marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'nightly' into k8s-shuffle-app-ports

Browse Source
This commit is contained in:
Frikky
2025-05-18 22:48:47 +02:00
committed by GitHub
parent e4a42128e7 6358d94984
commit ed70913be5
16 changed files with 570 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/go.mod
+1 -1
View File
@@ -22,7 +22,7 @@ require (
github.com/gorilla/mux v1.8.1
github.com/h2non/filetype v1.1.3
github.com/satori/go.uuid v1.2.0
github.com/shuffle/shuffle-shared v0.8.39
github.com/shuffle/shuffle-shared v0.8.50
golang.org/x/crypto v0.36.0
google.golang.org/api v0.228.0
google.golang.org/grpc v1.71.1
backend/go-app/go.sum
+2 -2
View File
@@ -341,8 +341,8 @@ github.com/sendgrid/sendgrid-go v3.14.0+incompatible h1:KDSasSTktAqMJCYClHVE94Fc
github.com/sendgrid/sendgrid-go v3.14.0+incompatible/go.mod h1:QRQt+LX/NmgVEvmdRw0VT/QgUn499+iza2FnDca9fg8=
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
github.com/shuffle/shuffle-shared v0.8.39 h1:ylRj+2xGIOPQfpawf45udnQzKLtTP9JFEFyREc2GJXM=
github.com/shuffle/shuffle-shared v0.8.39/go.mod h1:z+ISGBgNINmZvWNrtGTc51yVG+pMkpBFu9ZLVlTyuag=
github.com/shuffle/shuffle-shared v0.8.50 h1:Sy6o7Nrcd3QG+m28775STKS3uOfaXDzDcctTuaYfdYQ=
github.com/shuffle/shuffle-shared v0.8.50/go.mod h1:z+ISGBgNINmZvWNrtGTc51yVG+pMkpBFu9ZLVlTyuag=
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
backend/go-app/main.go
+1 -1
View File
@@ -5138,7 +5138,7 @@ func initHandlers() {
r.HandleFunc("/api/v1/apps/{key}/execute", executeSingleAction).Methods("POST", "OPTIONS")
r.HandleFunc("/api/v1/apps/{key}/run", executeSingleAction).Methods("POST", "OPTIONS")
r.HandleFunc("/api/v1/apps/categories", shuffle.GetActiveCategories).Methods("GET", "OPTIONS")
r.HandleFunc("/api/v1/apps/categories/run", shuffle.RunCategoryAction).Methods("POST", "OPTIONS")
//r.HandleFunc("/api/v1/apps/categories/run", shuffle.RunCategoryAction).Methods("POST", "OPTIONS")
r.HandleFunc("/api/v1/apps/upload", handleAppZipUpload).Methods("POST", "OPTIONS")
r.HandleFunc("/api/v1/apps/{appId}/activate", activateWorkflowAppDocker).Methods("GET", "OPTIONS")
r.HandleFunc("/api/v1/apps/{appId}/deactivate", activateWorkflowAppDocker).Methods("GET", "OPTIONS")
backend/go-app/walkoff.go
+13 -2
View File
@@ -3039,7 +3039,13 @@ func executeSingleAction(resp http.ResponseWriter, request *http.Request) {
shouldRerun = true
}
workflowExecution, err := shuffle.PrepareSingleAction(ctx, user, fileId, body, runValidationAction)
decisionId := ""
decision, decisionOk := query["decision_id"]
if decisionOk && len(decision) > 0 {
decisionId = decision[0]
}
workflowExecution, err := shuffle.PrepareSingleAction(ctx, user, fileId, body, runValidationAction, decisionId)
debugUrl := fmt.Sprintf("/workflows/%s?execution_id=%s", workflowExecution.Workflow.ID, workflowExecution.ExecutionId)
resp.Header().Add("X-Debug-Url", debugUrl)
@@ -3101,7 +3107,12 @@ func executeSingleAction(resp http.ResponseWriter, request *http.Request) {
return
}
returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1)
actionId := ""
if len(workflowExecution.Workflow.Actions) == 1 {
actionId = workflowExecution.Workflow.Actions[0].ID
}
returnBody := shuffle.HandleRetValidation(ctx, workflowExecution, 1, actionId)
returnBytes, err := json.Marshal(returnBody)
if err != nil {
log.Printf("[ERROR] Failed to marshal retStruct in single execution: %s", err)
frontend/src/App.jsx
+50
View File
@@ -791,6 +791,40 @@ const App = (message, props) => {
/>
}
/>
<Route
exact
path="/chat"
element={
<ChatBot
serverside={serverside}
cookies={cookies}
removeCookie={removeCookie}
isLoaded={isLoaded}
isLoggedIn={isLoggedIn}
globalUrl={globalUrl}
cookies={cookies}
userdata={userdata}
{...props}
/>
}
/>
<Route
exact
path="/conversation"
element={
<ChatBot
serverside={serverside}
cookies={cookies}
removeCookie={removeCookie}
isLoaded={isLoaded}
isLoggedIn={isLoggedIn}
globalUrl={globalUrl}
cookies={cookies}
userdata={userdata}
{...props}
/>
}
/>
<Route
exact
path="/dashboards/:key"
@@ -821,6 +855,22 @@ const App = (message, props) => {
/>
}
/>
<Route
exact
path="/agents"
element={
<AgentUI
serverside={serverside}
isLoaded={isLoaded}
isLoggedIn={isLoggedIn}
globalUrl={globalUrl}
userdata={userdata}
{...props}
/>
}
/>
<Route
exact
path="/"
functions/kubernetes/charts/shuffle/README.md
+61 -18
View File
@@ -217,7 +217,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `backend.affinity` | Affinity for backend pods assignment | `{}` |
| `backend.nodeSelector` | Node labels for backend pods assignment | `{}` |
| `backend.tolerations` | Tolerations for backend pods assignment | `[]` |
| `backend.updateStrategy.type` | backend deployment strategy type | `RollingUpdate` |
| `backend.updateStrategy.type` | backend deployment strategy type | `Recreate` |
| `backend.priorityClassName` | backend pods' priorityClassName | `""` |
| `backend.topologySpreadConstraints` | Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | `[]` |
| `backend.schedulerName` | Name of the k8s scheduler (other than default) for backend pods | `""` |
@@ -244,6 +244,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `backend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `backend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `backend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `backend.service.labels` | Extra labels for backend service | `{}` |
| `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -359,6 +360,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `frontend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `frontend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `frontend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `frontend.service.labels` | Extra labels for frontend service | `{}` |
| `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -477,23 +479,38 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### worker Parameters
| Name | Description | Value |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| Name | Description | Value |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.podSecurityContext.enabled` | Enable worker pods' Security Context | `true` |
| `worker.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for worker pods | `Always` |
| `worker.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for worker pods | `[]` |
| `worker.podSecurityContext.supplementalGroups` | Set filesystem extra groups for worker pods | `[]` |
| `worker.podSecurityContext.fsGroup` | Set fsGroup in worker pods' Security Context | `1001` |
| `worker.containerSecurityContext.enabled` | Enabled worker container' Security Context | `true` |
| `worker.containerSecurityContext.seLinuxOptions` | Set SELinux options in worker container | `{}` |
| `worker.containerSecurityContext.runAsUser` | Set runAsUser in worker container' Security Context | `1001` |
| `worker.containerSecurityContext.runAsGroup` | Set runAsGroup in worker container' Security Context | `1001` |
| `worker.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in worker container' Security Context | `true` |
| `worker.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in worker container' Security Context | `true` |
| `worker.containerSecurityContext.privileged` | Set privileged in worker container' Security Context | `false` |
| `worker.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in worker container' Security Context | `false` |
| `worker.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in worker container | `["ALL"]` |
| `worker.containerSecurityContext.seccompProfile.type` | Set seccomp profile in worker container | `RuntimeDefault` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### app Parameters
@@ -511,6 +528,32 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| `app.exposedContainerPort` | The port that shuffle app containers will listen on for new requests. | `80` |
| `app.podSecurityContext.enabled` | Enable app pods' Security Context | `true` |
| `app.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for app pods | `Always` |
| `app.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for app pods | `[]` |
| `app.podSecurityContext.supplementalGroups` | Set filesystem extra groups for app pods | `[]` |
| `app.podSecurityContext.fsGroup` | Set fsGroup in app pods' Security Context | `1001` |
| `app.containerSecurityContext.enabled` | Enabled app container' Security Context | `true` |
| `app.containerSecurityContext.seLinuxOptions` | Set SELinux options in app container | `{}` |
| `app.containerSecurityContext.runAsUser` | Set runAsUser in app container' Security Context | `1001` |
| `app.containerSecurityContext.runAsGroup` | Set runAsGroup in app container' Security Context | `1001` |
| `app.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in app container' Security Context | `true` |
| `app.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in app container' Security Context | `true` |
| `app.containerSecurityContext.privileged` | Set privileged in app container' Security Context | `false` |
| `app.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in app container' Security Context | `false` |
| `app.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in app container | `["ALL"]` |
| `app.containerSecurityContext.seccompProfile.type` | Set seccomp profile in app container | `RuntimeDefault` |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### Traffic Exposure Parameters
functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml
+4 -2
View File
@@ -8,18 +8,20 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
BACKEND_PORT: "5001"
BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}"
{{- if .Values.shuffle.baseUrl }}
BASE_URL: "{{ .Values.shuffle.baseUrl }}"
SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
{{- else }}
BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
{{- end }}
ORG_ID: "{{ .Values.shuffle.org }}"
SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
SHUFFLE_CHAT_DISABLED: "true"
# Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address
SHUFFLE_CLOUDRUN_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"
functions/kubernetes/charts/shuffle/templates/backend/backend-svc.yaml
+3 -1
View File
@@ -3,7 +3,8 @@ kind: Service
metadata:
name: {{ template "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.service.labels .Values.commonLabels) "context" .) }}
labels: {{- include "shuffle.backend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
@@ -14,5 +15,6 @@ spec:
port: {{ .Values.backend.containerPorts.http }}
targetPort: http
protocol: TCP
appProtocol: http
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
functions/kubernetes/charts/shuffle/templates/frontend/frontend-svc.yaml
+4 -1
View File
@@ -3,7 +3,8 @@ kind: Service
metadata:
name: {{ template "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.service.labels .Values.commonLabels) "context" .) }}
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
@@ -14,11 +15,13 @@ spec:
port: {{ .Values.frontend.containerPorts.http }}
targetPort: http
protocol: TCP
appProtocol: http
{{- if .Values.frontend.containerPorts.https }}
- name: https
port: {{ .Values.frontend.containerPorts.https }}
targetPort: https
protocol: TCP
appProtocol: https
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ data:
ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
ORG_ID: "{{ .Values.shuffle.org }}"
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }}
SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"
functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml
+16
View File
@@ -90,8 +90,24 @@ spec:
value: {{ include "shuffle.worker.serviceAccount.name" . }}
- name: SHUFFLE_APP_EXPOSED_PORT
value: {{ .Values.app.exposedContainerPort | quote }}
{{- if .Values.worker.podSecurityContext.enabled }}
- name: SHUFFLE_WORKER_POD_SECURITY_CONTEXT
value: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.worker.containerSecurityContext.enabled }}
- name: SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
- name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.app.serviceAccount.name" . }}
{{- if .Values.app.podSecurityContext.enabled }}
- name: SHUFFLE_APP_POD_SECURITY_CONTEXT
value: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.app.containerSecurityContext.enabled }}
- name: SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
{{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
+10
View File
@@ -29,6 +29,16 @@ spec:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
# Allow access to backend
- ports:
- port: {{ .Values.backend.containerPorts.http }}
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }}
# Allow access to workers
- ports:
- port: 33333
functions/kubernetes/charts/shuffle/values.schema.json
+215 -1
View File
@@ -517,7 +517,7 @@
"type": {
"type": "string",
"description": "backend deployment strategy type",
"default": "RollingUpdate"
"default": "Recreate"
}
}
},
@@ -683,6 +683,16 @@
}
}
},
"service": {
"type": "object",
"properties": {
"labels": {
"type": "object",
"description": "Extra labels for backend service",
"default": {}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -1362,6 +1372,16 @@
}
}
},
"service": {
"type": "object",
"properties": {
"labels": {
"type": "object",
"description": "Extra labels for frontend service",
"default": {}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -2074,6 +2094,103 @@
}
}
},
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable worker pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for worker pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for worker pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for worker pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in worker pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled worker container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in worker container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in worker container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in worker container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in worker container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in worker container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in worker container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in worker container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in worker container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -2152,6 +2269,103 @@
"app": {
"type": "object",
"properties": {
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable app pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for app pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for app pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for app pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in app pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled app container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in app container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in app container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in app container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in app container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in app container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in app container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in app container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in app container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
functions/kubernetes/charts/shuffle/values.yaml
+102 -2
View File
@@ -310,14 +310,14 @@ backend:
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
##
tolerations: []
## ONLY FOR DEPLOYMENTS:
## @param backend.updateStrategy.type backend deployment strategy type
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
##
updateStrategy:
## Can be set to RollingUpdate or Recreate
## Backend uses ReadWriteOnce volumes by default, which is incompatible with RollingUpdate
##
type: RollingUpdate
type: Recreate
## @param backend.priorityClassName backend pods' priorityClassName
##
priorityClassName: ""
@@ -421,6 +421,14 @@ backend:
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param backend.service.labels Extra labels for backend service
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
serviceAccount:
@@ -870,6 +878,14 @@ frontend:
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param frontend.service.labels Extra labels for frontend service
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
serviceAccount:
@@ -1328,6 +1344,48 @@ worker:
tag: ""
digest: ""
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param worker.podSecurityContext.enabled Enable worker pods' Security Context
## @param worker.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for worker pods
## @param worker.podSecurityContext.sysctls Set kernel settings using the sysctl interface for worker pods
## @param worker.podSecurityContext.supplementalGroups Set filesystem extra groups for worker pods
## @param worker.podSecurityContext.fsGroup Set fsGroup in worker pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context
## @param worker.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in worker container
## @param worker.containerSecurityContext.runAsUser Set runAsUser in worker container' Security Context
## @param worker.containerSecurityContext.runAsGroup Set runAsGroup in worker container' Security Context
## @param worker.containerSecurityContext.runAsNonRoot Set runAsNonRoot in worker container' Security Context
## @param worker.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in worker container' Security Context
## @param worker.containerSecurityContext.privileged Set privileged in worker container' Security Context
## @param worker.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in worker container' Security Context
## @param worker.containerSecurityContext.capabilities.drop List of capabilities to be dropped in worker container
## @param worker.containerSecurityContext.seccompProfile.type Set seccomp profile in worker container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration
##
serviceAccount:
@@ -1390,6 +1448,48 @@ worker:
## @section app Parameters
##
app:
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param app.podSecurityContext.enabled Enable app pods' Security Context
## @param app.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for app pods
## @param app.podSecurityContext.sysctls Set kernel settings using the sysctl interface for app pods
## @param app.podSecurityContext.supplementalGroups Set filesystem extra groups for app pods
## @param app.podSecurityContext.fsGroup Set fsGroup in app pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param app.containerSecurityContext.enabled Enabled app container' Security Context
## @param app.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in app container
## @param app.containerSecurityContext.runAsUser Set runAsUser in app container' Security Context
## @param app.containerSecurityContext.runAsGroup Set runAsGroup in app container' Security Context
## @param app.containerSecurityContext.runAsNonRoot Set runAsNonRoot in app container' Security Context
## @param app.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in app container' Security Context
## @param app.containerSecurityContext.privileged Set privileged in app container' Security Context
## @param app.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in app container' Security Context
## @param app.containerSecurityContext.capabilities.drop List of capabilities to be dropped in app container
## @param app.containerSecurityContext.seccompProfile.type Set seccomp profile in app container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration
##
serviceAccount:
functions/onprem/orborus/orborus.go
+39 -3
View File
@@ -76,7 +76,11 @@ var maxCPUPercent = 90
var isKubernetes = os.Getenv("IS_KUBERNETES")
var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
var workerServiceAccountName = os.Getenv("SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME")
var workerPodSecurityContext = os.Getenv("SHUFFLE_WORKER_POD_SECURITY_CONTEXT")
var workerContainerSecurityContext = os.Getenv("SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT")
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
var appPodSecurityContext = os.Getenv("SHUFFLE_APP_POD_SECURITY_CONTEXT")
var appContainerSecurityContext = os.Getenv("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT")
// var baseimagename = "docker.pkg.github.com/shuffle/shuffle"
// var baseimagename = "ghcr.io/frikky"
@@ -1004,6 +1008,14 @@ func deployK8sWorker(image string, identifier string, env []string) error {
env = append(env, fmt.Sprintf("SHUFFLE_APP_SERVICE_ACCOUNT_NAME=%s", appServiceAccountName))
}
if len(appPodSecurityContext) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_POD_SECURITY_CONTEXT=%s", appPodSecurityContext))
}
if len(appContainerSecurityContext) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT=%s", appContainerSecurityContext))
}
clientset, _, err := shuffle.GetKubernetesClient()
if err != nil {
log.Printf("[ERROR] Error getting kubernetes client:", err)
@@ -1085,10 +1097,33 @@ func deployK8sWorker(image string, identifier string, env []string) error {
"app.kubernetes.io/instance": identifier,
}
// Parse security contexts from env
var podSecurityContext *corev1.PodSecurityContext
var containerSecurityContext *corev1.SecurityContext
if len(workerPodSecurityContext) > 0 {
podSecurityContext = &corev1.PodSecurityContext{}
err = json.Unmarshal([]byte(workerPodSecurityContext), podSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal worker pod security context: %v", err)
return fmt.Errorf("failed to unmarshal worker pod security context: %v", err)
}
}
if len(workerContainerSecurityContext) > 0 {
containerSecurityContext = &corev1.SecurityContext{}
err = json.Unmarshal([]byte(workerContainerSecurityContext), containerSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal worker container security context: %v", err)
return fmt.Errorf("failed to unmarshal worker container security context: %v", err)
}
}
containerAttachment := corev1.Container{
Name: identifier,
Image: kubernetesImage,
Env: buildEnvVars(envMap),
Name: identifier,
Image: kubernetesImage,
Env: buildEnvVars(envMap),
SecurityContext: containerSecurityContext,
//ImagePullPolicy: "Never",
ImagePullPolicy: corev1.PullIfNotPresent,
@@ -1205,6 +1240,7 @@ func deployK8sWorker(image string, identifier string, env []string) error {
},
DNSPolicy: corev1.DNSClusterFirst,
ServiceAccountName: workerServiceAccountName,
SecurityContext: podSecurityContext,
},
},
},
functions/onprem/worker/worker.go
+48 -5
View File
@@ -57,9 +57,13 @@ var logsDisabled = os.Getenv("SHUFFLE_LOGS_DISABLED")
var cleanupEnv = strings.ToLower(os.Getenv("CLEANUP"))
var swarmNetworkName = os.Getenv("SHUFFLE_SWARM_NETWORK_NAME")
var dockerApiVersion = strings.ToLower(os.Getenv("DOCKER_API_VERSION"))
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
// Kubernetes settings
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
var appPodSecurityContext = os.Getenv("SHUFFLE_APP_POD_SECURITY_CONTEXT")
var appContainerSecurityContext = os.Getenv("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT")
var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
var executionCount int64
var baseimagename = os.Getenv("SHUFFLE_BASE_IMAGE_NAME")
@@ -74,6 +78,7 @@ var appsInitialized = false
var hostname string
var maxReplicas = uint64(12)
var debug bool
/*
var environments []string
@@ -506,6 +511,28 @@ func deployk8sApp(image string, identifier string, env []string) error {
"app.kubernetes.io/instance": name,
}
// Parse security contexts from env
var podSecurityContext *corev1.PodSecurityContext
var containerSecurityContext *corev1.SecurityContext
if len(appPodSecurityContext) > 0 {
podSecurityContext = &corev1.PodSecurityContext{}
err = json.Unmarshal([]byte(appPodSecurityContext), podSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal app pod security context: %v", err)
return fmt.Errorf("failed to unmarshal app pod security context: %v", err)
}
}
if len(appContainerSecurityContext) > 0 {
containerSecurityContext = &corev1.SecurityContext{}
err = json.Unmarshal([]byte(appContainerSecurityContext), containerSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal app container security context: %v", err)
return fmt.Errorf("failed to unmarshal app container security context: %v", err)
}
}
// pod := &corev1.Pod{
// ObjectMeta: metav1.ObjectMeta{
// Name: podName,
@@ -608,10 +635,12 @@ func deployk8sApp(image string, identifier string, env []string) error {
ContainerPort: int32(deployport),
},
},
SecurityContext: containerSecurityContext,
},
},
DNSPolicy: corev1.DNSClusterFirst,
ServiceAccountName: appServiceAccountName,
SecurityContext: podSecurityContext,
},
},
},
@@ -2555,11 +2584,16 @@ func runWorkflowExecutionTransaction(ctx context.Context, attempts int64, workfl
}
if setExecution || workflowExecution.Status == "FINISHED" || workflowExecution.Status == "ABORTED" || workflowExecution.Status == "FAILURE" {
log.Printf("[DEBUG][%s] Running setexec with status %s and %d/%d results", workflowExecution.ExecutionId, workflowExecution.Status, len(workflowExecution.Results), len(workflowExecution.Workflow.Actions))
if debug {
log.Printf("[DEBUG][%s] Running setexec with status %s and %d/%d results", workflowExecution.ExecutionId, workflowExecution.Status, len(workflowExecution.Results), len(workflowExecution.Workflow.Actions))
}
//result(s)", workflowExecution.ExecutionId, workflowExecution.Status, len(workflowExecution.Results))
err = setWorkflowExecution(ctx, *workflowExecution, dbSave)
if err != nil {
resp.WriteHeader(401)
log.Printf("[ERROR][%s] Failed setting execution: %s", workflowExecution.ExecutionId, err)
resp.WriteHeader(400)
resp.Write([]byte(fmt.Sprintf(`{"success": false, "reason": "Failed setting workflowexecution actionresult: %s"}`, err)))
return
}
@@ -2568,7 +2602,10 @@ func runWorkflowExecutionTransaction(ctx context.Context, attempts int64, workfl
if os.Getenv("SHUFFLE_SWARM_CONFIG") == "run" || os.Getenv("SHUFFLE_SWARM_CONFIG") == "swarm" {
finished := shuffle.ValidateFinished(ctx, -1, *workflowExecution)
if !finished {
log.Printf("[DEBUG][%s] Handling next node since it's not finished!", workflowExecution.ExecutionId)
if debug {
log.Printf("[DEBUG][%s] Handling next node since it's not finished!", workflowExecution.ExecutionId)
}
handleExecutionResult(*workflowExecution)
} else {
shutdownData, err := json.Marshal(workflowExecution)
@@ -3526,7 +3563,9 @@ func sendAppRequest(ctx context.Context, incomingUrl, appName string, port int,
log.Printf("[ERROR] Failed reading app request body body: %s", err)
return err
} else {
log.Printf("[DEBUG][%s] NEWRESP (from app): %s", workflowExecution.ExecutionId, string(body))
if debug {
log.Printf("[DEBUG][%s] NEWRESP (from app): %s", workflowExecution.ExecutionId, string(body))
}
}
return nil
@@ -3918,6 +3957,10 @@ func checkStandaloneRun() {
func main() {
checkStandaloneRun()
if os.Getenv("DEBUG") == "true" {
debug = true
}
/*** STARTREMOVE ***/
if os.Getenv("SHUFFLE_SWARM_CONFIG") == "run" || os.Getenv("SHUFFLE_SWARM_CONFIG") == "swarm" {
logsDisabled = "true"