admin feature : allow the possibility to call onyxia api to suspend a service

[alexisdondon]

The suspension of a service is a great feature to allow ressources savings.

Anyway none of my user click on suspend and we begin to implement an admin task running at regular interval to ask for the suspension of user service.

The workflow is:

• alertmanager to detect an alert of a "user service to suspend"
• with alert we need to:
  • find the release name (not always is the alert), find the version chart, add the repo or give the script the helm repo
  • do an helm upgrade to set the release to global.suspend = true.
• send en email to the user.

There is some drawbacks:

• i need to give this jobs the same rights that onyxia-api role (to be sure to make pause)
• i need to add to this job kubectl/helm configuration and probably to take care of the helm version in the future.
• i repeat the helm repositories

I don't know the signature of onyxia api to ask for suspension but if not too hard, impleting and admin endpoint to ask for the suspension of a user service with an api admin token or something else that secure the call could allow for us a simpler workflow:

• alertmanager
• find a way from the alert to feed the onyxia api call (depending of the api structure)
• call the api endpoint onyxia admin to ask for the suspension
• send a mail.

[fcomte]

what do you think ? @trygu @johnksv @olevitt

[olevitt]

I agree there is some logic hidden behind the "pause / resume" that makes scripting outside of Onyxia doable but not that easy.

Creating a /admin path in Onyxia-API with some endpoints (starting with the pause / resume) makes sense to me.
Creating another module (instead of adding that to Onyxia-API) does not seem worth it to me at the moment. If the admin features tend to grow a lot then we could still reconsider this and move that onto a new module.
As for the authentication, I think we can start simple with a admin token that would be provided in the env configuration. I also think the admin path should be disabled by default.

I will draft a PR to implement this. Feel free to comment and discuss in it :)