SUBMARINE-616. Deploying Traefik as Ingress controller in Submarine

### What is this PR for?
1. Declaring traefik-helm-chart as a dependency(subchart). And  it should be optional.
2. Add an Ingress object to route to submarine-server service and using NodePort (port 32080/TCP) to expose.

After installing Submarine with helm, users can directly access submarine-workbench from your browser.
If users dont want to use Traefik as default ingress controller, they can modify the value ".Value.submarine.traefik.enabled"

### What type of PR is it?
[Feature]

### Todos
* [ ] - Task

### What is the Jira issue?
[SUBMARINE-616](https://issues.apache.org/jira/projects/SUBMARINE/issues/SUBMARINE-616)

### How should this be tested?
[Travis CI](https://travis-ci.org/github/lowc1012/submarine/builds/724193208)

### Screenshots (if appropriate)
<img width="883" alt="image1" src="https://user-images.githubusercontent.com/52355146/92350220-e6a8a380-f10a-11ea-88d3-02cc17a8de86.png">

<img width="1228" alt="image2" src="https://user-images.githubusercontent.com/52355146/92350234-f32cfc00-f10a-11ea-83e3-424fc6b90ec5.png">

### Questions:
* Does the licenses files need update? No
* Is there breaking changes for older versions? No
* Does this needs documentation? No

Author: Ryan Lo <[email protected]>

Closes #393 from lowc1012/SUBMARINE-616 and squashes the following commits:

7629eaa [Ryan Lo] SUBMARINE-616. Update helm.md
876d4cc [Ryan Lo] SUBMARINE-616. Update docs/userdocs/k8s/helm.md
79e46c5 [Ryan Lo] SUBMARINE-616. Change kind-config path and rename files
df45f5c [Ryan Lo] SUBMARINE-616. Deploying Traefik as Ingress controller in Submarine on k8s

.github/workflows/python.yml

@@ -40,10 +40,33 @@ jobs:
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v1
+      - name: Create the kind config
+        run: |
+          cat <<EOF > ./kind-config-kind.yaml
+          kind: Cluster
+          apiVersion: kind.x-k8s.io/v1alpha4
+          nodes:
+          - role: control-plane
+            kubeadmConfigPatches:
+            - |
+              kind: InitConfiguration
+              nodeRegistration:
+                kubeletExtraArgs:
+                  node-labels: "ingress-ready=true"
+                  authorization-mode: "AlwaysAllow"
+            extraPortMappings:
+            - containerPort: 32080
+              hostPort: 80
+              protocol: TCP
+            - containerPort: 443
+              hostPort: 443
+              protocol: TCP
+          EOF
       - uses: engineerd/[email protected]
         with:
           version: "v0.7.0"
           image: kindest/node:v1.15.6
+          config: ./kind-config-kind.yaml
       - name: Show K8s cluster information
         run: |
           kubectl cluster-info

docs/userdocs/k8s/helm.md

@@ -22,7 +22,9 @@ under the License.
 
 ## Deploy Submarine Using Helm Chart (Recommended)
 
-Submarine's Helm Chart will not only deploy Submarine Server, but also deploys TF Operator / PyTorch Operator (which will be used by Submarine Server to run TF/PyTorch jobs on K8s).
+Submarine's Helm Chart will deploy Submarine Server, TF/PyTorch Operator, Notebook controller
+and Traefik. We use the TF/PyTorch operator to run tf/pytorch job, the notebook controller to
+manage jupyter notebook and Traefik as reverse-proxy.
 
 
 ### Install Helm
@@ -72,15 +74,36 @@ notebook-controller-deployment-5db8b6cbf7-k65jm   1/1     Running   0          5
 pytorch-operator-7ff5d96d59-gx7f5                 1/1     Running   0          5s
 submarine-database-8d95d74f7-ntvqp                1/1     Running   0          5s
 submarine-server-b6cd4787b-7bvr7                  1/1     Running   0          5s
+submarine-traefik-9bb6f8577-66sx6                 1/1     Running   0          5s
 tf-job-operator-7844656dd-lfgmd                   1/1     Running   0          5s
 ```
 
-### Enable local access to Submarine Server
-Submarine server by default expose 8080 port within K8s cluster.
-To access the server from outside of the cluster, we need to expose the service.
-We can either use port-forward, or use K8s `Ingress`, here is an example of port-forward.
+### Access to Submarine Server
+Submarine server by default expose 8080 port within K8s cluster. After Submarine v0.5
+uses Traefik as reverse-proxy by default. If you don't want to
+use Traefik, you can modify below value to ***false*** in `./helm-charts/submarine/values.yaml`.
+```yaml
+# Use Traefik by default
+traefik:
+  enabled: true
+```
+
+To access the server from outside of the cluster, we use Traefik ingress controller and
+NodePort for external access.\
+Please refer to `./helm-charts/submarine/charts/traefik/values.yaml` and [Traefik docs](https://docs.traefik.io/)
+for more details if you want to customize the default value for Traefik.
+
+```
+# Use nodePort and Traefik ingress controller by default.
+# To access the submarine server, open the following URL in your browser.
+http://127.0.0.1:32080
+```
+
+Or you can use port-forward to forward a local port to a port on the
+submarine server pod.
 
 ```bash
+# Use port-forward
 kubectl port-forward svc/submarine-server 8080:8080
 
 # In another terminal. Run below command to verify it works

helm-charts/submarine/Chart.yaml

@@ -21,4 +21,13 @@ description: Submarine is Cloud Native Machine Learning Platform.
 name: submarine
 version: 0.5.0-SNAPSHOT
 icon: https://submarine.apache.org/assets/themes/submarine/img/submarine_white_logo.png
-
+dependencies:
+- name: tfjob
+  version: "0.1.0"
+- name: pytorchjob
+  version: "0.1.0"
+- name: notebook-controller
+  version: "0.1.0"
+- name: traefik
+  version: "9.1.0"
+  condition: submarine.traefik.enabled

helm-charts/submarine/charts/traefik/.helmignore

@@ -0,0 +1,40 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm-charts/submarine/charts/traefik/Chart.yaml

@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: v2
+name: traefik
+description: A Traefik based Kubernetes ingress controller
+type: application
+version: 9.1.0
+appVersion: 2.2.8
+keywords:
+  - traefik
+  - ingress
+home: https://traefik.io/
+sources:
+  - https://github.com/containous/traefik
+icon: https://raw.githubusercontent.com/containous/traefik/v2.2/docs/content/assets/img/traefik.logo.png

helm-charts/submarine/charts/traefik/crds/ingressroute-tcp.yaml

@@ -0,0 +1,29 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutetcps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteTCP
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced

helm-charts/submarine/charts/traefik/crds/ingressroute-udp.yaml

@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressrouteudps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteUDP
+    plural: ingressrouteudps
+    singular: ingressrouteudp
+  scope: Namespaced

helm-charts/submarine/charts/traefik/crds/ingressroute.yaml

@@ -0,0 +1,29 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutes.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRoute
+    plural: ingressroutes
+    singular: ingressroute
+  scope: Namespaced

helm-charts/submarine/charts/traefik/crds/middlewares.yaml

@@ -0,0 +1,29 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: Middleware
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced

helm-charts/submarine/charts/traefik/crds/tls-options.yaml

@@ -0,0 +1,29 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: tlsoptions.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: TLSOption
+    plural: tlsoptions
+    singular: tlsoption
+  scope: Namespaced

helm-charts/submarine/charts/traefik/crds/tls-stores.yaml

@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: tlsstores.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: TLSStore
+    plural: tlsstores
+    singular: tlsstore
+  scope: Namespaced

helm-charts/submarine/charts/traefik/crds/traefik-services.yaml

@@ -0,0 +1,29 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: traefikservices.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: TraefikService
+    plural: traefikservices
+    singular: traefikservice
+  scope: Namespaced