Unverified Commit deaa1939 authored by Martin Barisits's avatar Martin Barisits Committed by GitHub
Browse files

Merge pull request #52 from rcarpa/fts_secrets_in_rucio_server 

add support for fts secrets in rucio-server chart
parents a0d5f93d e8773b99

rucio-server/Chart.yaml

+1 −1
Original line number Diff line number Diff line 
name: rucio-server

version: 0.3.0

version: 0.4.0

apiVersion: v1

description: A Helm chart to deploy servers for Rucio

keywords:

rucio-server/README.md

+9 −0
Original line number Diff line number Diff line
@@ -48,6 +48,15 @@ Alternatively, a YAML file that specifies the values for the parameters can be p 
      -f values.yaml \

      rucio/rucio-server





## Certificates



Some functions require certificates and CAs to work. They expect specific secrets that need to be created before the pod can start.



### API calls to FTS



To update rule priority in FTS, the API call must be authenticated. The configuration is identical to the one of the [conveyor](https://github.com/rucio/helm-charts/tree/master/rucio-daemons#conveyor) daemon. 



## Service



By default the servers pods are listening on port 80 using plain HTTP and the default services are of type `ClusterIP` on port 80. You can adapt this separately for the api, authentication and trace servers. To run the pods with HTTPS you will first have to install the necessary key, cert and CA files for the corresponding servers:

rucio-server/templates/deployment.yaml

+10 −0
Original line number Diff line number Diff line
@@ -33,6 +33,12 @@ spec: 
      serviceAccountName: {{ .Values.serviceAccountName }}

    {{- end }}

      volumes:

      - name: proxy-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-x509up

      - name: ca-volume

        secret:

          secretName: {{ .Release.Name }}-rucio-ca-bundle

      - name: httpdlog

        emptyDir: {}

      {{- range $key, $val := .Values.additionalSecrets }}
@@ -88,6 +94,10 @@ spec: 
          resources:

{{ toYaml .Values.serverResources | indent 12 }}

          volumeMounts:

          - name: proxy-volume

            mountPath: /opt/proxy

          - name: ca-volume

            mountPath: /opt/certs

          - name: httpdlog

            mountPath: /var/log/httpd

          {{- range $key, $val := .Values.additionalSecrets }}

rucio-server/templates/renew-fts-account.yaml

0 → 100644
+20 −0
Original line number Diff line number Diff line 
{{- if .Values.ftsRenewal.enabled -}}

apiVersion: v1

kind: ServiceAccount

metadata:

  name: {{ .Release.Name }}-rucio-edit

---

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: {{ .Release.Name }}-rucio-edit

  namespace: {{ .Release.Namespace }}

subjects:

- kind: ServiceAccount

  name: {{ .Release.Name }}-rucio-edit

  namespace: {{ .Release.Namespace }}

roleRef:

  kind: ClusterRole

  name: edit

  apiGroup: rbac.authorization.k8s.io

{{ end }}

rucio-server/templates/renew-fts-cronjob.yaml

0 → 100644
+67 −0
Original line number Diff line number Diff line 
{{- if .Values.ftsRenewal.enabled -}}

apiVersion: batch/v1beta1

kind: CronJob

metadata:

  name: {{ .Release.Name }}-renew-fts-proxy

spec:

  schedule: "{{ .Values.ftsRenewal.schedule }}"

  jobTemplate:

    spec:

      template:

        spec:

          serviceAccountName: {{ .Release.Name }}-rucio-edit

          volumes:

{{- if or (eq .Values.ftsRenewal.vo "atlas") (eq .Values.ftsRenewal.vo "dteam") }}

          - name: longproxy

            secret:

              secretName: {{ .Release.Name }}-longproxy

{{- else }}

          - name: usercert

            secret:

              secretName: {{ .Release.Name }}-fts-cert

          - name: userkey

            secret:

              secretName: {{ .Release.Name }}-fts-key

{{- end }}

{{- range $key, $val := .Values.persistentVolumes }}

          - name: {{ $key }}

            persistentVolumeClaim:

              claimName: {{ $val.name }}

{{- end}}

          containers:

            - name: renew-fts-cron

              image: "{{ .Values.ftsRenewal.image.repository }}:{{ .Values.ftsRenewal.image.tag }}"

              imagePullPolicy: {{ .Values.ftsRenewal.image.pullPolicy }}

              volumeMounts:

{{- if or (eq .Values.ftsRenewal.vo "atlas") (eq .Values.ftsRenewal.vo "dteam") }}

                - name: longproxy

                  mountPath: /opt/rucio/certs/

{{- else }}

                - name: usercert

                  mountPath: /opt/rucio/certs/

                - name: userkey

                  mountPath: /opt/rucio/keys/

{{- end }}

{{- range $key, $val := .Values.persistentVolumes }}

                - name: {{ $key }}

                  mountPath: {{ $val.mountPath }}

{{- end}}

              env:

                {{- range $key1, $val1 := .Values.optional_config }}

                - name: {{ $key1 | upper }}

                  value: "{{ $val1  }}"

                {{- end}}

                - name: RUCIO_VO

                  value: {{ .Values.ftsRenewal.vo | quote }}

                - name: RUCIO_FTS_VOMS

                  value: {{ .Values.ftsRenewal.voms | quote }}

                - name: RUCIO_FTS_SERVERS

                  value: {{ .Values.ftsRenewal.servers | quote }}

                - name: RUCIO_FTS_SECRETS

                  value: "{{ .Release.Name }}-rucio-x509up"

{{- if or (eq .Values.ftsRenewal.vo "atlas") (eq .Values.ftsRenewal.vo "dteam") }}

                - name: RUCIO_LONG_PROXY

                  value: {{ .Values.ftsRenewal.longProxy | quote }}

{{- end }}

          restartPolicy: OnFailure

{{ end }}