Skip to content

Commit

Permalink
feat(helm): helm chart for privacypal
Browse files Browse the repository at this point in the history 
Signed-off-by: Thuan Vo <thuan.votann@gmail.com>
  • Loading branch information
@tthvo
tthvo committed Jan 25, 2024
1 parent 2d5d0a1 commit 52ccb38
Show file tree
Hide file tree
Showing 25 changed files with 1,282 additions and 0 deletions.
1 change: 1 addition & 0 deletions helm-charts/README.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
charts/privacypal/README.md
72 changes: 72 additions & 0 deletions helm-charts/SETUP.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
# Kubernetes smoketests

## REQUIREMENTS

- [`kubectl`](https://kubectl.docs.kubernetes.io/installation/kubectl/binaries/) (v1.27+) or [`oc`](https://docs.openshift.com/container-platform/4.14/cli_reference/openshift_cli/getting-started-cli.html)
- [`aws`](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) with permissions to create IAM resources (IAM user not required)
- [`eksctl`](https://eksctl.io/installation/)
- [`helm`](https://helm.sh/docs/intro/install/)
- [`jq`](https://jqlang.github.io/jq/)
- [`podman`](https://podman.io/docs/installation) or [`docker`](https://docs.docker.com/engine/install/)
- [AWS EKS Instance](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html) (Kubernetes v1.27+) with Kubeadmin access

## Amazon Elastic Kubernetes Service (AWS EKS)

**Note:** The application currently supports only AWS EKS with Kubernetes v1.27+. Please ensure an EKS instance is available before proceeding.

To list available clusters, run:

```bash
aws eks list-clusters --region <region>
```

To create a cluster, if required, run:

```bash
eksctl create cluster --name <cluster-name> --region <region-code>
```

If you already have a cluster or at any time need to update kubeconfig, run:

```bash
aws eks update-kubeconfig --region <region-code> --name <cluster-name>
```

**Notes:**

- If you are using another aws profile other than `default`, specify the `--profile <profile-name>` in your `aws`/`eksctl` command.
- If you would like to use another config file rather than `$HOME/.kube/config`, set `KUBECONFIG=<path-to-kube-config>`.

## OIDC Identity Provider

Create an OpenID Connect (OIDC) identity provider for your EKS cluster using the `eksctl utils` command:

```bash
eksctl utils associate-iam-oidc-provider --cluster <eks cluster name> --region <region-code> --approve
```

This allows service accounts within the EKS cluster to authenticate with AWS services.

## ACK Controllers

The EKS instance must be properly configured with AWS Controllers for Kubernetes (ACK). These controllers are responsible for managing AWS resources via Kubernetes custom resource.

The ACK controllers are available for installation via Helm Charts. Follow the [ACK documentations](https://aws-controllers-k8s.github.io/community/docs/community/overview/) to set up IAM resources and installation step.

This repository also includes a utility script `ack_installer.sh` to automate the entire process.

```bash
AWS_SERVICE=s3 bash ack_installer.sh
```

To verify whether the controller is installed sucessfully, check if all controller pods are running:

```bash
$ kubectl get pods -n ack-system
NAME READY STATUS RESTARTS AGE
ack-ec2-controller-ec2-chart-588f67f4d-44l57 1/1 Running 0 5d19h
ack-iam-controller-iam-chart-b9ccd6779-l2qjr 1/1 Running 0 5d19h
ack-lambda-controller-lambda-chart-7d44454dbb-lb67c 1/1 Running 0 5d22h
ack-rds-controller-rds-chart-8bffcb97c-llttr 1/1 Running 0 5d22h
ack-s3-controller-s3-chart-65bd8564b4-9h8dl 1/1 Running 0 9d
```
21 changes: 21 additions & 0 deletions helm-charts/chart_schema.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: str()
home: str(required=False)
version: str()
appVersion: any(str(), num(), required=False)
description: str(required=False)
keywords: list(str(), required=False)
sources: list(str(), required=False)
maintainers: list(include('maintainer'), required=False)
icon: str(required=False)
apiVersion: str(required=False)
engine: str(required=False)
condition: str(required=False)
tags: str(required=False)
deprecated: bool(required=False)
kubeVersion: str(required=False)
annotations: map(str(), str(), required=False)
---
maintainer:
name: str(required=False)
email: str(required=False)
url: str(required=False)
23 changes: 23 additions & 0 deletions helm-charts/charts/privacypal/.helmignore
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
29 changes: 29 additions & 0 deletions helm-charts/charts/privacypal/Chart.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
apiVersion: v2

name: privacypal

description: A Helm chart for PrivacyPal

type: application

version: 0.1.0-dev

appVersion: "0.1.0-dev"

kubeVersion: ">= 1.19.0-0"

keywords:
- privacypal
- video-processing
- security

home: https://github.com/COSC-499-W2023/year-long-project-team-1/wiki

# icon:

sources:
- https://github.com/COSC-499-W2023/year-long-project-team-1

maintainers:
- name: Privacypal Team
url: https://github.com/orgs/COSC-499-W2023/teams/team-1
63 changes: 63 additions & 0 deletions helm-charts/charts/privacypal/README.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
# Privacypal Helm Chart

Helm Chart to deploy [Privacypal](https://github.com/COSC-499-W2023/year-long-project-team-1/wiki) application on Kubernetes. Currently, only AWS EKS is supported.

## Parameters

### PrivacyPal Application

| Name | Description | Value |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
| `web` | Configurations for the Privacypal pod | |
| `web.replicas` | Number of replicas of the Privacypal pod | `1` |
| `web.image.repository` | Repository for the Privacypal container image | `ghcr.io/cosc-499-w2023/privacypal` |
| `web.image.tag` | Tag for the Privacypal container image | `0.1.0-dev` |
| `web.image.pullPolicy` | Image pull policy for the Privacypal container image | `Always` |
| `web.podAnnotations` | Annotations to be applied to the Privacypal pod | `{}` |
| `web.podSecurityContext` | Security Context for the Privacypal Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) | `{}` |
| `web.securityContext` | Security Context for the Privacypal container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) | `{}` |
| `web.service.type` | Type of Service to create for Privacypal pod | `ClusterIP` |
| `web.service.port` | Port number to expose on the Service for Privacypal's HTTP server | `8080` |
| `web.ingress.enabled` | Whether to create an Ingress object for the Privacypal service | `false` |
| `web.ingress.className` | Ingress class name for the Privacypal Ingress | `""` |
| `web.ingress.annotations` | Annotations to apply to the Privacypal Ingress | `{}` |
| `web.ingress.hosts` | Hosts to create rules for in the Privacypal Ingress. See: [IngressSpec](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec) | `[]` |
| `web.resources` | Resource requests and limtis for Privacypal container. | `{}` |

### Lambda

| Name | Description | Value |
| ----------------------------- | ----------------------------------------------------------------------------------------------------------- | ----------- |
| `lambda` | Configurations for the Video processing component as AWS Lambda | |
| `lambda.image.repository` | Repository for the lambda container image | `""` |
| `lambda.image.tag` | Tag for the lambda container image | `0.1.0-dev` |
| `lambda.image.pullPolicy` | Image pull policy for the lambda container image | `Always` |
| `lambda.ephemeralStorageSize` | The size of the function’s /tmp directory in MB | `512` |
| `lambda.memorySize` | The size of allocated memory for the function in MB | `2048` |
| `lambda.timeout` | The amount of time (in seconds) that Lambda allows a function to run before stopping it | `600` |
| `lambda.iamRole` | The ARN of IAM role to attach to the lambda. The role must allow the lambda to read and write to S3 buckets | `""` |

### Database

| Name | Description | Value |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| `database` | Configurations for the database (Postgres) component | |
| `database.version` | Version of the Postgres engine. See: [Available versions(https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html#PostgreSQL.Concepts.General.DBVersions) | `16` |
| `database.allocatedStorage` | The amount of storage to allocate for this instance in GB | `20` |
| `database.instanceClass` | The compute and memory capacity of the DB instance. See: [Supported classes](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html) | `db.t4g.micro` |
| `database.dbName` | Name of the database to create | `privacypal` |
| `database.credentialSecretName` | Name of the secret to extract the password for database master credentials. Use key `DB_USERNAME` and `DB_PASSWORD` | `""` |
| `database.initializer.image.repository` | Repository for the database initializer container image | `ghcr.io/cosc-499-w2023/privacypal-init-db` |
| `database.initializer.image.tag` | Tag for the database initializer container image | `0.1.0-dev` |
| `database.initializer.image.pullPolicy` | Image pull policy for the database initializer container image | `Always` |

### Other Parameters

| Name | Description | Value |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------ |
| `nameOverride` | Overrides the name of this Chart | `""` |
| `fullnameOverride` | Overrides the fully qualified application name of `[release name]-[chart name]` | `""` |
| `imagePullSecrets` | Image pull secrets to be used for the PrivacyPal deployment | `[]` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account. Annotation eks.amazonaws.com/role-arn must be specified with an IAM role that allows the service account to read/write S3 buckets, and get lambda (health check). | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | `""` |
22 changes: 22 additions & 0 deletions helm-charts/charts/privacypal/templates/NOTES.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
1. Get the application URL by running these commands:
{{- if .Values.web.ingress.enabled }}
{{- range $host := .Values.web.ingress.hosts }}
{{- range .paths }}
http{{ if $.Values.web.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
{{- end }}
{{- end }}
{{- else if contains "NodePort" .Values.web.service.type }}
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "privacypal.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
{{- else if contains "LoadBalancer" .Values.web.service.type }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "privacypal.fullname" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "privacypal.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
echo http://$SERVICE_IP:{{ .Values.web.service.port }}
{{- else if contains "ClusterIP" .Values.web.service.type }}
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "privacypal.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
{{- end }}
Loading

0 comments on commit 52ccb38

Please sign in to comment.