Skip to content

Commit 395ee0c

Browse files
meffmaddmeffmadd
committed
Add helm chart for token-validator deployment
1 parent 8f69faf commit 395ee0c

File tree

8 files changed

+234
-0
lines changed

8 files changed

+234
-0
lines changed

‎charts/token-validator/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/token-validator/Chart.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: token-validator
3+
description: A Helm chart for a token-validator Deployment.
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0

‎charts/token-validator/templates/deployment.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: token-validator
5+
namespace: {{ $.Release.Namespace }}
6+
spec:
7+
replicas: 1
8+
selector:
9+
matchLabels:
10+
app: token-validator
11+
template:
12+
metadata:
13+
labels:
14+
app: token-validator
15+
spec:
16+
volumes:
17+
- name: db-storage
18+
persistentVolumeClaim:
19+
claimName: token-validator-db-pvc
20+
initContainers:
21+
- name: db-migrate
22+
image: {{.Values.image.repository }}:{{.Values.image.tag }}
23+
imagePullPolicy: {{ .Values.image.imagePullPolicy }}
24+
command: [ "flask", "db", "upgrade" ]
25+
env:
26+
- name: DATABASE_URI
27+
value: "sqlite:////db/token_validator.db"
28+
volumeMounts:
29+
- name: db-storage
30+
mountPath: /db
31+
containers:
32+
- name: token-validator
33+
image: {{.Values.image.repository }}:{{.Values.image.tag }}
34+
imagePullPolicy: {{ .Values.image.imagePullPolicy }}
35+
ports:
36+
- containerPort: 5000
37+
volumeMounts:
38+
- name: db-storage
39+
mountPath: /db
40+
env:
41+
- name: DATABASE_URI
42+
value: "sqlite:////db/token_validator.db"
43+
- name: OIDC_CLIENT_ID
44+
valueFrom:
45+
secretKeyRef:
46+
name: {{ .Values.oidc.secrets.existingSecret.name }}
47+
key: {{ .Values.oidc.secrets.existingSecret.clientIdKey }}
48+
- name: OIDC_CLIENT_SECRET
49+
valueFrom:
50+
secretKeyRef:
51+
name: {{ .Values.oidc.secrets.existingSecret.name }}
52+
key: {{ .Values.oidc.secrets.existingSecret.clientSecretKey }}
53+
- name: SECRET_KEY
54+
valueFrom:
55+
secretKeyRef:
56+
name: {{ .Values.secretKey.existingSecret.name }}
57+
key: {{ .Values.secretKey.existingSecret.key }}
58+
- name: ADMIN_GROUP
59+
value: {{ .Values.oidc.adminGroup }}
60+
- name: OIDC_AUTHORIZE_URL
61+
value: {{ .Values.oidc.authorizeURL }}
62+
- name: OIDC_CONFIGURATION_URL
63+
value: {{ .Values.oidc.configurationURL }}
64+
- name: OIDC_TOKEN_URL
65+
value: {{ .Values.oidc.tokenURL }}
66+
- name: OIDC_USERINFO_URL
67+
value: {{ .Values.oidc.userinfoURL }}
68+
- name: PREFERRED_URL_SCHEME
69+
value: 'https'
70+
strategy:
71+
type: Recreate

‎charts/token-validator/templates/ingress.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: token-validator-ingress
5+
namespace: {{ $.Release.Namespace }}
6+
annotations:
7+
{{- toYaml .Values.ingress.annotations | nindent 4 }}
8+
spec:
9+
ingressClassName: {{ .Values.ingress.className }}
10+
rules:
11+
{{- range .Values.ingress.hosts }}
12+
- host: {{ .host }}
13+
http:
14+
paths:
15+
{{- range .paths }}
16+
- path: {{ .path }}
17+
pathType: {{ .pathType }}
18+
backend:
19+
service:
20+
name: token-validator
21+
port:
22+
number: 5000
23+
{{- end }}
24+
{{- end }}
25+
tls:
26+
{{- toYaml .Values.ingress.tls | nindent 4 }}

‎charts/token-validator/templates/pvc.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: PersistentVolumeClaim
3+
metadata:
4+
name: token-validator-db-pvc
5+
namespace: {{ $.Release.Namespace }}
6+
spec:
7+
accessModes:
8+
- ReadWriteOnce
9+
resources:
10+
requests:
11+
storage: 1Gi

‎charts/token-validator/templates/service.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: token-validator
5+
namespace: {{ $.Release.Namespace }}
6+
spec:
7+
selector:
8+
app: token-validator
9+
ports:
10+
- name: http
11+
port: 80
12+
targetPort: 5000
13+
type: ClusterIP

‎charts/token-validator/templates/token-validator-secret.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{{ if .Values.externalSecret.enabled }}
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ExternalSecret
4+
metadata:
5+
name: {{ .Values.externalSecret.key }}
6+
spec:
7+
refreshInterval: "0"
8+
secretStoreRef:
9+
name: datalab-vault
10+
kind: ClusterSecretStore
11+
target:
12+
name: {{ .Values.oidc.secrets.existingSecret.name }}
13+
data:
14+
- secretKey: {{ .Values.oidc.secrets.existingSecret.clientIdKey }}
15+
remoteRef:
16+
key: {{ .Values.externalSecret.key }}
17+
property: OIDC_CLIENT_ID
18+
19+
- secretKey: {{ .Values.oidc.secrets.existingSecret.clientSecretKey }}
20+
remoteRef:
21+
key: {{ .Values.externalSecret.key }}
22+
property: OIDC_CLIENT_SECRET
23+
24+
- secretKey: {{ .Values.secretKey.existingSecret.key }}
25+
remoteRef:
26+
key: {{ .Values.externalSecret.key }}
27+
property: SECRET_KEY
28+
{{ end }}

‎charts/token-validator/values.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
image:
2+
repository: ghcr.io/tu-wien-datalab/token-validator
3+
tag: main
4+
imagePullPolicy: Always
5+
6+
externalSecret:
7+
enabled: true
8+
key: token-validator-secrets
9+
10+
oidc:
11+
adminGroup: "ds-ray-cluster"
12+
authorizeURL: https://login.datalab.tuwien.ac.at/application/o/authorize/
13+
configurationURL: https://login.datalab.tuwien.ac.at/application/o/tgi/.well-known/openid-configuration
14+
tokenURL: https://login.datalab.tuwien.ac.at/application/o/token/
15+
userinfoURL: https://login.datalab.tuwien.ac.at/application/o/userinfo/
16+
secrets:
17+
existingSecret:
18+
name: token-validator-secrets
19+
clientIdKey: OIDC_CLIENT_ID
20+
clientSecretKey: OIDC_CLIENT_SECRET
21+
22+
23+
secretKey:
24+
existingSecret:
25+
name: token-validator-secrets
26+
key: SECRET_KEY
27+
28+
29+
ingress:
30+
enabled: true
31+
className: nginx
32+
annotations:
33+
# tls
34+
kubernetes.io/tls-acme: "true"
35+
cert-manager.io/cluster-issuer: datalab-issuer
36+
hosts:
37+
- host: tgi.mlops-staging.datalab.tuwien.ac.at
38+
paths:
39+
- path: "/"
40+
pathType: "Prefix"
41+
tls:
42+
- secretName: token-validator-tls
43+
hosts:
44+
- tgi.mlops-staging.datalab.tuwien.ac.at

0 commit comments

Comments
 (0)