Commit 011bdbf5 authored by Radu Carpa's avatar Radu Carpa Committed by rcarpa
Browse files

servers: support new fts-renewal behavior in servers 

Check the following commit for details:
https://github.com/rucio/helm-charts/commit/d8790d46cc37d8b186ede9eafccd98a8d8fe38a7
parent 8674ba5c

charts/rucio-server/Chart.yaml

+1 −1
Original line number Diff line number Diff line 
name: rucio-server

version: 1.30.4

version: 1.30.5

apiVersion: v1

description: A Helm chart to deploy servers for Rucio

keywords:

charts/rucio-server/ci/testing-values.yaml

0 → 100644
+147 −0
Original line number Diff line number Diff line 
replicaCount: 1

authReplicaCount: 1

traceReplicaCount: 1



image:

  repository: rucio/rucio-server

  tag: release-1.26.9

  pullPolicy: IfNotPresent



automaticRestart:

  enabled: 1

  image:

    repository: bitnami/kubectl

    tag: 1.18

    pullPolicy: IfNotPresent

  schedule: "5 1 * * *"



service:

  type: LoadBalancer

  port: 80

  targetPort: 80

  protocol: TCP

  name: http

  externalTrafficPolicy: local

  annotations:

    service.beta.kubernetes.io/openstack-internal-load-balancer: "true"



monitoring:

  enabled: false

  serviceMonitor:

    relabelings:

      - sourceLabels: [__meta_kubernetes_pod_node_name]

        separator: ;

        regex: ^(.*)$

        targetLabel: nodename

        replacement: $1

        action: replace



secretMounts:

  - volumeName: gcsrucio

    secretName: gcsrucio

    mountPath: /opt/rucio/etc/

    subPaths:

      - gcs_rucio.json

  - volumeName: rse-accounts

    secretName: rse-accounts

    mountPath: /opt/rucio/etc/rse-accounts.cfg

    subPath: rse-accounts.cfg



additionalSecrets:

  - volumeName: mail-templates

    secretName: mail-templates

    mountPath: /opt/rucio/etc/mail_templates/

    subPaths:

      - rule_ok_notification.tmpl

      - rule_approval_request.tmpl

      - rule_approved_admin.tmpl

      - rule_approved_user.tmpl

      - rule_denied_admin.tmpl

      - rule_denied_user.tmpl

  - secretName: some-patch

    mountPath: /patch/some.patch

    subPath: some.patch



wsgi:

  daemonProcesses: "4"

  daemonThreads: "8"



httpd_config:

  mpm_mode: "event"

  timeout: "300"

  enable_status: "True"

  keep_alive: "On"

  keep_alive_timeout: "5"

  max_keep_alive_requests: "128"

  server_limit: "10"

  start_servers: "4"

  thread_limit: "128"

  threads_per_child: "128"

  min_spare_threads: "256"

  max_spare_threads: "512"

  max_request_workers: "1280"

  max_connections_per_child: "2048"



serverType:

  server: flask



serverResources:

  limits:

    cpu: "100m"

    memory: "100Mi"

  requests:

    cpu: "100m"

    memory: "100Mi"



ingress:

  enabled: true

  annotations:

    kubernetes.io/ingress.class: traefik

    traefik.ingress.kubernetes.io/frontend-entry-points: http, https

    traefik.ingress.kubernetes.io/redirect-entry-point: http

  hosts:

  - "a.b.c"

  tls: []



ftsRenewal:

  enabled: 1

  image:

    repository: rucio/fts-cron

    tag: java

    pullPolicy: IfNotPresent

  script: "cms"

  vos:

    - vo: "cms"

      voms: "cms:/cms/Role=production"

  servers: "https://d.f:8446,https://a.b.c:8446"

  secretMounts:

    - secretName: longproxy

      mountPath: /opt/rucio/certs/

  additionalEnvs:

    - name: RUCIO_FTS_SECRETS

      value: serverint-rucio-x509up

    - name: RUCIO_LONG_PROXY

      value: "latest_x509up.rfc.proxy"



config:

  core:

    default_mail_from: "a@b.c"



  monitor:

    carbon_server: "a.b.c"

    carbon_port: "8888"

    user_scope: "rucio-scope"



  policy:

    permission: "cms"

    schema: "cms"



  credentials:

    gcs: "/opt/rucio/etc/gcs_rucio.json"



  api:

    endpoints: "accountlimits, accounts, archives, config, credentials, dids, export, heartbeats, identities, import, lifetime_exceptions, locks, meta, ping, redirect, replicas, requests, rses, rules, scopes, subscriptions"



  conveyor:

    usercert: "/opt/proxy/x509up"

    use_preparer: "True"

charts/rucio-server/templates/renew-fts-cronjob.yaml

+46 −3
Original line number Diff line number Diff line
@@ -2,6 +2,17 @@ 
{{- if .Values.ftsRenewal.enabled }}

  serviceAccountName: {{ .Release.Name }}-rucio-edit

  volumes:

  - name: config-common

    secret:

      secretName: {{ template "rucio.fullname" . }}.config.common

  {{- range $collection := tuple .Values.secretMounts .Values.ftsRenewal.secretMounts .Values.additionalSecrets .Values.ftsRenewal.additionalSecrets }}

  {{- range $key, $val := $collection }}

  - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }}

    secret:

      secretName: {{ coalesce $val.secretFullName (printf "%s-%s" $.Release.Name $val.secretName) }}

  {{- end}}

  {{- end}}

  {{- if .Values.useDeprecatedImplicitSecrets }}

  {{- if or (eq .Values.ftsRenewal.vo "atlas") (eq .Values.ftsRenewal.vo "dteam") }}

  - name: longproxy

    secret:
@@ -14,6 +25,7 @@ 
    secret:

      secretName:  {{ .Release.Name }}-fts-key

  {{- end }}

  {{- end }}

  {{- range $key, $val := .Values.persistentVolumes }}

  - name: {{ $key }}

    persistentVolumeClaim:
@@ -26,6 +38,10 @@ 
      resources:

{{ toYaml .Values.ftsRenewal.resources | indent 15 }}

      volumeMounts:

        - name: config-common

          mountPath: /opt/rucio/etc/conf.d/10_common.json

          subPath: common.json

  {{- if .Values.useDeprecatedImplicitSecrets }}

  {{- if or (eq .Values.ftsRenewal.vo "atlas") (eq .Values.ftsRenewal.vo "dteam") }}

        - name: longproxy

          mountPath: /opt/rucio/certs/
@@ -35,6 +51,16 @@ 
        - name: userkey

          mountPath: /opt/rucio/keys/

  {{- end }}

  {{- end }}

  {{- range $collection := tuple .Values.secretMounts .Values.ftsRenewal.secretMounts .Values.additionalSecrets .Values.ftsRenewal.additionalSecrets }}

  {{- range $key, $val := $collection }}

        - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }}

          mountPath: {{ $val.mountPath }}

          {{- if $val.subPath }}

          subPath: "{{ $val.subPath }}"

          {{- end }}

  {{- end }}

  {{- end }}

  {{- range $key, $val := .Values.persistentVolumes }}

        - name: {{ $key }}

          mountPath: {{ $val.mountPath }}
@@ -45,17 +71,34 @@ 
          value: "{{ $val1  }}"

        {{- end}}

        - name: RUCIO_VO

          value: {{ .Values.ftsRenewal.vo | quote }}

          value: {{ coalesce .Values.ftsRenewal.vo (first .Values.ftsRenewal.vos).vo | quote }}

        - name: RUCIO_FTS_VOMS

          value: {{ .Values.ftsRenewal.voms | quote }}

          value: {{ coalesce .Values.ftsRenewal.voms (first .Values.ftsRenewal.vos).voms | quote }}

  {{- if not .Values.ftsRenewal.vo}}

        - name: RUCIO_FTS_SCRIPT

          value: "{{ .Values.ftsRenewal.script }}"

        - name: RUCIO_FTS_VO_COUNT

          value: "{{ len .Values.ftsRenewal.vos }}"

        {{- range $key, $val := .Values.ftsRenewal.vos }}

        - name: RUCIO_FTS_VO_{{ $key }}

          value: {{ $val.vo }}

        - name: RUCIO_FTS_VOMS_{{ $key }}

          value: {{ $val.voms }}

        {{- end }}

  {{- end }}

        - name: RUCIO_FTS_SERVERS

          value: {{ .Values.ftsRenewal.servers | quote }}

  {{- if .Values.useDeprecatedImplicitSecrets }}

        - name: RUCIO_FTS_SECRETS

          value: "{{ .Release.Name }}-rucio-x509up"

  {{- if or (eq .Values.ftsRenewal.vo "atlas") (eq .Values.ftsRenewal.vo "dteam") }}

        - name: RUCIO_LONG_PROXY

          value: {{ .Values.ftsRenewal.longProxy | quote }}

  {{- end }}

  {{- end }}

  {{- with .Values.ftsRenewal.additionalEnvs }}

{{ toYaml . | indent 8 }}

  {{- end}}

  restartPolicy: OnFailure

{{- end }}

{{- end }}

charts/rucio-server/values.yaml

+32 −4
Original line number Diff line number Diff line
@@ -8,6 +8,8 @@ replicaCount: 0 
authReplicaCount: 0

traceReplicaCount: 0



useDeprecatedImplicitSecrets: true



# When set, run extra busybox containers in the relevant pods to also expose the error logs

exposeErrorLogs:

  server: true
@@ -148,9 +150,35 @@ ftsRenewal: 
    repository: rucio/fts-cron

    tag: latest

    pullPolicy: Always

  vo: "cms"

  voms: "cms:/cms/Role=production"

  servers: "https://fts3-devel.cern.ch:8446,https://cmsfts3.fnal.gov:8446,https://fts3.cern.ch:8446,https://lcgfts3.gridpp.rl.ac.uk:8446,https://fts3-pilot.cern.ch:8446"

  script: 'default'  # one of: 'default', 'atlas', 'dteam', 'multi_vo', 'tutorial', 'escape'. The associated scripts can be found here: https://github.com/rucio/containers/tree/master/fts-cron

  vos:

    - vo: "cms"

      voms: "cms:/cms/Role=production"

  secretMounts: []

    # - secretName: fts-cert

    #   mountPath: /opt/rucio/certs/usercert.pem

    #   subPath: usercert.pem

    # - secretName: fts-key

    #   mountPath: /opt/rucio/certs/new_userkey.pem

    #   subPath: new_userkey.pem

    # - secretName: longproxy

    #   mountPath: /opt/rucio/certs/long.proxy

    #   subPath: long.proxy

  additionalEnvs: []

    # - name: RUCIO_FTS_SECRETS

    #   value: release-rucio-x509up

    # - name: USERCERT_NAME

    #   value: "usercert.pem"

    # - name: USERKEY_NAME

    #   value: "new_userkey.pem"

    # - name: RUCIO_LONG_PROXY

    #   value: long.proxy

    # - name: GRID_PASSPHRASE

    #   valueFrom:

    #     secretKeyRef:

    #       name:

    #       key:

  resources:

    limits:

      cpu: 500m
@@ -175,13 +203,13 @@ automaticRestart: 
      cpu: 100m

      memory: 128Mi



additionalSecrets: {}

additionalSecrets: []

  # - volumeName: gcssecret

  #   secretName: gcssecret

  #   mountPath: /opt/rucio/etc/gcs_rucio.json

  #   subPath: gcs_rucio.json



additionalEnvs: {}

additionalEnvs: []

  # - name: NODE_IP

  #   valueFrom:

  #     fieldRef: