cleanup values, add docs, regenerate parameters and values schema
Signed-off-by: Pascal Sthamer <pascal+github@sthamer.xyz>
This commit is contained in:
Pascal Sthamer
@@ -131,14 +131,30 @@ If you want full control, you can deploy apps using helm. This has the following
|
||||
- granular control per app and version (e.g. have more replicas and resources for frequently used apps)
|
||||
- avoid problems with on-demand started apps (see https://github.com/Shuffle/Shuffle/issues/1739)
|
||||
|
||||
To deploy apps using helm, use the `app.deployViaHelm` value:
|
||||
To deploy apps using helm, use the `app.deployViaHelm` value. Here is an example, which deploys the shuffle-tools app and 2 versions of the opensearch app:
|
||||
```yaml
|
||||
app:
|
||||
replicas: 1 # default to 1 replica per app
|
||||
deployViaHelm:
|
||||
- app: shuffle-tools
|
||||
tools:
|
||||
app: shuffle-tools
|
||||
version: 1.2.0
|
||||
TODO
|
||||
opensearchOld:
|
||||
app: opensearch
|
||||
version: 1.0.0 # Also deploy OpenSearch version 1.0.0, because some workflows still use it.
|
||||
opensearch:
|
||||
app: opensearch
|
||||
version: 1.1.0
|
||||
replicas: 3 # use 3 replicas for OpenSearch app
|
||||
resources: # Custom resources for OpenSearch app
|
||||
limits:
|
||||
memory: 512Mi
|
||||
```
|
||||
The key of an app in the `deployViaHelm` map does not matter. We are not using an array here, to allow overriding values in stage-specific value files or using the command line, e.g.
|
||||
`helm upgrade ... --set app.deployViaHelm.tools.replicas=3`.
|
||||
|
||||
See the app Paramters section below for a complete list of helm values, that can be used to customize app deployments.
|
||||
Take a look at the `app.deployViaHelm.MY_APP.*` parameters for a complete list of helm values that can be set on every app.
|
||||
|
||||
It is possible to use a hybrid approach - deploy some apps using helm, while still allowing Worker to create additional apps on-demand.
|
||||
|
||||
@@ -184,12 +200,13 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
|
||||
### Shared Shuffle Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------- | ------------------------------------------------------------- | --------------- |
|
||||
| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` |
|
||||
| `shuffle.org` | Default shuffle organization | `Shuffle` |
|
||||
| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `""` |
|
||||
| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------- |
|
||||
| `shuffle.baseUrl` | The external base URL under which Shuffle is reachable. | `""` |
|
||||
| `shuffle.org` | Default shuffle organization | `Shuffle` |
|
||||
| `shuffle.appRegistry` | The registry from / to which shuffle apps are pulled / pushed | `docker.io` |
|
||||
| `shuffle.appBaseImageName` | The base image used for shuffle apps. The final image for an app is <appRegistr>/<appBaseImageName>/<appName>:<appVersion> | `frikky` |
|
||||
| `shuffle.timezone` | The timezone used by Shuffle | `Europe/Berlin` |
|
||||
|
||||
### backend Parameters
|
||||
|
||||
@@ -418,7 +435,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
|
||||
| `orborus.image.registry` | orborus image registry | `ghcr.io` |
|
||||
| `orborus.image.repository` | orborus image repository | `shuffle/shuffle-orborus` |
|
||||
| `orborus.image.tag` | orborus image tag (immutable tags are recommended, defaults to appVersion) | `""` |
|
||||
| `orborus.image.tag` | orborus image tag (immutable tags are recommended, defaults to appVersion) | `nightly` |
|
||||
| `orborus.image.digest` | orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `orborus.image.pullPolicy` | orborus image pull policy | `IfNotPresent` |
|
||||
| `orborus.image.pullSecrets` | orborus image pull secrets | `[]` |
|
||||
@@ -515,15 +532,43 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
| `orborus.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `orborus.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `orborus.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
| `orborus.executionConcurrency` | The maximum amount of concurrent workflow executions per worker | `25` |
|
||||
| `orborus.manageWorkerDeployments` | Whether workers are deployed and managed by orborus. When disabled, every worker is expected to be already deployed (see worker.enableHelmDeployment). | `true` |
|
||||
|
||||
### worker Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `worker.enableHelmDeployment` | Deploy worker via helm. By default, workers are deployed by Orborus. | `false` |
|
||||
| `worker.image.registry` | worker image registry | `ghcr.io` |
|
||||
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
|
||||
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
|
||||
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `worker.image.pullPolicy` | worker image pull policy. Only effective with worker.enableHelmDeployment. | `IfNotPresent` |
|
||||
| `worker.image.pullSecrets` | worker image pull secrets. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.replicaCount` | Number of worker replicas to deploy. Only effective with worker.enableHelmDeployment. | `1` |
|
||||
| `worker.extraContainerPorts` | Optionally specify extra list of additional ports for worker containers. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.livenessProbe.enabled` | Enable livenessProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` |
|
||||
| `worker.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` |
|
||||
| `worker.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `15` |
|
||||
| `worker.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
|
||||
| `worker.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `4` |
|
||||
| `worker.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `worker.readinessProbe.enabled` | Enable readinessProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` |
|
||||
| `worker.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` |
|
||||
| `worker.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `worker.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `worker.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `worker.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `worker.startupProbe.enabled` | Enable startupProbe on worker containers. Only effective with worker.enableHelmDeployment. | `false` |
|
||||
| `worker.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
|
||||
| `worker.startupProbe.periodSeconds` | Period seconds for startupProbe | `1` |
|
||||
| `worker.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `worker.startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
|
||||
| `worker.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `worker.customLivenessProbe` | Custom livenessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.customReadinessProbe` | Custom readinessProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.customStartupProbe` | Custom startupProbe that overrides the default one. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.resourcesPreset` | Set worker container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if worker.resources is set (worker.resources is recommended for production). | `nano` |
|
||||
| `worker.resources` | Set worker container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `worker.podSecurityContext.enabled` | Enable worker pods' Security Context | `true` |
|
||||
@@ -541,6 +586,49 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
| `worker.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in worker container' Security Context | `false` |
|
||||
| `worker.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in worker container | `["ALL"]` |
|
||||
| `worker.containerSecurityContext.seccompProfile.type` | Set seccomp profile in worker container | `RuntimeDefault` |
|
||||
| `worker.command` | Override default worker container command (useful when using custom images). Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.args` | Override default worker container args (useful when using custom images). Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.automountServiceAccountToken` | Mount Service Account token in worker pods. Only effective with worker.enableHelmDeployment. | `true` |
|
||||
| `worker.hostAliases` | worker pods host aliases. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.deploymentAnnotations` | Annotations for worker deployment. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.podLabels` | Extra labels for worker pods. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.podAnnotations` | Annotations for worker pods. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.podAffinityPreset` | Pod affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `""` |
|
||||
| `worker.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `soft` |
|
||||
| `worker.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `worker.affinity` is set. Allowed values: `soft` or `hard`. Only effective with worker.enableHelmDeployment. | `""` |
|
||||
| `worker.nodeAffinityPreset.key` | Node label key to match. Ignored if `worker.affinity` is set | `""` |
|
||||
| `worker.nodeAffinityPreset.values` | Node label values to match. Ignored if `worker.affinity` is set | `[]` |
|
||||
| `worker.affinity` | Affinity for worker pods assignment. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.nodeSelector` | Node labels for worker pods assignment. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.tolerations` | Tolerations for worker pods assignment. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.updateStrategy.type` | worker deployment strategy type. Only effective with worker.enableHelmDeployment. | `RollingUpdate` |
|
||||
| `worker.priorityClassName` | worker pods' priorityClassName. Only effective with worker.enableHelmDeployment. | `""` |
|
||||
| `worker.topologySpreadConstraints` | Topology Spread Constraints for worker pod assignment spread across your cluster among failure-domains. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.schedulerName` | Name of the k8s scheduler (other than default) for worker pods. Only effective with worker.enableHelmDeployment. | `""` |
|
||||
| `worker.terminationGracePeriodSeconds` | Seconds worker pods need to terminate gracefully. Only effective with worker.enableHelmDeployment. | `""` |
|
||||
| `worker.lifecycleHooks` | for worker containers to automate configuration before or after startup. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.extraEnvVars` | Array with extra environment variables to add to worker containers. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. | `""` |
|
||||
| `worker.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for worker containers. Only effective with worker.enableHelmDeployment. | `""` |
|
||||
| `worker.extraVolumes` | Optionally specify extra list of additional volumes for the worker pods. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the worker containers. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.sidecars` | Add additional sidecar containers to the worker pods. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.initContainers` | Add additional init containers to the worker pods. Only effective with worker.enableHelmDeployment. | `[]` |
|
||||
| `worker.pdb.create` | Enable/disable a Pod Disruption Budget creation. Only effective with worker.enableHelmDeployment. | `true` |
|
||||
| `worker.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
|
||||
| `worker.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `worker.pdb.minAvailable` and `worker.pdb.maxUnavailable` are empty. | `""` |
|
||||
| `worker.autoscaling.vpa.enabled` | Enable VPA for worker pods. Only effective with worker.enableHelmDeployment. | `false` |
|
||||
| `worker.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
|
||||
| `worker.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
|
||||
| `worker.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
|
||||
| `worker.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
|
||||
| `worker.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
|
||||
| `worker.autoscaling.hpa.enabled` | Enable HPA for worker pods. Only effective with worker.enableHelmDeployment. | `false` |
|
||||
| `worker.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
|
||||
| `worker.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
|
||||
| `worker.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `worker.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
| `worker.service.labels` | Extra labels for worker service. Only effective with worker.enableHelmDeployment. | `{}` |
|
||||
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
@@ -552,6 +640,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
| `worker.manageAppDeployments` | Whether apps are deployed and managed by worker. When disabled, every used app is expected to to be already deployed (see app.deployViaHelm). | `true` |
|
||||
|
||||
### app Parameters
|
||||
|
||||
@@ -586,6 +675,11 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
| `app.exposedContainerPort` | The port that shuffle app containers will listen on for new requests. | `80` |
|
||||
| `app.sdkTimeout` | The timeout in seconds for app actions. | `300` |
|
||||
| `app.disableLogs` | Do not capture app logs. By default, app logs are captured, so that they are visible in the frontend. | `false` |
|
||||
| `app.deployViaHelm` | A list of apps that should be deployed using helm. | `{}` |
|
||||
| `app.deployViaHelm.MY_APP.app` | The name of the app (required, e.g. shuffle-tools) | |
|
||||
| `app.deployViaHelm.MY_APP.version` | The version of the app (required, e.g. 1.2.0) | |
|
||||
|
||||
### Traffic Exposure Parameters
|
||||
|
||||
@@ -654,19 +748,19 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
|
||||
### Init Container Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
|
||||
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnami/os-shell` |
|
||||
| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` |
|
||||
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
|
||||
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
|
||||
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
|
||||
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
|
||||
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
|
||||
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` |
|
||||
| `volumePermissions.image.registry` | OS Shell + Utility image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | OS Shell + Utility image repository | `bitnamilegacy/os-shell` |
|
||||
| `volumePermissions.image.tag` | OS Shell + Utility image tag (immutable tags are recommended) | `12-debian-12-r30` |
|
||||
| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` |
|
||||
| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` |
|
||||
| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
|
||||
| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` |
|
||||
| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` |
|
||||
| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` |
|
||||
|
||||
### OpenSearch Parameters
|
||||
|
||||
@@ -685,3 +779,5 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user