From 7673ba3b00718ea5a318c7668c51a7fb5bbc3a08 Mon Sep 17 00:00:00 2001 From: Asad Raheem Date: Thu, 29 Jan 2026 12:06:48 +0500 Subject: [PATCH] feat(chart): add Helm chart for Kubeflow Pipelines Signed-off-by: Asad Raheem --- manifests/helm/Chart.yaml | 15 + manifests/helm/templates/_helpers.tpl | 75 +++ manifests/helm/templates/api-server.yaml | 468 ++++++++++++++++++ manifests/helm/templates/cache-deployer.yaml | 103 ++++ .../templates/cache-mutating-webhook.yaml | 32 ++ manifests/helm/templates/cache.yaml | 209 ++++++++ manifests/helm/templates/cluster-rbac.yaml | 56 +++ manifests/helm/templates/configmap.yaml | 50 ++ manifests/helm/templates/crds.yaml | 222 +++++++++ manifests/helm/templates/externalsecret.yaml | 75 +++ manifests/helm/templates/metadata.yaml | 290 +++++++++++ .../helm/templates/mutating-webhook.yaml | 36 ++ manifests/helm/templates/namespace.yaml | 10 + .../helm/templates/persistence-agent.yaml | 145 ++++++ .../helm/templates/pipeline-runner-rbac.yaml | 119 +++++ manifests/helm/templates/rbac.yaml | 126 +++++ .../helm/templates/scheduled-workflow.yaml | 146 ++++++ .../templates/seaweedfs-artifact-secret.yaml | 14 + .../helm/templates/seaweedfs-deployment.yaml | 105 ++++ .../templates/seaweedfs-minio-service.yaml | 21 + .../templates/seaweedfs-networkpolicy.yaml | 39 ++ manifests/helm/templates/seaweedfs-pvc.yaml | 21 + manifests/helm/templates/seaweedfs-sa.yaml | 12 + .../helm/templates/seaweedfs-service.yaml | 40 ++ manifests/helm/templates/ui.yaml | 238 +++++++++ .../helm/templates/validating-webhook.yaml | 36 ++ manifests/helm/templates/viewer-crd.yaml | 113 +++++ manifests/helm/templates/visualization.yaml | 95 ++++ .../helm/templates/webhook-cert-issuer.yaml | 13 + manifests/helm/templates/webhook-cert.yaml | 52 ++ manifests/helm/values.yaml | 146 ++++++ 31 files changed, 3122 insertions(+) create mode 100644 manifests/helm/Chart.yaml create mode 100644 manifests/helm/templates/_helpers.tpl create mode 100644 manifests/helm/templates/api-server.yaml create mode 100644 manifests/helm/templates/cache-deployer.yaml create mode 100644 manifests/helm/templates/cache-mutating-webhook.yaml create mode 100644 manifests/helm/templates/cache.yaml create mode 100644 manifests/helm/templates/cluster-rbac.yaml create mode 100644 manifests/helm/templates/configmap.yaml create mode 100644 manifests/helm/templates/crds.yaml create mode 100644 manifests/helm/templates/externalsecret.yaml create mode 100644 manifests/helm/templates/metadata.yaml create mode 100644 manifests/helm/templates/mutating-webhook.yaml create mode 100644 manifests/helm/templates/namespace.yaml create mode 100644 manifests/helm/templates/persistence-agent.yaml create mode 100644 manifests/helm/templates/pipeline-runner-rbac.yaml create mode 100644 manifests/helm/templates/rbac.yaml create mode 100644 manifests/helm/templates/scheduled-workflow.yaml create mode 100644 manifests/helm/templates/seaweedfs-artifact-secret.yaml create mode 100644 manifests/helm/templates/seaweedfs-deployment.yaml create mode 100644 manifests/helm/templates/seaweedfs-minio-service.yaml create mode 100644 manifests/helm/templates/seaweedfs-networkpolicy.yaml create mode 100644 manifests/helm/templates/seaweedfs-pvc.yaml create mode 100644 manifests/helm/templates/seaweedfs-sa.yaml create mode 100644 manifests/helm/templates/seaweedfs-service.yaml create mode 100644 manifests/helm/templates/ui.yaml create mode 100644 manifests/helm/templates/validating-webhook.yaml create mode 100644 manifests/helm/templates/viewer-crd.yaml create mode 100644 manifests/helm/templates/visualization.yaml create mode 100644 manifests/helm/templates/webhook-cert-issuer.yaml create mode 100644 manifests/helm/templates/webhook-cert.yaml create mode 100644 manifests/helm/values.yaml diff --git a/manifests/helm/Chart.yaml b/manifests/helm/Chart.yaml new file mode 100644 index 00000000000..4977a088697 --- /dev/null +++ b/manifests/helm/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +name: kubeflow-pipelines +description: Kubeflow Pipelines v2.15.0 for Kubernetes Native API Mode +type: application +version: 2.15.0 +appVersion: "2.15.0" + + +annotations: {} + # Prerequisites: + # - cert-manager must be pre-installed (cluster-wide infrastructure) + # - Argo Workflows cluster resources must be pre-installed + # - MySQL database for ML Metadata (MLMD) - pipelines/versions stored as K8s CRs + # Note: Kubernetes-native mode stores pipelines as CRs, NOT in MySQL. + # MySQL is only used for ML Metadata artifact tracking. diff --git a/manifests/helm/templates/_helpers.tpl b/manifests/helm/templates/_helpers.tpl new file mode 100644 index 00000000000..ea05d8dc5ba --- /dev/null +++ b/manifests/helm/templates/_helpers.tpl @@ -0,0 +1,75 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "kubeflow-pipelines.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "kubeflow-pipelines.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "kubeflow-pipelines.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "kubeflow-pipelines.labels" -}} +helm.sh/chart: {{ include "kubeflow-pipelines.chart" . }} +{{ include "kubeflow-pipelines.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/part-of: kubeflow +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "kubeflow-pipelines.selectorLabels" -}} +app.kubernetes.io/name: {{ include "kubeflow-pipelines.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + + +{{/* +ServiceAccount annotations (for IRSA and custom annotations) +*/}} +{{- define "kubeflow-pipelines.serviceaccount-annotations" -}} +{{- with .Values.serviceAccount.annotations }} +{{- toYaml . | nindent 0 }} +{{- end }} +{{- end }} + +{{/* +Namespace helper +*/}} +{{- define "kubeflow-pipelines.namespace" -}} +{{- .Values.namespace.name | default "kubeflow" }} +{{- end }} + +{{/* +Compute checksum for config resources +*/}} +{{- define "kubeflow-pipelines.config-checksum" -}} +checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} +checksum/secret: {{ include (print $.Template.BasePath "/externalsecret.yaml") . | sha256sum }} +{{- end }} diff --git a/manifests/helm/templates/api-server.yaml b/manifests/helm/templates/api-server.yaml new file mode 100644 index 00000000000..5bc12e50109 --- /dev/null +++ b/manifests/helm/templates/api-server.yaml @@ -0,0 +1,468 @@ +{{- if .Values.components.apiserver.enabled }} +# API Server Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- if .Values.serviceAccount.annotations }} + {{- toYaml .Values.serviceAccount.annotations | nindent 4 }} + {{- else if .Values.components.apiserver.serviceAccount.annotations }} + {{- toYaml .Values.components.apiserver.serviceAccount.annotations | nindent 4 }} + {{- end }} + +--- +# API Server Service +apiVersion: v1 +kind: Service +metadata: + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + prometheus.io/port: "8888" + prometheus.io/scheme: http + prometheus.io/scrape: "true" +spec: + ports: + - name: http + port: 8888 + protocol: TCP + targetPort: 8888 + - name: grpc + port: 8887 + protocol: TCP + targetPort: 8887 + {{- if and .Values.kubernetesNative.enabled .Values.webhook.certManager.enabled }} + - name: webhook + port: 8443 + protocol: TCP + targetPort: 8443 + {{- end }} + selector: + app: ml-pipeline + +--- +# API Server Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + replicas: {{ .Values.components.apiserver.replicas }} + selector: + matchLabels: + app: ml-pipeline + template: + metadata: + labels: + app: ml-pipeline + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 8 }} + {{- include "kubeflow-pipelines.config-checksum" . | nindent 8 }} + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: ml-pipeline + {{- if eq .Values.storage.type "s3" }} + initContainers: + - name: verify-aws-access + image: amazon/aws-cli:latest + command: + - /bin/sh + - -c + - | + mkdir -p /tmp/.aws + export HOME=/tmp + export AWS_SHARED_CREDENTIALS_FILE=/tmp/.aws/credentials + export AWS_CONFIG_FILE=/tmp/.aws/config + echo "=== AWS Credential Check ===" + echo "Checking AWS identity..." + aws sts get-caller-identity || echo "ERROR: Failed to get AWS identity" + echo "" + echo "=== S3 Bucket Check ===" + echo "Bucket: {{ .Values.storage.bucket }}" + echo "Region: {{ .Values.storage.region }}" + echo "Checking if bucket exists and is accessible..." + aws s3api head-bucket --bucket {{ .Values.storage.bucket }} --region {{ .Values.storage.region }} || echo "ERROR: Failed to access bucket" + echo "Listing bucket contents..." + aws s3 ls s3://{{ .Values.storage.bucket }}/ --region {{ .Values.storage.region }} || echo "ERROR: Failed to list bucket" + env: + - name: AWS_REGION + value: {{ .Values.storage.region | quote }} + - name: AWS_DEFAULT_REGION + value: {{ .Values.storage.region | quote }} + - name: AWS_STS_REGIONAL_ENDPOINTS + value: "regional" + - name: HOME + value: /tmp + - name: AWS_SHARED_CREDENTIALS_FILE + value: /tmp/.aws/credentials + - name: AWS_CONFIG_FILE + value: /tmp/.aws/config + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + capabilities: + drop: + - ALL + {{- end }} + containers: + {{- if eq .Values.storage.type "s3" }} + - name: aws-credential-refresher + image: amazon/aws-cli:latest + command: + - /bin/sh + - -c + - | + export HOME=/tmp + export AWS_SHARED_CREDENTIALS_FILE=/tmp/.aws/credentials + export AWS_CONFIG_FILE=/tmp/.aws/config + mkdir -p /shared/aws-credentials + + # Function to fetch and write credentials + fetch_credentials() { + echo "=== Fetching AWS Credentials for MinIO Client ===" + + # Read the web identity token from file + WEB_IDENTITY_TOKEN=$(cat ${AWS_WEB_IDENTITY_TOKEN_FILE}) + + CREDS=$(aws sts assume-role-with-web-identity \ + --role-arn ${AWS_ROLE_ARN} \ + --role-session-name kubeflow-pipelines \ + --web-identity-token "${WEB_IDENTITY_TOKEN}" \ + --duration-seconds 3600 \ + --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \ + --output text 2>&1) + + if [ $? -eq 0 ]; then + ACCESS_KEY=$(echo $CREDS | awk '{print $1}') + SECRET_KEY=$(echo $CREDS | awk '{print $2}') + SESSION_TOKEN=$(echo $CREDS | awk '{print $3}') + + echo "AccessKeyId=${ACCESS_KEY}" > /shared/aws-credentials/accesskey + echo "SecretAccessKey=${SECRET_KEY}" > /shared/aws-credentials/secretkey + echo "SessionToken=${SESSION_TOKEN}" > /shared/aws-credentials/sessiontoken + echo "Region={{ .Values.storage.region }}" > /shared/aws-credentials/region + touch /shared/aws-credentials/.ready + echo "=== Credentials fetched successfully ===" + return 0 + else + echo "ERROR: Failed to fetch credentials: $CREDS" + return 1 + fi + } + + # Fetch initial credentials + fetch_credentials + + # Refresh credentials every 50 minutes (before 1-hour expiration) + while true; do + sleep 3000 # 50 minutes + fetch_credentials || echo "Warning: Failed to refresh credentials, will retry" + done + env: + - name: AWS_ROLE_ARN + {{- if .Values.components.apiserver.serviceAccount.annotations }} + value: {{ index .Values.components.apiserver.serviceAccount.annotations "eks.amazonaws.com/role-arn" | quote }} + {{- else if .Values.serviceAccount.annotations }} + value: {{ index .Values.serviceAccount.annotations "eks.amazonaws.com/role-arn" | quote }} + {{- end }} + - name: AWS_WEB_IDENTITY_TOKEN_FILE + value: /var/run/secrets/eks.amazonaws.com/serviceaccount/token + - name: AWS_REGION + value: {{ .Values.storage.region | quote }} + - name: AWS_DEFAULT_REGION + value: {{ .Values.storage.region | quote }} + - name: AWS_STS_REGIONAL_ENDPOINTS + value: "regional" + - name: HOME + value: /tmp + - name: AWS_SHARED_CREDENTIALS_FILE + value: /tmp/.aws/credentials + - name: AWS_CONFIG_FILE + value: /tmp/.aws/config + volumeMounts: + - name: aws-credentials + mountPath: /shared/aws-credentials + - name: aws-iam-token + mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount + readOnly: true + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + capabilities: + drop: + - ALL + resources: + requests: + cpu: 10m + memory: 64Mi + limits: + cpu: 50m + memory: 128Mi + {{- end }} + - name: ml-pipeline-api-server + image: {{ .Values.images.registry }}/kfp-api-server:{{ .Values.images.tag }} + imagePullPolicy: {{ .Values.images.pullPolicy }} + {{- if eq .Values.storage.type "s3" }} + command: + - /bin/sh + - -c + - | + # Wait for credentials to be ready + echo "Waiting for AWS credentials..." + while [ ! -f /shared/aws-credentials/.ready ]; do + sleep 1 + done + + # Read credentials from shared volume + export OBJECTSTORECONFIG_ACCESSKEY=$(cat /shared/aws-credentials/accesskey | cut -d'=' -f2) + export OBJECTSTORECONFIG_SECRETACCESSKEY=$(cat /shared/aws-credentials/secretkey | cut -d'=' -f2) + SESSION_TOKEN=$(cat /shared/aws-credentials/sessiontoken | cut -d'=' -f2) + + # Set session token for both MinIO client and AWS SDK + export AWS_SESSION_TOKEN="${SESSION_TOKEN}" + export OBJECTSTORECONFIG_SESSIONTOKEN="${SESSION_TOKEN}" + + # Also set standard AWS SDK environment variables as fallback + export AWS_ACCESS_KEY_ID="${OBJECTSTORECONFIG_ACCESSKEY}" + export AWS_SECRET_ACCESS_KEY="${OBJECTSTORECONFIG_SECRETACCESSKEY}" + + # Debug: Print credential lengths (not the actual values for security) + echo "Access Key length: ${#OBJECTSTORECONFIG_ACCESSKEY}" + echo "Secret Key length: ${#OBJECTSTORECONFIG_SECRETACCESSKEY}" + echo "Session Token length: ${#AWS_SESSION_TOKEN}" + + echo "AWS credentials loaded successfully" + + # Start the main application + exec /bin/apiserver \ + {{- if and .Values.kubernetesNative.enabled .Values.webhook.certManager.enabled }} + --config=/config \ + --sampleconfig=/config/sample_config.json \ + -logtostderr=true \ + --webhookTLSCertPath=/etc/webhook/certs/tls.crt \ + --webhookTLSKeyPath=/etc/webhook/certs/tls.key \ + --pipelinesStoreKubernetes=true + {{- else }} + --config=/etc/config/config.json \ + -logtostderr=true + {{- end }} + {{- else if and .Values.kubernetesNative.enabled .Values.webhook.certManager.enabled }} + command: + - "/bin/apiserver" + args: + - "--config=/config" + - "--sampleconfig=/config/sample_config.json" + - "-logtostderr=true" + - "--webhookTLSCertPath=/etc/webhook/certs/tls.crt" + - "--webhookTLSKeyPath=/etc/webhook/certs/tls.key" + - "--pipelinesStoreKubernetes=true" + {{- else }} + args: + - "--config=/etc/config/config.json" + - "--logtostderr=true" + {{- end }} + ports: + - name: http + containerPort: 8888 + protocol: TCP + - name: grpc + containerPort: 8887 + protocol: TCP + {{- if and .Values.kubernetesNative.enabled .Values.webhook.certManager.enabled }} + - name: webhook + containerPort: 8443 + protocol: TCP + {{- end }} + env: + - name: PUBLISH_LOGS + value: "true" + - name: LOG_LEVEL + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: LOG_LEVEL + - name: PIPELINE_LOG_LEVEL + value: "1" + - name: AUTO_UPDATE_PIPELINE_DEFAULT_VERSION + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: autoUpdatePipelineDefaultVersion + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: OBJECTSTORECONFIG_SECURE + value: {{ eq .Values.storage.type "s3" | ternary "true" "false" | quote }} + - name: OBJECTSTORECONFIG_BUCKETNAME + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: bucketName + {{- if eq .Values.storage.type "s3" }} + - name: OBJECTSTORECONFIG_HOST + value: "s3.{{ .Values.storage.region }}.amazonaws.com" + - name: OBJECTSTORECONFIG_REGION + value: {{ .Values.storage.region | quote }} + - name: AWS_REGION + value: {{ .Values.storage.region | quote }} + - name: AWS_DEFAULT_REGION + value: {{ .Values.storage.region | quote }} + - name: AWS_STS_REGIONAL_ENDPOINTS + value: "regional" + - name: AWS_SDK_LOAD_CONFIG + value: "true" + - name: AWS_LOG_LEVEL + value: "debug" + - name: AWS_ENABLE_ENDPOINT_DISCOVERY + value: "true" + # Note: OBJECTSTORECONFIG_ACCESSKEY and OBJECTSTORECONFIG_SECRETACCESSKEY are set by the wrapper script + # from credentials fetched by the aws-credential-refresher sidecar using IRSA + {{- else if or .Values.seaweedfs.enabled (eq .Values.storage.type "minio") }} + - name: OBJECTSTORECONFIG_HOST + value: "minio-service.{{ include "kubeflow-pipelines.namespace" . }}" + - name: OBJECTSTORECONFIG_PORT + value: "9000" + - name: OBJECTSTORECONFIG_ACCESSKEY + valueFrom: + secretKeyRef: + name: mlpipeline-minio-artifact + key: accesskey + - name: OBJECTSTORECONFIG_SECRETACCESSKEY + valueFrom: + secretKeyRef: + name: mlpipeline-minio-artifact + key: secretkey + {{- end }} + - name: V2_DRIVER_IMAGE + value: {{ .Values.images.registry }}/kfp-driver:{{ .Values.images.tag }} + - name: V2_LAUNCHER_IMAGE + value: {{ .Values.images.registry }}/kfp-launcher:{{ .Values.images.tag }} + - name: COMPILED_PIPELINE_SPEC_PATCH + value: "{}" + {{- if .Values.mysql.external }} + - name: DBCONFIG_CONMAXLIFETIME + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: ConMaxLifeTime + - name: DB_DRIVER_NAME + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: dbType + - name: DBCONFIG_MYSQLCONFIG_USER + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: username + - name: DBCONFIG_MYSQLCONFIG_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: password + - name: DBCONFIG_MYSQLCONFIG_DBNAME + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: pipelineDb + - name: DBCONFIG_MYSQLCONFIG_HOST + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: host + - name: DBCONFIG_MYSQLCONFIG_PORT + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: port + {{- end }} + volumeMounts: + {{- if eq .Values.storage.type "s3" }} + - name: aws-credentials + mountPath: /shared/aws-credentials + readOnly: true + {{- end }} + {{- if and .Values.kubernetesNative.enabled .Values.webhook.certManager.enabled }} + - name: webhook-certs + mountPath: /etc/webhook/certs + readOnly: true + {{- end }} + readinessProbe: + httpGet: + path: /apis/v1beta1/healthz + port: 8888 + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + livenessProbe: + httpGet: + path: /apis/v1beta1/healthz + port: 8888 + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + startupProbe: + httpGet: + path: /apis/v1beta1/healthz + port: 8888 + failureThreshold: 12 + periodSeconds: 5 + timeoutSeconds: 2 + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + resources: + {{- if .Values.components.apiserver.resources }} + {{- toYaml .Values.components.apiserver.resources | nindent 12 }} + {{- else }} + requests: + cpu: 250m + memory: 500Mi + {{- end }} + volumes: + {{- if eq .Values.storage.type "s3" }} + - name: aws-credentials + emptyDir: {} + - name: aws-iam-token + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + audience: sts.amazonaws.com + expirationSeconds: 86400 + path: token + {{- end }} + {{- if and .Values.kubernetesNative.enabled .Values.webhook.certManager.enabled }} + - name: webhook-certs + secret: + secretName: kfp-api-webhook-cert + {{- end }} +{{- end }} diff --git a/manifests/helm/templates/cache-deployer.yaml b/manifests/helm/templates/cache-deployer.yaml new file mode 100644 index 00000000000..3faccc14355 --- /dev/null +++ b/manifests/helm/templates/cache-deployer.yaml @@ -0,0 +1,103 @@ +{{- if and .Values.components.cacheDeployer.enabled (not .Values.webhook.certManager.enabled) }} +# Cache Deployer Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubeflow-pipelines-cache-deployer-sa + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: cache-deployer + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- include "kubeflow-pipelines.serviceaccount-annotations" . | nindent 4 }} + +--- +# Cache Deployer Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kubeflow-pipelines-cache-deployer-role + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: cache-deployer +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - patch + - list + +--- +# Cache Deployer RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubeflow-pipelines-cache-deployer-binding + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: cache-deployer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubeflow-pipelines-cache-deployer-role +subjects: + - kind: ServiceAccount + name: kubeflow-pipelines-cache-deployer-sa + namespace: {{ include "kubeflow-pipelines.namespace" . }} + +--- +# Cache Deployer Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cache-deployer-deployment + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: cache-deployer +spec: + replicas: {{ .Values.components.cacheDeployer.replicas | default 1 }} + selector: + matchLabels: + app: cache-deployer + strategy: + type: Recreate + template: + metadata: + labels: + app: cache-deployer + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + {{- include "kubeflow-pipelines.config-checksum" . | nindent 8 }} + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: kubeflow-pipelines-cache-deployer-sa + containers: + - name: main + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + image: {{ .Values.images.registry }}/kfp-cache-deployer:{{ .Values.images.tag }} + imagePullPolicy: Always + env: + - name: NAMESPACE_TO_WATCH + valueFrom: + fieldRef: + fieldPath: metadata.namespace + restartPolicy: Always +{{- end }} diff --git a/manifests/helm/templates/cache-mutating-webhook.yaml b/manifests/helm/templates/cache-mutating-webhook.yaml new file mode 100644 index 00000000000..1ab5902fffc --- /dev/null +++ b/manifests/helm/templates/cache-mutating-webhook.yaml @@ -0,0 +1,32 @@ +{{- if .Values.components.cache.enabled }} +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: cache-webhook-kubeflow + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- if .Values.webhook.certManager.enabled }} + cert-manager.io/inject-ca-from: {{ include "kubeflow-pipelines.namespace" . }}/kfp-cache-webhook-cert + {{- end }} +webhooks: + - name: cache-server.{{ include "kubeflow-pipelines.namespace" . }}.svc + clientConfig: + service: + name: cache-server + namespace: {{ include "kubeflow-pipelines.namespace" . }} + path: "/mutate" + failurePolicy: Ignore + rules: + - operations: ["CREATE"] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods"] + sideEffects: None + timeoutSeconds: 5 + objectSelector: + matchLabels: + pipelines.kubeflow.org/cache_enabled: "true" + admissionReviewVersions: ["v1"] +{{- end }} diff --git a/manifests/helm/templates/cache.yaml b/manifests/helm/templates/cache.yaml new file mode 100644 index 00000000000..8358922d2bd --- /dev/null +++ b/manifests/helm/templates/cache.yaml @@ -0,0 +1,209 @@ +{{- if .Values.components.cache.enabled }} +# Cache Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubeflow-pipelines-cache + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: cache-server + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- include "kubeflow-pipelines.serviceaccount-annotations" . | nindent 4 }} + +--- +# Cache Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kubeflow-pipelines-cache-role + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: kubeflow-pipelines-cache-role +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - update + - patch + +--- +# Cache RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubeflow-pipelines-cache-binding + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubeflow-pipelines-cache-role +subjects: + - kind: ServiceAccount + name: kubeflow-pipelines-cache + namespace: {{ include "kubeflow-pipelines.namespace" . }} + +--- +# Cache Service +apiVersion: v1 +kind: Service +metadata: + name: cache-server + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: cache-server +spec: + selector: + app: cache-server + ports: + - port: 443 + targetPort: webhook-api + +--- +# Cache Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cache-server + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: cache-server +spec: + replicas: {{ .Values.components.cache.replicas | default 1 }} + selector: + matchLabels: + app: cache-server + template: + metadata: + labels: + app: cache-server + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + {{- include "kubeflow-pipelines.config-checksum" . | nindent 8 }} + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: kubeflow-pipelines-cache + containers: + - name: server + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + image: {{ .Values.images.registry }}/kfp-cache-server:{{ .Values.images.tag }} + imagePullPolicy: Always + env: + - name: DEFAULT_CACHE_STALENESS + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: DEFAULT_CACHE_STALENESS + - name: MAXIMUM_CACHE_STALENESS + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: MAXIMUM_CACHE_STALENESS + - name: CACHE_IMAGE + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: cacheImage + - name: CACHE_NODE_RESTRICTIONS + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: cacheNodeRestrictions + - name: DBCONFIG_DRIVER + value: mysql + - name: DBCONFIG_DB_NAME + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: cacheDb + - name: DBCONFIG_HOST_NAME + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: dbHost + - name: DBCONFIG_PORT + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: dbPort + {{- if .Values.mysql.external }} + - name: DBCONFIG_USER + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: username + - name: DBCONFIG_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: password + {{- end }} + - name: NAMESPACE_TO_WATCH + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: WEBHOOK_PORT + value: "8443" + args: ["--db_driver=$(DBCONFIG_DRIVER)", + "--db_host=$(DBCONFIG_HOST_NAME)", + "--db_port=$(DBCONFIG_PORT)", + "--db_name=$(DBCONFIG_DB_NAME)", + "--db_user=$(DBCONFIG_USER)", + "--db_password=$(DBCONFIG_PASSWORD)", + "--namespace_to_watch=$(NAMESPACE_TO_WATCH)", + "--listen_port=$(WEBHOOK_PORT)"] + ports: + - containerPort: 8443 + name: webhook-api + volumeMounts: + - name: webhook-tls-certs + mountPath: /etc/webhook/certs + readOnly: true + volumes: + - name: webhook-tls-certs + secret: + secretName: webhook-server-tls + {{- if .Values.webhook.certManager.enabled }} + items: + - key: tls.crt + path: cert.pem + - key: tls.key + path: key.pem + {{- end }} +{{- end }} diff --git a/manifests/helm/templates/cluster-rbac.yaml b/manifests/helm/templates/cluster-rbac.yaml new file mode 100644 index 00000000000..fd9e2a0eab1 --- /dev/null +++ b/manifests/helm/templates/cluster-rbac.yaml @@ -0,0 +1,56 @@ +{{- if and .Values.components.cacheDeployer.enabled (not .Values.webhook.certManager.enabled) }} +# Cache Deployer ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kubeflow-pipelines-cache-deployer-clusterrole + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: kubeflow-pipelines-cache-deployer-clusterrole +rules: + - apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + - certificatesigningrequests/approval + verbs: + - create + - delete + - get + - update + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - apiGroups: + - certificates.k8s.io + resources: + - signers + resourceNames: + - kubernetes.io/* + verbs: + - approve + +--- +# Cache Deployer ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kubeflow-pipelines-cache-deployer-clusterrolebinding + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kubeflow-pipelines-cache-deployer-clusterrole +subjects: + - kind: ServiceAccount + name: kubeflow-pipelines-cache-deployer-sa + namespace: {{ include "kubeflow-pipelines.namespace" . }} +{{- end }} diff --git a/manifests/helm/templates/configmap.yaml b/manifests/helm/templates/configmap.yaml new file mode 100644 index 00000000000..d600af1cf46 --- /dev/null +++ b/manifests/helm/templates/configmap.yaml @@ -0,0 +1,50 @@ +{{- if .Values.components.apiserver.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: pipeline-install-config + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +data: + warning: | + 1. Do not use kubectl to edit this configmap, because some values are used + during helm template rendering. Instead, change the values.yaml and apply the entire + helm chart again. + 2. After updating the configmap, some deployments may need to be restarted + until the changes take effect. A quick way to restart all deployments in a + namespace: `kubectl rollout restart deployment -n `. + appName: pipeline + appVersion: {{ .Chart.AppVersion }} + {{- if .Values.mysql }} + dbHost: {{ .Values.mysql.host | default "mysql" }} + dbPort: {{ .Values.mysql.port | default "3306" | quote }} + dbType: mysql + mysqlHost: {{ .Values.mysql.host | default "mysql" }} + mysqlPort: {{ .Values.mysql.port | default "3306" | quote }} + mlmdDb: {{ .Values.mysql.database | default "metadb" }} + {{- else }} + dbHost: "" + dbPort: "3306" + dbType: mysql + mysqlHost: "" + mysqlPort: "3306" + mlmdDb: "" + {{- end }} + cacheDb: {{ .Values.config.cacheDb | default "cachedb" }} + pipelineDb: {{ .Values.config.pipelineDb | default "mlpipeline" }} + bucketName: {{ .Values.storage.bucket | default "mlpipeline" }} + defaultPipelineRoot: {{ .Values.storage.defaultPipelineRoot | default "" }} + autoUpdatePipelineDefaultVersion: {{ .Values.config.autoUpdatePipelineDefaultVersion | default "true" | quote }} + cronScheduleTimezone: {{ .Values.config.cronScheduleTimezone | default "UTC" | quote }} + cacheImage: {{ .Values.config.cacheImage | default "ghcr.io/containerd/busybox" | quote }} + cacheNodeRestrictions: {{ .Values.config.cacheNodeRestrictions | default "false" | quote }} + MAXIMUM_CACHE_STALENESS: {{ .Values.config.maximumCacheStaleness | default "" | quote }} + DEFAULT_CACHE_STALENESS: {{ .Values.config.defaultCacheStaleness | default "" | quote }} + ConMaxLifeTime: {{ .Values.config.conMaxLifeTime | default "120s" | quote }} + LOG_LEVEL: {{ .Values.config.logLevel | default "info" | quote }} + ARTIFACTS_PROXY_ENABLED: {{ .Values.config.artifactsProxyEnabled | default "false" | quote }} + ARTIFACT_RETENTION_DAYS: {{ .Values.config.artifactRetentionDays | default "-1" | quote }} +{{- end }} diff --git a/manifests/helm/templates/crds.yaml b/manifests/helm/templates/crds.yaml new file mode 100644 index 00000000000..03e5ea4d3b0 --- /dev/null +++ b/manifests/helm/templates/crds.yaml @@ -0,0 +1,222 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.4 + name: pipelines.pipelines.kubeflow.org +spec: + group: pipelines.kubeflow.org + names: + kind: Pipeline + listKind: PipelineList + plural: pipelines + singular: pipeline + scope: Namespaced + versions: + - name: v2beta1 + schema: + openAPIV3Schema: + description: Pipeline is the Schema for the pipelines API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: PipelineSpec defines the desired state of Pipeline. + properties: + description: + type: string + displayName: + type: string + type: object + type: object + served: true + storage: true + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.4 + name: pipelineversions.pipelines.kubeflow.org +spec: + group: pipelines.kubeflow.org + names: + kind: PipelineVersion + listKind: PipelineVersionList + plural: pipelineversions + singular: pipelineversion + scope: Namespaced + versions: + - name: v2beta1 + schema: + openAPIV3Schema: + description: PipelineVersion is the Schema for the pipelineversions API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: PipelineVersionSpec defines the desired state of PipelineVersion. + properties: + codeSourceURL: + type: string + description: + type: string + displayName: + type: string + pipelineName: + type: string + pipelineSpec: + x-kubernetes-preserve-unknown-fields: true + pipelineSpecURI: + type: string + platformSpec: + x-kubernetes-preserve-unknown-fields: true + required: + - pipelineSpec + type: object + status: + description: PipelineVersionStatus defines the observed state of PipelineVersion. + properties: + conditions: + items: + description: |- + SimplifiedCondition is a metav1.Condition without lastTransitionTime since the database model doesn't have such + a concept and it allows a default status in the CRD without a controller setting it. + properties: + message: + maxLength: 32768 + type: string + reason: + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - message + - reason + - status + - type + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: scheduledworkflows.kubeflow.org +spec: + group: kubeflow.org + names: + kind: ScheduledWorkflow + listKind: ScheduledWorkflowList + plural: scheduledworkflows + singular: scheduledworkflow + shortNames: + - swf + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + type: object + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic + status: + type: object + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic + required: + - spec + - status + type: object + served: true + storage: true + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: viewers.kubeflow.org +spec: + group: kubeflow.org + names: + kind: Viewer + listKind: ViewerList + plural: viewers + singular: viewer + shortNames: + - vi + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + type: object + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic + required: + - spec + type: object + served: true + storage: true diff --git a/manifests/helm/templates/externalsecret.yaml b/manifests/helm/templates/externalsecret.yaml new file mode 100644 index 00000000000..9a6ac57a07c --- /dev/null +++ b/manifests/helm/templates/externalsecret.yaml @@ -0,0 +1,75 @@ +{{- if and .Values.mysql.external .Values.externalSecrets.enabled .Values.externalSecrets.mysql.secretStore }} +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: {{ .Values.mysql.secretName }} + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + refreshInterval: 5m + secretStoreRef: + name: {{ .Values.externalSecrets.mysql.secretStore }} + kind: SecretStore + target: + name: {{ .Values.mysql.secretName }} + creationPolicy: Owner + data: + - secretKey: host + remoteRef: + key: {{ .Values.externalSecrets.mysql.remoteSecretKey }} + property: host + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + - secretKey: port + remoteRef: + key: {{ .Values.externalSecrets.mysql.remoteSecretKey }} + property: port + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + - secretKey: dbname + remoteRef: + key: {{ .Values.externalSecrets.mysql.remoteSecretKey }} + property: dbname + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + - secretKey: username + remoteRef: + key: {{ .Values.externalSecrets.mysql.remoteSecretKey }} + property: username + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + - secretKey: password + remoteRef: + key: {{ .Values.externalSecrets.mysql.remoteSecretKey }} + property: password + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + +--- +apiVersion: external-secrets.io/v1beta1 +kind: SecretStore +metadata: + name: {{ .Values.externalSecrets.mysql.secretStore }} + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + provider: + aws: + service: SecretsManager + region: {{ .Values.global.region }} + auth: + jwt: + serviceAccountRef: + name: ml-pipeline +{{- end }} diff --git a/manifests/helm/templates/metadata.yaml b/manifests/helm/templates/metadata.yaml new file mode 100644 index 00000000000..6a5747a6d91 --- /dev/null +++ b/manifests/helm/templates/metadata.yaml @@ -0,0 +1,290 @@ +{{- if .Values.components.metadata.enabled }} +# Metadata gRPC ConfigMap +apiVersion: v1 +kind: ConfigMap +metadata: + name: metadata-grpc-configmap + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + component: metadata-grpc-server +data: + METADATA_GRPC_SERVICE_HOST: "metadata-grpc-service" + METADATA_GRPC_SERVICE_PORT: "8080" + +--- +# Metadata Envoy ConfigMap +apiVersion: v1 +kind: ConfigMap +metadata: + name: metadata-envoy-configmap + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + component: metadata-envoy +data: + envoy-config.yaml: |- + admin: + access_log: + name: admin_access + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog + path: /tmp/admin_access.log + address: + socket_address: { address: 0.0.0.0, port_value: 9901 } + + static_resources: + listeners: + - name: listener_0 + address: + socket_address: { address: 0.0.0.0, port_value: 9090 } + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + codec_type: auto + stat_prefix: ingress_http + route_config: + name: local_route + virtual_hosts: + - name: local_service + domains: [ "*" ] + routes: + - match: { prefix: "/" } + route: + cluster: metadata-cluster + max_stream_duration: + grpc_timeout_header_max: '0s' + typed_per_filter_config: + envoy.filter.http.cors: + "@type": type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy + allow_origin_string_match: + - safe_regex: + regex: ".*" + allow_methods: GET, PUT, DELETE, POST, OPTIONS + allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,custom-header-1,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout + max_age: "1728000" + expose_headers: custom-header-1,grpc-status,grpc-message + http_filters: + - name: envoy.filters.http.grpc_web + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb + - name: envoy.filters.http.cors + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + clusters: + - name: metadata-cluster + connect_timeout: 30.0s + type: logical_dns + typed_extension_protocol_options: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + explicit_http_config: + http2_protocol_options: { } + lb_policy: round_robin + load_assignment: + cluster_name: metadata-grpc + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: metadata-grpc-service + port_value: 8080 + +--- +# Metadata gRPC Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: metadata-grpc-server + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + component: metadata-grpc-server + +--- +# Metadata gRPC Service +apiVersion: v1 +kind: Service +metadata: + name: metadata-grpc-service + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: metadata +spec: + selector: + component: metadata-grpc-server + type: ClusterIP + ports: + - port: 8080 + protocol: TCP + name: grpc-api + +--- +# Metadata gRPC Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: metadata-grpc-deployment + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + component: metadata-grpc-server +spec: + replicas: {{ .Values.components.metadata.replicas }} + selector: + matchLabels: + component: metadata-grpc-server + template: + metadata: + labels: + component: metadata-grpc-server + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + {{- include "kubeflow-pipelines.config-checksum" . | nindent 8 }} + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: metadata-grpc-server + containers: + - name: container + image: {{ .Values.metadata.image | default "gcr.io/tfx-oss-public/ml_metadata_store_server:1.14.0" }} + securityContext: + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + env: + {{- if .Values.mysql.external }} + - name: DBCONFIG_USER + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: username + - name: DBCONFIG_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: password + - name: MYSQL_DATABASE + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: mlmdDb + - name: MYSQL_HOST + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: host + - name: MYSQL_PORT + valueFrom: + secretKeyRef: + name: {{ .Values.mysql.secretName }} + key: port + {{- end }} + command: ["/bin/metadata_store_server"] + args: ["--grpc_port=8080", + "--mysql_config_database=$(MYSQL_DATABASE)", + "--mysql_config_host=$(MYSQL_HOST)", + "--mysql_config_port=$(MYSQL_PORT)", + "--mysql_config_user=$(DBCONFIG_USER)", + "--mysql_config_password=$(DBCONFIG_PASSWORD)", + "--enable_database_upgrade=true", + "--grpc_channel_arguments=grpc.max_metadata_size=16384"] + ports: + - name: grpc-api + containerPort: 8080 + livenessProbe: + tcpSocket: + port: grpc-api + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + readinessProbe: + tcpSocket: + port: grpc-api + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + +--- +# Metadata Envoy Service +apiVersion: v1 +kind: Service +metadata: + name: metadata-envoy-service + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: metadata-envoy +spec: + selector: + component: metadata-envoy + type: ClusterIP + ports: + - port: 9090 + protocol: TCP + name: md-envoy + +--- +# Metadata Envoy Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: metadata-envoy-deployment + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + component: metadata-envoy +spec: + replicas: {{ .Values.components.metadata.replicas }} + selector: + matchLabels: + component: metadata-envoy + template: + metadata: + labels: + component: metadata-envoy + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + sidecar.istio.io/inject: "false" + spec: + containers: + - name: container + image: {{ .Values.images.registry }}/kfp-metadata-envoy:{{ .Values.images.tag }} + imagePullPolicy: {{ .Values.images.pullPolicy }} + args: ["/etc/envoy/envoy-config.yaml"] + ports: + - name: md-envoy + containerPort: 9090 + - name: envoy-admin + containerPort: 9901 + securityContext: + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + volumeMounts: + - name: envoy-config + mountPath: /etc/envoy + volumes: + - name: envoy-config + configMap: + name: metadata-envoy-configmap +{{- end }} diff --git a/manifests/helm/templates/mutating-webhook.yaml b/manifests/helm/templates/mutating-webhook.yaml new file mode 100644 index 00000000000..d61b4770867 --- /dev/null +++ b/manifests/helm/templates/mutating-webhook.yaml @@ -0,0 +1,36 @@ +{{- if and .Values.components.apiserver.enabled .Values.kubernetesNative.enabled }} +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: pipelineversions.pipelines.kubeflow.org + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- if .Values.webhook.certManager.enabled }} + cert-manager.io/inject-ca-from: {{ include "kubeflow-pipelines.namespace" . }}/kfp-api-webhook-cert + {{- end }} +webhooks: + - name: pipelineversions.pipelines.kubeflow.org + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - pipelines.kubeflow.org + apiVersions: + - v2beta1 + resources: + - pipelineversions + scope: Namespaced + admissionReviewVersions: + - v1 + sideEffects: None + failurePolicy: Fail + clientConfig: + service: + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} + path: /webhooks/mutate-pipelineversion + port: 8443 +{{- end }} diff --git a/manifests/helm/templates/namespace.yaml b/manifests/helm/templates/namespace.yaml new file mode 100644 index 00000000000..3c312092241 --- /dev/null +++ b/manifests/helm/templates/namespace.yaml @@ -0,0 +1,10 @@ +{{- if .Values.namespace.create }} +apiVersion: v1 +kind: Namespace +metadata: + name: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +{{- end }} diff --git a/manifests/helm/templates/persistence-agent.yaml b/manifests/helm/templates/persistence-agent.yaml new file mode 100644 index 00000000000..da7ba6b1a3c --- /dev/null +++ b/manifests/helm/templates/persistence-agent.yaml @@ -0,0 +1,145 @@ +{{- if .Values.components.persistenceagent.enabled }} +# Persistence Agent Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline-persistenceagent + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-persistenceagent + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- include "kubeflow-pipelines.serviceaccount-annotations" . | nindent 4 }} + +--- +# Persistence Agent Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ml-pipeline-persistenceagent-role + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +rules: + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + verbs: + - get + - list + - watch + - apiGroups: + - pipelines.kubeflow.org + resources: + - scheduledworkflows + - workflows + verbs: + - report + - apiGroups: + - pipelines.kubeflow.org + resources: + - runs + verbs: + - reportMetrics + - readArtifact + +--- +# Persistence Agent RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ml-pipeline-persistenceagent-binding + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ml-pipeline-persistenceagent-role +subjects: + - kind: ServiceAccount + name: ml-pipeline-persistenceagent + namespace: {{ include "kubeflow-pipelines.namespace" . }} + +--- +# Persistence Agent Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ml-pipeline-persistenceagent + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-persistenceagent +spec: + replicas: {{ .Values.components.persistenceagent.replicas }} + selector: + matchLabels: + app: ml-pipeline-persistenceagent + template: + metadata: + labels: + app: ml-pipeline-persistenceagent + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + {{- include "kubeflow-pipelines.config-checksum" . | nindent 8 }} + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: ml-pipeline-persistenceagent + containers: + - name: ml-pipeline-persistenceagent + image: {{ .Values.images.registry }}/kfp-persistence-agent:{{ .Values.images.tag }} + imagePullPolicy: {{ .Values.images.pullPolicy }} + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: TTL_SECONDS_AFTER_WORKFLOW_FINISH + value: "86400" + - name: NUM_WORKERS + value: "2" + - name: LOG_LEVEL + value: "info" + volumeMounts: + - mountPath: /var/run/secrets/kubeflow/tokens + name: persistenceagent-sa-token + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + resources: + {{- if .Values.components.persistenceagent.resources }} + {{- toYaml .Values.components.persistenceagent.resources | nindent 12 }} + {{- else }} + requests: + cpu: 120m + memory: 500Mi + {{- end }} + volumes: + - name: persistenceagent-sa-token + projected: + sources: + - serviceAccountToken: + path: persistenceagent-sa-token + expirationSeconds: 3600 + audience: pipelines.kubeflow.org +{{- end }} diff --git a/manifests/helm/templates/pipeline-runner-rbac.yaml b/manifests/helm/templates/pipeline-runner-rbac.yaml new file mode 100644 index 00000000000..190ed2d44fa --- /dev/null +++ b/manifests/helm/templates/pipeline-runner-rbac.yaml @@ -0,0 +1,119 @@ +# Pipeline Runner Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: pipeline-runner + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + +--- +# Pipeline Runner Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: pipeline-runner + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - watch + - list + - apiGroups: + - "" + resources: + - persistentvolumes + - persistentvolumeclaims + verbs: + - '*' + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + verbs: + - create + - delete + - get + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + resources: + - pods + - pods/exec + - pods/log + - services + verbs: + - '*' + - apiGroups: + - "" + - apps + - extensions + resources: + - deployments + - replicasets + verbs: + - '*' + - apiGroups: + - kubeflow.org + resources: + - '*' + verbs: + - '*' + - apiGroups: + - batch + resources: + - jobs + verbs: + - '*' + - apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments + verbs: + - '*' + - apiGroups: + - argoproj.io + resources: + - workflowtaskresults + verbs: + - create + - patch + +--- +# Pipeline Runner RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: pipeline-runner-binding + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: pipeline-runner +subjects: + - kind: ServiceAccount + name: pipeline-runner + namespace: {{ include "kubeflow-pipelines.namespace" . }} diff --git a/manifests/helm/templates/rbac.yaml b/manifests/helm/templates/rbac.yaml new file mode 100644 index 00000000000..ac83485fc66 --- /dev/null +++ b/manifests/helm/templates/rbac.yaml @@ -0,0 +1,126 @@ +{{- if .Values.components.apiserver.enabled }} +# API Server Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - get + - list + - delete + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + verbs: + - create + - get + - list + - update + - patch + - delete + - apiGroups: + - kubeflow.org + resources: + - scheduledworkflows/finalizers + verbs: + - update + {{- if .Values.kubernetesNative.enabled }} + # Kubernetes Native Mode: Pipeline CRD permissions + - apiGroups: + - pipelines.kubeflow.org + resources: + - pipelines + - pipelines/finalizers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + # Kubernetes Native Mode: PipelineVersion CRD permissions + - apiGroups: + - pipelines.kubeflow.org + resources: + - pipelineversions + - pipelineversions/status + - pipelineversions/finalizers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + {{- else }} + # Non-native mode: read-only Pipeline access + - apiGroups: + - pipelines.kubeflow.org + resources: + - pipelines + verbs: + - get + - list + - watch + {{- end }} + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + +--- +# API Server RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ml-pipeline +subjects: + - kind: ServiceAccount + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} +{{- end }} diff --git a/manifests/helm/templates/scheduled-workflow.yaml b/manifests/helm/templates/scheduled-workflow.yaml new file mode 100644 index 00000000000..97ca57f7160 --- /dev/null +++ b/manifests/helm/templates/scheduled-workflow.yaml @@ -0,0 +1,146 @@ +{{- if .Values.components.scheduledworkflow.enabled }} +# Scheduled Workflow Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline-scheduledworkflow + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-scheduledworkflow + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- include "kubeflow-pipelines.serviceaccount-annotations" . | nindent 4 }} + +--- +# Scheduled Workflow Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ml-pipeline-scheduledworkflow-role + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-scheduledworkflow-role +rules: + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + - scheduledworkflows/finalizers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - pipelines.kubeflow.org + resources: + - runs + verbs: + - create + - apiGroups: + - '' + resources: + - events + verbs: + - create + - patch + +--- +# Scheduled Workflow RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ml-pipeline-scheduledworkflow-binding + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ml-pipeline-scheduledworkflow-role +subjects: + - kind: ServiceAccount + name: ml-pipeline-scheduledworkflow + namespace: {{ include "kubeflow-pipelines.namespace" . }} + +--- +# Scheduled Workflow Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ml-pipeline-scheduledworkflow + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-scheduledworkflow +spec: + replicas: {{ .Values.components.scheduledworkflow.replicas }} + selector: + matchLabels: + app: ml-pipeline-scheduledworkflow + template: + metadata: + labels: + app: ml-pipeline-scheduledworkflow + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + {{- include "kubeflow-pipelines.config-checksum" . | nindent 8 }} + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: ml-pipeline-scheduledworkflow + containers: + - name: ml-pipeline-scheduledworkflow + image: {{ .Values.images.registry }}/kfp-scheduled-workflow-controller:{{ .Values.images.tag }} + imagePullPolicy: {{ .Values.images.pullPolicy }} + env: + - name: LOG_LEVEL + value: "info" + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CRON_SCHEDULE_TIMEZONE + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: cronScheduleTimezone + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /var/run/secrets/kubeflow/tokens + name: scheduledworkflow-sa-token + volumes: + - name: scheduledworkflow-sa-token + projected: + sources: + - serviceAccountToken: + path: scheduledworkflow-sa-token + expirationSeconds: 3600 + audience: pipelines.kubeflow.org +{{- end }} diff --git a/manifests/helm/templates/seaweedfs-artifact-secret.yaml b/manifests/helm/templates/seaweedfs-artifact-secret.yaml new file mode 100644 index 00000000000..1b7c1aff9f6 --- /dev/null +++ b/manifests/helm/templates/seaweedfs-artifact-secret.yaml @@ -0,0 +1,14 @@ +{{- if .Values.seaweedfs.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: mlpipeline-minio-artifact + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +stringData: + accesskey: {{ .Values.seaweedfs.accessKey | default "minio" }} + secretkey: {{ .Values.seaweedfs.secretKey | default "minio123" }} +{{- end }} diff --git a/manifests/helm/templates/seaweedfs-deployment.yaml b/manifests/helm/templates/seaweedfs-deployment.yaml new file mode 100644 index 00000000000..c4df0f03458 --- /dev/null +++ b/manifests/helm/templates/seaweedfs-deployment.yaml @@ -0,0 +1,105 @@ +{{- if .Values.seaweedfs.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: seaweedfs + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: seaweedfs + application-crd-id: kubeflow-pipelines + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + selector: + matchLabels: + app: seaweedfs + strategy: + type: Recreate + replicas: 1 + template: + metadata: + labels: + app: seaweedfs + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + application-crd-id: kubeflow-pipelines + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + fsGroup: 1000 + fsGroupChangePolicy: "OnRootMismatch" + serviceAccountName: seaweedfs + containers: + - name: seaweedfs + envFrom: + - secretRef: + name: mlpipeline-minio-artifact + image: {{ .Values.seaweedfs.image | default "chrislusf/seaweedfs:4.00" }} + imagePullPolicy: {{ .Values.images.pullPolicy }} + args: + - "server" + - "-dir=/data" + - "-s3" + - "-iam" + - "-filer" + - "-master.volumePreallocate=false" + lifecycle: + postStart: + exec: + command: + - /bin/sh + - -ec + - | + # wait until seaweedfs master is ready + for i in $(seq 1 120); do + if wget -q --spider http://127.0.0.1:8333/status; then + break + fi + sleep 2 + done + # create bucket if not exists (ignore error if exists) + echo "s3.bucket.create --name mlpipeline" | /usr/bin/weed shell || true + # configure admin user using keys from secret + echo "s3.configure -user kubeflow-admin -access_key $accesskey -secret_key $secretkey -actions Admin -apply" | /usr/bin/weed shell + ports: + - containerPort: 8333 + - containerPort: 8111 + - containerPort: 9333 + - containerPort: 19333 + - containerPort: 8888 + readinessProbe: + httpGet: + path: /status + port: 8333 + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 15 + successThreshold: 1 + failureThreshold: 100 + timeoutSeconds: 10 + securityContext: + allowPrivilegeEscalation: false + privileged: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /data + name: data + resources: + {{- if .Values.seaweedfs.resources }} + {{- toYaml .Values.seaweedfs.resources | nindent 12 }} + {{- else }} + requests: + cpu: 32m + memory: 128Mi + {{- end }} + volumes: + - name: data + persistentVolumeClaim: + claimName: seaweedfs-pvc +{{- end }} diff --git a/manifests/helm/templates/seaweedfs-minio-service.yaml b/manifests/helm/templates/seaweedfs-minio-service.yaml new file mode 100644 index 00000000000..e039d42f1d2 --- /dev/null +++ b/manifests/helm/templates/seaweedfs-minio-service.yaml @@ -0,0 +1,21 @@ +{{- if .Values.seaweedfs.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: minio-service + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: seaweedfs + component: minio-compatibility + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + ports: + - name: http + port: 9000 + protocol: TCP + targetPort: 8333 + selector: + app: seaweedfs +{{- end }} diff --git a/manifests/helm/templates/seaweedfs-networkpolicy.yaml b/manifests/helm/templates/seaweedfs-networkpolicy.yaml new file mode 100644 index 00000000000..838df0eb533 --- /dev/null +++ b/manifests/helm/templates/seaweedfs-networkpolicy.yaml @@ -0,0 +1,39 @@ +{{- if and .Values.seaweedfs.enabled .Values.seaweedfs.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: seaweedfs + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +spec: + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: app.kubernetes.io/part-of + operator: In + values: + - kubeflow-profile + ports: + - port: 8333 + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - istio-system + - from: + - podSelector: {} + ports: + - port: 8333 + podSelector: + matchExpressions: + - key: app + operator: In + values: + - seaweedfs + policyTypes: + - Ingress +{{- end }} diff --git a/manifests/helm/templates/seaweedfs-pvc.yaml b/manifests/helm/templates/seaweedfs-pvc.yaml new file mode 100644 index 00000000000..5d2a714a877 --- /dev/null +++ b/manifests/helm/templates/seaweedfs-pvc.yaml @@ -0,0 +1,21 @@ +{{- if .Values.seaweedfs.enabled }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: seaweedfs-pvc + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: seaweedfs + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ .Values.seaweedfs.storage.size | default "20Gi" }} + {{- if .Values.seaweedfs.storage.storageClassName }} + storageClassName: {{ .Values.seaweedfs.storage.storageClassName }} + {{- end }} +{{- end }} diff --git a/manifests/helm/templates/seaweedfs-sa.yaml b/manifests/helm/templates/seaweedfs-sa.yaml new file mode 100644 index 00000000000..0e3a17bed5c --- /dev/null +++ b/manifests/helm/templates/seaweedfs-sa.yaml @@ -0,0 +1,12 @@ +{{- if .Values.seaweedfs.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: seaweedfs + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: seaweedfs + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +{{- end }} diff --git a/manifests/helm/templates/seaweedfs-service.yaml b/manifests/helm/templates/seaweedfs-service.yaml new file mode 100644 index 00000000000..36351bc005d --- /dev/null +++ b/manifests/helm/templates/seaweedfs-service.yaml @@ -0,0 +1,40 @@ +{{- if .Values.seaweedfs.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: seaweedfs + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: seaweedfs + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + ports: + - name: http-iam + port: 8111 + protocol: TCP + targetPort: 8111 + - name: http-s3 + port: 8333 + protocol: TCP + targetPort: 8333 + - name: http-master + port: 9333 + protocol: TCP + targetPort: 9333 + - name: grpc-master + port: 19333 + protocol: TCP + targetPort: 19333 + - name: grpc-filer + port: 18888 + protocol: TCP + targetPort: 18888 + - name: http-filer + port: 8888 + protocol: TCP + targetPort: 8888 + selector: + app: seaweedfs +{{- end }} diff --git a/manifests/helm/templates/ui.yaml b/manifests/helm/templates/ui.yaml new file mode 100644 index 00000000000..6fba155044c --- /dev/null +++ b/manifests/helm/templates/ui.yaml @@ -0,0 +1,238 @@ +{{- if .Values.components.ui.enabled }} +# UI ConfigMap +apiVersion: v1 +kind: ConfigMap +metadata: + name: ml-pipeline-ui-configmap + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-ui + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +data: + viewer-pod-template.json: |- + { + "spec": { + "serviceAccountName": "kubeflow-pipelines-viewer" + } + } + +--- +# UI Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline-ui + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-ui + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- include "kubeflow-pipelines.serviceaccount-annotations" . | nindent 4 }} + +--- +# UI Service +apiVersion: v1 +kind: Service +metadata: + name: ml-pipeline-ui + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-ui + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + ports: + - name: http + protocol: TCP + port: 80 + targetPort: 3000 + selector: + app: ml-pipeline-ui + +--- +# UI Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ml-pipeline-ui + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-ui + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + replicas: {{ .Values.components.ui.replicas }} + selector: + matchLabels: + app: ml-pipeline-ui + template: + metadata: + labels: + app: ml-pipeline-ui + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 8 }} + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: ml-pipeline-ui + volumes: + - name: config-volume + configMap: + name: ml-pipeline-ui-configmap + containers: + - name: ml-pipeline-ui + image: {{ .Values.images.registry }}/kfp-frontend:{{ .Values.images.tag }} + imagePullPolicy: {{ .Values.images.pullPolicy }} + ports: + - containerPort: 3000 + volumeMounts: + - name: config-volume + mountPath: /etc/config + readOnly: true + env: + - name: VIEWER_TENSORBOARD_POD_TEMPLATE_SPEC_PATH + value: /etc/config/viewer-pod-template.json + - name: MINIO_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if or .Values.seaweedfs.enabled (eq .Values.storage.type "minio") }} + - name: MINIO_ACCESS_KEY + valueFrom: + secretKeyRef: + name: mlpipeline-minio-artifact + key: accesskey + - name: MINIO_SECRET_KEY + valueFrom: + secretKeyRef: + name: mlpipeline-minio-artifact + key: secretkey + {{- end }} + - name: ALLOW_CUSTOM_VISUALIZATIONS + value: "true" + - name: FRONTEND_SERVER_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ARGO_ARCHIVE_LOGS + value: "true" + - name: DISABLE_GKE_METADATA + value: "true" + - name: ARTIFACTS_SERVICE_PROXY_ENABLED + valueFrom: + configMapKeyRef: + name: pipeline-install-config + key: ARTIFACTS_PROXY_ENABLED + optional: true + readinessProbe: + httpGet: + path: /apis/v1beta1/healthz + port: 3000 + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + livenessProbe: + httpGet: + path: /apis/v1beta1/healthz + port: 3000 + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + resources: + {{- if .Values.components.ui.resources }} + {{- toYaml .Values.components.ui.resources | nindent 12 }} + {{- else }} + requests: + cpu: 10m + memory: 70Mi + {{- end }} + +--- +# UI Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ml-pipeline-ui + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-ui + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - get + - apiGroups: + - "" + resources: + - events + verbs: + - list + - apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + - list + - apiGroups: + - "kubeflow.org" + resources: + - viewers + verbs: + - create + - get + - list + - watch + - delete + - apiGroups: + - "argoproj.io" + resources: + - workflows + verbs: + - get + - list + +--- +# UI RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ml-pipeline-ui + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-ui + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ml-pipeline-ui +subjects: + - kind: ServiceAccount + name: ml-pipeline-ui + namespace: {{ include "kubeflow-pipelines.namespace" . }} +{{- end }} diff --git a/manifests/helm/templates/validating-webhook.yaml b/manifests/helm/templates/validating-webhook.yaml new file mode 100644 index 00000000000..f9c6eda1c6a --- /dev/null +++ b/manifests/helm/templates/validating-webhook.yaml @@ -0,0 +1,36 @@ +{{- if and .Values.components.apiserver.enabled .Values.kubernetesNative.enabled }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: pipelineversions.pipelines.kubeflow.org + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} + {{- if .Values.webhook.certManager.enabled }} + cert-manager.io/inject-ca-from: {{ include "kubeflow-pipelines.namespace" . }}/kfp-api-webhook-cert + {{- end }} +webhooks: + - name: pipelineversions.pipelines.kubeflow.org + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - pipelines.kubeflow.org + apiVersions: + - v2beta1 + resources: + - pipelineversions + scope: Namespaced + admissionReviewVersions: + - v1 + sideEffects: None + failurePolicy: Fail + clientConfig: + service: + name: ml-pipeline + namespace: {{ include "kubeflow-pipelines.namespace" . }} + path: /webhooks/validate-pipelineversion + port: 8443 +{{- end }} diff --git a/manifests/helm/templates/viewer-crd.yaml b/manifests/helm/templates/viewer-crd.yaml new file mode 100644 index 00000000000..a0500b419d5 --- /dev/null +++ b/manifests/helm/templates/viewer-crd.yaml @@ -0,0 +1,113 @@ +{{- if .Values.components.viewercrd.enabled }} +# Viewer CRD Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline-viewer-crd-service-account + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-viewer-crd + +--- +# Viewer CRD Role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ml-pipeline-viewer-controller-role + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +rules: + - apiGroups: + - '*' + resources: + - deployments + - services + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - kubeflow.org + resources: + - viewers + - viewers/finalizers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + +--- +# Viewer CRD RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ml-pipeline-viewer-crd-binding + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ml-pipeline-viewer-controller-role +subjects: + - kind: ServiceAccount + name: ml-pipeline-viewer-crd-service-account + namespace: {{ include "kubeflow-pipelines.namespace" . }} + +--- +# Viewer CRD Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ml-pipeline-viewer-crd + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-viewer-crd +spec: + replicas: {{ .Values.components.viewercrd.replicas | default 1 }} + selector: + matchLabels: + app: ml-pipeline-viewer-crd + template: + metadata: + labels: + app: ml-pipeline-viewer-crd + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: ml-pipeline-viewer-crd-service-account + containers: + - name: ml-pipeline-viewer-crd + image: {{ .Values.images.registry }}/kfp-viewer-crd-controller:{{ .Values.images.tag }} + imagePullPolicy: Always + env: + - name: MAX_NUM_VIEWERS + value: "50" + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL +{{- end }} diff --git a/manifests/helm/templates/visualization.yaml b/manifests/helm/templates/visualization.yaml new file mode 100644 index 00000000000..33c40ec5237 --- /dev/null +++ b/manifests/helm/templates/visualization.yaml @@ -0,0 +1,95 @@ +{{- if .Values.components.visualization.enabled }} +# Visualization Service Account +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ml-pipeline-visualizationserver + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-visualizationserver + +--- +# Visualization Service +apiVersion: v1 +kind: Service +metadata: + name: ml-pipeline-visualizationserver + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-visualizationserver +spec: + ports: + - name: http + port: 8888 + protocol: TCP + targetPort: 8888 + selector: + app: ml-pipeline-visualizationserver + +--- +# Visualization Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ml-pipeline-visualizationserver + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + app: ml-pipeline-visualizationserver +spec: + replicas: {{ .Values.components.visualization.replicas | default 1 }} + selector: + matchLabels: + app: ml-pipeline-visualizationserver + template: + metadata: + labels: + app: ml-pipeline-visualizationserver + {{- include "kubeflow-pipelines.selectorLabels" . | nindent 8 }} + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + serviceAccountName: ml-pipeline-visualizationserver + containers: + - name: ml-pipeline-visualizationserver + image: {{ .Values.images.registry }}/kfp-visualization-server:{{ .Values.images.tag }} + imagePullPolicy: {{ .Values.images.pullPolicy }} + ports: + - name: http + containerPort: 8888 + readinessProbe: + httpGet: + path: / + port: 8888 + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + livenessProbe: + httpGet: + path: / + port: 8888 + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 0 + capabilities: + drop: + - ALL + resources: + {{- if .Values.components.visualization.resources }} + {{- toYaml .Values.components.visualization.resources | nindent 12 }} + {{- else }} + requests: + cpu: 30m + memory: 500Mi + {{- end }} +{{- end }} diff --git a/manifests/helm/templates/webhook-cert-issuer.yaml b/manifests/helm/templates/webhook-cert-issuer.yaml new file mode 100644 index 00000000000..878069495ae --- /dev/null +++ b/manifests/helm/templates/webhook-cert-issuer.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.webhook.certManager.enabled (or (and .Values.components.apiserver.enabled .Values.kubernetesNative.enabled) .Values.components.cache.enabled) }} +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: kfp-api-webhook-selfsigned-issuer + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + selfSigned: {} +{{- end }} diff --git a/manifests/helm/templates/webhook-cert.yaml b/manifests/helm/templates/webhook-cert.yaml new file mode 100644 index 00000000000..cec40bbbb95 --- /dev/null +++ b/manifests/helm/templates/webhook-cert.yaml @@ -0,0 +1,52 @@ +{{- if and .Values.components.apiserver.enabled .Values.kubernetesNative.enabled .Values.webhook.certManager.enabled }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kfp-api-webhook-cert + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + commonName: kfp-api-webhook-cert + isCA: true + duration: 8760h # 1 year + renewBefore: 720h # 30 days before expiry + dnsNames: + - ml-pipeline + - ml-pipeline.{{ include "kubeflow-pipelines.namespace" . }} + - ml-pipeline.{{ include "kubeflow-pipelines.namespace" . }}.svc + - ml-pipeline.{{ include "kubeflow-pipelines.namespace" . }}.svc.cluster.local + issuerRef: + kind: Issuer + name: kfp-api-webhook-selfsigned-issuer + secretName: kfp-api-webhook-cert +{{- end }} + +--- +{{- if and .Values.components.cache.enabled .Values.webhook.certManager.enabled }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kfp-cache-webhook-cert + namespace: {{ include "kubeflow-pipelines.namespace" . }} + labels: + {{- include "kubeflow-pipelines.labels" . | nindent 4 }} + annotations: + {{- include "kubeflow-pipelines.careem-annotations" . | nindent 4 }} +spec: + commonName: kfp-cache-webhook-cert + isCA: true + duration: 8760h # 1 year + renewBefore: 720h # 30 days before expiry + dnsNames: + - cache-server + - cache-server.{{ include "kubeflow-pipelines.namespace" . }} + - cache-server.{{ include "kubeflow-pipelines.namespace" . }}.svc + - cache-server.{{ include "kubeflow-pipelines.namespace" . }}.svc.cluster.local + issuerRef: + kind: Issuer + name: kfp-api-webhook-selfsigned-issuer + secretName: webhook-server-tls +{{- end }} diff --git a/manifests/helm/values.yaml b/manifests/helm/values.yaml new file mode 100644 index 00000000000..ddf3231055b --- /dev/null +++ b/manifests/helm/values.yaml @@ -0,0 +1,146 @@ +images: + registry: "ghcr.io/kubeflow" + tag: "2.15.0" + pullPolicy: "IfNotPresent" + +namespace: + create: false + name: "kubeflow" + +kubernetesNative: + enabled: true + +webhook: + certManager: + enabled: true + + +components: + apiserver: + enabled: true + replicas: 1 + serviceAccount: + name: ml-pipeline + annotations: {} + resources: + requests: + cpu: 250m + memory: 500Mi + limits: + cpu: "1" + memory: 1Gi + ui: + enabled: true + replicas: 1 + serviceAccount: + name: ml-pipeline-ui + annotations: {} + resources: + requests: + cpu: 10m + memory: 70Mi + metadata: + enabled: true + replicas: 1 + serviceAccount: + name: ml-pipeline-metadata + annotations: {} + resources: {} + persistenceagent: + enabled: true + replicas: 1 + serviceAccount: + name: ml-pipeline-persistenceagent + annotations: {} + resources: {} + scheduledworkflow: + enabled: true + replicas: 1 + serviceAccount: + name: ml-pipeline-scheduledworkflow + annotations: {} + resources: {} + cache: + enabled: true + replicas: 1 + serviceAccount: + name: kubeflow-pipelines-cache + annotations: {} + resources: {} + cacheDeployer: + enabled: true + replicas: 1 + serviceAccount: + name: kubeflow-pipelines-cache-deployer-sa + annotations: {} + resources: {} + visualization: + enabled: true + replicas: 1 + serviceAccount: + name: ml-pipeline-visualizationserver + annotations: {} + resources: {} + viewercrd: + enabled: true + replicas: 1 + serviceAccount: + name: ml-pipeline-viewercrd + annotations: {} + resources: {} + +metadata: + image: "gcr.io/tfx-oss-public/ml_metadata_store_server:1.14.0" + +mysql: + external: true + host: "" + port: 3306 + database: "mlmd" + secretName: "mysql-secret" + +storage: + type: "s3" + bucket: "" + region: "eu-west-1" + defaultPipelineRoot: "" + +seaweedfs: + enabled: false + image: "chrislusf/seaweedfs:4.00" + resources: + requests: + cpu: 32m + memory: 128Mi + persistence: + enabled: true + size: 10Gi + storageClass: "" + +config: + autoUpdatePipelineDefaultVersion: "true" + cronScheduleTimezone: "UTC" + cacheImage: "ghcr.io/containerd/busybox" + cacheNodeRestrictions: "false" + maximumCacheStaleness: "" + defaultCacheStaleness: "" + conMaxLifeTime: "120s" + logLevel: "info" + artifactsProxyEnabled: "false" + artifactRetentionDays: "-1" + +externalSecrets: + enabled: false + mysql: + secretStore: "" + remoteSecretKey: "" + +ingress: + enabled: false + host: "" + annotations: {} + tls: [] + + + +