Add model registry v0.2.19

2025-07-01 14:28:17 +09:00
parent f8d6965288
commit 6e83726fb3
68 changed files with 2018 additions and 0 deletions
@@ -0,0 +1,127 @@
+# ArgoCD Deployment for Kubeflow Model Registry
+
+이 디렉토리는 ArgoCD를 사용하여 Kubeflow Model Registry Core 컴포넌트를 Profile 네임스페이스에 배포하기 위한 매니페스트를 포함합니다.
+
+## 개요
+
+이 overlay는 Model Registry의 **Core 컴포넌트만**을 배포합니다:
+- **Database**: MySQL 데이터베이스 (initContainer 포함)
+- **Model Registry Server**: REST/gRPC API 서버 (리소스 제한 포함)
+
+> **참고**: UI 컴포넌트 및 Istio 설정은 별도로 kubeflow 카탈로그에서 배포합니다.
+
+## 사전 요구사항
+
+- ArgoCD가 클러스터에 설치되고 구성되어 있어야 합니다
+- 이 매니페스트들이 포함된 Git 저장소에 접근할 수 있어야 합니다
+
+## 배포 방법
+
+### Core 컴포넌트 배포 (Profile 네임스페이스)
+
+1. **ArgoCD Application 매니페스트 편집**:
+   ```bash
+   vim model-registry-application.yaml
+   ```
+   
+   다음 항목들을 수정:
+   - `metadata.name`: Application 이름 (예: `model-registry-demo01-test`)
+   - `metadata.namespace`: ArgoCD 네임스페이스 (예: `platform`)
+   - `spec.source.repoURL`: Git 저장소 URL
+   - `spec.source.targetRevision`: 브랜치/태그 (예: `model-registry/v0.2.19`)
+   - `spec.destination.namespace`: 대상 Profile 네임스페이스 (예: `demo01-test`)
+
+2. **ArgoCD Application 배포**:
+   ```bash
+   kubectl apply -f model-registry-application.yaml
+   ```
+
+### 실제 배포 예시
+
+테스트된 설정 예시:
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: model-registry-demo01-test
+  namespace: platform
+spec:
+  source:
+    repoURL: https://gitea.example.org/dip/tenant-catalog
+    targetRevision: model-registry/v0.2.19
+    path: model-registry/overlays/argocd
+  destination:
+    namespace: demo01-test
+```
+
+## 배포 확인
+
+### ArgoCD Application 상태 확인
+```bash
+# ArgoCD CLI 사용 (설치된 경우)
+argocd app get model-registry-demo01-test
+
+# 수동 동기화가 필요한 경우
+argocd app sync model-registry-demo01-test
+
+# kubectl로 Application 상태 확인
+kubectl get application -n platform model-registry-demo01-test
+```
+
+### 배포된 리소스 확인
+```bash
+# Profile 네임스페이스의 리소스 확인
+kubectl get pods -n demo01-test
+kubectl get svc -n demo01-test
+kubectl get deployment -n demo01-test
+
+# 특정 컴포넌트 상태 확인
+kubectl get pods -n demo01-test -l app.kubernetes.io/name=model-registry
+```
+
+## 포함된 컴포넌트 및 리소스 설정
+
+### 1. Model Registry Database (MySQL)
+- **Deployment**: `model-registry-db`
+- **Service**: `model-registry-db`
+- **PVC**: `metadata-mysql`
+- **특별 설정**:
+  - initContainer로 권한 설정 (`chown 999:999 /var/lib/mysql`)
+  - 리소스 요청: CPU 100m, Memory 100M
+
+### 2. Model Registry Server
+- **Deployment**: `model-registry-deployment`
+- **Service**: `model-registry-service`
+- **컨테이너별 리소스 설정**:
+  - **rest-container**:
+    - Requests: CPU 100m, Memory 256Mi
+    - Limits: CPU 500m, Memory 512Mi
+  - **grpc-container**:
+    - Requests: CPU 100m, Memory 128Mi
+    - Limits: CPU 500m, Memory 512Mi
+
+### 3. Istio 네트워킹
+- **VirtualService**: 라우팅 규칙
+- **DestinationRule**: 트래픽 정책
+- **AuthorizationPolicy**: 접근 제어
+
+## 제거
+
+```bash
+# ArgoCD Application 제거
+kubectl delete -f model-registry-application.yaml
+
+# 또는 직접 삭제
+kubectl delete application -n platform model-registry-demo01-test
+```
+
+## 파일 구조
+
+```
+overlays/argocd/
+├── README.md                           # 이 파일
+├── kustomization.yaml                  # 메인 kustomization 설정
+├── model-registry-application.yaml     # ArgoCD Application 매니페스트
+├── patch-db-deployment.yaml           # DB 배포 패치 (initContainer + 리소스)
+└── patch-model-registry-deployment.yaml # 서버 배포 패치 (리소스 제한)
+```
@@ -0,0 +1,30 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Include core model registry components (for profile namespace)
+resources:
+  # Database and core model registry components
+  - ../db
+  # Istio networking components
+  - ../../options/istio
+
+# Patches for deployments
+patches:
+  - path: patch-db-deployment.yaml
+    target:
+      group: apps
+      version: v1
+      kind: Deployment
+      name: model-registry-db
+  - path: patch-model-registry-deployment.yaml
+    target:
+      group: apps
+      version: v1
+      kind: Deployment
+      name: model-registry-deployment
+
+# Common labels for all resources
+commonLabels:
+  app.kubernetes.io/name: model-registry
+  app.kubernetes.io/component: model-registry-core
+  app.kubernetes.io/part-of: kubeflow
@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: model-registry-demo01-test
+  namespace: platform
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.example.org/dip/tenant-catalog  # Replace with your actual repository URL
+    targetRevision: model-registry/v0.2.19
+    path: model-registry/overlays/argocd
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: demo01-test  # Replace with your actual profile namespace
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+  ignoreDifferences:
+    - group: apps
+      kind: Deployment
+      jsonPointers:
+        - /spec/replicas
@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: model-registry-db
+spec:
+  template:
+    spec:
+      ## initContainer 추가
+      initContainers:
+      - args:
+        - /bin/sh
+        - -c
+        - chown 999:999 /var/lib/mysql
+        image: busybox:1.36
+        imagePullPolicy: IfNotPresent
+        name: init-permissions
+        resources:
+          requests:
+            cpu: 100m
+            memory: 100Mi
+        securityContext:
+          runAsGroup: 0
+          runAsNonRoot: false
+          runAsUser: 0
+        volumeMounts:
+        - mountPath: /var/lib/mysql
+          name: metadata-mysql
+      containers:
+      - name: db-container
+        resources:
+          requests:
+            cpu: 100m
+            memory: 100M
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: model-registry-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: rest-container
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+      - name: grpc-container
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
@@ -0,0 +1,69 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- model-registry-db-pvc.yaml
+- model-registry-db-deployment.yaml
+- model-registry-db-service.yaml
+- ../../base
+
+
+configMapGenerator:
+- envs:
+  - params.env
+  name: model-registry-db-parameters
+secretGenerator:
+- envs:
+  - secrets.env
+  name: model-registry-db-secrets
+generatorOptions:
+  disableNameSuffixHash: true
+
+
+images:
+- name: mysql
+  newName: mysql
+  newTag: 8.3.0
+
+patches:
+- path: patches/model-registry-deployment.yaml
+replacements:
+- source:
+    fieldPath: metadata.name
+    kind: Service
+    name: model-registry-db
+    version: v1
+  targets:
+  - fieldPaths:
+    - spec.template.spec.containers.1.args.1
+    options:
+      delimiter: =
+      index: 1
+    select:
+      group: apps
+      kind: Deployment
+      name: model-registry-deployment
+      version: v1
+- source:
+    fieldPath: data.MYSQL_PORT
+    kind: ConfigMap
+    name: model-registry-db-parameters
+    version: v1
+  targets:
+  - fieldPaths:
+    - spec.template.spec.containers.1.args.3
+    options:
+      delimiter: =
+      index: 1
+    select:
+      group: apps
+      kind: Deployment
+      name: model-registry-deployment
+      version: v1
+  - fieldPaths:
+    - spec.template.metadata.annotations.[traffic.sidecar.istio.io/excludeOutboundPorts]
+    select:
+      group: apps
+      kind: Deployment
+      name: model-registry-deployment
+      version: v1
@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: model-registry-db
+  labels:
+    component: db
+spec:
+  selector:
+    matchLabels:
+      component: db
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      name: db
+      labels:
+        component: db
+        sidecar.istio.io/inject: "false"
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+        runAsNonRoot: true
+      containers:
+      - name: db-container
+        image: mysql:8.3.0
+        args:
+        - --datadir
+        - /var/lib/mysql/datadir
+        - --default-authentication-plugin=mysql_native_password
+        envFrom:
+        - configMapRef:
+            name: model-registry-db-parameters
+        - secretRef:
+            name: model-registry-db-secrets
+        ports:
+        - name: dbapi
+          containerPort: 3306
+        readinessProbe:
+          exec:
+            command:
+            - "/bin/bash"
+            - "-c"
+            - "mysql -D $$MYSQL_DATABASE -u$$MYSQL_USER_NAME -p$$MYSQL_ROOT_PASSWORD -e 'SELECT 1'"
+          initialDelaySeconds: 5
+          periodSeconds: 2
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: metadata-mysql
+          mountPath: /var/lib/mysql
+        securityContext:
+          runAsUser: 999
+          runAsGroup: 999
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+      volumes:
+      - name: metadata-mysql
+        persistentVolumeClaim:
+          claimName: metadata-mysql
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: metadata-mysql
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: model-registry-db
+  labels:
+    component: db
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3306
+      protocol: TCP
+      name: dbapi
+  selector:
+    component: db
@@ -0,0 +1,3 @@
+MYSQL_DATABASE=metadb
+MYSQL_PORT=3306
+MYSQL_ALLOW_EMPTY_PASSWORD=true
@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: model-registry-deployment
+spec:
+  template:
+    metadata:
+      annotations:
+        # db doesn't use istio
+        traffic.sidecar.istio.io/excludeOutboundPorts: MYSQL_PORT_PLACEHOLDER
+    spec:
+      containers:
+        - name: rest-container
+          # Remove existing environment variables
+          env:
+          - $patch: replace
+          envFrom:
+          - configMapRef:
+              name: model-registry-configmap
+          args:
+            - --hostname=0.0.0.0
+            - --port=$(MODEL_REGISTRY_REST_SERVICE_PORT)
+            - --mlmd-hostname=localhost
+            - --mlmd-port=$(MODEL_REGISTRY_GRPC_SERVICE_PORT)
+            - --datastore-type=$(MODEL_REGISTRY_DATA_STORE_TYPE)
+        - name: grpc-container
+          # Remove existing environment variables
+          env:
+          - $patch: replace
+          envFrom:
+          - configMapRef:
+              name: model-registry-db-parameters
+          - secretRef:
+              name: model-registry-db-secrets
+          - configMapRef:
+              name: model-registry-configmap
+          args: ["--grpc_port=$(MODEL_REGISTRY_GRPC_SERVICE_PORT)",
+                 "--mysql_config_host=MLMD_DB_HOST_PLACEHOLDER",
+                 "--mysql_config_database=$(MYSQL_DATABASE)",
+                 "--mysql_config_port=MYSQL_PORT_PLACEHOLDER",
+                 "--mysql_config_user=$(MYSQL_USER_NAME)",
+                 "--mysql_config_password=$(MYSQL_ROOT_PASSWORD)"]
@@ -0,0 +1,2 @@
+MYSQL_USER_NAME=root
+MYSQL_ROOT_PASSWORD=test
@@ -0,0 +1,68 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- model-registry-db-pvc.yaml
+- model-registry-db-deployment.yaml
+- model-registry-db-service.yaml
+- ../../base
+
+
+configMapGenerator:
+- envs:
+  - params.env
+  name: metadata-registry-db-parameters
+secretGenerator:
+- envs:
+  - secrets.env
+  name: metadata-registry-db-secrets
+generatorOptions:
+  disableNameSuffixHash: true
+
+images:
+- name: postgres
+  newName: postgres
+  newTag: 14.7-alpine3.17
+
+patches:
+- path: patches/model-registry-deployment.yaml
+replacements:
+- source:
+    fieldPath: metadata.name
+    kind: Service
+    name: metadata-postgres-db
+    version: v1
+  targets:
+  - fieldPaths:
+    - spec.template.spec.containers.0.args.2
+    options:
+      delimiter: =
+      index: 1
+    select:
+      group: apps
+      kind: Deployment
+      name: model-registry-deployment
+      version: v1
+- source:
+    fieldPath: data.POSTGRES_PORT
+    kind: ConfigMap
+    name: metadata-registry-db-parameters
+    version: v1
+  targets:
+  - fieldPaths:
+    - spec.template.metadata.annotations.[traffic.sidecar.istio.io/excludeOutboundPorts]
+    select:
+      group: apps
+      kind: Deployment
+      name: model-registry-deployment
+      version: v1
+  - fieldPaths:
+    - spec.template.spec.containers.0.args.3
+    options:
+      delimiter: =
+      index: 1
+    select:
+      group: apps
+      kind: Deployment
+      name: model-registry-deployment
+      version: v1
@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: metadata-postgres-db
+  labels:
+    component: db
+spec:
+  selector:
+    matchLabels:
+      component: db
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      name: db
+      labels:
+        component: db
+        sidecar.istio.io/inject: "false"
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+        runAsNonRoot: true
+      containers:
+      - name: db-container
+        image: postgres
+        env:
+          - name: PGDATA
+            value: /var/lib/postgresql/data/pgdata
+        envFrom:
+        - configMapRef:
+            name: metadata-registry-db-parameters
+        - secretRef:
+            name: metadata-registry-db-secrets
+        ports:
+        - name: postgres
+          containerPort: 5432
+        volumeMounts:
+        - name: metadata-postgres
+          mountPath: /var/lib/postgresql/data
+        securityContext:
+          runAsUser: 70
+          runAsGroup: 70
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+      volumes:
+      - name: metadata-postgres
+        persistentVolumeClaim:
+          claimName: metadata-postgres
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: metadata-postgres
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: metadata-postgres-db
+  labels:
+    component: db
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5432
+      protocol: TCP
+      name: postgres
+  selector:
+    component: db
@@ -0,0 +1,2 @@
+POSTGRES_PORT=5432
+POSTGRES_DBNAME=mlmdpostgres
@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: model-registry-deployment
+spec:
+  template:
+    metadata:
+      annotations:
+        # db doesn't use istio
+        traffic.sidecar.istio.io/excludeOutboundPorts: POSTGRES_PORT_PLACEHOLDER
+    spec:
+      containers:
+        - name: grpc-container
+          # Remove existing environment variables
+          env:
+          - $patch: replace
+          envFrom:
+          - configMapRef:
+              name: metadata-registry-db-parameters
+          - secretRef:
+              name: metadata-registry-db-secrets
+          - configMapRef:
+              name: model-registry-configmap
+          args: ["--grpc_port=$(MODEL_REGISTRY_GRPC_SERVICE_PORT)",
+                 "--metadata_source_config_type=postgresql",
+                 "--postgres_config_host=MLMD_DB_HOST_PLACEHOLDER",
+                 "--postgres_config_port=POSTGRES_PORT_PLACEHOLDER",
+                 "--postgres_config_dbname=$(POSTGRES_DBNAME)",
+                 "--postgres_config_user=$(POSTGRES_USER)",
+                 "--postgres_config_password=$(POSTGRES_PASSWORD)",
+                #  "--postgres_config_skip_db_creation=true",
+                 "--enable_database_upgrade=true"]
@@ -0,0 +1,2 @@
+POSTGRES_USER=root
+POSTGRES_PASSWORD=password