swan-cern: Add swan-cern-system chart for system components

.github/workflows/check-charts.yaml

@@ -29,3 +29,5 @@ jobs:
       - run: helm dependency update swan && helm lint swan && helm package swan
 
       - run: helm dependency update swan-cern && helm lint swan-cern && helm package swan-cern
+
+      - run: helm dependency update swan-cern-system && helm lint swan-cern-system && helm package swan-cern-system

.github/workflows/list-changed-charts.sh

@@ -6,7 +6,7 @@ script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" || exit; pwd;)"
 
 cd "${script_dir}/../../" # cd to the root of the repo
 
-CHARTS=("swan" "swan-cern")
+CHARTS=("swan" "swan-cern" "swan-cern-system")
 
 for CHART_NAME in "${CHARTS[@]}"; do
 

.github/workflows/release-charts.yaml

@@ -42,6 +42,16 @@ on:
           - minor
           - patch
 
+      bump_swan_cern_system:
+        description: "Bump version for swan-cern-system/"
+        required: false
+        default: patch
+        type: choice
+        options:
+          - major
+          - minor
+          - patch
+
 jobs:
   check_branch:
     runs-on: ubuntu-latest
@@ -59,6 +69,7 @@ jobs:
     outputs:
       swan_has_changed: ${{ steps.diff.outputs.swan_has_changed }}
       swan-cern_has_changed: ${{ steps.diff.outputs.swan-cern_has_changed }}
+      swan-cern-system_has_changed: ${{ steps.diff.outputs.swan-cern-system_has_changed }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
@@ -135,3 +146,15 @@ jobs:
       WORKFLOW_ACCESS_TOKEN: ${{ secrets.WORKFLOW_ACCESS_TOKEN }}
       HELM_REPO_USERNAME: ${{ secrets.HELM_REPO_USERNAME }}
       HELM_REPO_PASSWORD: ${{ secrets.HELM_REPO_PASSWORD }}
+
+  tag_swan_cern_system:
+    needs: [check_charts, list_changed_charts]
+    if: needs.list_changed_charts.outputs.swan-cern-system_has_changed == 'true'
+    uses: ./.github/workflows/tag-chart.yaml
+    with:
+      chart: swan-cern-system
+      bump: ${{ inputs.bump_swan_cern_system }}
+    secrets:
+      WORKFLOW_ACCESS_TOKEN: ${{ secrets.WORKFLOW_ACCESS_TOKEN }}
+      HELM_REPO_USERNAME: ${{ secrets.HELM_REPO_USERNAME }}
+      HELM_REPO_PASSWORD: ${{ secrets.HELM_REPO_PASSWORD }}

swan-cern-system/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

swan-cern-system/Chart.lock

@@ -0,0 +1,15 @@
+dependencies:
+- name: fluentd
+  repository: https://fluent.github.io/helm-charts
+  version: 0.4.3
+- name: gpu-operator
+  repository: oci://registry.cern.ch/kubernetes/charts
+  version: v24.6.2
+- name: cern-it-monitoring-kubernetes
+  repository: oci://registry.cern.ch/monit
+  version: 1.0.0-rc4
+- name: cern-it-monitoring-kubernetes-crds
+  repository: oci://registry.cern.ch/monit
+  version: 1.0.0-rc3
+digest: sha256:35b63dc5472be7adf6b9a0113f030ebe7986df5c09c37db2e8d31818c8252eb4
+generated: "2024-10-24T11:59:20.581052975+02:00"

swan-cern-system/Chart.yaml

@@ -0,0 +1,26 @@
+apiVersion: v2
+#
+name: swan-cern-system
+type: application
+# version set by bump2version search/replace
+version: 0.0.1 # __swan-cern-system_version__
+appVersion: 0.0.1
+#
+description: The chart to deploy SWAN system components at CERN
+#
+dependencies:
+  - name: fluentd
+    version: 0.4.3
+    repository: https://fluent.github.io/helm-charts
+  - name: gpu-operator
+    version: v24.6.2
+    repository: oci://registry.cern.ch/kubernetes/charts
+    condition: gpu-operator.enabled
+  - name: cern-it-monitoring-kubernetes
+    version: 1.0.0-rc4
+    repository: oci://registry.cern.ch/monit
+    condition: cern-it-monitoring-kubernetes.enabled
+  - name: cern-it-monitoring-kubernetes-crds
+    version: 1.0.0-rc3
+    repository: oci://registry.cern.ch/monit
+    condition: cern-it-monitoring-kubernetes.enabled

swan-cern-system/values.yaml

@@ -0,0 +1,122 @@
+fluentd:
+  caCertPath: &fluentdCaCertPath /etc/ssl/ca-bundle.crt
+  plugins:
+    - fluent-plugin-rewrite-tag-filter
+    - fluent-plugin-out-http
+    - fluent-plugin-grok-parser
+    - fluent-plugin-route
+  containerRuntime: containerd
+  output:
+    includeInternal: false
+    cacert: *fluentdCaCertPath
+  configMapConfigs:
+    - fluentd-prometheus-conf # Preserve prometheus config for probes to work
+    - fluentd-sources-conf
+    - fluentd-filters-conf
+    - fluentd-outputs-conf
+  fileConfigs:
+    # This is to disable the configuration that comes from upstream
+    01_sources.conf: "" 
+    02_filters.conf: ""
+    03_dispatch.conf: ""
+    04_outputs.conf: ""
+  volumeMounts:
+  - name: ca-certificate
+    mountPath: *fluentdCaCertPath
+    subPath: ca-bundle.crt
+    readOnly: true
+  volumes:
+  - name: ca-certificate
+    configMap:
+      name: fluentd-ca
+      items:
+        - key: ca-bundle.crt
+          path: ca-bundle.crt
+
+gpu-operator:
+  enabled: true
+  validator:
+    repository: registry.cern.ch/kubernetes
+    version: v24.6.2
+  operator:
+    repository: registry.cern.ch/kubernetes
+    version: v24.6.2
+    defaultRuntime: containerd
+    initContainer:
+      repository: registry.cern.ch/kubernetes
+      version: 11.4.2-base-ubi8
+  driver:
+    repository: registry.cern.ch/kubernetes
+    image: nvidia-gpu-driver
+    version: "v550.54.15-6.8.4-200.fc39.x86_64"
+    imagePullPolicy: Always
+    manager:
+      repository: registry.cern.ch/kubernetes
+      version: v0.6.0
+    licensingConfig:
+      configMapName: "nvidia-grid-license"
+      nlsEnabled: false
+    nfd:
+      enabled: false
+  vgpuManager:
+    repository: registry.cern.ch
+    driverManager:
+      repository: registry.cern.ch
+      version: v0.5.1
+  vfioManager:
+    repository: registry.cern.ch
+    version: 11.7.1-base-ubi8
+    driverManager:
+      repository: registry.cern.ch
+      version: v0.5.1
+  gdrcopy:
+    repository: registry.cern.ch/kubernetes
+    version: v2.4.1-1
+  vgpuDeviceManager:
+    repository: registry.cern.ch
+    version: v0.2.0
+  toolkit:
+    repository: registry.cern.ch/kubernetes
+    version: v1.16.2-ubuntu20.04
+  devicePlugin:
+    repository: registry.cern.ch/kubernetes
+    version: v0.13.0
+  dcgm:
+    repository: registry.cern.ch
+    version: 3.1.3-1-ubuntu20.04
+  dcgmExporter:
+    repository: registry.cern.ch/kubernetes
+    version: 3.1.3-3.1.2-ubuntu20.04
+    config:
+      name: nvidia-dcgm-exporter-metrics
+  gfd:
+    repository: registry.cern.ch/kubernetes
+    version: v0.16.2-ubi8
+  mig:
+    strategy: mixed
+  migManager:
+    repository: registry.cern.ch/kubernetes
+    version: v0.5.0
+    config:
+      name: nvidia-mig-config
+  nodeStatusExporter:
+    repository: registry.cern.ch
+    version: v24.6.2
+  kataManager:
+    repository: registry.cern.ch/kubernetes
+    version: v0.2.1
+  sandboxDevicePlugin:
+    repository: registry.cern.ch/kubernetes
+    version: v1.2.1
+  ccManager:
+    repository: registry.cern.ch/kubernetes
+    version: v0.1.1
+  devicePlugin:
+    repository: registry.cern.ch/kubernetes
+    version: v0.12.2-ubi8
+    config:
+      name: nvidia-device-plugin-config
+      default: "default"
+
+cern-it-monitoring-kubernetes:
+  enabled: true

swan-cern/Chart.lock

@@ -1,12 +1,6 @@
 dependencies:
 - name: swan
   repository: oci://registry.cern.ch/swan/charts
-  version: 2.3.8
-- name: fluentd
-  repository: https://fluent.github.io/helm-charts
-  version: 0.4.3
-- name: gpu-operator
-  repository: oci://registry.cern.ch/kubernetes/charts
-  version: v24.6.2
-digest: sha256:02b128aa07fd796252255ac4f09708fef9b99aabd0d01d4f2c29d28a2e1aca55
-generated: "2024-10-16T10:39:56.250436142+02:00"
+  version: 2.3.1
+digest: sha256:29975b17c609f14239268ceb400c12d076fa4700acff018a8f56abc0b4314da7
+generated: "2024-09-16T14:32:44.292303568+02:00"

swan-cern/Chart.yaml

@@ -12,10 +12,4 @@ dependencies:
   - name: swan
     version: 2.3.8
     repository: oci://registry.cern.ch/swan/charts
-  - name: fluentd
-    version: 0.4.3
-    repository: https://fluent.github.io/helm-charts
-  - name: gpu-operator
-    version: v24.6.2
-    repository: oci://registry.cern.ch/kubernetes/charts
-    condition: gpu-operator.enabled
+    condition: swan.enabled

swan-cern/templates/config.yaml

@@ -1,3 +1,4 @@
+{{- if index .Values "enabled" }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -8,3 +9,4 @@ data:
 {{ (.Files.Glob "files/swan_config_cern.py").AsConfig | indent 2 }}
 {{ (.Files.Glob "files/swan_computing_config.py").AsConfig | indent 2 }}
 {{ (.Files.Glob "files/private/side_container_tokens_perm.sh").AsConfig | indent 2 }}
+{{- end }}

swan-cern/templates/hadoop-token-generator.yaml

@@ -1,3 +1,4 @@
+{{- if index .Values "enabled" }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -88,3 +89,4 @@ spec:
   ports:
     - protocol: TCP
       port: 80
+{{- end }}

swan-cern/templates/monitoring.yaml

@@ -1,3 +1,4 @@
+{{- if index .Values "enabled" }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -23,3 +24,4 @@ spec:
     bearerTokenSecret:
       name: hub
       key: hub.services.prometheus-service-monitor.apiToken
+{{- end }}

swan-cern/templates/secrets.yaml

@@ -1,3 +1,4 @@
+{{- if index .Values "enabled" }}
 apiVersion: v1
 kind: Secret
 type: Opaque
@@ -8,3 +9,4 @@ data:
   eos.cred: {{ (required "helm --set swanCern.secrets.eos.cred=$(base64 -w0 <path>)" .Values.swanCern.secrets.eos.cred) }}
   hadoop.cred: {{ (required "helm --set swanCern.secrets.hadoop.cred=$(base64 -w0 <path>)" .Values.swanCern.secrets.hadoop.cred) }}
   sparkk8s.cred: {{ (required "helm --set swanCern.secrets.sparkk8s.cred=$(base64 -w0 <path>)" .Values.swanCern.secrets.sparkk8s.cred) }}
+{{- end }}