containers.go

/*
Copyright 2022-2023 Lawrence Livermore National Security, LLC
 (c.f. AUTHORS, NOTICE.LLNS, COPYING)

This is part of the Flux resource manager framework.
For details, see https://github.com/flux-framework.

SPDX-License-Identifier: Apache-2.0
*/

package controllers

import (
	"fmt"

	corev1 "k8s.io/api/core/v1"

	api "github.com/flux-framework/flux-operator/api/v1alpha2"
)

// getFluxContainers prepares the flux container to run the show!
func getFluxContainer(
	cluster *api.MiniCluster,
	mounts []corev1.VolumeMount) (corev1.Container, error) {

	// Allow dictating pulling on the level of the container
	pullPolicy := corev1.PullIfNotPresent
	if cluster.Spec.Flux.Container.PullAlways {
		pullPolicy = corev1.PullAlways
	}

	// test minicluster with init security context added PLUS mount at /tmp somewhere
	initContainer := corev1.Container{

		// Call this the driver container, number 0
		Name:            cluster.Spec.Flux.Container.Name,
		Image:           cluster.Spec.Flux.Container.Image,
		Command:         []string{"/bin/bash", "/flux_operator/flux-init.sh"},
		ImagePullPolicy: pullPolicy,
		WorkingDir:      cluster.Spec.Flux.Container.WorkingDir,
		VolumeMounts:    mounts,
		Stdin:           true,
		TTY:             true,
		Resources:       cluster.Spec.Flux.Container.Resources,
		SecurityContext: &cluster.Spec.Flux.Container.SecurityContext,
	}
	return initContainer, nil
}

// getContainers gets containers for a MiniCluster job or external service

func getContainers(
	specs []api.MiniClusterContainer,
	defaultName string,
	mounts []corev1.VolumeMount,
	serviceContainer bool,
) ([]corev1.Container, error) {

	// Create the containers for the pod
	containers := []corev1.Container{}

	// Assume we can't mount the same name twice
	seenMounts := map[string]bool{}

	// Add on application and flux runner containers
	for i, container := range specs {

		// Allow dictating pulling on the level of the container
		pullPolicy := corev1.PullIfNotPresent
		if container.ImagePullPolicy != "" {
			pullPolicy = corev1.PullPolicy(container.ImagePullPolicy)
		}
		if container.PullAlways {
			pullPolicy = corev1.PullAlways
		}

		// Fluxrunner will use the namespace name
		containerName := container.Name
		command := []string{}

		// A Flux runner will have a wait.sh script that waits for the flux view
		// to copy over, and then wraps the original command in a submit
		// It inherits the cluster name
		if container.RunFlux {

			// wait.sh path corresponds to container identifier
			waitScript := fmt.Sprintf("/flux_operator/wait-%d.sh", i)
			command = []string{"/bin/bash", waitScript}
			containerName = defaultName
		}

		// A container not running flux can only have pre/post sections
		// in a custom script if we know the entrypoint.
		if container.GenerateEntrypoint() && !serviceContainer {
			startScript := fmt.Sprintf("/flux_operator/start-%d.sh", i)
			command = []string{"/bin/bash", startScript}
		}

		// Prepare lifescycle commands for the container
		lifecycle := createContainerLifecycle(container)

		// Add on existing volumes/claims
		for volumeName, volume := range container.Volumes {

			var mount corev1.VolumeMount
			if volume.EmptyDir {

				// We assume bindings to /dev/shm
				mount = corev1.VolumeMount{
					Name:      volumeName,
					MountPath: "/dev/shm",
				}
			} else {
				mount = corev1.VolumeMount{
					Name:      volumeName,
					MountPath: volume.Path,
					ReadOnly:  volume.ReadOnly,
				}
			}
			_, ok := seenMounts[volumeName]
			if !ok {
				mounts = append(mounts, mount)
				seenMounts[volumeName] = true
			}
		}

		// Create the container
		newContainer := corev1.Container{

			// Call this the driver container, number 0
			Name:            containerName,
			Image:           container.Image,
			ImagePullPolicy: pullPolicy,
			WorkingDir:      container.WorkingDir,
			VolumeMounts:    mounts,
			Stdin:           true,
			TTY:             true,
			Lifecycle:       lifecycle,
			Resources:       container.Resources,
			SecurityContext: &container.SecurityContext,
		}

		// Only add command if we actually have one
		if len(command) > 0 {
			newContainer.Command = command
		}

		ports := []corev1.ContainerPort{}
		envars := []corev1.EnvVar{}

		// For now we will take ports and have container port == exposed port
		for _, port := range container.Ports {
			newPort := corev1.ContainerPort{
				ContainerPort: int32(port),
				Protocol:      "TCP",
			}
			ports = append(ports, newPort)
		}
		// Add environment variables
		for key, value := range container.Environment {
			newEnvar := corev1.EnvVar{
				Name:  key,
				Value: value,
			}
			envars = append(envars, newEnvar)
		}

		// Add environment variables that come as secrets
		for envarName, envar := range container.Secrets {
			newEnvar := corev1.EnvVar{
				Name: envarName,
				ValueFrom: &corev1.EnvVarSource{
					SecretKeyRef: &corev1.SecretKeySelector{
						LocalObjectReference: corev1.LocalObjectReference{
							Name: envar.Name,
						},
						Key: envar.Key,
					},
				},
			}
			envars = append(envars, newEnvar)
		}

		newContainer.Ports = ports
		newContainer.Env = envars

		containers = append(containers, newContainer)
	}
	return containers, nil
}