Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(helm): improve opensearch deployment #843

Merged
merged 4 commits into from
Nov 12, 2024
Merged

fix(helm): improve opensearch deployment #843

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b235782
fix(helm): set `fsGroup` to zero for local OpenSearch deployment (#843)
mdonadoni Nov 11, 2024
1895ac7
fix(helm): support OpenSearch deployment in non-default namespace (#843)
mdonadoni Nov 11, 2024
aad7dff
fix(helm): avoid redefining `REANA_OPENSEARCH_PASSWORD` (#843)
mdonadoni Nov 11, 2024
47c7a02
fix(reana-dev): allow `root` group to write to shared storage (#843)
mdonadoni Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions helm/configurations/values-dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ opensearch:
key: OPENSEARCH_INITIAL_ADMIN_PASSWORD
secretMounts: []
customSecurityConfig:
podSecurityContext:
fsGroup: 0

# FluentBit configuration for dev environment
fluent-bit:
Expand Down
4 changes: 2 additions & 2 deletions helm/reana/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,6 @@ This Helm automatically prefixes all names using the release name to avoid colli
| `components.reana_workflow_controller.environment.REANA_OPENSEARCH_USE_SSL` | Use SSL when connecting to OpenSearch instance. | true |
| `components.reana_workflow_controller.environment.REANA_OPENSEARCH_CA_CERTS` | Path to a file with OpenSearch root CA certificates. | "/code/certs/ca.crt" |
| `components.reana_workflow_controller.environment.REANA_OPENSEARCH_USER` | OpenSearch user name for Basic Authentication. | reana |
| `components.reana_workflow_controller.environment.REANA_OPENSEARCH_PASSWORD` | OpenSearch password for Basic Authentication. Set this value in the Helm command. | "" |
| `components.reana_workflow_engine_cwl.environment` | [REANA-Workflow-Engine-CWL](https://github.com/reanahub/reana-workflow-engine-cwl) environment variables | `{}` |
| `components.reana_workflow_engine_cwl.image` | [REANA-Workflow-Engine-CWL image](https://hub.docker.com/r/reanahub/reana-workflow-engine-cwl) to use | `docker.io/reanahub/reana-workflow-engine-cwl:<chart-release-version>` |
| `components.reana_workflow_engine_serial.environment` | [REANA-Workflow-Engine-Serial](https://github.com/reanahub/reana-workflow-engine-serial) environment variables | `{}` |
Expand Down Expand Up @@ -141,7 +140,7 @@ This Helm automatically prefixes all names using the release name to avoid colli
| `opensearch.tls.generate` | Enable the generation of a self-signed TLS certificates for OpenSearch | true |
| `opensearch.tls.ca.cn` | OpenSearch root CA certificate common name (CN) | reana.io |
| `opensearch.tls.ca.ttl` | OpenSearch root CA certificate TTL in days | 365 |
| `opensearch.tls.cert.cn` | OpenSearch node certificate common name (CN) | reana-opensearch-master.default.svc.cluster.local |
| `opensearch.tls.cert.cn` | OpenSearch node certificate common name (CN) | reana-opensearch-master |
| `opensearch.tls.cert.ttl` | OpenSearch node certificate TTL in days | 180 |
| `opensearch.tls.admin.cn` | OpenSearch admin certificate common name (CN) | opensearch-admin.reana.io |
| `opensearch.tls.admin.ttl` | OpenSearch admin certificate TTL in days | 180 |
Expand All @@ -162,6 +161,7 @@ This Helm automatically prefixes all names using the release name to avoid colli
| `secrets.gitlab.REANA_GITLAB_OAUTH_APP_ID` | GitLab OAuth application id | None |
| `secrets.gitlab.REANA_GITLAB_OAUTH_APP_SECRET` | **[Do not use in production, use secrets instead]** GitLab OAuth application secret | None |
| `secrets.login` | **[Do not use in production, use secrets instead]** Third-party Keycloak identity provider consumer key and secret ([configuration details](https://docs.reana.io/administration/configuration/configuring-access/#keycloak-single-sign-on-configuration)) | `{}` |
| `secrets.opensearch.password` | **[Do not use in production, use secrets instead]** OpenSearch password for Basic Authentication | None |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cosmetics: redefining instead of "re-defining" in the commit log.

| `secrets.reana.REANA_SECRET_KEY` | **[Do not use in production, use secrets instead]** REANA encryption secret key | None |
| `serviceAccount.create` | Create a service account for the REANA system user | true |
| `serviceAccount.name` | Service account name | reana |
Expand Down
2 changes: 1 addition & 1 deletion helm/reana/templates/secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ metadata:
"helm.sh/resource-policy": keep
type: Opaque
data:
REANA_OPENSEARCH_PASSWORD: {{ .Values.components.reana_workflow_controller.environment.REANA_OPENSEARCH_PASSWORD | default "reana" | b64enc }}
REANA_OPENSEARCH_PASSWORD: {{ .Values.secrets.opensearch.password | default "reana" | b64enc }}
{{- if not .Values.opensearch.securityConfig.enabled }}
OPENSEARCH_INITIAL_ADMIN_PASSWORD: {{ .Values.opensearch.initialAdminPassword | default "reana" | b64enc }} # dev environment only
{{- end }}
Expand Down
6 changes: 3 additions & 3 deletions helm/reana/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ secrets:
sso: {}
reana: {}
login: {}
opensearch: {}

# Enable and configure SSO authentication via a third-party Keycloak identity provider
login: []
Expand Down Expand Up @@ -116,7 +117,6 @@ components:
REANA_OPENSEARCH_USE_SSL: true
REANA_OPENSEARCH_CA_CERTS: "/code/certs/ca.crt"
REANA_OPENSEARCH_USER: reana
REANA_OPENSEARCH_PASSWORD: "" # Set this value in the Helm command
reana_workflow_engine_cwl:
image: docker.io/reanahub/reana-workflow-engine-cwl:0.9.3
environment: {}
Expand Down Expand Up @@ -215,7 +215,7 @@ opensearch:
cn: "reana.io"
ttl: 365
cert:
cn: "reana-opensearch-master.default.svc.cluster.local"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cosmetics: s/opensearch/OpenSearch/ in the commit log.

cn: "reana-opensearch-master"
ttl: 180
admin:
cn: "opensearch-admin.reana.io"
Expand Down Expand Up @@ -382,7 +382,7 @@ fluent-bit:
kubeCaFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
kubeTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
outputConfig:
host: reana-opensearch-master.default.svc.cluster.local
host: reana-opensearch-master
httpUser: fluentbit
httpPasswd:
tls: "On"
Expand Down
4 changes: 4 additions & 0 deletions reana/reana_dev/cluster.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,10 @@
cluster_config=yaml.dump(cluster_config),
)
run_command(cluster_create, "reana")
run_command(

Check warning on line 188 in reana/reana_dev/cluster.py

View check run for this annotation

Codecov / codecov/patch

reana/reana_dev/cluster.py#L188 

Added line #L188 was not covered by tests
"docker exec kind-control-plane sh -c 'mkdir -p /var/reana && chmod g+rwx /var/reana'",
"reana",
)

# pull Docker images
if mode in ("releasepypi", "latest", "debug"):
Expand Down
Loading