image.tag worker image tag (immutable tags are recommended) + ## @param worker.image.digest worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) + ## + image: + registry: ghcr.io + repository: shuffle/shuffle-worker + tag: nightly + digest: "" + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param worker.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param worker.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param worker.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param worker.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## + automountServiceAccountToken: true + + ## RBAC configuration + ## + rbac: + ## @param worker.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param worker.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param worker.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param worker.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param worker.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: [] + ## @param worker.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## NOTE: You likely want to allow access to cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## + extraEgress: [] + +## @section app Parameters +## +app: + ## ServiceAccount configuration + ## + serviceAccount: + ## @param app.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param app.serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param app.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param app.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## NOTE: You likely want to allow access to cluster-proxies, e.g: + ## extraEgress: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## kubernetes.io/metadata.name: istio-system + ## podSelector: + ## matchLabels: + ## istio: pilot + ## + automountServiceAccountToken: true + + ## RBAC configuration + ## + rbac: + ## @param app.rbac.create Specifies whether RBAC resources should be created + create: true + + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param app.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param app.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param app.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param app.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: [] + ## @param app.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## + extraEgress: [] + +## @section Traffic Exposure Parameters +## + +## ingress parameters +## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/ +## +ingress: + ## @param ingress.enabled Enable ingress record generation for frontend and backend + ## + enabled: false + ## @param ingress.pathType Ingress path type for the frontend path + ## + pathType: Prefix + ## @param ingress.backendPathType Ingress path type for the backend path + ## + backendPathType: Prefix + ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) + ## + apiVersion: "" + ## @param ingress.hostname Default host for the ingress record + ## + hostname: shuffle.local + ## @param ingress.ingressClassName [default: nginx] IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) + ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster . + ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ + ## + ingressClassName: "" + ## @param ingress.path [default: "/"] Ingress path for Shuffle frontend + ## NOTE: The shuffle frontend currently does not support using base paths + ## + path: / + ## @param ingress.backendPath [default: "/api/"] Ingress path for Shuffle backend + ## NOTE: The shuffle backend is currently required to be reachable at shuffle-frontend.example.com/api/ + ## + backendPath: /api/ + ## @param ingress.annotations Additional annotations for the Ingress resource. + ## + annotations: {} + ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter + ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}` + ## You can: + ## - Use the `ingress.secrets` parameter to create this TLS secret + ## - Rely on cert-manager to create it by setting the corresponding annotations + ## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true` + ## + tls: false + ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm + ## + selfSigned: false + ## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record + ## e.g: + ## extraHosts: + ## - name: example.local + ## path: / + ## + extraHosts: [] + ## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host + ## e.g: + ## extraPaths: + ## - path: /* + ## backend: + ## serviceName: ssl-redirect + ## servicePort: use-annotation + ## + extraPaths: [] + ## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## e.g: + ## extraTls: + ## - hosts: + ## - example.local + ## secretName: example.local-tls + ## + extraTls: [] + ## @param ingress.secrets Custom TLS certificates as secrets + ## NOTE: 'key' and 'certificate' are expected in PEM format + ## NOTE: 'name' should line up with a 'secretName' set further up + ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates + ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## e.g: + ## secrets: + ## - name: example.local-tls + ## key: |- + ## -----BEGIN RSA PRIVATE KEY----- + ## ... + ## -----END RSA PRIVATE KEY----- + ## certificate: |- + ## -----BEGIN CERTIFICATE----- + ## ... + ## -----END CERTIFICATE----- + ## + secrets: [] + ## @param ingress.extraRules Additional rules to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules + ## e.g: + ## extraRules: + ## - host: example.local + ## http: + ## path: / + ## backend: + ## service: + ## name: example-svc + ## port: + ## name: http + ## + extraRules: [] + +## @section Istio Parameters +## +istio: + ## @param istio.enabled Enable creation of an Istio Gateway and VirtualService for frontend and backend + ## + enabled: false + + ## @param istio.apiVersion The istio apiVersion to use for Gateway and VirtualService resources + ## + apiVersion: networking.istio.io/v1 + + ## @param istio.hosts One or more hosts exposed by Istio + ## + hosts: [] + + gateway: + ## @param istio.gateway.annotations Additional annotations for the Gateway resource + ## + annotations: {} + ## @param istio.gateway.selector [object, default: { istio: ingress }] The selector matches the ingress gateway pod labels + ## + selector: + istio: ingress + ## @param istio.gateway.http.enabled Enable HTTP server port 80 + ## @param istio.gateway.http.httpsRedirect If set to true, a 301 redirect is send for all HTTP connections + ## + http: + enabled: true + httpsRedirect: false + ## @param istio.gateway.https.enabled Enable HTTPS server on port 443 + ## @param istio.gateway.https.tlsCredentialName The name of the secret that holds the TLS certs including the CA certificates. + ## NOTE: The secret must exist in the namespace of the istio gateway pod + https: + enabled: false + tlsCredentialName: "" + ## @param istio.gateway.extraServers Additional servers for the Gateway resource + ## ref: https://istio.io/latest/docs/reference/config/networking/gateway/#Server + extraServers: [] + + virtualService: + ## @param istio.virtualService.annotations Additional annotations for the VirtualService resource. + ## + annotations: {} + +## @section Persistence Parameters +## + +## Enable persistence using Persistent Volume Claims +## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/ +## +persistence: + ## @param persistence.enabled Enable persistence using Persistent Volume Claims + ## + enabled: true + + ## @param persistence.apps.existingClaim Name of an existing PVC to use + ## @param persistence.apps.storageClass PVC Storage Class for shuffle-apps volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning + ## @param persistence.apps.subPath The sub path used in the volume + ## @param persistence.apps.accessModes The access mode of the volume + ## @param persistence.apps.size The size of the volume + ## @param persistence.apps.annotations Annotations for the PVC + ## @param persistence.apps.selector Selector to match an existing Persistent Volume + apps: + existingClaim: "" + storageClass: "" + subPath: "" + accessModes: + - ReadWriteOnce + size: 5Gi + annotations: {} + selector: {} + + ## @param persistence.appBuilder.storageClass PVC Storage Class for backend-apps-claim volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning + ## @param persistence.appBuilder.accessModes The access mode of the volume + ## @param persistence.appBuilder.size The size of the volume + ## @param persistence.appBuilder.annotations Annotations for the PVC + ## @param persistence.appBuilder.selector Selector to match an existing Persistent Volume + appBuilder: + storageClass: "" + accessModes: + - ReadWriteOnce + size: 5Gi + annotations: {} + selector: {} + + ## @param persistence.files.existingClaim Name of an existing PVC to use + ## @param persistence.files.storageClass PVC Storage Class for shuffle-files volume + ## Note: The default StorageClass will be used if not defined. Set it to `-` to disable dynamic provisioning + ## @param persistence.files.subPath The sub path used in the volume + ## @param persistence.files.accessModes The access mode of the volume + ## @param persistence.files.size The size of the volume + ## @param persistence.files.annotations Annotations for the PVC + ## @param persistence.files.selector Selector to match an existing Persistent Volume + files: + existingClaim: "" + storageClass: "" + subPath: "" + accessModes: + - ReadWriteOnce + size: 5Gi + annotations: {} + selector: {} + +## @section Init Container Parameters +## + +## 'volumePermissions' init container parameters +## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values +## based on the *podSecurityContext/*containerSecurityContext parameters +## +volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` + ## + enabled: false + ## OS Shell + Utility image + ## ref: https://hub.docker.com/r/bitnami/os-shell/tags/ + ## @param volumePermissions.image.registry OS Shell + Utility image registry + ## @param volumePermissions.image.repository OS Shell + Utility image repository + ## @skip volumePermissions.image.tag OS Shell + Utility image tag (immutable tags are recommended) + ## @param volumePermissions.image.pullPolicy OS Shell + Utility image pull policy + ## @param volumePermissions.image.pullSecrets OS Shell + Utility image pull secrets + ## + image: + registry: docker.io + repository: bitnami/os-shell + tag: 12-debian-12-r30 + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Init container's resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param volumePermissions.resourcesPreset Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param volumePermissions.resources Set init container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Init container Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param volumePermissions.containerSecurityContext.enabled Enabled init container' Security Context + ## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in init container + ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser + ## NOTE: when runAsUser is set to special value "auto", init container will try to chown the + ## data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` + ## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed) + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 0 + +## @section OpenSearch Parameters +## + +## OpenSearch chart configuration +## ref: https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml +## @param opensearch.enabled Switch to enable or disable the opensearch helm chart +## +opensearch: + enabled: true + +## @section Vault Parameters +## + +vault: + ## @param vault.role Specify the Vault role, which should be used to get the secret from Vault. + ## NOTE: This value is used as a default for all secrets and can be overwritten for individual secrets + ## with the vaultRole property. + ## + role: "" + + ## @param vault.secrets A list of VaultSecrets to create + ## NOTE: 'type', 'name' and 'path' must be set + ## type is the type of the Kubernetes secret + ## name is the suffix of the name of the resulting (Vault)Secret + ## path is the path of the corresponding secret in Vault + ## Additional VaultSecret parameters can optionally be set. + ## Ref: https://github.com/ricoberger/vault-secrets-operator/blob/0409d56beb36ab95c4582a0cc35c0a2b517961e7/api/v1alpha1/vaultsecret_types.go#L9-L59 + ## e.g: + ## secrets: + ## - type: Opaque + ## name: "example" + ## path: "example/secret" + ## + secrets: [] +## @section Other Parameters +## From 00cfa0bb4494ade5fd50d255da3fad68badfc1ec Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Thu, 2 Jan 2025 09:07:18 +0100 Subject: [PATCH 02/13] disable security contexts for frontend by default Incompatible with official shuffle frontend image Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index 0e551a45..daa4ec9a 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -656,7 +656,7 @@ frontend: ## @param frontend.podSecurityContext.fsGroup Set fsGroup in frontend pods' Security Context ## podSecurityContext: - enabled: true + enabled: false fsGroupChangePolicy: Always sysctls: [] supplementalGroups: [] @@ -675,7 +675,7 @@ frontend: ## @param frontend.containerSecurityContext.seccompProfile.type Set seccomp profile in frontend container ## containerSecurityContext: - enabled: true + enabled: false seLinuxOptions: {} runAsUser: 101 runAsGroup: 101 From 95949415f399cd770dfb0920a7928a030179f2f3 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Thu, 2 Jan 2025 09:07:45 +0100 Subject: [PATCH 03/13] update README Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 60 ++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 27 deletions(-) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 5b5ebe55..2dd62129 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -17,45 +17,52 @@ SPDX-License-Identifier: APACHE-2.0 ## Usage ```sh -# Lint chart -helm lint . - -# Package chart -helm package . - # Install (the shuffle namespace is hardcoded into the shuffle source code) -helm install shuffle oci://TODO -n shuffle +helm install shuffle oci://TODO --namespace shuffle --create-namespace ``` ## Secret Parameters The helm chart was designed to not contain any secret data and does not allow configuring secret data using helm values. -Instead, secret values must be passed to services using `extraEnvVarsSecret`. The secrets need to be manually created. +Instead, secret values must be passed to services using `extraEnvVarsSecret` or `extraEnvVars`. -### Creating secrets using vault-secrets-operator - -If you are using [vault-secret-operator by Rico Berger](https://github.com/ricoberger/vault-secrets-operator), -then you can create VaultSecret resources via Helm. -Note that the resulting (Vault)Secret is prefixed with the release name of the chart. - -```yaml -vault: - secrets: - - name: backend-env - type: Opaque - path: shuffle/backend/env -``` +The secrets need to be manually created. It is possible to run this helm chart without specifying any secrets. +You will be prompted to create an admin user when visiting the shuffle dashboard for the first time. +Note that information will not be encrypted without specifying the `SHUFFLE_ENCRYPTION_MODIFIER` value. ### Mounting env variables into a service -After creating a secret which holds the environment variables (either manually or via a VaultSecret), you can then -use that secret to mount environment variables into a service via the `extraEnvVarsSecret` value. - -You can use helm templates for generating the secret name as shown in the example below. +After creating secrets which hold sensitive information, you can mount them as environment variables into a +service via the `extraEnvVarsSecret` or `extraEnvVars` values. ```yaml backend: - extraEnvVarsSecret: "{{ include \"common.names.fullname\" . }}-backend-env" + # Use a single secret, which holds environment variables. + # Remember that the secret keys must exactly match the environment variable names. + extraEnvVarsSecret: shuffle-backend-env + + # Or mount each value explicitly + extraEnvVars: + - name: SHUFFLE_DEFAULT_USERNAME + valueFrom: + secretKeyRef: + name: "shuffle-initial-user" + key: username + - name: SHUFFLE_DEFAULT_PASSWORD + valueFrom: + secretKeyRef: + name: "shuffle-initial-user" + key: password + - name: SHUFFLE_DEFAULT_APIKEY + valueFrom: + secretKeyRef: + name: "shuffle-initial-user" + key: apikey + - name: SHUFFLE_ENCRYPTION_MODIFIER + valueFrom: + secretKeyRef: + name: "shuffle-encryption" + key: modifier ``` ### Backend @@ -567,4 +574,3 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `vault.secrets` | A list of VaultSecrets to create | `[]` | ### Other Parameters - From 2980fba8c7d8e3d03b55e7a8a04aa45ad3e3e50d Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Thu, 2 Jan 2025 09:09:36 +0100 Subject: [PATCH 04/13] allow to change container ports, fix default frontend ports Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 12 +++- .../templates/backend/backend-dpl.yaml | 11 ++-- .../backend/backend-network-policy.yaml | 2 +- .../templates/backend/backend-svc.yaml | 2 +- .../templates/frontend/frontend-dpl.yaml | 15 +++-- .../frontend/frontend-network-policy.yaml | 5 +- .../templates/frontend/frontend-svc.yaml | 8 ++- .../templates/istio/virtual-service.yaml | 4 +- .../orborus-worker-network-policy.yaml | 4 +- .../templates/orborus/orborus-dpl.yaml | 11 ++-- .../orborus/orborus-network-policy.yaml | 4 +- charts/shuffle/values.schema.json | 57 ++++++++++++++++++- charts/shuffle/values.yaml | 35 ++++++++++++ 13 files changed, 144 insertions(+), 26 deletions(-) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 2dd62129..3c713a6c 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -137,6 +137,8 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `backend.image.pullPolicy` | backend image pull policy | `IfNotPresent` | | `backend.image.pullSecrets` | backend image pull secrets | `[]` | | `backend.replicaCount` | Number of backend replicas to deploy | `1` | +| `backend.containerPorts.http` | backend HTTP container port | `5001` | +| `backend.extraContainerPorts` | Optionally specify extra list of additional ports for backend containers | `[]` | | `backend.livenessProbe.enabled` | Enable livenessProbe on backend containers | `false` | | `backend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | | `backend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | @@ -251,6 +253,9 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `frontend.image.pullPolicy` | frontend image pull policy | `IfNotPresent` | | `frontend.image.pullSecrets` | frontend image pull secrets | `[]` | | `frontend.replicaCount` | Number of frontend replicas to deploy | `1` | +| `frontend.containerPorts.http` | frontend HTTP container port | `80` | +| `frontend.containerPorts.https` | frontend HTTPS container port | `443` | +| `frontend.extraContainerPorts` | Optionally specify extra list of additional ports for frontend containers | `[]` | | `frontend.livenessProbe.enabled` | Enable livenessProbe on frontend containers | `false` | | `frontend.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | | `frontend.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | @@ -274,12 +279,12 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `frontend.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | | `frontend.resourcesPreset` | Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). | `nano` | | `frontend.resources` | Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `true` | +| `frontend.podSecurityContext.enabled` | Enable frontend pods' Security Context | `false` | | `frontend.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for frontend pods | `Always` | | `frontend.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for frontend pods | `[]` | | `frontend.podSecurityContext.supplementalGroups` | Set filesystem extra groups for frontend pods | `[]` | | `frontend.podSecurityContext.fsGroup` | Set fsGroup in frontend pods' Security Context | `1001` | -| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `true` | +| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `false` | | `frontend.containerSecurityContext.seLinuxOptions` | Set SELinux options in frontend container | `{}` | | `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `101` | | `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `101` | @@ -355,6 +360,8 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `orborus.image.pullPolicy` | orborus image pull policy | `IfNotPresent` | | `orborus.image.pullSecrets` | orborus image pull secrets | `[]` | | `orborus.replicaCount` | Number of orborus replicas to deploy | `1` | +| `orborus.containerPorts.http` | orborus HTTP container port | `8080` | +| `orborus.extraContainerPorts` | Optionally specify extra list of additional ports for orborus containers | `[]` | | `orborus.livenessProbe.enabled` | Enable livenessProbe on orborus containers | `false` | | `orborus.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | | `orborus.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` | @@ -574,3 +581,4 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `vault.secrets` | A list of VaultSecrets to create | `[]` | ### Other Parameters + diff --git a/charts/shuffle/templates/backend/backend-dpl.yaml b/charts/shuffle/templates/backend/backend-dpl.yaml index 8a4cfc36..ecf52e20 100644 --- a/charts/shuffle/templates/backend/backend-dpl.yaml +++ b/charts/shuffle/templates/backend/backend-dpl.yaml @@ -144,7 +144,10 @@ spec: {{- end }} ports: - name: http - containerPort: 5001 + containerPort: {{ .Values.backend.containerPorts.http }} + {{- if .Values.backend.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.backend.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.backend.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customLivenessProbe "context" $) | nindent 12 }} @@ -152,7 +155,7 @@ spec: livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /api/v1/health - port: 5001 + port: {{ .Values.backend.containerPorts.http }} {{- end }} {{- if .Values.backend.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customReadinessProbe "context" $) | nindent 12 }} @@ -160,7 +163,7 @@ spec: readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /api/v1/health - port: 5001 + port: {{ .Values.backend.containerPorts.http }} {{- end }} {{- if .Values.backend.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.backend.customStartupProbe "context" $) | nindent 12 }} @@ -168,7 +171,7 @@ spec: startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.backend.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /api/v1/health - port: 5001 + port: {{ .Values.backend.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.backend.lifecycleHooks }} diff --git a/charts/shuffle/templates/backend/backend-network-policy.yaml b/charts/shuffle/templates/backend/backend-network-policy.yaml index 47d7bd3b..48010706 100644 --- a/charts/shuffle/templates/backend/backend-network-policy.yaml +++ b/charts/shuffle/templates/backend/backend-network-policy.yaml @@ -35,7 +35,7 @@ spec: {{- end }} ingress: - ports: - - port: 5001 + - port: {{ .Values.backend.containerPorts.http }} protocol: TCP {{- if not .Values.backend.networkPolicy.allowExternal }} from: diff --git a/charts/shuffle/templates/backend/backend-svc.yaml b/charts/shuffle/templates/backend/backend-svc.yaml index c41aa3bb..18328899 100644 --- a/charts/shuffle/templates/backend/backend-svc.yaml +++ b/charts/shuffle/templates/backend/backend-svc.yaml @@ -11,7 +11,7 @@ spec: type: ClusterIP ports: - name: http - port: 5001 + port: {{ .Values.backend.containerPorts.http }} targetPort: http protocol: TCP {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }} diff --git a/charts/shuffle/templates/frontend/frontend-dpl.yaml b/charts/shuffle/templates/frontend/frontend-dpl.yaml index 659167df..b3a68dbb 100644 --- a/charts/shuffle/templates/frontend/frontend-dpl.yaml +++ b/charts/shuffle/templates/frontend/frontend-dpl.yaml @@ -103,7 +103,14 @@ spec: {{- end }} ports: - name: http - containerPort: 8080 + containerPort: {{ .Values.frontend.containerPorts.http }} + {{- if .Values.frontend.containerPorts.https }} + - name: https + containerPort: {{ .Values.frontend.containerPorts.https }} + {{- end }} + {{- if .Values.frontend.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.frontend.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.frontend.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customLivenessProbe "context" $) | nindent 12 }} @@ -111,7 +118,7 @@ spec: livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} {{- end }} {{- if .Values.frontend.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customReadinessProbe "context" $) | nindent 12 }} @@ -119,7 +126,7 @@ spec: readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} {{- end }} {{- if .Values.frontend.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.customStartupProbe "context" $) | nindent 12 }} @@ -127,7 +134,7 @@ spec: startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.frontend.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.frontend.lifecycleHooks }} diff --git a/charts/shuffle/templates/frontend/frontend-network-policy.yaml b/charts/shuffle/templates/frontend/frontend-network-policy.yaml index b8143312..9082535b 100644 --- a/charts/shuffle/templates/frontend/frontend-network-policy.yaml +++ b/charts/shuffle/templates/frontend/frontend-network-policy.yaml @@ -36,7 +36,10 @@ spec: ingress: {{ if .Values.frontend.networkPolicy.allowExternal }} - ports: - - port: 8080 + - port: {{ .Values.frontend.containerPorts.http }} + {{- if .Values.frontend.containerPorts.https }} + - port: {{ .Values.frontend.containerPorts.https }} + {{- end }} {{- end }} {{- if .Values.frontend.networkPolicy.extraIngress }} {{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }} diff --git a/charts/shuffle/templates/frontend/frontend-svc.yaml b/charts/shuffle/templates/frontend/frontend-svc.yaml index 8a5ca84c..76851c0a 100644 --- a/charts/shuffle/templates/frontend/frontend-svc.yaml +++ b/charts/shuffle/templates/frontend/frontend-svc.yaml @@ -11,8 +11,14 @@ spec: type: ClusterIP ports: - name: http - port: 8080 + port: {{ .Values.frontend.containerPorts.http }} targetPort: http protocol: TCP + {{- if .Values.frontend.containerPorts.https }} + - name: https + port: {{ .Values.frontend.containerPorts.https }} + targetPort: https + protocol: TCP + {{- end }} {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }} selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/istio/virtual-service.yaml b/charts/shuffle/templates/istio/virtual-service.yaml index ed74004b..902a1583 100644 --- a/charts/shuffle/templates/istio/virtual-service.yaml +++ b/charts/shuffle/templates/istio/virtual-service.yaml @@ -21,10 +21,10 @@ spec: - destination: host: {{ include "shuffle.backend.name" . }} port: - number: 5001 + number: {{ .Values.backend.containerPorts.http }} - route: - destination: host: {{ include "shuffle.frontend.name" . }} port: - number: 8080 + number: {{ .Values.frontend.containerPorts.http }} {{- end }} diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml b/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml index f4ee4aba..1b07d9a9 100644 --- a/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml +++ b/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml @@ -28,10 +28,10 @@ spec: to: - namespaceSelector: matchLabels: - kubernetes.io/metadata.name: kube-system + kubernetes.io/metadata.name: kube-system # Allow access to orborus - ports: - - port: 8080 + - port: {{ .Values.orborus.containerPorts.http }} protocol: TCP to: - namespaceSelector: diff --git a/charts/shuffle/templates/orborus/orborus-dpl.yaml b/charts/shuffle/templates/orborus/orborus-dpl.yaml index b63c7a8b..411db680 100644 --- a/charts/shuffle/templates/orborus/orborus-dpl.yaml +++ b/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -107,7 +107,10 @@ spec: {{- end }} ports: - name: http - containerPort: 8080 + containerPort: {{ .Values.orborus.containerPorts.http }} + {{- if .Values.orborus.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.orborus.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customLivenessProbe "context" $) | nindent 12 }} @@ -115,7 +118,7 @@ spec: livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.orborus.containerPorts.http }} {{- end }} {{- if .Values.orborus.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customReadinessProbe "context" $) | nindent 12 }} @@ -123,7 +126,7 @@ spec: readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.orborus.containerPorts.http }} {{- end }} {{- if .Values.orborus.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.customStartupProbe "context" $) | nindent 12 }} @@ -131,7 +134,7 @@ spec: startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.orborus.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / - port: 8080 + port: {{ .Values.orborus.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.orborus.lifecycleHooks }} diff --git a/charts/shuffle/templates/orborus/orborus-network-policy.yaml b/charts/shuffle/templates/orborus/orborus-network-policy.yaml index 6e03b9e3..f6a22339 100644 --- a/charts/shuffle/templates/orborus/orborus-network-policy.yaml +++ b/charts/shuffle/templates/orborus/orborus-network-policy.yaml @@ -31,7 +31,7 @@ spec: kubernetes.io/metadata.name: kube-system # Allow access to backend - ports: - - port: 5001 + - port: {{ .Values.backend.containerPorts.http }} protocol: TCP to: - namespaceSelector: @@ -55,7 +55,7 @@ spec: {{- end }} ingress: - ports: - - port: 8080 + - port: {{ .Values.orborus.containerPorts.http }} protocol: TCP {{- if not .Values.orborus.networkPolicy.allowExternal }} from: diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json index 62e2dff2..d70c16cb 100644 --- a/charts/shuffle/values.schema.json +++ b/charts/shuffle/values.schema.json @@ -178,6 +178,22 @@ "description": "Number of backend replicas to deploy", "default": 1 }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "backend HTTP container port", + "default": 5001 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for backend containers", + "default": [], + "items": {} + }, "livenessProbe": { "type": "object", "properties": { @@ -840,6 +856,27 @@ "description": "Number of frontend replicas to deploy", "default": 1 }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "frontend HTTP container port", + "default": 80 + }, + "https": { + "type": "number", + "description": "frontend HTTPS container port", + "default": 443 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for frontend containers", + "default": [], + "items": {} + }, "livenessProbe": { "type": "object", "properties": { @@ -976,7 +1013,7 @@ "enabled": { "type": "boolean", "description": "Enable frontend pods' Security Context", - "default": true + "default": false }, "fsGroupChangePolicy": { "type": "string", @@ -1008,7 +1045,7 @@ "enabled": { "type": "boolean", "description": "Enabled frontend container' Security Context", - "default": true + "default": false }, "runAsUser": { "type": "number", @@ -1437,6 +1474,22 @@ "description": "Number of orborus replicas to deploy", "default": 1 }, + "containerPorts": { + "type": "object", + "properties": { + "http": { + "type": "number", + "description": "orborus HTTP container port", + "default": 8080 + } + } + }, + "extraContainerPorts": { + "type": "array", + "description": "Optionally specify extra list of additional ports for orborus containers", + "default": [], + "items": {} + }, "livenessProbe": { "type": "object", "properties": { diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index daa4ec9a..b9d47913 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -122,6 +122,17 @@ backend: ## @param backend.replicaCount Number of backend replicas to deploy ## replicaCount: 1 + ## @param backend.containerPorts.http backend HTTP container port + ## + containerPorts: + http: 5001 + ## @param backend.extraContainerPorts Optionally specify extra list of additional ports for backend containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] ## Configure extra options for backend containers' liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes ## @param backend.livenessProbe.enabled Enable livenessProbe on backend containers @@ -577,6 +588,19 @@ frontend: ## @param frontend.replicaCount Number of frontend replicas to deploy ## replicaCount: 1 + ## @param frontend.containerPorts.http frontend HTTP container port + ## @param frontend.containerPorts.https frontend HTTPS container port + ## + containerPorts: + http: 80 + https: 443 + ## @param frontend.extraContainerPorts Optionally specify extra list of additional ports for frontend containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] ## Configure extra options for frontend containers' liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes ## @param frontend.livenessProbe.enabled Enable livenessProbe on frontend containers @@ -966,6 +990,17 @@ orborus: ## @param orborus.replicaCount Number of orborus replicas to deploy ## replicaCount: 1 + ## @param orborus.containerPorts.http orborus HTTP container port + ## + containerPorts: + http: 8080 + ## @param orborus.extraContainerPorts Optionally specify extra list of additional ports for orborus containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] ## Configure extra options for orborus containers' liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes ## @param orborus.livenessProbe.enabled Enable livenessProbe on orborus containers From 577462b4208fe381492082d1744d65d6cd445e04 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Thu, 2 Jan 2025 09:32:08 +0100 Subject: [PATCH 05/13] add github workflow to package helm chart Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- .github/workflows/.github/workflows/helm.yml | 41 ++++++++++++++++++++ charts/shuffle/Chart.yaml | 2 +- charts/shuffle/README.md | 5 +-- 3 files changed, 44 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/.github/workflows/helm.yml diff --git a/.github/workflows/.github/workflows/helm.yml b/.github/workflows/.github/workflows/helm.yml new file mode 100644 index 00000000..c3a6657a --- /dev/null +++ b/.github/workflows/.github/workflows/helm.yml @@ -0,0 +1,41 @@ + +name: helm + +on: + workflow_dispatch: + push: + branches: + - main + paths: + - "charts/**" + +permissions: + contents: read + packages: write + +jobs: + main: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install apt dependencies + run: | + curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null + sudo apt-get install apt-transport-https -y --no-install-recommends + echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list + sudo apt-get update + sudo apt-get install helm -y --no-install-recommends + + - name: Update helm dependencies + run: helm dependency update ./charts/shuffle + + - name: Package Helm chart + run: helm package ./charts/shuffle --destination ./charts + + - name: Login to OCI registry (ghcr.io) + run: helm registry login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} + + - name: Push helm chart + run: helm push ./charts/shuffle-*.tgz oci://ghcr.io/shuffle/shuffle/charts diff --git a/charts/shuffle/Chart.yaml b/charts/shuffle/Chart.yaml index 3d74f418..67d1de83 100644 --- a/charts/shuffle/Chart.yaml +++ b/charts/shuffle/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: shuffle description: A Helm chart for deploying Shuffle on Kubernetes type: application -version: 0.0.0 +version: 0.1.0 appVersion: nightly dependencies: - name: common diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 3c713a6c..8667ed8d 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -17,8 +17,8 @@ SPDX-License-Identifier: APACHE-2.0 ## Usage ```sh -# Install (the shuffle namespace is hardcoded into the shuffle source code) -helm install shuffle oci://TODO --namespace shuffle --create-namespace +# Install shuffle via helm (the shuffle namespace is hardcoded into the shuffle source code) +helm install shuffle oci://ghcr.io/shuffle/shuffle/charts/shuffle --namespace shuffle --create-namespace ``` ## Secret Parameters @@ -581,4 +581,3 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `vault.secrets` | A list of VaultSecrets to create | `[]` | ### Other Parameters - From 63fac95c51f9b26e9ead5128000b4568b8ae2d61 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Thu, 2 Jan 2025 09:40:28 +0100 Subject: [PATCH 06/13] add note on how to access shuffle Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/templates/NOTES.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/charts/shuffle/templates/NOTES.txt b/charts/shuffle/templates/NOTES.txt index 1091d443..10e38886 100644 --- a/charts/shuffle/templates/NOTES.txt +++ b/charts/shuffle/templates/NOTES.txt @@ -20,6 +20,8 @@ Access the pod you want to debug by executing {{- end }} -TODO +To access shuffle using port-forwarding: + +1. Run `kubectl port-forward -n shuffle svc/shuffle-frontend 8080:http` +2. Visit http://localhost:8080 with your browser -{{- include "common.warnings.rollingTag" .Values.backend.image }} From 10c13dfa6f979d869b986b41fe081bb666a9ea8e Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Tue, 18 Feb 2025 16:31:40 +0100 Subject: [PATCH 07/13] update matchLabels As changed in #1625 Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/templates/_helpers.tpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/shuffle/templates/_helpers.tpl b/charts/shuffle/templates/_helpers.tpl index 0e90cbe9..369dfec1 100644 --- a/charts/shuffle/templates/_helpers.tpl +++ b/charts/shuffle/templates/_helpers.tpl @@ -111,7 +111,7 @@ Return the match labels for worker components NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. */}} {{- define "shuffle.worker.matchLabels" -}} -container: shuffle-worker +app.kubernetes.io/name: shuffle-worker {{- end -}} {{/* @@ -119,7 +119,7 @@ Return the match labels for app components NOTE: This does not match the labels from shuffle.worker.labels, but the labels set by the orborus GoLang app. */}} {{- define "shuffle.app.matchLabels" -}} -app: shuffle-app +app.kubernetes.io/name: shuffle-app {{- end -}} {{/* From 2edd3be85fed7bd398937c1a5d514a045d0c23d7 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Wed, 19 Feb 2025 11:31:04 +0100 Subject: [PATCH 08/13] use custom service accounts for workers and apps Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/templates/orborus/orborus-dpl.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/charts/shuffle/templates/orborus/orborus-dpl.yaml b/charts/shuffle/templates/orborus/orborus-dpl.yaml index 411db680..0d3488f0 100644 --- a/charts/shuffle/templates/orborus/orborus-dpl.yaml +++ b/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -86,6 +86,10 @@ spec: value: kubernetes - name: IS_KUBERNETES value: "true" + - name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME + value: {{ include "shuffle.worker.serviceAccountName" . }} + - name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME + value: {{ include "shuffle.app.serviceAccountName" . }} {{- if .Values.orborus.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }} {{- end }} From af2d58155c195ce9002d646fbe9b04e035744702 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Wed, 19 Feb 2025 12:36:47 +0100 Subject: [PATCH 09/13] use app and worker service accounts in role binding Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- .../shuffle-app-network-policy.yaml} | 0 .../shuffle-app-role-binding.yaml} | 4 +--- .../shuffle-app-role.yaml} | 0 .../shuffle-app-service-account.yaml} | 0 .../shuffle-worker-network-policy.yaml} | 0 .../shuffle-worker-role-binding.yaml} | 4 +--- .../shuffle-worker-role.yaml} | 0 .../shuffle-worker-service-account.yaml} | 0 8 files changed, 2 insertions(+), 6 deletions(-) rename charts/shuffle/templates/{orborus-app/orborus-app-network-policy.yaml => shuffle-app/shuffle-app-network-policy.yaml} (100%) rename charts/shuffle/templates/{orborus-app/orborus-app-role-binding.yaml => shuffle-app/shuffle-app-role-binding.yaml} (77%) rename charts/shuffle/templates/{orborus-app/orborus-app-role.yaml => shuffle-app/shuffle-app-role.yaml} (100%) rename charts/shuffle/templates/{orborus-app/orborus-app-service-account.yaml => shuffle-app/shuffle-app-service-account.yaml} (100%) rename charts/shuffle/templates/{orborus-worker/orborus-worker-network-policy.yaml => shuffle-worker/shuffle-worker-network-policy.yaml} (100%) rename charts/shuffle/templates/{orborus-worker/orborus-worker-role-binding.yaml => shuffle-worker/shuffle-worker-role-binding.yaml} (77%) rename charts/shuffle/templates/{orborus-worker/orborus-worker-role.yaml => shuffle-worker/shuffle-worker-role.yaml} (100%) rename charts/shuffle/templates/{orborus-worker/orborus-worker-service-account.yaml => shuffle-worker/shuffle-worker-service-account.yaml} (100%) diff --git a/charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml similarity index 100% rename from charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml rename to charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml diff --git a/charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml similarity index 77% rename from charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml rename to charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml index 91115fb4..ec369148 100644 --- a/charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml @@ -8,11 +8,9 @@ metadata: {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} -# Deployed shuffle apps will use the default service account. There is currently no way to change that. -# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260 subjects: - kind: ServiceAccount - name: default + name: {{ include "shuffle.app.serviceAccountName" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/orborus-app/orborus-app-role.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml similarity index 100% rename from charts/shuffle/templates/orborus-app/orborus-app-role.yaml rename to charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml diff --git a/charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml similarity index 100% rename from charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml rename to charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml similarity index 100% rename from charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml similarity index 77% rename from charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml index 71479700..1e952733 100644 --- a/charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml @@ -8,11 +8,9 @@ metadata: {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} -# Deployed shuffle workers will use the default service account. There is currently no way to change that. -# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260 subjects: - kind: ServiceAccount - name: default + name: {{ include "shuffle.worker.serviceAccountName" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml similarity index 100% rename from charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml similarity index 100% rename from charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml From f09d8b6751720db6cf9008df4b93b5c4df9d4c0a Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Wed, 19 Feb 2025 12:37:03 +0100 Subject: [PATCH 10/13] add usage and uninstallation information Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 8667ed8d..7241c640 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -21,6 +21,21 @@ SPDX-License-Identifier: APACHE-2.0 helm install shuffle oci://ghcr.io/shuffle/shuffle/charts/shuffle --namespace shuffle --create-namespace ``` +Make sure that no other application is deployed to the shuffle namespace, as shuffle deletes kubernetes resources in this namespace. + +Only a single deployment of shuffle is supported per namespace. + +## Uninstallation + +```sh +# Uninstall shuffle via helm +helm uninstall shuffle --namespace shuffle + +# Remove additional resources created by shuffle (such as workers and apps) +kubectl delete svc --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)" +kubectl delete deploy --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)" +``` + ## Secret Parameters The helm chart was designed to not contain any secret data and does not allow configuring secret data using helm values. From 53a7d2f2c42e895f60f7705a85f08a68bbb5b933 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Thu, 20 Feb 2025 15:16:49 +0100 Subject: [PATCH 11/13] istio: allow to change tls cipher suites and headers Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 5 +++++ charts/shuffle/templates/istio/gateway.yaml | 3 +++ .../shuffle/templates/istio/virtual-service.yaml | 12 ++++++++++-- charts/shuffle/values.schema.json | 16 ++++++++++++++++ charts/shuffle/values.yaml | 12 ++++++++++++ 5 files changed, 46 insertions(+), 2 deletions(-) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 7241c640..27d7aeba 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -539,8 +539,11 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `istio.gateway.http.httpsRedirect` | If set to true, a 301 redirect is send for all HTTP connections | `false` | | `istio.gateway.https.enabled` | Enable HTTPS server on port 443 | `false` | | `istio.gateway.https.tlsCredentialName` | The name of the secret that holds the TLS certs including the CA certificates. | `""` | +| `istio.gateway.https.tlsCipherSuites` | If specified, only support the specified cipher list. | `[]` | | `istio.gateway.extraServers` | Additional servers for the Gateway resource | `[]` | | `istio.virtualService.annotations` | Additional annotations for the VirtualService resource. | `{}` | +| `istio.virtualService.backendHeaders` | Header manipulation rules for backend traffic | `{}` | +| `istio.virtualService.frontendHeaders` | Header manipulation rules for frontend traffic | `{}` | ### Persistence Parameters @@ -596,3 +599,5 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `vault.secrets` | A list of VaultSecrets to create | `[]` | ### Other Parameters + + diff --git a/charts/shuffle/templates/istio/gateway.yaml b/charts/shuffle/templates/istio/gateway.yaml index fe80084f..f30a5ecb 100644 --- a/charts/shuffle/templates/istio/gateway.yaml +++ b/charts/shuffle/templates/istio/gateway.yaml @@ -32,6 +32,9 @@ spec: tls: credentialName: {{ .Values.istio.gateway.https.tlsCredentialName }} mode: SIMPLE + {{- with .Values.istio.gateway.https.tlsCipherSuites }} + cipherSuites: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 10 }} + {{- end }} {{- end }} {{- if .Values.istio.gateway.extraServers }} {{- include "common.tplvalues.render" (dict "value" .Values.istio.gateway.extraServers "context" $) | nindent 4 }} diff --git a/charts/shuffle/templates/istio/virtual-service.yaml b/charts/shuffle/templates/istio/virtual-service.yaml index 902a1583..aae37e77 100644 --- a/charts/shuffle/templates/istio/virtual-service.yaml +++ b/charts/shuffle/templates/istio/virtual-service.yaml @@ -14,7 +14,8 @@ spec: gateways: - {{ include "common.names.fullname" . }} http: - - match: + - name: backend + match: - uri: prefix: /api route: @@ -22,9 +23,16 @@ spec: host: {{ include "shuffle.backend.name" . }} port: number: {{ .Values.backend.containerPorts.http }} - - route: + {{- with .Values.istio.virtualService.backendHeaders }} + headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }} + {{- end }} + - name: frontend + route: - destination: host: {{ include "shuffle.frontend.name" . }} port: number: {{ .Values.frontend.containerPorts.http }} + {{- with .Values.istio.virtualService.frontendHeaders }} + headers: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }} + {{- end }} {{- end }} diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json index d70c16cb..d5ad8fe9 100644 --- a/charts/shuffle/values.schema.json +++ b/charts/shuffle/values.schema.json @@ -2366,6 +2366,12 @@ "type": "string", "description": "The name of the secret that holds the TLS certs including the CA certificates.", "default": "" + }, + "tlsCipherSuites": { + "type": "array", + "description": "If specified, only support the specified cipher list.", + "default": [], + "items": {} } } }, @@ -2384,6 +2390,16 @@ "type": "object", "description": "Additional annotations for the VirtualService resource.", "default": {} + }, + "backendHeaders": { + "type": "object", + "description": "Header manipulation rules for backend traffic", + "default": {} + }, + "frontendHeaders": { + "type": "object", + "description": "Header manipulation rules for frontend traffic", + "default": {} } } } diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index b9d47913..91103002 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -1632,18 +1632,30 @@ istio: httpsRedirect: false ## @param istio.gateway.https.enabled Enable HTTPS server on port 443 ## @param istio.gateway.https.tlsCredentialName The name of the secret that holds the TLS certs including the CA certificates. + ## @param istio.gateway.https.tlsCipherSuites If specified, only support the specified cipher list. ## NOTE: The secret must exist in the namespace of the istio gateway pod + ## https: enabled: false tlsCredentialName: "" + tlsCipherSuites: [] ## @param istio.gateway.extraServers Additional servers for the Gateway resource ## ref: https://istio.io/latest/docs/reference/config/networking/gateway/#Server + ## extraServers: [] virtualService: ## @param istio.virtualService.annotations Additional annotations for the VirtualService resource. ## annotations: {} + ## @param istio.virtualService.backendHeaders Header manipulation rules for backend traffic + ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers + ## + backendHeaders: {} + ## @param istio.virtualService.frontendHeaders Header manipulation rules for frontend traffic + ## ref: https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers + ## + frontendHeaders: {} ## @section Persistence Parameters ## From 8263ba38aa3111df753be0a5e8452d9cf6fe5755 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Fri, 21 Feb 2025 10:44:49 +0100 Subject: [PATCH 12/13] allow to specify image pull secrets for service accounts Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 6 + charts/shuffle/templates/_helpers.tpl | 186 ++++++++++++++++-- .../templates/backend/backend-dpl.yaml | 4 +- .../backend/backend-role-binding.yaml | 2 +- .../backend/backend-service-account.yaml | 3 +- .../templates/frontend/frontend-dpl.yaml | 4 +- .../frontend/frontend-service-account.yaml | 3 +- .../templates/orborus/orborus-cm-env.yaml | 2 +- .../templates/orborus/orborus-dpl.yaml | 8 +- .../orborus/orborus-role-binding.yaml | 2 +- .../orborus/orborus-service-account.yaml | 3 +- .../shuffle-app/shuffle-app-role-binding.yaml | 2 +- .../shuffle-app-service-account.yaml | 3 +- .../shuffle-worker-role-binding.yaml | 2 +- .../shuffle-worker-service-account.yaml | 3 +- charts/shuffle/values.schema.json | 30 +++ charts/shuffle/values.yaml | 15 ++ 17 files changed, 248 insertions(+), 30 deletions(-) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 27d7aeba..051687e0 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -242,6 +242,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `backend.serviceAccount.imagePullSecrets` | Add image pull secrets to the backend service account | `[]` | | `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `backend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -359,6 +360,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `frontend.serviceAccount.imagePullSecrets` | Add image pull secrets to the frontend service account | `[]` | | `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | | `frontend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | @@ -465,6 +467,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `orborus.serviceAccount.imagePullSecrets` | Add image pull secrets to the orborus service account | `[]` | | `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `orborus.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -483,6 +486,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` | | `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -498,6 +502,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` | | `app.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -601,3 +606,4 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" ### Other Parameters + diff --git a/charts/shuffle/templates/_helpers.tpl b/charts/shuffle/templates/_helpers.tpl index 369dfec1..6bd29238 100644 --- a/charts/shuffle/templates/_helpers.tpl +++ b/charts/shuffle/templates/_helpers.tpl @@ -1,10 +1,3 @@ -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "shuffle.imagePullSecrets" -}} -{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image .Values.frontend.image .Values.orborus.image .Values.worker.image .Values.volumePermissions.image) "context" $) -}} -{{- end -}} - {{/* Return the common name for backend componentes */}} @@ -136,6 +129,13 @@ Return the proper Shuffle backend image name {{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the backend pod +*/}} +{{- define "shuffle.backend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}} +{{- end -}} + {{/* Return the proper Shuffle frontend image name */}} @@ -143,6 +143,13 @@ Return the proper Shuffle frontend image name {{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the frontend pod +*/}} +{{- define "shuffle.frontend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}} +{{- end -}} + {{/* Return the proper Shuffle orborus image name */}} @@ -150,6 +157,13 @@ Return the proper Shuffle orborus image name {{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the orborus pod +*/}} +{{- define "shuffle.orborus.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}} +{{- end -}} + {{/* Return the proper Shuffle worker image name */}} @@ -160,7 +174,7 @@ Return the proper Shuffle worker image name {{/* Create the name of the service account to use for the Shuffle backend */}} -{{- define "shuffle.backend.serviceAccountName" -}} +{{- define "shuffle.backend.serviceAccount.name" -}} {{- if .Values.backend.serviceAccount.create -}} {{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -168,10 +182,40 @@ Create the name of the service account to use for the Shuffle backend {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the backend service account +*/}} +{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.backend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for the Shuffle frontend */}} -{{- define "shuffle.frontend.serviceAccountName" -}} +{{- define "shuffle.frontend.serviceAccount.name" -}} {{- if .Values.frontend.serviceAccount.create -}} {{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -179,10 +223,40 @@ Create the name of the service account to use for the Shuffle frontend {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the frontend service account +*/}} +{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.frontend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for Shuffle orborus */}} -{{- define "shuffle.orborus.serviceAccountName" -}} +{{- define "shuffle.orborus.serviceAccount.name" -}} {{- if .Values.orborus.serviceAccount.create -}} {{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -190,10 +264,40 @@ Create the name of the service account to use for Shuffle orborus {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the orborus service account +*/}} +{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.orborus.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for Shuffle workers */}} -{{- define "shuffle.worker.serviceAccountName" -}} +{{- define "shuffle.worker.serviceAccount.name" -}} {{- if .Values.worker.serviceAccount.create -}} {{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -201,10 +305,40 @@ Create the name of the service account to use for Shuffle workers {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the worker service account +*/}} +{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.worker.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for Shuffle apps */}} -{{- define "shuffle.app.serviceAccountName" -}} +{{- define "shuffle.app.serviceAccount.name" -}} {{- if .Values.app.serviceAccount.create -}} {{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -212,4 +346,32 @@ Create the name of the service account to use for Shuffle apps {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the app service account +*/}} +{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.app.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/shuffle/templates/backend/backend-dpl.yaml b/charts/shuffle/templates/backend/backend-dpl.yaml index ecf52e20..b1cc606c 100644 --- a/charts/shuffle/templates/backend/backend-dpl.yaml +++ b/charts/shuffle/templates/backend/backend-dpl.yaml @@ -25,8 +25,8 @@ spec: {{- end }} labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} spec: - {{- include "shuffle.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ template "shuffle.backend.serviceAccountName" . }} + {{- include "shuffle.backend.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.backend.serviceAccount.name" . }} automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }} {{- if .Values.backend.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }} diff --git a/charts/shuffle/templates/backend/backend-role-binding.yaml b/charts/shuffle/templates/backend/backend-role-binding.yaml index ffbe3ce0..171e2c98 100644 --- a/charts/shuffle/templates/backend/backend-role-binding.yaml +++ b/charts/shuffle/templates/backend/backend-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.backend.serviceAccountName" . }} + name: {{ include "shuffle.backend.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/backend/backend-service-account.yaml b/charts/shuffle/templates/backend/backend-service-account.yaml index efe96b6a..5a49ba3a 100644 --- a/charts/shuffle/templates/backend/backend-service-account.yaml +++ b/charts/shuffle/templates/backend/backend-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.backend.serviceAccountName" . }} + name: {{ include "shuffle.backend.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.backend.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-dpl.yaml b/charts/shuffle/templates/frontend/frontend-dpl.yaml index b3a68dbb..1a984eaf 100644 --- a/charts/shuffle/templates/frontend/frontend-dpl.yaml +++ b/charts/shuffle/templates/frontend/frontend-dpl.yaml @@ -25,8 +25,8 @@ spec: {{- end }} labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} spec: - {{- include "shuffle.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ template "shuffle.frontend.serviceAccountName" . }} + {{- include "shuffle.frontend.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.frontend.serviceAccount.name" . }} automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }} {{- if .Values.frontend.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }} diff --git a/charts/shuffle/templates/frontend/frontend-service-account.yaml b/charts/shuffle/templates/frontend/frontend-service-account.yaml index a55fad19..d580dd3e 100644 --- a/charts/shuffle/templates/frontend/frontend-service-account.yaml +++ b/charts/shuffle/templates/frontend/frontend-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.frontend.serviceAccountName" . }} + name: {{ include "shuffle.frontend.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.frontend.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-cm-env.yaml b/charts/shuffle/templates/orborus/orborus-cm-env.yaml index b49ce510..57b020a7 100644 --- a/charts/shuffle/templates/orborus/orborus-cm-env.yaml +++ b/charts/shuffle/templates/orborus/orborus-cm-env.yaml @@ -13,7 +13,7 @@ data: TZ: "{{ .Values.shuffle.timezone }}" BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001" KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}" - KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccountName" . }} + KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }} SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}" REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" SHUFFLE_SWARM_CONFIG: run diff --git a/charts/shuffle/templates/orborus/orborus-dpl.yaml b/charts/shuffle/templates/orborus/orborus-dpl.yaml index 0d3488f0..a2d9c278 100644 --- a/charts/shuffle/templates/orborus/orborus-dpl.yaml +++ b/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -25,8 +25,8 @@ spec: {{- end }} labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} spec: - {{- include "shuffle.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ template "shuffle.orborus.serviceAccountName" . }} + {{- include "shuffle.orborus.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.orborus.serviceAccount.name" . }} automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }} {{- if .Values.orborus.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }} @@ -87,9 +87,9 @@ spec: - name: IS_KUBERNETES value: "true" - name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME - value: {{ include "shuffle.worker.serviceAccountName" . }} + value: {{ include "shuffle.worker.serviceAccount.name" . }} - name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME - value: {{ include "shuffle.app.serviceAccountName" . }} + value: {{ include "shuffle.app.serviceAccount.name" . }} {{- if .Values.orborus.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }} {{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-role-binding.yaml b/charts/shuffle/templates/orborus/orborus-role-binding.yaml index f4c2689e..feb73887 100644 --- a/charts/shuffle/templates/orborus/orborus-role-binding.yaml +++ b/charts/shuffle/templates/orborus/orborus-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.orborus.serviceAccountName" . }} + name: {{ include "shuffle.orborus.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/orborus/orborus-service-account.yaml b/charts/shuffle/templates/orborus/orborus-service-account.yaml index 4a5c7f3a..27c4b9f6 100644 --- a/charts/shuffle/templates/orborus/orborus-service-account.yaml +++ b/charts/shuffle/templates/orborus/orborus-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.orborus.serviceAccountName" . }} + name: {{ include "shuffle.orborus.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.orborus.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml index ec369148..55a166e7 100644 --- a/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.app.serviceAccountName" . }} + name: {{ include "shuffle.app.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml index f5e4befe..736e9957 100644 --- a/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.app.serviceAccountName" . }} + name: {{ include "shuffle.app.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.app.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml index 1e952733..328b3dd5 100644 --- a/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.worker.serviceAccountName" . }} + name: {{ include "shuffle.worker.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml index e27395f0..a9a90204 100644 --- a/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.worker.serviceAccountName" . }} + name: {{ include "shuffle.worker.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.worker.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json index d5ad8fe9..f7745e6e 100644 --- a/charts/shuffle/values.schema.json +++ b/charts/shuffle/values.schema.json @@ -715,6 +715,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the backend service account", + "default": [], + "items": {} } } }, @@ -1398,6 +1404,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the frontend service account", + "default": [], + "items": {} } } }, @@ -2011,6 +2023,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the orborus service account", + "default": [], + "items": {} } } }, @@ -2103,6 +2121,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the worker service account", + "default": [], + "items": {} } } }, @@ -2175,6 +2199,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the app service account", + "default": [], + "items": {} } } }, diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index 91103002..60fde98d 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -456,6 +456,9 @@ backend: ## @param backend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param backend.serviceAccount.imagePullSecrets Add image pull secrets to the backend service account + ## + imagePullSecrets: [] ## RBAC configuration ## @@ -921,6 +924,9 @@ frontend: ## @param frontend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param frontend.serviceAccount.imagePullSecrets Add image pull secrets to the frontend service account + ## + imagePullSecrets: [] ## Network Policies ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ @@ -1322,6 +1328,9 @@ orborus: ## @param orborus.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param orborus.serviceAccount.imagePullSecrets Add image pull secrets to the orborus service account + ## + imagePullSecrets: [] ## RBAC configuration ## @@ -1393,6 +1402,9 @@ worker: ## @param worker.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param worker.serviceAccount.imagePullSecrets Add image pull secrets to the worker service account + ## + imagePullSecrets: [] ## RBAC configuration ## @@ -1461,6 +1473,9 @@ app: ## istio: pilot ## automountServiceAccountToken: true + ## @param app.serviceAccount.imagePullSecrets Add image pull secrets to the app service account + ## + imagePullSecrets: [] ## RBAC configuration ## From ceb62abc1c0bdce5dab45c31750e86dfc218cec6 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Fri, 21 Feb 2025 10:58:02 +0100 Subject: [PATCH 13/13] update value description Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 12 +++++------- charts/shuffle/values.schema.json | 10 +++++----- charts/shuffle/values.yaml | 10 +++++----- 3 files changed, 15 insertions(+), 17 deletions(-) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 051687e0..495d2690 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -241,7 +241,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | -| `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the backend service account | `true` | | `backend.serviceAccount.imagePullSecrets` | Add image pull secrets to the backend service account | `[]` | | `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | @@ -359,7 +359,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | -| `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the frontend service account | `true` | | `frontend.serviceAccount.imagePullSecrets` | Add image pull secrets to the frontend service account | `[]` | | `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -466,7 +466,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `orborus.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | -| `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the orborus service account | `true` | | `orborus.serviceAccount.imagePullSecrets` | Add image pull secrets to the orborus service account | `[]` | | `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | @@ -485,7 +485,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | -| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` | | `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` | | `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | @@ -501,7 +501,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | -| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` | | `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` | | `app.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | @@ -605,5 +605,3 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" ### Other Parameters - - diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json index f7745e6e..7a85b9fa 100644 --- a/charts/shuffle/values.schema.json +++ b/charts/shuffle/values.schema.json @@ -713,7 +713,7 @@ }, "automountServiceAccountToken": { "type": "boolean", - "description": "Automount service account token for the server service account", + "description": "Automount service account token for the backend service account", "default": true }, "imagePullSecrets": { @@ -1402,7 +1402,7 @@ }, "automountServiceAccountToken": { "type": "boolean", - "description": "Automount service account token for the server service account", + "description": "Automount service account token for the frontend service account", "default": true }, "imagePullSecrets": { @@ -2021,7 +2021,7 @@ }, "automountServiceAccountToken": { "type": "boolean", - "description": "Automount service account token for the server service account", + "description": "Automount service account token for the orborus service account", "default": true }, "imagePullSecrets": { @@ -2119,7 +2119,7 @@ }, "automountServiceAccountToken": { "type": "boolean", - "description": "Automount service account token for the server service account", + "description": "Automount service account token for the worker service account", "default": true }, "imagePullSecrets": { @@ -2197,7 +2197,7 @@ }, "automountServiceAccountToken": { "type": "boolean", - "description": "Automount service account token for the server service account", + "description": "Automount service account token for the app service account", "default": true }, "imagePullSecrets": { diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index 60fde98d..35492f94 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -453,7 +453,7 @@ backend: ## @param backend.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) ## annotations: {} - ## @param backend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param backend.serviceAccount.automountServiceAccountToken Automount service account token for the backend service account ## automountServiceAccountToken: true ## @param backend.serviceAccount.imagePullSecrets Add image pull secrets to the backend service account @@ -921,7 +921,7 @@ frontend: ## @param frontend.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) ## annotations: {} - ## @param frontend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param frontend.serviceAccount.automountServiceAccountToken Automount service account token for the frontend service account ## automountServiceAccountToken: true ## @param frontend.serviceAccount.imagePullSecrets Add image pull secrets to the frontend service account @@ -1325,7 +1325,7 @@ orborus: ## @param orborus.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) ## annotations: {} - ## @param orborus.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param orborus.serviceAccount.automountServiceAccountToken Automount service account token for the orborus service account ## automountServiceAccountToken: true ## @param orborus.serviceAccount.imagePullSecrets Add image pull secrets to the orborus service account @@ -1399,7 +1399,7 @@ worker: ## @param worker.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) ## annotations: {} - ## @param worker.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param worker.serviceAccount.automountServiceAccountToken Automount service account token for the worker service account ## automountServiceAccountToken: true ## @param worker.serviceAccount.imagePullSecrets Add image pull secrets to the worker service account @@ -1461,7 +1461,7 @@ app: ## @param app.serviceAccount.annotations Additional Service Account annotations (evaluated as a template) ## annotations: {} - ## @param app.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param app.serviceAccount.automountServiceAccountToken Automount service account token for the app service account ## NOTE: You likely want to allow access to cluster-proxies, e.g: ## extraEgress: ## - to: