Skip to content

Commit 59a7303

Browse files
tcjenningstcjennings
committed
Refactor cm-service helm chart
cm-service: Add vault-secrets template cm-service: Add preinstall hook for db migration
1 parent bd63077 commit 59a7303

18 files changed

+207
-111
lines changed

‎applications/cm-service/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
2-
appVersion: 0.1.2
2+
appVersion: 0.2.0
33
description: Campaign Management for Rubin Data Release Production
44
name: cm-service
55
sources:
6-
- https://github.com/lsst-dm/cm-service
6+
- https://github.com/lsst-dm/cm-service
77
type: application
88
version: 1.0.0

‎applications/cm-service/README.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,21 @@ Campaign Management for Rubin Data Release Production
1010

1111
| Key | Type | Default | Description |
1212
|-----|------|---------|-------------|
13-
| config.databaseEcho | bool | `false` | Whether to echo SQLAlchemy generated SQL to the log |
13+
| config.db.echo | bool | `false` | Whether to echo SQLAlchemy generated SQL to the log |
14+
| config.db.hostname | string | `""` | Name of the database host |
15+
| config.db.name | string | `"cmservice"` | Name of the database to use for the application |
16+
| config.db.port | int | `5432` | Port number of the database host |
17+
| config.db.username | string | `"cmservice"` | Name of the database user to use for the application |
1418
| config.logLevel | string | `"INFO"` | Logging level (`DEBUG`, `INFO`, `WARNING`, `ERROR`, or `CRITICAL`) |
1519
| config.logProfile | string | `"production"` | Logging profile (`production` for JSON, `development` for human-friendly) |
1620
| config.outputVolume.storage | string | `"1Gi"` | Minimum storage requested in service output area PVC |
1721
| config.outputVolume.storageClassName | string | `nil` | If specified, name of storage class requested in service output area PVC |
1822
| config.outputVolume.subPath | string | `nil` | If specified, sub-path within bound PV to be mounted at service output area |
19-
| config.pathPrefix | string | `"/cm-service/v1"` | URL path prefix |
23+
| config.pathPrefix | string | `"/cm-service"` | URL path prefix |
2024
| frontend.affinity | object | `{}` | Affinity rules for the frontend pods |
25+
| frontend.image.pullPolicy | string | `"IfNotPresent"` | Pull policy for the frontend image |
26+
| frontend.image.repository | string | `"ghcr.io/lsst-dm/cm-service"` | Image to use for frontend containers |
27+
| frontend.image.tag | string | The appVersion of the chart | Tag of frontend image to use |
2128
| frontend.nodeSelector | object | `{}` | Node selector rules for the frontend pods |
2229
| frontend.podAnnotations | object | `{}` | Annotations for the frontend pods |
2330
| frontend.replicaCount | int | `1` | Number of frontend pods to start |
@@ -30,6 +37,7 @@ Campaign Management for Rubin Data Release Production
3037
| image.repository | string | `"ghcr.io/lsst-dm/cm-service"` | Image to use for frontend containers |
3138
| image.tag | string | The appVersion of the chart | Tag of frontend image to use |
3239
| ingress.annotations | object | `{}` | Additional annotations for the frontend ingress rule |
40+
| internalDB | bool | `false` | Whether to use the internal (phalanx) database |
3341
| worker.affinity | object | `{}` | Affinity rules for the worker pods |
3442
| worker.htcondor.config.contents | string | `nil` | If specified, contents of htcondor config file to be injected into worker containers |
3543
| worker.htcondor.config.mountPath | string | `nil` | If specified, location for htcondor config file to be injected into worker containers |
@@ -39,7 +47,7 @@ Campaign Management for Rubin Data Release Production
3947
| worker.htcondor.scheddAddress.contents | string | `nil` | If specified, location for htcondor schedd address file to be injected into worker pods |
4048
| worker.htcondor.scheddAddress.mountPath | string | `nil` | If specified, contents of htcondor schedd address file to be injected into worker pods |
4149
| worker.image.pullPolicy | string | `"IfNotPresent"` | Pull policy for the worker image |
42-
| worker.image.repository | string | `"ghcr.io/lsst-dm/cm-service-worker"` | Image to use for worker containers |
50+
| worker.image.repository | string | `"ghcr.io/lsst-dm/cm-worker"` | Image to use for worker containers |
4351
| worker.image.tag | string | The appVersion of the chart | Tag of worker image to use |
4452
| worker.nodeSelector | object | `{}` | Node selection rules for the worker pods |
4553
| worker.podAnnotations | object | `{}` | Annotations for the worker pods |

‎applications/cm-service/secrets.yaml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
postgres-password:
2-
description: >-
3-
Password used to authenticate cm-service to its internal cnpg Postgres
4-
server, deployed as part of the same Argo CD application. This secret can be
5-
changed at any time, but the cm-service deployments will then have to be
6-
restarted to pick up the new value.
7-
generate:
8-
type: password
1+
# the database password has been generated in the postgres application; copy
2+
# the secret from there if `internalDB` is set.
3+
internalDatabasePassword:
4+
description: "Password for the internal phalanx postgres database"
5+
if: internalDB
6+
copy:
7+
application: postgres
8+
key: cmservice_password

‎applications/cm-service/templates/_helpers.tpl

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
{{/*
22
Create chart name and version as used by the chart label.
33
*/}}
4-
{{- define "cm-service.chart" -}}
4+
{{- define "application.chart" -}}
55
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
66
{{- end }}
77

88
{{/*
99
Common labels
1010
*/}}
11-
{{- define "cm-service.labels" -}}
12-
helm.sh/chart: {{ include "cm-service.chart" . }}
13-
{{ include "cm-service.selectorLabels" . }}
11+
{{- define "application.labels" -}}
12+
helm.sh/chart: {{ include "application.chart" . }}
13+
{{ include "application.selectorLabels" . }}
1414
{{- if .Chart.AppVersion }}
1515
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
1616
{{- end }}
@@ -20,7 +20,7 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
2020
{{/*
2121
Selector labels
2222
*/}}
23-
{{- define "cm-service.selectorLabels" -}}
24-
app.kubernetes.io/name: "cm-service"
23+
{{- define "application.selectorLabels" -}}
24+
app.kubernetes.io/name: {{ .Chart.Name }}
2525
app.kubernetes.io/instance: {{ .Release.Name }}
2626
{{- end }}

‎applications/cm-service/templates/deployment.yaml renamed to ‎applications/cm-service/templates/api-deployment.yaml

Lines changed: 13 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
apiVersion: apps/v1
22
kind: Deployment
33
metadata:
4-
name: "cm-service"
4+
name: {{ .Chart.Name }}-server
55
labels:
6-
{{- include "cm-service.labels" . | nindent 4 }}
6+
{{- include "application.labels" . | nindent 4 }}
77
spec:
88
replicas: {{ .Values.frontend.replicaCount }}
99
selector:
1010
matchLabels:
11-
{{- include "cm-service.selectorLabels" . | nindent 6 }}
11+
{{- include "application.selectorLabels" . | nindent 6 }}
1212
app.kubernetes.io/component: "frontend"
1313
template:
1414
metadata:
@@ -17,7 +17,7 @@ spec:
1717
{{- toYaml . | nindent 8 }}
1818
{{- end }}
1919
labels:
20-
{{- include "cm-service.selectorLabels" . | nindent 8 }}
20+
{{- include "application.selectorLabels" . | nindent 8 }}
2121
app.kubernetes.io/component: "frontend"
2222
spec:
2323
{{- with .Values.frontend.affinity }}
@@ -26,23 +26,16 @@ spec:
2626
{{- end }}
2727
automountServiceAccountToken: false
2828
containers:
29-
- name: "cm-service"
29+
- name: {{ .Chart.Name }}
30+
envFrom:
31+
- configMapRef:
32+
name: {{ .Chart.Name }}-env
3033
env:
31-
- name: CM_DATABASE_PASSWORD
34+
- name: DB__PASSWORD
3235
valueFrom:
3336
secretKeyRef:
34-
name: postgres-secret
35-
key: password
36-
- name: CM_URL_PREFIX
37-
value: {{ .Values.config.pathPrefix | quote }}
38-
- name: CM_DATABASE_URL
39-
value: "postgresql://cm-service@cm-service-pg-rw/cm-service"
40-
- name: CM_DATABASE_ECHO
41-
value: {{ .Values.config.databaseEcho | quote }}
42-
- name: CM_LOG_PROFILE
43-
value: {{ .Values.config.logProfile | quote }}
44-
- name: CM_LOG_LEVEL
45-
value: {{ .Values.config.logLevel | quote }}
37+
name: cm-service
38+
key: internalDatabasePassword
4639
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
4740
imagePullPolicy: {{ .Values.image.pullPolicy }}
4841
ports:
@@ -51,7 +44,7 @@ spec:
5144
protocol: "TCP"
5245
readinessProbe:
5346
httpGet:
54-
path: "/"
47+
path: "/healthz"
5548
port: "http"
5649
resources:
5750
{{- toYaml .Values.frontend.resources | nindent 12 }}
@@ -70,7 +63,7 @@ spec:
7063
volumes:
7164
- name: output-volume
7265
persistentVolumeClaim:
73-
claimName: cm-service-output
66+
claimName: {{ .Chart.Name }}-output
7467
{{- with .Values.frontend.nodeSelector }}
7568
nodeSelector:
7669
{{- toYaml . | nindent 8 }}

‎applications/cm-service/templates/configmap.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: "{{ .Chart.Name }}-env"
5+
labels:
6+
{{- include "application.labels" . | nindent 4 }}
7+
data:
8+
ASGI__PREFIX: {{ .Values.config.pathPrefix | quote }}
9+
{{- with .Values.config.db }}
10+
DB__URL: "postgresql://{{ .username }}@{{ .hostname }}:{{ .port }}/{{ .name }}"
11+
DB__ECHO: {{ .echo | quote }}
12+
{{- end }}
13+
LOGGING__PROFILE: {{ .Values.config.logProfile | quote }}
14+
LOGGING__LEVEL: {{ .Values.config.logLevel | quote }}
15+
---
16+
apiVersion: v1
17+
kind: ConfigMap
18+
metadata:
19+
name: "{{ .Chart.Name }}-htcondor-env"
20+
labels:
21+
{{- include "application.labels" . | nindent 4 }}
22+
data:
23+
CONDOR_CONFIG: /home/lsstsvc1/.config/condor/condor-config

‎applications/cm-service/templates/ingress.yaml

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
apiVersion: gafaelfawr.lsst.io/v1alpha1
22
kind: GafaelfawrIngress
33
metadata:
4-
name: "cm-service"
4+
name: {{ .Chart.Name }}
55
labels:
6-
{{- include "cm-service.labels" . | nindent 4 }}
6+
{{- include "application.labels" . | nindent 4 }}
77
config:
88
baseUrl: {{ .Values.global.baseUrl | quote }}
99
loginRedirect: true
1010
scopes:
1111
all:
1212
- "exec:internal-tools"
13-
service: "cm-service"
13+
service: {{ .Chart.Name }}
1414
template:
1515
metadata:
16-
name: "cm-service"
16+
name: {{ .Chart.Name }}
1717
{{- with .Values.ingress.annotations }}
1818
annotations:
1919
{{- toYaml . | nindent 6 }}
@@ -27,13 +27,20 @@ template:
2727
pathType: "Prefix"
2828
backend:
2929
service:
30-
name: "cm-service"
30+
name: {{ .Chart.Name }}
3131
port:
32-
number: 8080
32+
name: "http"
33+
- path: "/docs"
34+
pathType: "Prefix"
35+
backend:
36+
service:
37+
name: {{ .Chart.Name }}
38+
port:
39+
name: "http"
3340
- path: "/web_app"
3441
pathType: "Prefix"
3542
backend:
3643
service:
37-
name: "cm-service"
44+
name: {{ .Chart.Name }}
3845
port:
39-
number: 8080
46+
name: "http"

‎applications/cm-service/templates/networkpolicy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
apiVersion: networking.k8s.io/v1
22
kind: NetworkPolicy
33
metadata:
4-
name: "cm-service"
4+
name: {{ .Chart.Name }}
55
spec:
66
podSelector:
77
matchLabels:
8-
{{- include "cm-service.selectorLabels" . | nindent 6 }}
8+
{{- include "application.selectorLabels" . | nindent 6 }}
99
policyTypes:
1010
- "Ingress"
1111
ingress:

‎applications/cm-service/templates/postgres.yaml

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎applications/cm-service/templates/pre-install-hooks.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: "{{ .Chart.Name }}-db-alembic-migration"
5+
labels:
6+
{{- include "application.labels" . | nindent 4 }}
7+
annotations:
8+
"helm.sh/hook": pre-install
9+
"helm.sh/hook-weight": "0"
10+
"helm.sh/hook-delete-policy": before-hook-creation
11+
spec:
12+
template:
13+
metadata: {}
14+
spec:
15+
restartPolicy: Never
16+
containers:
17+
- name: db-alembic-migration
18+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
19+
command: ["alembic"]
20+
args: ["upgrade", "head"]
21+
{{- with .Values.config.db }}
22+
env:
23+
- name: DB__URL
24+
value: "postgresql://{{ .username }}@{{ .hostname }}:{{ .port }}/{{ .name }}"
25+
{{- end }}
26+
- name: DB__PASSWORD
27+
valueFrom:
28+
secretKeyRef:
29+
name: cm-service
30+
key: internalDatabasePassword

‎applications/cm-service/templates/pvc.yaml

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,33 +2,31 @@
22
apiVersion: v1
33
kind: PersistentVolumeClaim
44
metadata:
5-
name: cm-service-output
5+
name: {{ .Chart.Name }}-output
66
labels:
7-
{{- include "cm-service.labels" . | nindent 4 }}
7+
{{- include "application.labels" . | nindent 4 }}
88
spec:
9-
{{- with .Values.config.outputVolume.storageClassName }}
10-
storageClassName: {{ . }}
11-
{{- end }}
9+
{{- with .Values.config.outputVolume }}
10+
storageClassName: {{ .storageClassName }}
1211
accessModes:
1312
- ReadWriteMany
1413
resources:
1514
requests:
16-
storage: {{ .Values.config.outputVolume.storage }}
17-
{{- with .Values.worker.htcondor.fsRemoteDir }}
15+
storage: {{ .storage }}
16+
{{- end }}
1817
---
1918
apiVersion: v1
2019
kind: PersistentVolumeClaim
2120
metadata:
22-
name: cm-service-htcondor
21+
name: {{ $.Chart.Name }}-htcondor
2322
labels:
24-
{{- include "cm-service.labels" $ | nindent 4 }}
23+
{{- include "application.labels" $ | nindent 4 }}
2524
spec:
26-
{{- with .storageClassName }}
27-
storageClassName: {{ . }}
28-
{{- end }}
25+
{{- with .Values.worker.htcondor.fsRemoteDir }}
26+
storageClassName: {{ .storageClassName }}
2927
accessModes:
3028
- ReadWriteMany
3129
resources:
3230
requests:
3331
storage: {{ .storage }}
34-
{{- end }}
32+
{{- end }}

‎applications/cm-service/templates/service.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4-
name: "cm-service"
4+
name: {{ .Chart.Name }}
55
labels:
6-
{{- include "cm-service.labels" . | nindent 4 }}
6+
{{- include "application.labels" . | nindent 4 }}
77
spec:
88
type: "ClusterIP"
99
ports:
@@ -12,5 +12,5 @@ spec:
1212
protocol: "TCP"
1313
name: "http"
1414
selector:
15-
{{- include "cm-service.selectorLabels" . | nindent 4 }}
15+
{{- include "application.selectorLabels" . | nindent 4 }}
1616
app.kubernetes.io/component: "frontend"

‎applications/cm-service/templates/vault-secrets.yaml

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
1+
---
12
apiVersion: ricoberger.de/v1alpha1
23
kind: VaultSecret
34
metadata:
4-
name: postgres-secret
5+
name: {{ .Chart.Name }}
56
labels:
6-
{{- include "cm-service.labels" . | nindent 4 }}
7+
{{- include "application.labels" . | nindent 4 }}
78
spec:
8-
path: "{{ .Values.global.vaultSecretsPath }}/cm-service"
9-
templates:
10-
username: cm-service
11-
password: >-
12-
{% index .Secrets "postgres-password" %}
13-
type: kubernetes.io/basic-auth
9+
path: "{{ .Values.global.vaultSecretsPath }}/{{ .Chart.Name }}"
10+
type: Opaque

0 commit comments

Comments
 (0)