Unverified Commit d7648a17 authored by rcarpa's avatar rcarpa Committed by GitHub
Browse files

Merge pull request #139 from rcarpa/multivo_fts_renewal 

prepare the path for multi-vo fts renewal. Fix #113
parents fffa29fa 9a2325da

charts/rucio-daemons/Chart.yaml

+1 −2
Original line number Diff line number Diff line 
name: rucio-daemons

version: 1.30.4

version: 1.30.5

apiVersion: v1

description: A Helm chart to deploy daemons for Rucio

keywords:
@@ -11,4 +11,3 @@ sources: 
maintainers:

  - name: Rucio development team

    email: rucio-dev@cern.ch

charts/rucio-daemons/README.md

+26 −29
Original line number Diff line number Diff line
@@ -61,36 +61,33 @@ The conveyor needs a delegated X509 user proxy and the necessary CA so that it c 
        repository: rucio/fts-cron

        tag: latest

        pullPolicy: Always

      vo: "cms"

      voms: "cms:/cms/Role=production"

      gridPassphrase:

        required: false

        existingSecret:

          name: 'grid-passphrase'

          key: 'passphrase'

      servers: "https://fts3-devel.cern.ch:8446,https://fts3-pilot.cern.ch:8446"

      ftsCert:

        existingSecret:

          name: '' # e.g., fts-cert

          key: '' # e.g., usercert.pem

      ftsKey:

        existingSecret:

          name: '' # e.g., fts-key

          key: '' # e.g., userkey.pem

      longProxy: ''

      ftsLongProxy:

        existingSecret:

          name: '' # e.g., long-proxy

          key: '' # e.g., long.proxy



The possible VOs are:



- `atlas` expects a long proxy as input secret. It then creates a user proxy with the given VOMS extensions and with 96h lifetime and saves it as a cluster secret (`<releasename>-rucio-x509up`).

- `cms` expects a separate key and cert as input secrets. It then creates a user proxy with the given VOMS extensions and with 96h lifetime and delegates it to the given FTS servers. Then saves it as a cluster secret (`<releasename>-rucio-x509up`).

- `escape` expects a separate key and cert as input secrets, as well as a grid passphrase called. It then creates a user proxy with the given VOMS extensions and with 96h lifetime and delegates it to the given FTS servers. Then saves it as a cluster secret (`<releasename>-rucio-x509up`).

- `dteam` expects a long proxy like `atlas` and then creates, delegates and saves the user proxy like `cms`.

- `tutorial` expects a separate key and cert as input secrets like `cms` and then directly delegates to FTS. No proxy generation and `<releasename>-rucio-x509up` has to be manually created.

- Any other VO value will lead to the execution of the default script and expects a separate key and cert as input secrets. It then creates a user proxy with the given VOMS extensions and with 96h lifetime and delegates it to the given FTS servers. Then saves it as a cluster secret (`<releasename>-rucio-x509up`). Additionally a grid passphrase can be specified and saved in a dedicated secret.

      script: default

      vos:

        - vo: "cms"

          voms: "cms:/cms/Role=production"



Please check directly the scripts in the [fts-cron](https://github.com/rucio/containers/tree/master/fts-cron)

container to see their required input. For example, the "atlas" script requires

a proxy certificate (longproxy) to be mounted into the pod at the correct

location. And it will be used to generate a short proxy into the kubernetes 

secret with the name given in the `RUCIO_FTS_SECRETS` env variable. 

The configuration will be like that:



      script: atlas

      vos:

        - vo: "atlas"

          voms: "atlas:/atlas/Role=production"

        secretMounts:

          - secretFullName: release-longproxy

            mountPath: /opt/rucio/certs/long.proxy

            subPath: long.proxy

        additionalEnvs:

          - name: RUCIO_LONG_PROXY

            value: long.proxy

          - name: RUCIO_FTS_SECRETS

            value: release-rucio-x509up





### Reaper

charts/rucio-daemons/templates/abacus-account.yaml

+31 −17
Original line number Diff line number Diff line 
{{- if gt .Values.abacusAccountCount 0.0 -}}

{{- $rucio_daemon := "abacus-account" }}

{{- $component_values := .Values.abacusAccount }}

{{- $component_count := .Values.abacusAccountCount }}

{{- $app_label := printf "%s-%s" (include "rucio.name" .) $rucio_daemon }}

apiVersion: v1

kind: Secret

metadata:

  name: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}.yaml

  name: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

  labels:

    app: {{ $app_label }}

    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
@@ -13,8 +15,7 @@ metadata: 
type: Opaque

data:

  {{- $common_config := .Values.config | default dict | mustToPrettyJson | b64enc }}

  {{- $component_config := .Values.abacusAccount.config | default dict | mustToPrettyJson | b64enc }}

  common.json: {{ $common_config | quote }}

  {{- $component_config := $component_values.config | default dict | mustToPrettyJson | b64enc }}

  component.json: {{ $component_config | quote }}

---

apiVersion: apps/v1
@@ -28,7 +29,7 @@ metadata: 
    release: {{ .Release.Name }}

    heritage: {{ .Release.Service }}

spec:

  replicas: {{ .Values.abacusAccountCount }}

  replicas: {{ $component_count }}

  selector:

    matchLabels:

      app: {{ $app_label }}
@@ -57,7 +58,7 @@ spec: 
    {{- with .Values.podAnnotations }}

        {{- toYaml . | nindent 8 }}

    {{- end }}

    {{- with .Values.abacusAccount.podAnnotations }}

    {{- with $component_values.podAnnotations }}

        {{- toYaml . | nindent 8 }}

    {{- end }}

    spec:
@@ -65,20 +66,27 @@ spec: 
      serviceAccountName: {{ .Values.serviceAccountName }}

    {{- end }}

      volumes:

      - name: config

      - name: config-common

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}.yaml

          secretName: {{ template "rucio.fullname" . }}.config.common

      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

      {{- range $key, $val := .Values.additionalSecrets }}

    {{- end }}

      {{- range $collection := tuple .Values.secretMounts $component_values.secretMounts .Values.additionalSecrets $component_values.additionalSecrets }}

      {{- range $key, $val := $collection }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:

          secretName: {{ coalesce $val.secretFullName (printf "%s-%s" $.Release.Name $val.secretName) }}

      {{- end}}

      {{- end}}

      {{- range $key, $val := .Values.persistentVolumes }}

      - name: {{ $key }}

        persistentVolumeClaim:
@@ -89,20 +97,26 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

            - name: config

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json

            - name: config

            - name: config-component

              mountPath: /opt/rucio/etc/conf.d/20_component.json

              subPath: component.json

            {{- range $key, $val := .Values.additionalSecrets }}

            {{- range $collection := tuple .Values.secretMounts $component_values.secretMounts .Values.additionalSecrets $component_values.additionalSecrets }}

            {{- range $key, $val := $collection }}

            - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

              mountPath: {{ $val.mountPath }}

              subPath: {{ $val.subPath }}

              {{- if $val.subPath }}

              subPath: "{{ $val.subPath }}"

              {{- end }}

            {{- end}}

            {{- end}}

            {{- range $key, $val := .Values.persistentVolumes }}

            - name: {{ $key }}
@@ -118,20 +132,20 @@ spec: 
            - name: RUCIO_DAEMON

              value: "{{ $rucio_daemon }}"

            - name: RUCIO_DAEMON_ARGS

              value: "--threads {{ .Values.abacusAccount.threads }}"

{{- with .Values.abacusAccount.resources }}

              value: "--threads {{ $component_values.threads }}"

{{- with $component_values.resources }}

          resources:

{{ toYaml . | trim | indent 12 }}

{{ end }}

{{- with .Values.abacusAccount.nodeSelector }}

{{- with $component_values.nodeSelector }}

      nodeSelector:

{{ toYaml . | indent 8 }}

{{- end }}

{{- with .Values.abacusAccount.affinity }}

{{- with $component_values.affinity }}

      affinity:

{{ toYaml . | indent 8 }}

{{- end }}

{{- with .Values.abacusAccount.tolerations }}

{{- with $component_values.tolerations }}

      tolerations:

{{ toYaml . | indent 8 }}

{{- end }}

charts/rucio-daemons/templates/abacus-collection-replica.yaml

+31 −17
Original line number Diff line number Diff line 
{{- if gt .Values.abacusCollectionReplicaCount 0.0 -}}

{{- $rucio_daemon := "abacus-collection-replica" }}

{{- $component_values := .Values.abacusCollectionReplica }}

{{- $component_count := .Values.abacusCollectionReplicaCount }}

{{- $app_label := printf "%s-%s" (include "rucio.name" .) $rucio_daemon }}

apiVersion: v1

kind: Secret

metadata:

  name: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}.yaml

  name: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

  labels:

    app: {{ $app_label }}

    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
@@ -13,8 +15,7 @@ metadata: 
type: Opaque

data:

  {{- $common_config := .Values.config | default dict | mustToPrettyJson | b64enc }}

  {{- $component_config := .Values.abacusCollectionReplica.config | default dict | mustToPrettyJson | b64enc }}

  common.json: {{ $common_config | quote }}

  {{- $component_config := $component_values.config | default dict | mustToPrettyJson | b64enc }}

  component.json: {{ $component_config | quote }}

---

apiVersion: apps/v1
@@ -28,7 +29,7 @@ metadata: 
    release: {{ .Release.Name }}

    heritage: {{ .Release.Service }}

spec:

  replicas: {{ .Values.abacusCollectionReplicaCount }}

  replicas: {{ $component_count }}

  selector:

    matchLabels:

      app: {{ $app_label }}
@@ -57,7 +58,7 @@ spec: 
    {{- with .Values.podAnnotations }}

        {{- toYaml . | nindent 8 }}

    {{- end }}

    {{- with .Values.abacusCollectionReplica.podAnnotations }}

    {{- with $component_values.podAnnotations }}

        {{- toYaml . | nindent 8 }}

    {{- end }}

    spec:
@@ -65,20 +66,27 @@ spec: 
      serviceAccountName: {{ .Values.serviceAccountName }}

    {{- end }}

      volumes:

      - name: config

      - name: config-common

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}.yaml

          secretName: {{ template "rucio.fullname" . }}.config.common

      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

      {{- range $key, $val := .Values.additionalSecrets }}

    {{- end }}

      {{- range $collection := tuple .Values.secretMounts $component_values.secretMounts .Values.additionalSecrets $component_values.additionalSecrets }}

      {{- range $key, $val := $collection }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:

          secretName: {{ coalesce $val.secretFullName (printf "%s-%s" $.Release.Name $val.secretName) }}

      {{- end}}

      {{- end}}

      {{- range $key, $val := .Values.persistentVolumes }}

      - name: {{ $key }}

        persistentVolumeClaim:
@@ -89,20 +97,26 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

            - name: config

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json

            - name: config

            - name: config-component

              mountPath: /opt/rucio/etc/conf.d/20_component.json

              subPath: component.json

            {{- range $key, $val := .Values.additionalSecrets }}

            {{- range $collection := tuple .Values.secretMounts $component_values.secretMounts .Values.additionalSecrets $component_values.additionalSecrets }}

            {{- range $key, $val := $collection }}

            - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

              mountPath: {{ $val.mountPath }}

              subPath: {{ $val.subPath }}

              {{- if $val.subPath }}

              subPath: "{{ $val.subPath }}"

              {{- end }}

            {{- end}}

            {{- end}}

            {{- range $key, $val := .Values.persistentVolumes }}

            - name: {{ $key }}
@@ -118,20 +132,20 @@ spec: 
            - name: RUCIO_DAEMON

              value: "{{ $rucio_daemon }}"

            - name: RUCIO_DAEMON_ARGS

              value: "--threads {{ .Values.abacusCollectionReplica.threads }}"

{{- with .Values.abacusCollectionReplica.resources }}

              value: "--threads {{ $component_values.threads }}"

{{- with $component_values.resources }}

          resources:

{{ toYaml . | trim | indent 12 }}

{{ end }}

{{- with .Values.abacusCollectionReplica.nodeSelector }}

{{- with $component_values.nodeSelector }}

      nodeSelector:

{{ toYaml . | indent 8 }}

{{- end }}

{{- with .Values.abacusCollectionReplica.affinity }}

{{- with $component_values.affinity }}

      affinity:

{{ toYaml . | indent 8 }}

{{- end }}

{{- with .Values.abacusCollectionReplica.tolerations }}

{{- with $component_values.tolerations }}

      tolerations:

{{ toYaml . | indent 8 }}

{{- end }}

charts/rucio-daemons/templates/abacus-rse.yaml

+31 −17
Original line number Diff line number Diff line 
{{- if gt .Values.abacusRseCount 0.0 -}}

{{- $rucio_daemon := "abacus-rse" }}

{{- $component_values := .Values.abacusRse }}

{{- $component_count := .Values.abacusRseCount }}

{{- $app_label := printf "%s-%s" (include "rucio.name" .) $rucio_daemon }}

apiVersion: v1

kind: Secret

metadata:

  name: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}.yaml

  name: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

  labels:

    app: {{ $app_label }}

    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
@@ -13,8 +15,7 @@ metadata: 
type: Opaque

data:

  {{- $common_config := .Values.config | default dict | mustToPrettyJson | b64enc }}

  {{- $component_config := .Values.abacusRse.config | default dict | mustToPrettyJson | b64enc }}

  common.json: {{ $common_config | quote }}

  {{- $component_config := $component_values.config | default dict | mustToPrettyJson | b64enc }}

  component.json: {{ $component_config | quote }}

---

apiVersion: apps/v1
@@ -28,7 +29,7 @@ metadata: 
    release: {{ .Release.Name }}

    heritage: {{ .Release.Service }}

spec:

  replicas: {{ .Values.abacusRseCount }}

  replicas: {{ $component_count }}

  selector:

    matchLabels:

      app: {{ $app_label }}
@@ -57,7 +58,7 @@ spec: 
    {{- with .Values.podAnnotations }}

        {{- toYaml . | nindent 8 }}

    {{- end }}

    {{- with .Values.abacusRse.podAnnotations }}

    {{- with $component_values.podAnnotations }}

        {{- toYaml . | nindent 8 }}

    {{- end }}

    spec:
@@ -65,20 +66,27 @@ spec: 
      serviceAccountName: {{ .Values.serviceAccountName }}

    {{- end }}

      volumes:

      - name: config

      - name: config-common

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}.yaml

          secretName: {{ template "rucio.fullname" . }}.config.common

      - name: config-component

        secret:

          secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}

    {{- if .Values.useDeprecatedImplicitSecrets }}

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

      {{- range $key, $val := .Values.additionalSecrets }}

    {{- end }}

      {{- range $collection := tuple .Values.secretMounts $component_values.secretMounts .Values.additionalSecrets $component_values.additionalSecrets }}

      {{- range $key, $val := $collection }}

      - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

        secret:

          secretName: {{ coalesce $val.secretFullName (printf "%s-%s" $.Release.Name $val.secretName) }}

      {{- end}}

      {{- end}}

      {{- range $key, $val := .Values.persistentVolumes }}

      - name: {{ $key }}

        persistentVolumeClaim:
@@ -89,20 +97,26 @@ spec: 
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

          imagePullPolicy: {{ .Values.image.pullPolicy }}

          volumeMounts:

          {{- if .Values.useDeprecatedImplicitSecrets }}

            - name: proxy-volume

              mountPath: /opt/proxy

            - name: ca-volume

              mountPath: /opt/certs

            - name: config

          {{- end }}

            - name: config-common

              mountPath: /opt/rucio/etc/conf.d/10_common.json

              subPath: common.json

            - name: config

            - name: config-component

              mountPath: /opt/rucio/etc/conf.d/20_component.json

              subPath: component.json

            {{- range $key, $val := .Values.additionalSecrets }}

            {{- range $collection := tuple .Values.secretMounts $component_values.secretMounts .Values.additionalSecrets $component_values.additionalSecrets }}

            {{- range $key, $val := $collection }}

            - name: {{ kindIs "int" $key | ternary (coalesce $val.volumeName $val.secretName $val.secretFullName) $key }} 

              mountPath: {{ $val.mountPath }}

              subPath: {{ $val.subPath }}

              {{- if $val.subPath }}

              subPath: "{{ $val.subPath }}"

              {{- end }}

            {{- end}}

            {{- end}}

            {{- range $key, $val := .Values.persistentVolumes }}

            - name: {{ $key }}
@@ -118,20 +132,20 @@ spec: 
            - name: RUCIO_DAEMON

              value: "{{ $rucio_daemon }}"

            - name: RUCIO_DAEMON_ARGS

              value: "{{- if .Values.abacusRse.fillHistoryTable }}--enable-history {{ end }}--threads {{ .Values.abacusRse.threads }}"

{{- with .Values.abacusRse.resources }}

              value: "{{- if $component_values.fillHistoryTable }}--enable-history {{ end }}--threads {{ $component_values.threads }}"

{{- with $component_values.resources }}

          resources:

{{ toYaml . | trim | indent 12 }}

{{ end }}

{{- with .Values.abacusRse.nodeSelector }}

{{- with $component_values.nodeSelector }}

      nodeSelector:

{{ toYaml . | indent 8 }}

{{- end }}

{{- with .Values.abacusRse.affinity }}

{{- with $component_values.affinity }}

      affinity:

{{ toYaml . | indent 8 }}

{{- end }}

{{- with .Values.abacusRse.tolerations }}

{{- with $component_values.tolerations }}

      tolerations:

{{ toYaml . | indent 8 }}

{{- end }}