Initial k8s config for lsst-lsp-int

kube/lsst-lsp-int/configmaps.sh

@@ -0,0 +1,2 @@
+kubectl create configmap davt-nginx-config --from-file=nginx.conf=./nginx.conf
+

kube/lsst-lsp-int/davt-datasets.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: davt-datasets-volume
+  annotations:
+    volume.beta.kubernetes.io/mount-options: local_lock=all
+spec:
+  accessModes:
+  - ReadOnlyMany
+  capacity:
+    storage: 1100Ti
+  nfs:
+    path: /lsst/datasets
+    server: lsst-nfs.ncsa.illinois.edu
+  persistentVolumeReclaimPolicy: Retain
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: davt-datasets-claim
+spec:
+  accessModes:
+  - ReadOnlyMany
+  resources:
+    requests:
+      storage: 1090Ti
+  volumeName: davt-datasets-volume
+
+

kube/lsst-lsp-int/davt.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: davt-deployment
+  labels:
+    app: davt
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: davt
+  template:
+    metadata:
+      labels:
+        app: davt
+    spec:
+      containers:
+      - name: davt
+        image: lsstdm/davt
+        ports:
+        - containerPort: 8080
+        volumeMounts:
+        - name: davt-nginx-config-volume
+          mountPath: "/etc/nginx/nginx.conf"
+          subPath: nginx.conf
+          readOnly: true
+        - name: davt-datasets-volume
+          mountPath: "/datasets"
+          readOnly: true
+        - mountPath: /cache
+          name: cache-volume
+      volumes:
+      - name: davt-nginx-config-volume
+        configMap:
+          name: davt-nginx-config
+      - name: davt-datasets-volume
+        persistentVolumeClaim:
+          claimName: davt-datasets-claim
+      - name: cache-volume
+        emptyDir: {}
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  name: davt-service
+spec:
+  selector:
+    app: davt
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80
+
+---
+
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.lsst-pdac.svc.cluster.local:4180/auth"
+    nginx.ingress.kubernetes.io/auth-response-headers: X-Forwarded-User
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      auth_request_set $user $upstream_http_x_auth_request_user;
+      add_header REMOTE_USER $user;
+
+  name: davt-ingress
+spec:
+  rules:
+  - host: lsst-pdac.ncsa.illinois.edu
+    http:
+      paths:
+      - path: /workspace
+        backend:
+          serviceName: davt-service
+          servicePort: 80

kube/lsst-lsp-int/nginx.conf

@@ -0,0 +1,99 @@
+# User is root but capabilites should be dropped with docker/capsh
+user  root;
+worker_processes  1;
+
+load_module modules/ngx_http_dav_ext_module.so;
+load_module modules/ndk_http_module.so;
+load_module modules/ngx_http_lua_module.so;
+
+thread_pool workspace_pool threads=16;
+
+error_log  /var/log/nginx/error.log info;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    gzip  on;
+
+    # Add lua modules in scripts to the default lua search path (the `;;`)
+    lua_package_path "/etc/nginx/scripts/?.lua;;";
+
+    server {
+        underscores_in_headers on;
+        # Should be SSL terminated
+        listen      80;
+        listen [::]:80;
+
+        access_log                /dev/stdout;
+        error_log                 /dev/stderr info;
+
+        # Set the maximum size of uploads
+        client_max_body_size 500m;
+        client_body_timeout 600s; # Default is 60, May need to be increased for very large uploads
+
+        # other configs
+        location /workspace/datasets/ {
+            aio threads=workspace_pool;
+            autoindex              on;
+            alias                  /lsst/datasets/;
+            client_body_temp_path  /cache/client_temp;
+
+            dav_methods PUT DELETE MKCOL COPY MOVE;
+            dav_ext_methods PROPFIND OPTIONS;
+
+            create_full_put_path   on;
+            # dav_access             group:rw  all:r;
+
+            # An init_by_lua_block could setsfsuid(65534) or something
+            # So that access_by_lua_block is never setfsuid(0)
+            # Per-Request Impersionation
+            access_by_lua_block {
+                local username = ngx.req.get_headers()['remote_user']
+                local davt = require("davt")
+                davt.impersonate(username, nil)
+            }
+        }
+
+        # other configs
+        # location /workspace/jhome/ {
+        #     aio threads=workspace_pool;
+        #     autoindex              on;
+        #     alias                  /lsst/project/jhome/;
+        #     client_body_temp_path  /cache/client_temp;
+
+        #     dav_methods PUT DELETE MKCOL COPY MOVE;
+        #     dav_ext_methods PROPFIND OPTIONS;
+
+        #     create_full_put_path   on;
+        #     # dav_access             group:rw  all:r;
+
+        #     # An init_by_lua_block could setsfsuid(65534) or something
+        #     # So that access_by_lua_block is never setfsuid(0)
+        #     # Per-Request Impersionation
+        #     access_by_lua_block {
+        #         local username = ngx.req.get_headers()['remote_user']
+        #         local davt = require("davt")
+        #         davt.impersonate(username, nil)
+        #     }
+        # }
+    }
+}