diff --git a/charts/kubeflow/CUSTOM-README.md b/charts/kubeflow/CUSTOM-README.md new file mode 100644 index 0000000..ff1f122 --- /dev/null +++ b/charts/kubeflow/CUSTOM-README.md @@ -0,0 +1,59 @@ +# Kubeflow 배포 + +## 배포 절차 +### 1) 변수 수정 +- 대상 파일 +``` +- common/oauth2-proxy/overlays/m2m-keycloak/m2m.env +- common/oauth2-proxy/overlays/m2m-keycloak/patch-oauth2-proxy-config.yaml +- common/oauth2-proxy/overlays/m2m-keycloak/secrets.env +- dip/kubeflow-core/ingress.yaml +- dip/applicationset/kubeflow-applicationset.yaml +``` +- 변수 예시 +``` yaml +HOST='kubeflow.example.org' +DOMAIN='example.org' +OIDC_ISSUER_URL='https://keycloak.example.org/realms/paasup' +OIDC_JWKS_URL='http://kubeflow.platform.svc.cluster.local/realms/paasup/protocol/openid-connect/certs' +REDIRECT_URL='https://kubeflow.example.org/oauth2/callback' +CLIENT_ID='kubeflow' +CLIENT_SECRET='NOARm1WehZbWIHt9Aheau9kDrefBrZy8' +COOKIE_SECRET='094f9651100c4ee4a3a7337e405d8650' +GIT_REPO_URL=https://gitea.example.org/dip/tenant-catalog +TAG=kubeflow/1.10.0 +``` + +- 수정 위치 +``` +# 변수 처리된 파일에 값 수정 +## 1. dip/kubeflow-core/ingress.yaml +## 파일 내 $HOST 수정 + +## 2. dip/kubeflow-dependencies/knative-serving/patches/config-domain.yaml +## $DOMAIN 수정 + +## 3. common/oauth2-proxy/overlays/m2m-keycloak/m2m.env +## $OIDC_ISSUER_URL와 $OIDC_JWKS_URL 수정 + +## 4. common/oauth2-proxy/overlays/m2m-keycloak/patch-oauth2-proxy-config.yaml +## $OIDC_ISSUER_URL와 $REDIRECT_URL 수정 + +## 5. common/oauth2-proxy/overlays/m2m-keycloak/secrets.env +## $CLIENT_ID / $CLIENT-SECRET / $COOKIE-SECRET 수정 + +## 6. dip/applicationset/kubeflow-applicationset.yaml +## $GIT_REPO_URL / $TAG 수정 +``` + + +### 2. 배포 방법 +- 배포 전 검토 사항 + - keycloak 내 oicd 설정 확인 + - gitea repogitory 구성 확인 + - argocd 배포 확인 + - argocd 내 repository 등록 확인 +- 배포 +``` sh +kubectl apply -f dip/applicationset/kubeflow-applicationset.yaml +``` \ No newline at end of file diff --git a/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-oauth2-proxy.yaml b/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-oauth2-proxy.yaml index ff80cab..24ebad3 100644 --- a/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-oauth2-proxy.yaml +++ b/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-oauth2-proxy.yaml @@ -23,3 +23,6 @@ spec: - /dex/* - /dex/** - /oauth2/* + - /v1* + - /v2* + - /openai* diff --git a/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-require-jwt.yaml b/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-require-jwt.yaml index 7f92eaf..ea1b9cc 100644 --- a/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-require-jwt.yaml +++ b/charts/kubeflow/common/oauth2-proxy/overlays/m2m-keycloak/istio-keycloak-auth/authorizationpolicy.istio-ingressgateway-require-jwt.yaml @@ -22,3 +22,6 @@ spec: - /dex/* - /dex/** - /oauth2/* + - /v1* + - /v2* + - /openai* diff --git a/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/README.md b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/README.md new file mode 100644 index 0000000..fd9d128 --- /dev/null +++ b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/README.md @@ -0,0 +1,88 @@ +# Kubeflow DIP용 Knative Serving 구성 + +이 디렉토리는 Kubeflow DIP(Data Intelligence Platform) 배포의 일부로 사용되는 Knative Serving의 Kustomization 구성을 포함합니다. + +## 개요 + +이 구성은 DIP 환경에 맞춤화된 사용자 정의 패치를 통해 기본 Knative Serving 설치를 확장합니다. 공통 Knative Serving 기본 구성을 참조하고 배포를 사용자 정의하기 위해 여러 패치를 적용합니다. + +## 구조 + +``` +knative-serving/ +├── kustomization.yaml # 메인 Kustomization 구성 +├── patches/ # 사용자 정의 패치 디렉토리 +│ ├── config-deployment.yaml # 배포 리소스 구성 +│ ├── config-feature.yaml # 기능 플래그 구성 +│ ├── config-domain.yaml # 도메인 구성 +│ ├── config-network.yaml # 네트워크 구성 +│ ├── gateway-selector-in-knative-serving.yaml # knative-serving 네임스페이스용 게이트웨이 구성 +│ └── gateway-selector-in-istio-system.yaml # istio-system 네임스페이스용 서비스 구성 +└── README.md # 이 파일 +``` + +## 구성 세부사항 + +### 기본 리소스 +- **기본 경로**: `../../../common/knative/knative-serving/base` +- Kubeflow 배포 전반에서 공유되는 공통 Knative Serving 기본 구성을 참조 + +### 적용된 패치 + +#### 1. 배포 구성 (`config-deployment.yaml`) +- **목적**: 큐 사이드카 컨테이너의 리소스 요청 구성 +- **설정**: + - 큐 사이드카 CPU 요청: `25m` + - 큐 사이드카 메모리 요청: `400Mi` + +#### 2. 기능 구성 (`config-feature.yaml`) +- **목적**: 특정 Knative Serving 기능 활성화 +- **설정**: + - 런타임 클래스 지원을 위한 `kubernetes.podspec-runtimeclassname` 기능 활성화 + +#### 3. 도메인 구성 (`config-domain.yaml`) +- **목적**: 사용자 정의 도메인 구성 설정 +- **설정**: + - `hopt.paasup.io`를 기본 도메인으로 구성 + +#### 4. 네트워크 구성 (`config-network.yaml`) +- **목적**: 네트워크 라우팅 및 도메인 템플릿 정의 +- **설정**: + - 도메인 템플릿: `{{.Name}}.{{.Namespace}}.{{.Domain}}` + - 이는 `서비스명.네임스페이스.도메인` 형식의 URL을 생성 + +#### 5. 게이트웨이 구성 (`gateway-selector-in-knative-serving.yaml`) +- **목적**: 로컬 클러스터 액세스를 위한 Istio 게이트웨이 구성 +- **네임스페이스**: `knative-serving` +- **설정**: + - 게이트웨이 이름: `knative-local-gateway` + - 셀렉터 레이블: `app: cluster-local-gateway`, `istio: cluster-local-gateway` + +#### 6. 서비스 구성 (`gateway-selector-in-istio-system.yaml`) +- **목적**: 게이트웨이 라우팅을 위한 istio-system 네임스페이스의 서비스 구성 +- **네임스페이스**: `istio-system` +- **설정**: + - 서비스 이름: `knative-local-gateway` + - 셀렉터 레이블: `app: cluster-local-gateway`, `istio: cluster-local-gateway` + +## 사용법 + +이 구성은 Kubeflow DIP 스택을 배포할 때 자동으로 적용됩니다. 패치는 다음을 보장합니다: + +1. **리소스 최적화**: 큐 사이드카가 적절한 리소스 요청을 사용 +2. **기능 활성화**: 향상된 보안을 위한 런타임 클래스 이름 지원 +3. **도메인 관리**: 사용자 정의 도메인 라우팅이 적절히 구성 +4. **네트워크 라우팅**: 구성된 도메인 템플릿을 통해 서비스에 액세스 가능 +5. **Istio 통합**: Istio 메시를 위한 적절한 게이트웨이 및 서비스 구성 + +## 의존성 + +- Knative Serving 기본 설치 +- Istio 서비스 메시 +- 적절한 RBAC 권한을 가진 Kubernetes 클러스터 + +## 참고사항 + +- `hopt.paasup.io` 도메인이 DNS 설정에서 적절히 구성되어야 함 +- Istio cluster-local-gateway가 배포되고 실행 중인지 확인 +- 큐 사이드카의 리소스 요청은 일반적인 DIP 워크로드에 최적화됨 \ No newline at end of file diff --git a/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/kustomization.yaml b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/kustomization.yaml new file mode 100644 index 0000000..885d520 --- /dev/null +++ b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/kustomization.yaml @@ -0,0 +1,14 @@ +# Kubeflow Dependencies Kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- ../../../common/knative/knative-serving/base + +patches: +- path: patches/config-deployment.yaml +- path: patches/config-feature.yaml +- path: patches/config-domain.yaml +- path: patches/config-network.yaml +- path: patches/gateway-selector-in-knative-serving.yaml +- path: patches/gateway-selector-in-istio-system.yaml \ No newline at end of file diff --git a/charts/kubeflow/dip/kubeflow-dependencies/config-deployment-patch.yaml b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-deployment.yaml similarity index 100% rename from charts/kubeflow/dip/kubeflow-dependencies/config-deployment-patch.yaml rename to charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-deployment.yaml diff --git a/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-domain.yaml b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-domain.yaml new file mode 100644 index 0000000..69e0d1e --- /dev/null +++ b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-domain.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-domain + namespace: knative-serving +data: + $DOMAIN: "" diff --git a/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-feature.yaml b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-feature.yaml new file mode 100644 index 0000000..a82fd16 --- /dev/null +++ b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-feature.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-features + namespace: knative-serving +data: + kubernetes.podspec-runtimeclassname: "enabled" diff --git a/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-network.yaml b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-network.yaml new file mode 100644 index 0000000..44d45cb --- /dev/null +++ b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/config-network.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-network + namespace: knative-serving +data: + domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" diff --git a/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/gateway-selector-in-istio-system.yaml b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/gateway-selector-in-istio-system.yaml new file mode 100644 index 0000000..ad36872 --- /dev/null +++ b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/gateway-selector-in-istio-system.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Service +metadata: + name: knative-local-gateway + namespace: istio-system +spec: + selector: + app: cluster-local-gateway + istio: cluster-local-gateway \ No newline at end of file diff --git a/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/gateway-selector-in-knative-serving.yaml b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/gateway-selector-in-knative-serving.yaml new file mode 100644 index 0000000..d1bffc7 --- /dev/null +++ b/charts/kubeflow/dip/kubeflow-dependencies/knative-serving/patches/gateway-selector-in-knative-serving.yaml @@ -0,0 +1,9 @@ +apiVersion: networking.istio.io/v1beta1 +kind: Gateway +metadata: + name: knative-local-gateway + namespace: knative-serving +spec: + selector: + app: cluster-local-gateway + istio: cluster-local-gateway diff --git a/charts/kubeflow/dip/kubeflow-dependencies/kustomization.yaml b/charts/kubeflow/dip/kubeflow-dependencies/kustomization.yaml index 3a91549..30dc773 100644 --- a/charts/kubeflow/dip/kubeflow-dependencies/kustomization.yaml +++ b/charts/kubeflow/dip/kubeflow-dependencies/kustomization.yaml @@ -7,8 +7,8 @@ resources: - ../../common/cert-manager/kubeflow-issuer/base # OAuth2-Proxy - ../../common/oauth2-proxy/overlays/m2m-keycloak -# KNative -- ../../common/knative/knative-serving/overlays/gateways +# KNative dip patch +- ./knative-serving # Kubeflow namespace - ../../common/kubeflow-namespace/base # NetworkPolicies @@ -17,6 +17,3 @@ resources: - ../../common/kubeflow-roles/base # Kubeflow Istio Resources - ../../common/istio-1-24/kubeflow-istio-resources/base - -patchesStrategicMerge: -- config-deployment-patch.yaml \ No newline at end of file