-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* start reana v093 deployment on new VRE * re appaly reana db secret with correct secret name * apply reana adming access token * apply reana ingress * apply reana iam secrets, update secrets script and add escape-iam as loging on the reana chart * reapply secrets to match secret name in release * apply last secrets and updated secrets script * typo on one of the workflows * update reana secrets script * test CI tf
- Loading branch information
1 parent
a790d09
commit c8f4cd6
Showing
11 changed files
with
307 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| apiVersion: source.toolkit.fluxcd.io/v1 | ||
| kind: HelmRepository | ||
| metadata: | ||
| name: reana | ||
| namespace: reana | ||
| spec: | ||
| interval: 5m | ||
| url: https://reanahub.github.io/reana/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: Ingress | ||
| metadata: | ||
| annotations: | ||
| cert-manager.io/cluster-issuer: letsencrypt | ||
| ingress.kubernetes.io/ssl-redirect: "true" | ||
| meta.helm.sh/release-name: reana | ||
| meta.helm.sh/release-namespace: reana | ||
| traefik.frontend.entryPoints: http,https | ||
| name: reana-ingress | ||
| namespace: reana | ||
| spec: | ||
| ingressClassName: nginx | ||
| tls: | ||
| - secretName: cert-manager-tls-ingress-secret-reana | ||
| hosts: | ||
| - reana-vre.cern.ch | ||
| rules: | ||
| - host: reana-vre.cern.ch | ||
| http: | ||
| paths: | ||
| - backend: | ||
| service: | ||
| name: reana-server | ||
| port: | ||
| number: 80 | ||
| path: /api | ||
| pathType: Prefix | ||
| - backend: | ||
| service: | ||
| name: reana-server | ||
| port: | ||
| number: 80 | ||
| path: /oauth | ||
| pathType: Prefix | ||
| - backend: | ||
| service: | ||
| name: reana-ui | ||
| port: | ||
| number: 80 | ||
| path: / | ||
| pathType: Prefix | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| apiVersion: v1 | ||
| kind: Namespace | ||
| metadata: | ||
| labels: | ||
| name: reana | ||
| name: reana |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| apiVersion: helm.toolkit.fluxcd.io/v2 | ||
| kind: HelmRelease | ||
| metadata: | ||
| name: reana | ||
| namespace: reana | ||
| annotations: | ||
| flux.weave.works/automated: "false" | ||
|
|
||
| spec: | ||
| releaseName: reana | ||
| interval: 5m | ||
| chart: | ||
| spec: | ||
| sourceRef: | ||
| kind: HelmRepository | ||
| name: reana | ||
| namespace: reana | ||
| chart: reana | ||
| interval: 1m | ||
| version: 0.9.3 | ||
|
|
||
| valuesFrom: | ||
| - kind: Secret | ||
| name: reana-vre-iam-client | ||
| valuesKey: client_id | ||
| targetPath: secrets.login.escape-iam.consumer_key | ||
| - kind: Secret | ||
| name: reana-vre-iam-client | ||
| valuesKey: client_secret | ||
| targetPath: secrets.login.escape-iam.consumer_secret | ||
| - kind: Secret | ||
| name: reana-db | ||
| valuesKey: user | ||
| targetPath: secrets.database.user | ||
| - kind: Secret | ||
| name: reana-db | ||
| valuesKey: password | ||
| targetPath: secrets.database.password | ||
|
|
||
| values: | ||
|
|
||
| shared_storage: | ||
| backend: cephfs | ||
| volume_size: 1000 | ||
| access_modes: ReadWriteMany | ||
| cephfs: | ||
| provisioner: manila-provisioner | ||
| type: "Meyrin CephFS" | ||
| availability_zone: nova | ||
| os_secret_name: os-trustee | ||
| os_secret_namespace: kube-system | ||
| cephfs_os_share_id: a6a85651-0b95-4e31-89ac-4ff31037f342 | ||
| cephfs_os_share_access_id: 1cd91c50-8cc6-449d-ae39-83249aca398b | ||
|
|
||
| components: | ||
| reana_ui: | ||
| enabled: true | ||
| local_users: false | ||
| reana_db: | ||
| enabled: false | ||
| reana_server: | ||
| environment: | ||
| REANA_USER_EMAIL_CONFIRMATION: false | ||
| # reana_workflow_controller: | ||
| # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs | ||
| # reana_job_controller: | ||
| # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 | ||
|
|
||
| compute_backends: | ||
| - "kubernetes" | ||
| - "htcondorcern" | ||
| - "slurmcern" | ||
|
|
||
| notifications: | ||
| enabled: true | ||
| email_config: | ||
| receiver: escape-cern-ops@cern.ch | ||
| sender: escape-cern-ops@cern.ch | ||
| login: "" | ||
| smtp_server: cernmx.cern.ch | ||
| smtp_port: 25 | ||
|
|
||
| reana_hostname: "reana-vre.cern.ch" | ||
|
|
||
| db_env_config: | ||
| REANA_DB_NAME: "reana" | ||
| REANA_DB_PORT: "6600" | ||
| REANA_DB_HOST: "dbod-vre.cern.ch" | ||
| # There are two more environment variables that should be set in order | ||
| # to connect to a database: | ||
| # REANA_DB_USERNAME: containing the database user name. | ||
| # REANA_DB_PASSWORD: containing the password for the user previously set. | ||
| # Both environment variables should be set inside a Kubernetes secret: | ||
| # `[release-name]-db` | ||
|
|
||
| login: | ||
| - name: "escape-iam" | ||
| type: "keycloak" | ||
| config: | ||
| title: "ESCAPE IAM" | ||
| base_url: "https://iam-escape.cloud.cnaf.infn.it" | ||
| realm_url: "https://iam-escape.cloud.cnaf.infn.it" | ||
| auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" | ||
| token_url: "https://iam-escape.cloud.cnaf.infn.it/token" | ||
| userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" | ||
|
|
||
| ingress: | ||
| enabled: false | ||
|
|
||
| traefik: | ||
| enabled: false |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| # Follow the instructions in | ||
| # https://kubernetes.docs.cern.ch/docs/storage/fileshares/#using-existing-shares | ||
| # | ||
| # Because we are recreating the cluster, the share already existed and we don't want to | ||
| # create a new one. We will use the existing share. | ||
| # | ||
| apiVersion: v1 | ||
| kind: PersistentVolume | ||
| metadata: | ||
| name: manila-preprovisioned-pv-reana-share | ||
| spec: | ||
| csi: | ||
| driver: cephfs.manila.csi.openstack.org | ||
| # NOTE: volumeHandle MUST be unique across all PersistentVolume objects in the cluster. | ||
| # The value itself can be arbitrary. You can use metadata.name for consistency. | ||
|
|
||
| # These values are just IDs and can be shared publically in github. | ||
| volumeHandle: manila-preprovisioned-pv-reana-share | ||
| volumeAttributes: | ||
| shareID: a6a85651-0b95-4e31-89ac-4ff31037f342 | ||
| shareAccessID: 1cd91c50-8cc6-449d-ae39-83249aca398b | ||
|
|
||
| # CephFS shares can be mounted using either FUSE or kernel CephFS client. | ||
| # FUSE is used by default. Uncomment and modify the parameter below to change | ||
| # the mount tool. See openstack-manila-csi docs to see all supported parameters. | ||
| # cephfs-mounter: kernel | ||
|
|
||
| nodeStageSecretRef: | ||
| name: os-trustee | ||
| namespace: kube-system | ||
| nodePublishSecretRef: | ||
| name: os-trustee | ||
| namespace: kube-system | ||
| accessModes: | ||
| - ReadWriteMany | ||
| capacity: | ||
| storage: 1000Gi | ||
| --- | ||
| apiVersion: v1 | ||
| kind: PersistentVolumeClaim | ||
| metadata: | ||
| name: manila-preprovisioned-pvc-reana | ||
| namespace: reana | ||
| spec: | ||
| accessModes: | ||
| - ReadWriteMany | ||
| resources: | ||
| requests: | ||
| storage: 1000Gi | ||
| # volumeName must match the name we have set in the PersistentVolume defined above. | ||
| volumeName: manila-preprovisioned-pv-reana-share | ||
| # Storage class name must be set to an empty string "" | ||
| # to disable dynamic provisioning. | ||
| storageClassName: "" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| ##!/bin/bash | ||
|
|
||
| echo "Start REANA secrets scripts" | ||
|
|
||
| # kubeseal controller namespace | ||
| CONTROLLER_NS="sealed-secrets" | ||
| CONTROLLER_NAME="sealed-secrets-controller" | ||
|
|
||
| # REANA namespace | ||
| REANA_NS="reana" | ||
|
|
||
| # Output dir | ||
| SECRETS_DIR="/root/software/vre/infrastructure/secrets/reana" | ||
| RAW_SECRETS_TMP_DIR="/root/software/vre/infrastructure/secrets/tmp_local_secrets" | ||
|
|
||
|
|
||
| echo "Create REANA DB secret" | ||
|
|
||
| DB_OUTPUT_SECRET="reana-db.yaml" | ||
| RAW_DB_FILE_SECRET=${RAW_SECRETS_TMP_DIR}/${DB_OUTPUT_SECRET} | ||
|
|
||
| cat ${RAW_DB_FILE_SECRET} | kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${REANA_NS} > ${SECRETS_DIR}/ss_${DB_OUTPUT_SECRET} | ||
| kubectl apply -f ${SECRETS_DIR}/ss_${DB_OUTPUT_SECRET} | ||
|
|
||
|
|
||
| echo "Create REANA Admin Access Token secret" | ||
|
|
||
| ADMIN_ACCOUNT_SECRET='reana-admin-access-token.yaml' | ||
| RAW_ADMIN_FILE_SECRET=${RAW_SECRETS_TMP_DIR}/${ADMIN_ACCOUNT_SECRET} | ||
|
|
||
| cat ${RAW_ADMIN_FILE_SECRET} | kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${REANA_NS} > ${SECRETS_DIR}/ss_${ADMIN_ACCOUNT_SECRET} | ||
| kubectl apply -f ${SECRETS_DIR}/ss_${ADMIN_ACCOUNT_SECRET} | ||
|
|
||
|
|
||
| echo "Create REANA IAM client credentials" | ||
|
|
||
| REANA_IAM_ACCOUNT_SECRET='reana-vre-iam-client.yaml' | ||
| RAW_REANA_IAM_FILE_SECRET=${RAW_SECRETS_TMP_DIR}/${REANA_IAM_ACCOUNT_SECRET} | ||
|
|
||
| cat ${RAW_REANA_IAM_FILE_SECRET} | kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${REANA_NS} > ${SECRETS_DIR}/ss_${REANA_IAM_ACCOUNT_SECRET} | ||
| kubectl apply -f ${SECRETS_DIR}/ss_${REANA_IAM_ACCOUNT_SECRET} | ||
|
|
||
|
|
||
| # echo "Create 'REANA secrets' secret" | ||
| # # This secret is unknow for what is used - no doc :harold: | ||
| # # Kept commented for the moment | ||
|
|
||
| # REANA_SECRETS_SECRET='reana-secrets.yaml' | ||
| # RAW_REANA_SECRETS_FILE_SECRET=${RAW_SECRETS_TMP_DIR}/${REANA_SECRETS_SECRET} | ||
|
|
||
| # cat ${RAW_REANA_SECRETS_FILE_SECRET} | kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${REANA_NS} > ${SECRETS_DIR}/ss_${REANA_SECRETS_SECRET} | ||
| # kubectl apply -f ${SECRETS_DIR}/ss_${REANA_SECRETS_SECRET} | ||
|
|
||
|
|
||
| echo "END REANA Secret Script" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| --- | ||
| apiVersion: bitnami.com/v1alpha1 | ||
| kind: SealedSecret | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: reana-db | ||
| namespace: reana | ||
| spec: | ||
| encryptedData: | ||
| password: AgAAIVxBG7DRcCPJngXOaEdSBWKZvVMeDThMZpTaVWubk5TxVPwwVTHY+Bm2bZifG1gwd08XU250mYCuQ0mu7q7KPwM/nWrL6v0HHq142LayjDnhfES82YXJuMbjQdsFY0IiUI23gKIL9Pw84p+guEQrdbzHgYA7NQTijrD15U9h4Idj4LgT0nKL1to70QAJXUN+HsvCrfKw8ie0/LzCSp9U8JTWFyQ6jq9utSAWglbmp7pk3W0g49wP6MyYfQDfpx1KzsI48YtSgoW47uN9O0nz8cB8OgszyQqC4so/Q8yO7uASYjaW10ED1fog6wLBqK1TnTbNEBP2GgGRWpExvTcuBJD0b53LGv5Ss1ABg8N3IncxEujOnGVtudoQ8WBrPcQwBgv7gXsMDJY8ag2wEkIQ/iI5F5Xm5xoDptqf9jl1g4AznJkQ/H4LvHuxqo7D+WBx9B4hufyQ6VNsEbHHpg/ZHa9ws/l3UQeofgxqM7P8yI3hySbcTO/j+d5TJEhEmDgcCxiE53TY/eWtpgzwzVI+iigEJIUWa0r0iP/P7C1zLkOGrvqWEJ4i8WzaS79Ap2hvaUkg/lubtnnd/8WURkJO1WIV0IeZfNOP81MeA6W5uKMTUBQU9V+BJK4q9t0Uv5IPbiMpLC4CoXNkgcEhx48e5o0MQfbiLeXy+BFSpOX8hAziGdBD0xvGVtW9nKYQBFwPpC3pkBPf976gde6UDdxuo7ObM0pX9wqKS9gjow== | ||
| user: AgCU5qbzGKuyTODyawryV0QSO8nLzB2dDZa9R+yM5E/ZCc8MhIgRMMv9Swrs8jL0YbyKEM4XxCos9io02Oc8gwJZSO9Z5grai0Mc+J1ae/ukKKSn53u4DjP24UQQGtRiSKJSxq2T0bpFk18fqSJJK3TPObS6ZfBeni/hJscysYZexBassHhraAAXXSLFNnGPSAt51TFiVKv2qejcxC7n2dWYPVSyjIRErfZU+oSvTma6OTEM3WhnPYhH4PG+Rlm1E3C1WbpQfu1JzCqBr0t9nTlVyB/shdpkn+IxS+ZLQHBRU45abJDxtPT6jet2ZZXNnoPQrdmv2JBs8i0OilZ10IH8H75DZe57FrJ0AojGAyhno2F2roSUxQ3U5Ln8QcjqJiH6AF4HJih8mlYCuHj4YI5bapXJPe/Aq34zDE5OnUHkb4W8x1l2wldwiCEKO9LzyrJm1JCo3qkWaFKARvJJ4fB5Sa8DdxfmUyngezi82eMSE7zOeOp8Vss0FungFx/uml2wawFqmhg5pxrU+/NJ8dqpwh2L3vJ5XqqGBwUSuJmnGha8r7aM0n+uuuvS9EBNRutLGt3uuRRiNydR3qe7bA+Mww4eIb4WulfsbnsM9A7vyGWc7nEFlQON6WA1bHe+oRxKvDR9Sy+iUbyEINo976VsgJz/JQskHltiBil1nImOdyK7yDD3WooQxy3r03VdgBsfIToZFg== | ||
| template: | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: reana-db | ||
| namespace: reana | ||
| type: Opaque |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters