The diracx-charts from diracgrid

Persist the data volumes of Opensearch/Minio/MySQL

The same way that the diracx pv and pvc are kept when doing helm delete, the data volume of the DBs should be preserved

Integrate IAM and use it for a user VO

#66

Find a way to run the demo completely offline

Current problem is the hostname resolution, we need an ip address different from localhost

Refactor charts to support production installation

Currently, whenever installing the chart, you get a "developer/demo" installation. there is unconditionally a new CS generated, an ssh key, the local code mounted, etc.
The charts should be refactored as to allow production usecase, that is an existing volume with the CS on it, an existing key, etc

Try to integrate IAM to the Helm chart

On the longer run, we will likely need to have a good integration with IAM.
For a first objective, we would like IAM to be spawned, and the admin VO manually reconfigured to use IAM instead of Dex

Cannot remove `cs-mount` content

When I delete the cluster and try to recreate it, I get:

$ diracx-charts/run_demo.sh diracx DIRAC diracx-web
🦄 Found package directories for: diracx DIRAC diracx-web
💀 ping command exited with a non-zero exit code
ℹ️ Using IP address 172.17.0.1.nip.io instead 
🦄 Generating Kind cluster template...
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/logs/HEAD': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/logs/refs/heads/master': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/HEAD': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/index': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/commit-msg.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/pre-push.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/prepare-commit-msg.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/pre-rebase.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/applypatch-msg.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/fsmonitor-watchman.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/push-to-checkout.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/pre-merge-commit.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/pre-applypatch.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/post-update.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/sendemail-validate.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/update.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/pre-receive.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/hooks/pre-commit.sample': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/info/exclude': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/description': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/refs/tags': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/refs/heads/master': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/bd/3918db17d0bc333035871b8ec54536d409d7de': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/pack': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/b7/aa4453635e786d8f1e3edcd9d6bb3cb1e5024d': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/01/9169a208ab83ad6f937b182d2dc810a7fa886f': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/info': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/76/3d2034d3d5a7f5e51405c41e26016d165eb59f': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/f3/398b10c5650c4bf6f7d5745da45a27635a8ddf': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/objects/3d/fd657c1e9d65314e947ad9a33a234fececf2f0': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/.git/config': Permission denied
rm: cannot remove '/home/projects/diracx-charts/.demo/cs-mount/initialRepo/default.yml': Permission denied

How to handle hotfixing?

My naive suggestion would be to support installing from a branch (like #36 does for development) but maybe there are better ways.

Expose through ingress more services

They should be exposed via a sub domain and SNI in the ingress

minio
dex

Use HTTPS for other services (minio/dex/...)

Add a dependency to Rucio

Need input from Rucio people to define precise objectives

Restructure API routes to better support a web app

Once we have a webapp it shuold ideally be hosted on the root endpoint of the main URL. This is problematic for things like /dex and /minio and even the DiracX services like /jobs as well. I think it would be better to structure the API routes as for a service running at myhostname.com as:

myhostname.com/api/... contains DiracX services
myhostname.com/external/... contains subroutes for /dex, /minio and any other external services
everything else is part of the web app that users are exposed to

Documentation

What needs to be there:

list of components
flow chart
How you install (k3s etc)

More robust handling of machine hostname in demo

For the demo require that the hostname doesn't resolve to a loopback address (127.0.0.0/8) in order for the pods to be able to talk to each other via the host.

We should check that the hostname is valid like what is already done here:

If the hostname isn't valid, we should fallback to trying to find an IP like ifconfig | rg 'inet ' on macOS or ip address | grep 'inet ' on Linux.

readlink -f in run_demo.sh

The use of readlink -f in run_demo.sh is not working on MacOS. The extract from the man readlink:

When invoked as readlink, only the target of the symbolic link is printed.  
If the given argument is not a symbolic link, readlink will print nothing and 
exit with an error.

and -f flag is not allowed for readlink

How to manage update of secrets

As it is now, when updating the secrets in a values.yaml, the k8s secrets are not updated (see generate_secret_if_needed).

Used editable install of mounted Python packages instead of mounting directly

I think it would be preferably to allow people to do something to the effect of pip install -e /sources/* && uvicorn --reload for interactive development as adding entrypoint metadata won't be picked up by the demo as it currently stands. If needed we could have both options available in the values.yaml.

Add starting a helm install test

A new DB in diracx is not created in the demo

I don't think it is a problem really as it is a rare use case, but the new DBs are not created in mysql as the init script is not re-run.
We need to either find a way to force to re-run the script, or to document that the demo cluster needs to be recreated

Stabilize helm charts

Basically address all the TODOs in #78

Suport running demo in a browser

We could use either of these (or preferably both):

Support setting CORS headers

We should then remove https://github.com/DIRACGrid/diracx/blob/c6499caf4485b2a26ad73115d4235e434f4bb5d6/src/diracx/routers/__init__.py#L149-L161

Demo requires client to be installed

Investigate Gateway API

The current use of the Ingress API might be better implemented using the Gateway API. To be checked.

Document how to use run_demo on a remote machine

@sfayer tried to run the demo with port forwarding. This doesn't work due to SNI...

We should document that you need to use a SOCKS proxy if you want it to work.

Support getting all images from a image proxy

Probably essential for Juno to be able to run.

Force pods to respect a certain boot order

On slower connections, it often happens that the run_demo script fails because the initialization of some client pods is faster than the resource they need (typically, the db initialization timing out before the mysql pod is ready).
We should have a pods starting in a sequence. The best way to address that seems to be an init container in the client pod probing the resource

diracgrid / diracx-charts Goto Github PK

diracx-charts's People

Contributors

Watchers

Forkers

diracx-charts's Issues

Recommend Projects

Recommend Topics

Recommend Org