Skip to content

Commit 5a93916

Browse files
liavweissLiav Weiss (EXT-Nokia)
liavweiss
and
Liav Weiss (EXT-Nokia)
authored
feat(ws): add manifests for backend (#455)
* feat(ws): Define k8s workload manifest for backend component #324 Signed-off-by: Liav Weiss (EXT-Nokia) <[email protected]> * feat(ws): Define k8s workload manifest for backend component #324 Signed-off-by: Liav Weiss (EXT-Nokia) <[email protected]> * feat(ws): add Istio AuthorizationPolicy for nb-backend #324 Signed-off-by: Liav Weiss (EXT-Nokia) <[email protected]> * feat(ws): Define k8s workload manifest for backend component + istio - #324 Signed-off-by: Liav Weiss (EXT-Nokia) <[email protected]> --------- Signed-off-by: Liav Weiss (EXT-Nokia) <[email protected]> Co-authored-by: Liav Weiss (EXT-Nokia) <[email protected]>
1 parent 586a879 commit 5a93916

File tree

13 files changed

+330
-1
lines changed

13 files changed

+330
-1
lines changed

‎workspaces/backend/Makefile‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Image URL to use all building/pushing image targets
2-
IMG ?= nbv2-backend:latest
2+
IMG ?= nb-backend:latest
33
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
44
ENVTEST_K8S_VERSION = 1.31.0
55

@@ -124,11 +124,13 @@ $(LOCALBIN):
124124

125125
## Tool Binaries
126126
KUBECTL ?= kubectl
127+
KUSTOMIZE := $(LOCALBIN)/kustomize
127128
ENVTEST ?= $(LOCALBIN)/setup-envtest
128129
GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
129130
SWAGGER = $(LOCALBIN)/swag
130131

131132
## Tool Versions
133+
KUSTOMIZE_VERSION ?= v5.5.0
132134
ENVTEST_VERSION ?= release-0.19
133135
GOLANGCI_LINT_VERSION ?= v1.61.0
134136
SWAGGER_VERSION ?= v1.16.6
@@ -148,6 +150,26 @@ golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
148150
$(GOLANGCI_LINT): $(LOCALBIN)
149151
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
150152

153+
154+
##@ deployment
155+
156+
.PHONY: deploy
157+
deploy: kustomize ## Deploy backend to the K8s cluster specified in ~/.kube/config.
158+
cd manifests/kustomize/overlays/istio && $(KUSTOMIZE) edit set image workspaces-backend=${IMG}
159+
$(KUBECTL) apply -k manifests/kustomize/overlays/istio
160+
161+
.PHONY: undeploy
162+
undeploy: kustomize ## Undeploy backend from the K8s cluster specified in ~/.kube/config.
163+
$(KUBECTL) delete -k manifests/kustomize/overlays/istio --ignore-not-found=true
164+
165+
166+
##@ Dependencies
167+
168+
.PHONY: kustomize
169+
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
170+
$(KUSTOMIZE): $(LOCALBIN)
171+
$(call go-install-tool,$(KUSTOMIZE),sigs.k8s.io/kustomize/kustomize/v5,$(KUSTOMIZE_VERSION))
172+
151173
# go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
152174
# $1 - target path with name of binary
153175
# $2 - package url which can be installed

‎workspaces/backend/manifests/kustomize/base/deployment.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: workspaces-backend
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels: {}
9+
strategy:
10+
type: RollingUpdate
11+
rollingUpdate:
12+
maxUnavailable: 0
13+
maxSurge: 1
14+
template:
15+
metadata:
16+
labels: {}
17+
spec:
18+
serviceAccountName: workspaces-backend
19+
securityContext:
20+
runAsNonRoot: true
21+
terminationGracePeriodSeconds: 30
22+
containers:
23+
- name: workspaces-backend
24+
image: workspaces-backend
25+
imagePullPolicy: IfNotPresent
26+
securityContext:
27+
allowPrivilegeEscalation: false
28+
capabilities:
29+
drop:
30+
- "ALL"
31+
ports:
32+
- name: http-api
33+
containerPort: 4000
34+
env:
35+
- name: PORT
36+
value: "4000"
37+
resources:
38+
limits:
39+
cpu: 1
40+
memory: 1Gi
41+
requests:
42+
cpu: 100m
43+
memory: 512Mi
44+
livenessProbe:
45+
httpGet:
46+
path: /api/v1/healthcheck
47+
port: http-api
48+
scheme: HTTP
49+
initialDelaySeconds: 30
50+
periodSeconds: 20
51+
timeoutSeconds: 5
52+
failureThreshold: 3
53+
successThreshold: 1
54+
readinessProbe:
55+
httpGet:
56+
path: /api/v1/healthcheck
57+
port: http-api
58+
scheme: HTTP
59+
initialDelaySeconds: 10
60+
periodSeconds: 10
61+
timeoutSeconds: 5
62+
failureThreshold: 3
63+
successThreshold: 1

‎workspaces/backend/manifests/kustomize/base/kustomization.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
namespace: kubeflow-workspaces
5+
6+
resources:
7+
- namespace.yaml
8+
- service_account.yaml
9+
- rbac.yaml
10+
- service.yaml
11+
- deployment.yaml
12+
13+
labels:
14+
- includeSelectors: true
15+
pairs:
16+
app.kubernetes.io/component: api

‎workspaces/backend/manifests/kustomize/base/namespace.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: kubeflow-workspaces

‎workspaces/backend/manifests/kustomize/base/rbac.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: workspaces-backend
5+
rules:
6+
- apiGroups:
7+
- kubeflow.org
8+
resources:
9+
- workspaces
10+
- workspacekinds
11+
verbs:
12+
- get
13+
- list
14+
- watch
15+
- create
16+
- update
17+
- patch
18+
- delete
19+
- apiGroups:
20+
- ""
21+
resources:
22+
- namespaces
23+
verbs:
24+
- get
25+
- list
26+
- watch
27+
---
28+
apiVersion: rbac.authorization.k8s.io/v1
29+
kind: ClusterRoleBinding
30+
metadata:
31+
name: workspaces-backend
32+
roleRef:
33+
apiGroup: rbac.authorization.k8s.io
34+
kind: ClusterRole
35+
name: workspaces-backend
36+
subjects:
37+
- kind: ServiceAccount
38+
name: workspaces-backend
39+
namespace: kubeflow-workspaces

‎workspaces/backend/manifests/kustomize/base/service.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: workspaces-backend
5+
spec:
6+
selector: {}
7+
ports:
8+
- name: http-api
9+
port: 4000
10+
targetPort: http-api
11+
type: ClusterIP

‎workspaces/backend/manifests/kustomize/base/service_account.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: workspaces-backend

‎workspaces/backend/manifests/kustomize/components/common/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: kustomize.config.k8s.io/v1alpha1
2+
kind: Component
3+
4+
labels:
5+
- includeSelectors: true
6+
pairs:
7+
app.kubernetes.io/managed-by: kustomize
8+
app.kubernetes.io/name: workspaces-backend
9+
app.kubernetes.io/part-of: kubeflow-workspaces

‎workspaces/backend/manifests/kustomize/components/istio/authorization-policy.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: security.istio.io/v1beta1
2+
kind: AuthorizationPolicy
3+
metadata:
4+
name: workspaces-backend
5+
spec:
6+
action: ALLOW
7+
selector:
8+
matchLabels:
9+
app.kubernetes.io/component: api
10+
app.kubernetes.io/managed-by: kustomize
11+
app.kubernetes.io/name: workspaces-backend
12+
app.kubernetes.io/part-of: kubeflow-workspaces
13+
rules:
14+
- from:
15+
- source:
16+
principals:
17+
- cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account

‎workspaces/backend/manifests/kustomize/components/istio/destination-rule.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: networking.istio.io/v1beta1
2+
kind: DestinationRule
3+
metadata:
4+
name: workspaces-backend
5+
spec:
6+
host: workspaces-backend.kubeflow-workspaces.svc.cluster.local
7+
trafficPolicy:
8+
tls:
9+
mode: ISTIO_MUTUAL

0 commit comments

Comments
 (0)