-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
cm-service: Add vault-secrets template cm-service: Add preinstall hook for db migration cm-service: configure butler cm-service: configure htcondor
- Loading branch information
1 parent
74f9820
commit 903c891
Showing
20 changed files
with
422 additions
and
304 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| apiVersion: v2 | ||
| appVersion: 0.1.2 | ||
| appVersion: 0.2.0 | ||
| description: Campaign Management for Rubin Data Release Production | ||
| name: cm-service | ||
| sources: | ||
| - https://github.com/lsst-dm/cm-service | ||
| - https://github.com/lsst-dm/cm-service | ||
| type: application | ||
| version: 1.0.0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| postgres-password: | ||
| description: >- | ||
| Password used to authenticate cm-service to its internal cnpg Postgres | ||
| server, deployed as part of the same Argo CD application. This secret can be | ||
| changed at any time, but the cm-service deployments will then have to be | ||
| restarted to pick up the new value. | ||
| generate: | ||
| type: password | ||
| # the database password has been generated in the postgres application; copy | ||
| # the secret from there if `internalDB` is set. | ||
| internalDatabasePassword: | ||
| description: "Password for the internal phalanx postgres database" | ||
| if: internalDB | ||
| copy: | ||
| application: postgres | ||
| key: cmservice_password |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: "{{ .Chart.Name }}-env" | ||
| labels: | ||
| {{- include "application.labels" . | nindent 4 }} | ||
| data: | ||
| ASGI__PREFIX: {{ .Values.config.pathPrefix | quote }} | ||
| {{- with .Values.config.db }} | ||
| DB__URL: "postgresql://{{ .username }}@{{ .hostname }}:{{ .port }}/{{ .name }}" | ||
| DB__ECHO: {{ .echo | quote }} | ||
| {{- end }} | ||
| LOGGING__PROFILE: {{ .Values.config.logProfile | quote }} | ||
| LOGGING__LEVEL: {{ .Values.config.logLevel | quote }} | ||
| --- | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: "{{ .Chart.Name }}-butler-env" | ||
| labels: | ||
| {{- include "application.labels" . | nindent 4 }} | ||
| data: | ||
| DAF_BUTLER_REPOSITORIES: {{ toJson .Values.config.butler.repositories | quote }} | ||
| --- | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: "{{ .Chart.Name }}-htcondor-env" | ||
| labels: | ||
| {{- include "application.labels" . | nindent 4 }} | ||
| data: | ||
| DAEMON__allocate_resources: "1" | ||
| HTCONDOR__schedd_host: {{ .Values.config.htcondor.scheddHost }} | ||
| HTCONDOR__collector_host: {{ .Values.config.htcondor.collectorHost }} | ||
| HTCONDOR__condor_home: /opt/htcondor | ||
| HTCONDOR__condor_submit_bin: /opt/htcondor/bin/condor_submit | ||
| HTCONDOR__condor_q_bin: /opt/htcondor/bin/condor_q | ||
| HTCONDOR__working_directory: /sdf/group/rubin/{{ .Values.config.outputVolume.subPath }} | ||
| HTCONDOR__fs_remote_dir: /sdf/group/rubin/services/htcondor/shared |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: "{{ .Chart.Name }}-config-daemon" | ||
| labels: | ||
| {{- include "application.labels" . | nindent 4 }} | ||
| data: | ||
| {{- with .Values.config.htcondor.config }} | ||
| config: | | ||
| {{- .contents | nindent 4 }} | ||
| {{- end }} |
121 changes: 121 additions & 0 deletions
121
applications/cm-service/templates/daemon-deployment.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: {{ .Chart.Name }}-daemon | ||
| labels: | ||
| {{- include "application.labels" . | nindent 4 }} | ||
| spec: | ||
| replicas: {{ .Values.daemon.replicaCount }} | ||
| revisionHistoryLimit: 2 | ||
| selector: | ||
| matchLabels: | ||
| {{- include "application.selectorLabels" . | nindent 6 }} | ||
| app.kubernetes.io/component: "daemon" | ||
| template: | ||
| metadata: | ||
| annotations: | ||
| {{- with .Values.daemon.podAnnotations }} | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| labels: | ||
| {{- include "application.selectorLabels" . | nindent 8 }} | ||
| app.kubernetes.io/component: "daemon" | ||
| spec: | ||
| securityContext: | ||
| runAsUser: 17951 | ||
| runAsGroup: 1126 | ||
| fsGroup: 1126 | ||
| runAsNonRoot: true | ||
| {{- with .Values.daemon.affinity }} | ||
| affinity: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| automountServiceAccountToken: false | ||
| containers: | ||
| - name: "{{ .Chart.Name }}-daemon" | ||
| image: "{{ .Values.daemon.image.repository }}:{{ .Values.daemon.image.tag | default .Chart.AppVersion }}" | ||
| imagePullPolicy: {{ .Values.daemon.image.pullPolicy }} | ||
| ports: | ||
| - name: "http" | ||
| containerPort: 8080 | ||
| protocol: "TCP" | ||
| readinessProbe: | ||
| httpGet: | ||
| path: "/healthz" | ||
| port: "http" | ||
| livenessProbe: | ||
| httpGet: | ||
| path: "/healthz" | ||
| port: "http" | ||
| envFrom: | ||
| - configMapRef: | ||
| name: {{ .Chart.Name }}-env | ||
| - configMapRef: | ||
| name: {{ .Chart.Name }}-butler-env | ||
| - configMapRef: | ||
| name: {{ .Chart.Name }}-htcondor-env | ||
| env: | ||
| - name: BUTLER__AUTHENTICATION_FILE | ||
| value: "/var/run/secrets/db-auth.yaml" | ||
| - name: DB__PASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: cm-service | ||
| key: internalDatabasePassword | ||
| resources: | ||
| {{- toYaml .Values.daemon.resources | nindent 12 }} | ||
| securityContext: | ||
| allowPrivilegeEscalation: false | ||
| capabilities: | ||
| drop: | ||
| - "all" | ||
| readOnlyRootFilesystem: true | ||
| volumeMounts: | ||
| {{- with .Values.config.outputVolume }} | ||
| - mountPath: {{ .mountPath }} | ||
| name: output-volume | ||
| subPath: {{ .subPath }} | ||
| {{- end }} | ||
| {{- with .Values.config.butler }} | ||
| - mountPath: {{ .mountPath }} | ||
| name: butler-repo-volume | ||
| subPath: {{ .subPath }} | ||
| {{- end }} | ||
| - mountPath: "/tmp" | ||
| name: "tmp-volume" | ||
| {{- with .Values.config.htcondor.fsRemoteDir }} | ||
| - mountPath: {{ .mountPath }} | ||
| name: condor-remote-volume | ||
| subPath: {{ .subPath }} | ||
| {{- end }} | ||
| - name: butler-registry-volume | ||
| mountPath: "/var/run/secrets" | ||
| readonly: true | ||
| volumes: | ||
| - name: output-volume | ||
| persistentVolumeClaim: | ||
| claimName: {{ .Chart.Name }}-output | ||
| - name: butler-repo-volume | ||
| persistentVolumeClaim: | ||
| claimName: {{ .Chart.Name }}-butler | ||
| - name: tmp-volume | ||
| emptyDir: | ||
| sizeLimit: 500Mi | ||
| - name: condor-remote-volume | ||
| persistentVolumeClaim: | ||
| claimName: {{ $.Chart.Name }}-htcondor | ||
| - name: butler-registry-volume | ||
| secret: | ||
| secretName: cm-service-butler | ||
| items: | ||
| - key: butler-registry | ||
| path: db-auth.yaml | ||
| mode: 0600 | ||
| {{- with .Values.daemon.nodeSelector }} | ||
| nodeSelector: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- with .Values.daemon.tolerations }} | ||
| tolerations: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} |
Oops, something went wrong.