Skip to content

Commit 96b8554

Browse files
hdpriest-uihdpriest-ui
authored
Merge pull request #15 from hdpriest-ui/main
sync main into dev
2 parents a1070c7 + 50209d4 commit 96b8554

9 files changed

Lines changed: 627 additions & 43 deletions

File tree

‎kubernetes/00-namespace.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
# Namespace for ICRN Kernel Manager
3+
apiVersion: v1
4+
kind: Namespace
5+
metadata:
6+
name: kernels
7+
labels:
8+
app: icrn-kernel-manager
9+
name: kernels
10+
annotations:
11+
# Pod Security Standards for hardened cluster
12+
pod-security.kubernetes.io/enforce: restricted
13+
pod-security.kubernetes.io/audit: restricted
14+
pod-security.kubernetes.io/warn: restricted

‎kubernetes/01-pv-pvc.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
# PersistentVolume for NFS mount to kernel repository
3+
apiVersion: v1
4+
kind: PersistentVolume
5+
metadata:
6+
name: icrn-kernels-pv
7+
labels:
8+
app: icrn-kernel-manager
9+
spec:
10+
storageClassName: nfs-static
11+
capacity:
12+
storage: 500Gi # Adjust based on your kernel repository size
13+
accessModes:
14+
- ReadWriteMany # ReadWriteMany allows multiple pods with read and write access
15+
nfs:
16+
server: harbor-cc.internal.ncsa.edu
17+
path: /harbor/illinois/iccp/sw/icrn/dev/kernels
18+
readOnly: false
19+
persistentVolumeReclaimPolicy: Retain
20+
21+
---
22+
# PersistentVolumeClaim for the kernels data
23+
apiVersion: v1
24+
kind: PersistentVolumeClaim
25+
metadata:
26+
name: icrn-kernels-pvc
27+
namespace: kernels # Change to your desired namespace
28+
labels:
29+
app: icrn-kernel-manager
30+
spec:
31+
storageClassName: nfs-static
32+
accessModes:
33+
- ReadWriteMany
34+
resources:
35+
requests:
36+
storage: 500Gi
37+
selector:
38+
matchLabels:
39+
app: icrn-kernel-manager
40+
volumeName: icrn-kernels-pv

‎kubernetes/02-web-deployment.yaml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
---
2+
# Deployment for ICRN Web Interface
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: icrn-web
7+
namespace: kernels # Change to your desired namespace
8+
labels:
9+
app: icrn-web
10+
component: web-interface
11+
spec:
12+
replicas: 1 # Adjust based on your needs
13+
selector:
14+
matchLabels:
15+
app: icrn-web
16+
template:
17+
metadata:
18+
labels:
19+
app: icrn-web
20+
component: web-interface
21+
spec:
22+
securityContext:
23+
seccompProfile:
24+
type: RuntimeDefault
25+
containers:
26+
- name: web
27+
image: hdpriest0uiuc/icrn-kernel-webserver:latest # Update with your registry/tag
28+
imagePullPolicy: Always
29+
ports:
30+
- containerPort: 8000
31+
name: http
32+
securityContext:
33+
allowPrivilegeEscalation: false
34+
runAsNonRoot: true
35+
runAsUser: 1000
36+
capabilities:
37+
drop:
38+
- ALL
39+
env:
40+
- name: COLLATED_MANIFESTS_PATH
41+
value: "/app/data/collated_manifests.json"
42+
- name: PACKAGE_INDEX_PATH
43+
value: "/app/data/package_index.json"
44+
- name: WORKERS
45+
value: "4"
46+
volumeMounts:
47+
- name: kernels-data
48+
mountPath: /app/data
49+
readOnly: true
50+
livenessProbe:
51+
httpGet:
52+
path: /
53+
port: 8000
54+
initialDelaySeconds: 30
55+
periodSeconds: 10
56+
timeoutSeconds: 5
57+
failureThreshold: 3
58+
readinessProbe:
59+
httpGet:
60+
path: /
61+
port: 8000
62+
initialDelaySeconds: 20
63+
periodSeconds: 5
64+
timeoutSeconds: 3
65+
failureThreshold: 3
66+
resources:
67+
requests:
68+
memory: "256Mi"
69+
cpu: "250m"
70+
limits:
71+
memory: "512Mi"
72+
cpu: "500m"
73+
volumes:
74+
- name: kernels-data
75+
persistentVolumeClaim:
76+
claimName: icrn-kernels-pvc
77+
78+
---
79+
# Service for ICRN Web Interface
80+
apiVersion: v1
81+
kind: Service
82+
metadata:
83+
name: icrn-web-service
84+
namespace: kernels # Change to your desired namespace
85+
labels:
86+
app: icrn-web
87+
spec:
88+
type: ClusterIP # Change to LoadBalancer if needed
89+
selector:
90+
app: icrn-web
91+
ports:
92+
- protocol: TCP
93+
port: 80
94+
targetPort: 8000
95+
name: http
96+
97+
---
98+
# Ingress for ICRN Web Interface
99+
apiVersion: networking.k8s.io/v1
100+
kind: Ingress
101+
metadata:
102+
name: icrn-web-ingress
103+
namespace: kernels # Change to your desired namespace
104+
labels:
105+
app: icrn-web
106+
spec:
107+
ingressClassName: traefik # Adjust based on your ingress controller
108+
tls:
109+
- hosts:
110+
- kernels.cori-dev.ncsa.illinois.edu
111+
secretName: icrn-web-tls
112+
rules:
113+
- host: kernels.cori-dev.ncsa.illinois.edu
114+
http:
115+
paths:
116+
- path: /
117+
pathType: Prefix
118+
backend:
119+
service:
120+
name: icrn-web-service
121+
port:
122+
number: 80

‎kubernetes/03-cronjob-indexer.yaml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
# CronJob to run kernel indexer every hour
3+
apiVersion: batch/v1
4+
kind: CronJob
5+
metadata:
6+
name: icrn-kernel-indexer
7+
namespace: kernels # Change to your desired namespace
8+
labels:
9+
app: icrn-kernel-manager
10+
component: kernel-indexer
11+
spec:
12+
# Run every hour at minute 0
13+
schedule: "0 * * * *"
14+
15+
# Keep last 3 successful and 5 failed jobs for debugging
16+
successfulJobsHistoryLimit: 3
17+
failedJobsHistoryLimit: 5
18+
19+
# Deadline to complete the job (in seconds)
20+
startingDeadlineSeconds: 300
21+
22+
jobTemplate:
23+
spec:
24+
# Complete job within 30 minutes
25+
backoffLimit: 2
26+
# Keep failed job pods for 7 days for debugging
27+
ttlSecondsAfterFinished: 604800
28+
template:
29+
metadata:
30+
labels:
31+
app: icrn-kernel-manager
32+
component: kernel-indexer
33+
spec:
34+
serviceAccountName: icrn-indexer # See RBAC below
35+
securityContext:
36+
seccompProfile:
37+
type: RuntimeDefault
38+
fsGroup: 55311
39+
supplementalGroups:
40+
- 55311
41+
42+
containers:
43+
- name: kernel-indexer
44+
image: hdpriest0uiuc/icrn-kernel-indexer:latest # Update with your registry/tag
45+
imagePullPolicy: IfNotPresent
46+
securityContext:
47+
allowPrivilegeEscalation: false
48+
runAsNonRoot: true
49+
runAsUser: 1000
50+
capabilities:
51+
drop:
52+
- ALL
53+
54+
env:
55+
- name: KERNEL_ROOT
56+
value: "/app/data" # Path where kernels are stored in the NFS mount
57+
58+
volumeMounts:
59+
- name: kernels-data
60+
mountPath: /app/data
61+
readOnly: false # Needs write access to update index files
62+
63+
resources:
64+
requests:
65+
memory: "512Mi"
66+
cpu: "500m"
67+
limits:
68+
memory: "1Gi"
69+
cpu: "1000m"
70+
71+
# Fail the job if it takes longer than 25 minutes
72+
livenessProbe:
73+
exec:
74+
command:
75+
- /bin/sh
76+
- -c
77+
- test -f /tmp/indexer.running || exit 1
78+
initialDelaySeconds: 60
79+
periodSeconds: 300
80+
81+
volumes:
82+
- name: kernels-data
83+
persistentVolumeClaim:
84+
claimName: icrn-kernels-pvc
85+
86+
restartPolicy: Never
87+
88+
---
89+
# ServiceAccount for the kernel indexer CronJob
90+
apiVersion: v1
91+
kind: ServiceAccount
92+
metadata:
93+
name: icrn-indexer
94+
namespace: kernels # Change to your desired namespace
95+
labels:
96+
app: icrn-kernel-manager
97+
98+
---
99+
# ClusterRole for kernel indexer (minimal permissions)
100+
apiVersion: rbac.authorization.k8s.io/v1
101+
kind: ClusterRole
102+
metadata:
103+
name: icrn-indexer-role
104+
labels:
105+
app: icrn-kernel-manager
106+
rules:
107+
# Minimal permissions - adjust as needed
108+
- apiGroups: [""]
109+
resources: ["pods"]
110+
verbs: ["get", "list"]
111+
112+
---
113+
# ClusterRoleBinding for kernel indexer
114+
apiVersion: rbac.authorization.k8s.io/v1
115+
kind: ClusterRoleBinding
116+
metadata:
117+
name: icrn-indexer-binding
118+
labels:
119+
app: icrn-kernel-manager
120+
roleRef:
121+
apiGroup: rbac.authorization.k8s.io
122+
kind: ClusterRole
123+
name: icrn-indexer-role
124+
subjects:
125+
- kind: ServiceAccount
126+
name: icrn-indexer
127+
namespace: kernels # Change to your desired namespace

0 commit comments

Comments
 (0)