update kubeflow dip-catalog
This commit is contained in:
ChanghoWoo
@@ -0,0 +1,11 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cluster-role-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: service-account
|
||||
@@ -0,0 +1,128 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cluster-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumeclaims
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- storage.k8s.io
|
||||
resources:
|
||||
- storageclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- list
|
||||
- apiGroups:
|
||||
- kubeflow.org
|
||||
resources:
|
||||
- notebooks
|
||||
verbs:
|
||||
- list
|
||||
- apiGroups:
|
||||
- kubeflow.org
|
||||
resources:
|
||||
- pvcviewers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kubeflow-volume-ui-admin
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
|
||||
rules: []
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kubeflow-volume-ui-edit
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumeclaims
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- kubeflow.org
|
||||
resources:
|
||||
- pvcviewers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kubeflow-volume-ui-view
|
||||
labels:
|
||||
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-view: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumeclaims
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- storage.k8s.io
|
||||
resources:
|
||||
- storageclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- kubeflow.org
|
||||
resources:
|
||||
- pvcviewers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
@@ -0,0 +1,33 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: deployment
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: volumes-web-app
|
||||
image: docker.io/kubeflownotebookswg/volumes-web-app
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
env:
|
||||
- name: APP_PREFIX
|
||||
value: $(VWA_PREFIX)
|
||||
- name: USERID_HEADER
|
||||
value: $(VWA_USERID_HEADER)
|
||||
- name: USERID_PREFIX
|
||||
value: $(VWA_USERID_PREFIX)
|
||||
- name: APP_SECURE_COOKIES
|
||||
value: $(VWA_APP_SECURE_COOKIES)
|
||||
- name: VOLUME_VIEWER_IMAGE
|
||||
value: filebrowser/filebrowser:v2.25.0
|
||||
volumeMounts:
|
||||
- name: viewer-spec
|
||||
mountPath: /etc/config/viewer-spec.yaml
|
||||
subPath: viewer-spec.yaml
|
||||
serviceAccountName: service-account
|
||||
volumes:
|
||||
- name: viewer-spec
|
||||
configMap:
|
||||
name: viewer-spec
|
||||
@@ -0,0 +1,69 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- cluster-role-binding.yaml
|
||||
- cluster-role.yaml
|
||||
- deployment.yaml
|
||||
- service-account.yaml
|
||||
- service.yaml
|
||||
namePrefix: volumes-web-app-
|
||||
namespace: kubeflow
|
||||
commonLabels:
|
||||
app: volumes-web-app
|
||||
kustomize.component: volumes-web-app
|
||||
images:
|
||||
- name: docker.io/kubeflownotebookswg/volumes-web-app
|
||||
newName: docker.io/kubeflownotebookswg/volumes-web-app
|
||||
newTag: v1.9.0
|
||||
# We need the name to be unique without the suffix because the original name is what
|
||||
# gets used with patches
|
||||
configMapGenerator:
|
||||
- envs:
|
||||
- params.env
|
||||
name: parameters
|
||||
- files:
|
||||
- viewer-spec.yaml
|
||||
name: viewer-spec
|
||||
vars:
|
||||
- fieldref:
|
||||
fieldPath: data.VWA_CLUSTER_DOMAIN
|
||||
name: VWA_CLUSTER_DOMAIN
|
||||
objref:
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
name: parameters
|
||||
- fieldref:
|
||||
fieldPath: metadata.namespace
|
||||
name: VWA_NAMESPACE
|
||||
objref:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
name: service
|
||||
- fieldref:
|
||||
fieldPath: data.VWA_USERID_HEADER
|
||||
name: VWA_USERID_HEADER
|
||||
objref:
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
name: parameters
|
||||
- fieldref:
|
||||
fieldPath: data.VWA_USERID_PREFIX
|
||||
name: VWA_USERID_PREFIX
|
||||
objref:
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
name: parameters
|
||||
- fieldref:
|
||||
fieldPath: data.VWA_PREFIX
|
||||
name: VWA_PREFIX
|
||||
objref:
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
name: parameters
|
||||
- name: VWA_APP_SECURE_COOKIES
|
||||
fieldref:
|
||||
fieldPath: data.VWA_APP_SECURE_COOKIES
|
||||
objref:
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
name: parameters
|
||||
@@ -0,0 +1,5 @@
|
||||
VWA_CLUSTER_DOMAIN=cluster.local
|
||||
VWA_USERID_HEADER=kubeflow-userid
|
||||
VWA_USERID_PREFIX=
|
||||
VWA_PREFIX=/volumes
|
||||
VWA_APP_SECURE_COOKIES=true
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: service-account
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
run: volumes-web-app
|
||||
name: service
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 5000
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,46 @@
|
||||
# Note: the volumes-web-app allows expanding strings using ${VAR_NAME}
|
||||
# You may use any environment variable. This lets us e.g. specify images that can be modified using kustomize's image transformer.
|
||||
# Additionally, 'PVC_NAME', 'NAME' and 'NAMESPACE' are defined
|
||||
# Name of the pvc is set by the volumes web app
|
||||
pvc: $NAME
|
||||
podSpec:
|
||||
serviceAccountName: default-editor
|
||||
containers:
|
||||
- name: main
|
||||
image: $VOLUME_VIEWER_IMAGE
|
||||
env:
|
||||
- name: FB_ADDRESS
|
||||
value: "0.0.0.0"
|
||||
- name: FB_PORT
|
||||
value: "8080"
|
||||
- name: FB_DATABASE
|
||||
value: /tmp/filebrowser.db
|
||||
- name: FB_NOAUTH
|
||||
value: "true"
|
||||
- name: FB_BASEURL
|
||||
value: /pvcviewers/$NAMESPACE/$NAME/
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 8080
|
||||
initialDelaySeconds: 2
|
||||
periodSeconds: 10
|
||||
# viewer-volume is provided automatically by the volumes web app
|
||||
volumeMounts:
|
||||
- name: viewer-volume
|
||||
mountPath: /srv
|
||||
workingDir: /srv
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
volumes:
|
||||
- name: viewer-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: $NAME
|
||||
networking:
|
||||
targetPort: 8080
|
||||
basePrefix: "/pvcviewers"
|
||||
rewrite: "/"
|
||||
timeout: 30s
|
||||
rwoScheduling: true
|
||||
Reference in New Issue
Block a user