From fa666cd02657894c7f987acf2e04287288fc7781 Mon Sep 17 00:00:00 2001 From: Kevin Reeuwijk Date: Mon, 8 Sep 2025 14:25:20 +0200 Subject: [PATCH 1/3] Kubeflow and OAuth2 Proxy --- packs/kubeflow-1.9.1/README.md | 10 + packs/kubeflow-1.9.1/charts/kserve-0.13.0.tgz | Bin 0 -> 46987 bytes .../kubeflow-1.9.1/charts/kserve/.helmignore | 23 + packs/kubeflow-1.9.1/charts/kserve/Chart.yaml | 24 + .../charts/kserve/crds/kserve.yaml | 21920 ++++++++++++++++ .../charts/kserve/values_lint.yaml | 0 .../kubeflow-1.9.1/charts/kubeflow-0.5.1.tgz | Bin 0 -> 81408 bytes .../charts/kubeflow/.helmignore | 23 + .../kubeflow-1.9.1/charts/kubeflow/Chart.yaml | 27 + .../pipelines-profile-controller/sync.py | 425 + .../mlpipeline-minio-artifact.txt | 12 + ...e-accesskey-secretaccesskey-secret-ref.txt | 3 + .../charts/kubeflow/templates/_NOTES.txt | 22 + .../kubeflow/templates/_deployment.yaml | 61 + .../kubeflow/templates/_helpers/_helpers.tpl | 398 + .../_helpers/kubeflow.admissionWebhook.tpl | 301 + .../_helpers/kubeflow.centraldashboard.tpl | 221 + .../_helpers/kubeflow.dexIntegration.tpl | 61 + .../kubeflow.istio.authorizationPolicy.tpl | 14 + .../_helpers/kubeflow.istioIntegration.tpl | 133 + .../_helpers/kubeflow.katib.controller.tpl | 332 + .../_helpers/kubeflow.katib.dbmanager.tpl | 358 + .../templates/_helpers/kubeflow.katib.tpl | 265 + .../templates/_helpers/kubeflow.katib.ui.tpl | 277 + .../_helpers/kubeflow.knativeIntegration.tpl | 43 + .../_helpers/kubeflow.kserveModelsWebApp.tpl | 125 + .../_helpers/kubeflow.kubeflowRoles.tpl | 121 + .../_helpers/kubeflow.modelRegistry.tpl | 269 + .../_helpers/kubeflow.networkPolicies.tpl | 31 + .../kubeflow.notebooks.controller.tpl | 272 + .../kubeflow.notebooks.jupyterWebApp.tpl | 241 + ...kubeflow.notebooks.pvcviewerController.tpl | 368 + .../templates/_helpers/kubeflow.notebooks.tpl | 126 + .../kubeflow.notebooks.volumesWebApp.tpl | 229 + .../kubeflow.oauth2ProxyIntegration.tpl | 6 + .../kubeflow.pipelines.cache.config.tpl | 108 + .../_helpers/kubeflow.pipelines.cache.tpl | 252 + .../kubeflow.pipelines.metadataEnvoy.tpl | 197 + ...ow.pipelines.metadataGrpcServer.config.tpl | 76 + .../kubeflow.pipelines.metadataGrpcServer.tpl | 209 + .../kubeflow.pipelines.metadataWriter.tpl | 204 + .../kubeflow.pipelines.mlPipeline.config.tpl | 243 + .../kubeflow.pipelines.mlPipeline.tpl | 220 + .../kubeflow.pipelines.persistenceAgent.tpl | 208 + ...low.pipelines.profileController.config.tpl | 51 + .../kubeflow.pipelines.profileController.tpl | 227 + .../kubeflow.pipelines.scheduledWorkflow.tpl | 209 + .../templates/_helpers/kubeflow.pipelines.tpl | 150 + .../_helpers/kubeflow.pipelines.ui.config.tpl | 51 + .../_helpers/kubeflow.pipelines.ui.tpl | 233 + .../_helpers/kubeflow.pipelines.viewerCrd.tpl | 209 + .../kubeflow.pipelines.visualization.tpl | 213 + .../_helpers/kubeflow.profilesController.tpl | 205 + .../kubeflow.tensorboard.controller.tpl | 314 + ...ubeflow.tensorboard.tensorboardsWebApp.tpl | 220 + .../_helpers/kubeflow.tensorboard.tpl | 126 + .../_helpers/kubeflow.trainingOperator.tpl | 234 + .../templates/_helpers/validation.tpl | 51 + .../charts/kubeflow/templates/_hpa.yaml | 28 + .../charts/kubeflow/templates/_ingress.yaml | 61 + .../charts/kubeflow/templates/_service.yaml | 15 + .../kubeflow/templates/_serviceaccount.yaml | 12 + .../certmanager.certificate.yaml | 23 + .../admission-webhook/certmanager.issuer.yaml | 13 + .../cluster-role-binding.yaml | 18 + .../admission-webhook/clusterrole.main.yaml | 23 + .../admission-webhook/clusterroles.user.yaml | 52 + .../admission-webhook/deployment.yaml | 88 + .../templates/admission-webhook/hpa.yaml | 36 + .../admission-webhook/mutatingwebhook.yaml | 42 + .../poddisruptionbudget.yaml | 18 + .../admission-webhook/service-account.yaml | 15 + .../templates/admission-webhook/service.yaml | 24 + .../authorizationpolicy.extAuthz.yaml | 41 + .../centraldashboard/authorizationpolicy.yaml | 20 + .../centraldashboard/clusterrole-binding.yaml | 18 + .../centraldashboard/clusterrole.yaml | 21 + .../configmap.centraldashboard-config.yaml | 18 + .../centraldashboard/deployment.yaml | 99 + .../templates/centraldashboard/hpa.yaml | 36 + .../centraldashboard/poddisruptionbudget.yaml | 18 + .../centraldashboard/role-binding.yaml | 19 + .../templates/centraldashboard/role.yaml | 31 + .../centraldashboard/service-account.yaml | 15 + .../templates/centraldashboard/service.yaml | 25 + .../centraldashboard/virtual-service.yaml | 27 + .../dex-integration/virtualservice.yaml | 29 + .../cluster-jwks-proxy/deployment.yaml | 55 + .../cluster-jwks-proxy/service-account.yaml | 9 + .../cluster-jwks-proxy/service.yaml | 16 + .../istio-integration/cluster-roles.yaml | 60 + .../templates/istio-integration/gateway.yaml | 16 + .../authorizationpolicy.jwt-require.yaml | 41 + .../authorizationpolicy.oauth2-proxy.yaml | 48 + .../requestauthentication.user-auth.yaml | 26 + .../istio-m2m/requestauthentication.m2m.yaml | 29 + .../controller/certmanager.certificate.yaml | 22 + .../katib/controller/certmanager.issuer.yaml | 12 + .../controller/configmap.katib-config.yaml | 17 + .../katib/controller/deployment.yaml | 80 + .../katib/controller/rbac/clusterrole.yaml | 133 + .../controller/rbac/clusterrolebinding.yaml | 18 + .../katib/controller/rbac/serviceaccount.yaml | 18 + .../templates/katib/controller/service.yaml | 30 + .../katib/controller/trial-templates.yaml | 80 + .../katib/controller/webhook.mutating.yaml | 67 + .../katib/controller/webhook.validating.yaml | 36 + .../katib/db-manager/deployment.yaml | 56 + .../templates/katib/db-manager/service.yaml | 24 + .../katib/ui/authorizationpolicy.yaml | 22 + .../templates/katib/ui/deployment.yaml | 52 + .../templates/katib/ui/rbac/clusterrole.yaml | 44 + .../katib/ui/rbac/clusterrolebinding.yaml | 18 + .../katib/ui/rbac/serviceaccount.yaml | 16 + .../kubeflow/templates/katib/ui/service.yaml | 25 + .../templates/katib/ui/virtualservice.yaml | 38 + .../clusterrole.kubeflow-katib-admin.yaml | 11 + .../clusterrole.kubeflow-katib-edit.yaml | 35 + .../clusterrole.kubeflow-katib-view.yaml | 17 + .../istio.authrizationpolicies.yaml | 41 + .../istio.destinationrules.yaml | 16 + .../operator.knative.eventing.yaml | 11 + .../operator.knative.serving.yaml | 10 + .../authorizationpolicy.yaml | 21 + .../cluster-role-binding.yaml | 18 + .../kserve-models-web-app/cluster-role.yaml | 55 + .../templates/kserve-models-web-app/cm.yaml | 15 + .../kserve-models-web-app/deployment.yaml | 79 + .../service-account.yaml | 15 + .../kserve-models-web-app/service.yaml | 24 + .../virtual-service.yaml | 25 + .../kubeflow-pipelines-roles.yaml | 146 + .../kubeflow-roles/kubeflow-roles.yaml | 43 + .../kubeflow-roles/kubernetes-roles.yaml | 296 + .../model-registry/authorizationpolicy.yaml | 18 + .../kubeflow/templates/model-registry/cm.yaml | 16 + .../templates/model-registry/deployment.yaml | 156 + .../model-registry/destinationrule.yaml | 16 + .../templates/model-registry/hpa.yaml | 36 + .../model-registry/poddisruptionbudget.yaml | 18 + .../templates/model-registry/service.yaml | 29 + .../model-registry/serviceaccount.yaml | 15 + .../model-registry/virtualservice.yaml | 36 + .../networkpolicies/admission-webhook.yaml | 30 + .../networkpolicies/centraldashboard.yaml | 29 + .../default-allow-same-namespace.yaml | 18 + .../networkpolicies/katib-controller.yaml | 33 + .../networkpolicies/katib-db-manager.yaml | 34 + .../templates/networkpolicies/katib-ui.yaml | 32 + .../kserve-models-web-app.yaml | 28 + .../ml-pipeline-apiserver.yaml | 38 + .../networkpolicies/ml-pipeline-cache.yaml | 30 + .../ml-pipeline-metadata-envoy.yaml | 33 + .../ml-pipeline-metadata-grpc-server.yaml | 33 + .../networkpolicies/ml-pipeline-ui.yaml | 32 + .../networkpolicies/model-registry.yaml | 39 + .../notebooks-jupyter-web-app.yaml | 33 + .../networkpolicies/notebooks-pvcviewer.yaml | 30 + .../notebooks-volumes-web-app.yaml | 33 + .../networkpolicies/tensorboards-web-app.yaml | 35 + .../training-operator-webhook.yaml | 26 + .../notebooks/controller/deployment.yaml | 71 + .../controller/rbac/clusterrole.main.yaml | 55 + .../rbac/clusterrolebinding.main.yaml | 18 + .../controller/rbac/clusterroles.user.yaml | 62 + .../controller/rbac/role.leader-election.yaml | 38 + .../rbac/rolebinding.leader-election.yaml | 19 + .../controller/rbac/serviceaccount.yaml | 15 + .../notebooks/controller/service.yaml | 22 + .../notebooks/jupyter-web-app/NOTES.txt | 1 + .../authorizationpolicy.extAuth.yaml | 29 + .../jupyter-web-app/authorizationpolicy.yaml | 20 + .../jupyter-web-app/cluster-role-binding.yaml | 18 + .../jupyter-web-app/cluster-role.yaml | 123 + .../notebooks/jupyter-web-app/cm.logos.yaml | 229 + .../jupyter-web-app/cm.spawner-ui.yaml | 15 + .../notebooks/jupyter-web-app/deployment.yaml | 100 + .../jupyter-web-app/destination-rule.yaml | 16 + .../notebooks/jupyter-web-app/hpa.yaml | 36 + .../jupyter-web-app/poddisruptionbudget.yaml | 18 + .../jupyter-web-app/service-account.yaml | 15 + .../notebooks/jupyter-web-app/service.yaml | 25 + .../jupyter-web-app/virtual-service.yaml | 31 + .../certmanager.certificate.yaml | 21 + .../certmanager.issuer.yaml | 13 + .../pvcviewer-controller/deployment.yaml | 144 + .../rbac/clusterrole.manager.yaml | 83 + .../rbac/clusterrole.metrics-reader.yaml | 15 + .../rbac/clusterrole.proxy.yaml | 23 + .../rbac/clusterrolebinding.manager.yaml | 18 + .../rbac/clusterrolebinding.proxy.yaml | 18 + .../rbac/role.leader-election.yaml | 43 + .../rbac/rolebinding.leader-election.yaml | 19 + .../rbac/volumesviewer_editor_role.yaml | 36 + .../rbac/volumesviewer_viewer_role.yaml | 32 + .../service.kube-rbac-proxy.yaml | 25 + .../pvcviewer-controller/service.manager.yaml | 24 + .../pvcviewer-controller/serviceaccount.yaml | 15 + .../webhook/mutating.yaml | 38 + .../webhook/validating.yaml | 38 + .../authorizationpolicy.extAuth.yaml | 29 + .../volumes-web-app/authorizationpolicy.yaml | 20 + .../volumes-web-app/cluster-role-binding.yaml | 18 + .../volumes-web-app/cluster-role.yaml | 143 + .../notebooks/volumes-web-app/cm.yaml | 59 + .../notebooks/volumes-web-app/deployment.yaml | 94 + .../volumes-web-app/destination-rule.yaml | 16 + .../notebooks/volumes-web-app/hpa.yaml | 36 + .../volumes-web-app/poddisruptionbudget.yaml | 18 + .../volumes-web-app/service-account.yaml | 15 + .../notebooks/volumes-web-app/service.yaml | 25 + .../volumes-web-app/virtual-service.yaml | 31 + .../virtualservice.yaml | 23 + .../kubeflow/templates/pipelines/_notes.txt | 5 + .../pipelines/cache/authorizationpolicy.yaml | 17 + .../cache/certmanager.certificate.yaml | 23 + .../pipelines/cache/certmanager.issuer.yaml | 13 + .../templates/pipelines/cache/deployment.yaml | 127 + .../pipelines/cache/mutatingwebhook.yaml | 36 + .../pipelines/cache/role-or-clusterrole.yaml | 57 + .../rolebinding-or-clusterrolebinding.yaml | 22 + .../templates/pipelines/cache/sa.yaml | 15 + .../templates/pipelines/cache/service.yaml | 47 + .../apiserver/authorizationpolicy.yaml | 41 + .../ml-pipeline/apiserver/deployment.yaml | 162 + .../apiserver/destinationrule.yaml | 16 + .../apiserver/role-or-clusterrole.yaml | 85 + .../rolebinding-or-clusterrolebinding.yaml | 19 + .../pipelines/ml-pipeline/apiserver/sa.yaml | 15 + .../ml-pipeline/apiserver/service.yaml | 32 + .../metadata-envoy/deployment.yaml | 76 + .../ml-pipeline/metadata-envoy/sa.yaml | 15 + .../ml-pipeline/metadata-envoy/service.yaml | 41 + .../authorizationpolicy.yaml | 18 + .../metadata-grpc-server/deployment.yaml | 103 + .../metadata-grpc-server/destinationrule.yaml | 16 + .../ml-pipeline/metadata-grpc-server/sa.yaml | 15 + .../metadata-grpc-server/service.yaml | 55 + .../metadata-grpc-server/virtualservice.yaml | 28 + .../metadata-writer/deployment.yaml | 84 + .../metadata-writer/role-or-clusterrole.yaml | 38 + .../rolebinding-or-clusterrolebinding.yaml | 19 + .../ml-pipeline/metadata-writer/sa.yaml | 15 + .../persistenceagent/deployment.yaml | 100 + .../persistenceagent/role-or-clusterrole.yaml | 42 + .../rolebinding-or-clusterrolebinding.yaml | 19 + .../ml-pipeline/persistenceagent/sa.yaml | 15 + .../scheduledworkflow/deployment.yaml | 87 + .../role-or-clusterrole.yaml | 44 + .../rolebinding-or-clusterrolebinding.yaml | 19 + .../ml-pipeline/scheduledworkflow/sa.yaml | 15 + .../secret.mlpipeline-minio-artifact.yaml | 27 + .../ui/authorizationpolicy.extAuth.yaml | 27 + .../ml-pipeline/ui/authorizationpolicy.yaml | 30 + .../pipelines/ml-pipeline/ui/configmap.yaml | 18 + .../pipelines/ml-pipeline/ui/deployment.yaml | 147 + .../ml-pipeline/ui/destinationrule.yaml | 16 + .../ml-pipeline/ui/role-or-clusterrole.yaml | 49 + .../ui/rolebinding-or-clusterrolebinding.yaml | 19 + .../pipelines/ml-pipeline/ui/sa.yaml | 15 + .../pipelines/ml-pipeline/ui/service.yaml | 25 + .../ml-pipeline/ui/virtualservice.yaml | 28 + .../ml-pipeline/viewer-crd/deployment.yaml | 85 + .../viewer-crd/role-or-clusterrole.yaml | 38 + .../rolebinding-or-clusterrolebinding.yaml | 19 + .../pipelines/ml-pipeline/viewer-crd/sa.yaml | 15 + .../visualization/authorizationpolicy.yaml | 25 + .../ml-pipeline/visualization/deployment.yaml | 101 + .../visualization/destinationrule.yaml | 16 + .../ml-pipeline/visualization/sa.yaml | 15 + .../ml-pipeline/visualization/service.yaml | 25 + .../profile-controller/configmap.yaml | 14 + .../decorator-controller.yaml | 50 + .../profile-controller/deployment.yaml | 119 + .../pipelines/profile-controller/service.yaml | 21 + .../rbac/clusterrole.cache-deployer.yaml | 45 + .../clusterrolebinding.cache-deployer.yaml | 24 + .../pipelines/rbac/sa.cache-deployer.yaml | 17 + .../kubeflow/templates/pipelines/rbac/sa.yaml | 5 + .../authorizationpolicy.yaml | 25 + .../configmap.namespace-labels.yaml | 20 + .../profiles-controller/deployment.yaml | 134 + .../rbac/clusterrolebinding.main.yaml | 18 + .../rbac/profile_editor_role.yaml | 29 + .../rbac/profile_viewer_role.yaml | 25 + .../rbac/role.leader-election.yaml | 37 + .../profiles-controller/rbac/role.yaml | 44 + .../rbac/rolebinding.leader-election.yaml | 18 + .../rbac/serviceaccount.yaml | 15 + .../profiles-controller/service.yaml | 22 + .../profiles-controller/virtualservice.yaml | 31 + .../tensorboard/controller/deployment.yaml | 139 + .../controller/rbac/clusterrole.manager.yaml | 83 + .../rbac/clusterrole.metrics-reader.yaml | 15 + .../controller/rbac/clusterrole.proxy.yaml | 23 + .../rbac/clusterrolebinding.manager.yaml | 18 + .../rbac/clusterrolebinding.proxy.yaml | 18 + .../controller/rbac/role.leader-election.yaml | 43 + .../rbac/rolebinding.leader-election.yaml | 19 + ...ce.controller-manager-metrics-service.yaml | 28 + .../controller/serviceaccount.yaml | 15 + .../authorizationpolicy.extAuth.yaml | 29 + .../authorizationpolicy.yaml | 20 + .../cluster-role-binding.yaml | 18 + .../tensorboards-web-app/cluster-role.yaml | 134 + .../tensorboards-web-app/deployment.yaml | 84 + .../destination-rule.yaml | 16 + .../tensorboard/tensorboards-web-app/hpa.yaml | 36 + .../poddisruptionbudget.yaml | 18 + .../tensorboards-web-app/service-account.yaml | 15 + .../tensorboards-web-app/service.yaml | 25 + .../tensorboards-web-app/virtual-service.yaml | 31 + .../templates/tests/_test-connection.yaml | 15 + .../cluster-role-binding.yaml | 18 + .../training-operator/clusterrole.main.yaml | 297 + .../training-operator/clusterroles.user.yaml | 109 + .../training-operator/deployment.yaml | 122 + .../templates/training-operator/hpa.yaml | 36 + .../poddisruptionbudget.yaml | 18 + .../secret.webhook-cert.yaml | 13 + .../training-operator/service-account.yaml | 15 + .../templates/training-operator/service.yaml | 28 + .../validatingwebhookconfiguration.yaml | 110 + .../charts/kubeflow/values_lint.yaml | 2057 ++ .../charts/metacontroller-4.11.22.tgz | Bin 0 -> 4115 bytes .../charts/metacontroller/.helmignore | 23 + .../charts/metacontroller/Chart.yaml | 24 + .../metacontroller/crds/controllers.yaml | 827 + .../metacontroller/templates/clusterrole.yaml | 32 + .../templates/clusterrolebinding.yaml | 12 + .../templates/serviceaccount.yaml | 4 + .../metacontroller/templates/statefulset.yaml | 54 + .../charts/metacontroller/values_lint.yaml | 0 packs/kubeflow-1.9.1/charts/profile-0.1.0.tgz | Bin 0 -> 2043 bytes .../kubeflow-1.9.1/charts/profile/.helmignore | 23 + .../kubeflow-1.9.1/charts/profile/Chart.yaml | 24 + .../charts/profile/templates/_helpers.tpl | 51 + .../authorizationpolicy.contributor.yaml | 28 + .../authorizationpolicy.ext-auth.yaml | 20 + .../charts/profile/templates/profile.yaml | 21 + .../templates/rolebinding.contributor.yaml | 26 + .../charts/profile/values_lint.yaml | 28 + packs/kubeflow-1.9.1/logo.png | Bin 0 -> 54864 bytes packs/kubeflow-1.9.1/pack.json | 20 + packs/kubeflow-1.9.1/values.yaml | 2097 ++ packs/kubeflow-crds-1.9.1/README.md | 10 + .../charts/kubeflow-crds-0.4.1.tgz | Bin 0 -> 362188 bytes .../charts/kubeflow-crds/.helmignore | 23 + .../charts/kubeflow-crds/Chart.yaml | 27 + .../templates/_helpers/_helpers.tpl | 107 + .../kubeflowCrds.admissionWebhook.tpl | 50 + .../kubeflowCrds.katib.controller.tpl | 80 + .../templates/_helpers/kubeflowCrds.katib.tpl | 36 + .../kubeflowCrds.notebooks.controller.tpl | 60 + ...flowCrds.notebooks.pvcviewerController.tpl | 67 + .../_helpers/kubeflowCrds.notebooks.tpl | 34 + ...beflowCrds.pipelines.scheduledWorkflow.tpl | 55 + .../_helpers/kubeflowCrds.pipelines.tpl | 34 + .../kubeflowCrds.pipelines.viewerCrd.tpl | 55 + .../kubeflowCrds.profilesController.tpl | 50 + .../kubeflowCrds.tensorboard.controller.tpl | 56 + .../_helpers/kubeflowCrds.tensorboard.tpl | 34 + .../kubeflowCrds.trainingOperator.tpl | 110 + .../templates/admission-webhook/crd.yaml | 2102 ++ .../templates/katib/experiment.yaml | 42 + .../templates/katib/suggestion.yaml | 48 + .../kubeflow-crds/templates/katib/trial.yaml | 42 + .../notebooks/kubeflow.org_notebooks.yaml | 9513 +++++++ .../pipeline/scheduled-workflow-crd.yaml | 45 + .../templates/pipeline/viewer-crd.yaml | 40 + .../profiles/kubeflow.org_profiles.yaml | 696 + .../kubeflow.org_pvcviewers.yaml | 3492 +++ ...tensorboard.kubeflow.org_tensorboards.yaml | 91 + .../kubeflow.org_mpijobs.yaml | 7547 ++++++ .../kubeflow.org_mxjobs.yaml | 7544 ++++++ .../kubeflow.org_paddlejobs.yaml | 8031 ++++++ .../kubeflow.org_pytorchjobs.yaml | 8068 ++++++ .../kubeflow.org_tfjobs.yaml | 7546 ++++++ .../kubeflow.org_xgboostjobs.yaml | 7528 ++++++ .../charts/kubeflow-crds/values.yaml | 47 + packs/kubeflow-crds-1.9.1/logo.png | Bin 0 -> 54864 bytes packs/kubeflow-crds-1.9.1/pack.json | 17 + packs/kubeflow-crds-1.9.1/values.yaml | 52 + packs/oauth2-proxy-8.2.0/README.md | 380 + .../charts/oauth2-proxy-8.2.0.tgz | Bin 0 -> 60874 bytes .../charts/oauth2-proxy/.helmignore | 23 + .../charts/oauth2-proxy/Chart.lock | 6 + .../charts/oauth2-proxy/Chart.yaml | 39 + .../charts/oauth2-proxy/README.md | 380 + .../oauth2-proxy/charts/redis-ha/.helmignore | 25 + .../oauth2-proxy/charts/redis-ha/Chart.yaml | 19 + .../oauth2-proxy/charts/redis-ha/README.md | 485 + .../charts/redis-ha/templates/NOTES.txt | 25 + .../charts/redis-ha/templates/_configs.tpl | 730 + .../charts/redis-ha/templates/_helpers.tpl | 130 + .../redis-ha/templates/redis-auth-secret.yaml | 15 + .../templates/redis-ha-announce-service.yaml | 64 + .../templates/redis-ha-configmap.yaml | 37 + .../redis-ha-exporter-script-configmap.yaml | 14 + .../templates/redis-ha-health-configmap.yaml | 20 + .../templates/redis-ha-network-policy.yaml | 80 + .../redis-ha/templates/redis-ha-pdb.yaml | 18 + .../templates/redis-ha-prometheus-rule.yaml | 19 + .../redis-ha/templates/redis-ha-role.yaml | 19 + .../templates/redis-ha-rolebinding.yaml | 19 + .../redis-ha/templates/redis-ha-secret.yaml | 32 + .../redis-ha/templates/redis-ha-service.yaml | 57 + .../templates/redis-ha-serviceaccount.yaml | 31 + .../templates/redis-ha-servicemonitor.yaml | 39 + .../templates/redis-ha-statefulset.yaml | 668 + .../templates/redis-haproxy-deployment.yaml | 202 + .../redis-haproxy-network-policy.yaml | 74 + .../redis-ha/templates/redis-haproxy-pdb.yaml | 18 + .../templates/redis-haproxy-role.yaml | 22 + .../templates/redis-haproxy-rolebinding.yaml | 22 + .../templates/redis-haproxy-service.yaml | 60 + .../redis-haproxy-serviceaccount.yaml | 15 + .../redis-haproxy-servicemonitor.yaml | 39 + .../redis-ha/templates/redis-tls-secret.yaml | 27 + .../templates/sentinel-auth-secret.yaml | 15 + .../tests/test-redis-ha-configmap.yaml | 32 + .../templates/tests/test-redis-ha-pod.yaml | 29 + .../oauth2-proxy/charts/redis-ha/values.yaml | 1010 + .../oauth2-proxy/ci/default-values.yaml | 1 + .../ci/extra-args-as-dict-values.yaml | 4 + .../ci/extra-args-as-list-values.yaml | 5 + .../oauth2-proxy/ci/extra-env-tpl-values.yaml | 6 + .../oauth2-proxy/ci/extra-init-container.yaml | 7 + .../ci/horizontal-pod-autoscaling-values.yaml | 5 + .../ci/ingress-extra-paths-values.yaml | 14 + .../charts/oauth2-proxy/ci/pdb-values.yaml | 1 + .../ci/pod-security-context-values.yaml | 4 + .../ci/redis-sentinel-array-values.yaml | 34 + .../ci/redis-sentinel-comma-values.yaml | 32 + .../ci/redis-standalone-values.yaml | 65 + .../ci/servicemonitor-values.yaml | 18 + .../charts/oauth2-proxy/ci/tpl-values.yaml | 62 + .../oauth2-proxy/scripts/check-redis.sh | 61 + .../charts/oauth2-proxy/templates/NOTES.txt | 3 + .../oauth2-proxy/templates/_capabilities.tpl | 23 + .../oauth2-proxy/templates/_helpers.tpl | 161 + .../oauth2-proxy/templates/_ingress.tpl | 46 + .../configmap-authenticated-emails-file.yaml | 18 + .../templates/configmap-wait-for-redis.yaml | 13 + .../oauth2-proxy/templates/configmap.yaml | 18 + .../oauth2-proxy/templates/deployment.yaml | 425 + .../oauth2-proxy/templates/deprecation.yaml | 12 + .../templates/extra-manifests.yaml | 4 + .../oauth2-proxy/templates/google-secret.yaml | 13 + .../charts/oauth2-proxy/templates/hpa.yaml | 49 + .../oauth2-proxy/templates/ingress.yaml | 44 + .../templates/poddisruptionbudget.yaml | 27 + .../oauth2-proxy/templates/redis-secret.yaml | 23 + .../oauth2-proxy/templates/secret-alpha.yaml | 21 + .../secret-authenticated-emails-file.yaml | 19 + .../templates/secret-htpasswd-file.yaml | 16 + .../charts/oauth2-proxy/templates/secret.yaml | 17 + .../oauth2-proxy/templates/service.yaml | 68 + .../templates/serviceaccount.yaml | 60 + .../templates/servicemonitor.yaml | 57 + .../charts/oauth2-proxy/values.yaml | 569 + packs/oauth2-proxy-8.2.0/logo.png | Bin 0 -> 11087 bytes packs/oauth2-proxy-8.2.0/pack.json | 17 + packs/oauth2-proxy-8.2.0/values.yaml | 580 + 464 files changed, 117804 insertions(+) create mode 100644 packs/kubeflow-1.9.1/README.md create mode 100644 packs/kubeflow-1.9.1/charts/kserve-0.13.0.tgz create mode 100644 packs/kubeflow-1.9.1/charts/kserve/.helmignore create mode 100644 packs/kubeflow-1.9.1/charts/kserve/Chart.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kserve/crds/kserve.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kserve/values_lint.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow-0.5.1.tgz create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/.helmignore create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/Chart.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/files/pipelines-profile-controller/sync.py create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/mlpipeline-minio-artifact.txt create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/objectstore-accesskey-secretaccesskey-secret-ref.txt create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_NOTES.txt create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/_helpers.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.admissionWebhook.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.centraldashboard.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.dexIntegration.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istio.authorizationPolicy.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istioIntegration.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.controller.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.dbmanager.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.ui.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.knativeIntegration.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kserveModelsWebApp.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kubeflowRoles.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.modelRegistry.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.networkPolicies.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.controller.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.jupyterWebApp.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.pvcviewerController.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.volumesWebApp.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.oauth2ProxyIntegration.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.config.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataEnvoy.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.config.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataWriter.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.config.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.persistenceAgent.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.config.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.scheduledWorkflow.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.config.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.viewerCrd.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.visualization.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.profilesController.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.controller.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tensorboardsWebApp.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.trainingOperator.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/validation.tpl create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_ingress.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/_serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.certificate.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.issuer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/cluster-role-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterrole.main.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterroles.user.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/mutatingwebhook.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/poddisruptionbudget.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.extAuthz.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/configmap.centraldashboard-config.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/poddisruptionbudget.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/virtual-service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/dex-integration/virtualservice.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-roles.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/gateway.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.jwt-require.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.oauth2-proxy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/requestauthentication.user-auth.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-m2m/requestauthentication.m2m.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.certificate.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.issuer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/configmap.katib-config.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/trial-templates.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.mutating.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.validating.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/virtualservice.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-admin.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-edit.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-view.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.authrizationpolicies.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.destinationrules.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.eventing.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.serving.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cm.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/virtual-service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-pipelines-roles.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-roles.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubernetes-roles.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/cm.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/destinationrule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/poddisruptionbudget.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/virtualservice.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/admission-webhook.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/centraldashboard.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/default-allow-same-namespace.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-controller.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-db-manager.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-ui.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/kserve-models-web-app.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-apiserver.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-cache.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-envoy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-grpc-server.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-ui.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/model-registry.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-jupyter-web-app.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-pvcviewer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-volumes-web-app.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/tensorboards-web-app.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/training-operator-webhook.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrole.main.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrolebinding.main.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterroles.user.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/role.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/rolebinding.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/NOTES.txt create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.extAuth.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.logos.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.spawner-ui.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/destination-rule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/poddisruptionbudget.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/virtual-service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.certificate.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.issuer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.manager.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.metrics-reader.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.proxy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.manager.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.proxy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/role.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/rolebinding.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_editor_role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_viewer_role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.kube-rbac-proxy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.manager.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/mutating.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/validating.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.extAuth.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cm.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/destination-rule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/poddisruptionbudget.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/virtual-service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/oauth2-proxy-integration/virtualservice.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/_notes.txt create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.certificate.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.issuer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/mutatingwebhook.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/role-or-clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/rolebinding-or-clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/destinationrule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/role-or-clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/rolebinding-or-clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/destinationrule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/virtualservice.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/role-or-clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/rolebinding-or-clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/role-or-clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/rolebinding-or-clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/role-or-clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/rolebinding-or-clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/secret.mlpipeline-minio-artifact.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.extAuth.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/configmap.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/destinationrule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/role-or-clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/rolebinding-or-clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/virtualservice.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/role-or-clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/rolebinding-or-clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/destinationrule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/configmap.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/decorator-controller.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrole.cache-deployer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrolebinding.cache-deployer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.cache-deployer.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/configmap.namespace-labels.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/clusterrolebinding.main.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_editor_role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_viewer_role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/rolebinding.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/virtualservice.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.manager.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.metrics-reader.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.proxy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.manager.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.proxy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/role.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/rolebinding.leader-election.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/service.controller-manager-metrics-service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.extAuth.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/destination-rule.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/poddisruptionbudget.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/virtual-service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/tests/_test-connection.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/cluster-role-binding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterrole.main.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterroles.user.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/deployment.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/hpa.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/poddisruptionbudget.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/secret.webhook-cert.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service-account.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/validatingwebhookconfiguration.yaml create mode 100644 packs/kubeflow-1.9.1/charts/kubeflow/values_lint.yaml create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller-4.11.22.tgz create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/.helmignore create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/Chart.yaml create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/crds/controllers.yaml create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/templates/clusterrole.yaml create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/templates/clusterrolebinding.yaml create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/templates/serviceaccount.yaml create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/templates/statefulset.yaml create mode 100644 packs/kubeflow-1.9.1/charts/metacontroller/values_lint.yaml create mode 100644 packs/kubeflow-1.9.1/charts/profile-0.1.0.tgz create mode 100644 packs/kubeflow-1.9.1/charts/profile/.helmignore create mode 100644 packs/kubeflow-1.9.1/charts/profile/Chart.yaml create mode 100644 packs/kubeflow-1.9.1/charts/profile/templates/_helpers.tpl create mode 100644 packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.contributor.yaml create mode 100644 packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.ext-auth.yaml create mode 100644 packs/kubeflow-1.9.1/charts/profile/templates/profile.yaml create mode 100644 packs/kubeflow-1.9.1/charts/profile/templates/rolebinding.contributor.yaml create mode 100644 packs/kubeflow-1.9.1/charts/profile/values_lint.yaml create mode 100644 packs/kubeflow-1.9.1/logo.png create mode 100644 packs/kubeflow-1.9.1/pack.json create mode 100644 packs/kubeflow-1.9.1/values.yaml create mode 100644 packs/kubeflow-crds-1.9.1/README.md create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds-0.4.1.tgz create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/.helmignore create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/Chart.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/_helpers.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.admissionWebhook.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.katib.controller.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.katib.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.notebooks.controller.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.notebooks.pvcviewerController.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.notebooks.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.pipelines.scheduledWorkflow.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.pipelines.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.pipelines.viewerCrd.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.profilesController.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.tensorboard.controller.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.tensorboard.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/_helpers/kubeflowCrds.trainingOperator.tpl create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/admission-webhook/crd.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/katib/experiment.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/katib/suggestion.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/katib/trial.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/notebooks/kubeflow.org_notebooks.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/pipeline/scheduled-workflow-crd.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/pipeline/viewer-crd.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/profiles/kubeflow.org_profiles.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/pvcviewer-controller/kubeflow.org_pvcviewers.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/tensorboard/tensorboard.kubeflow.org_tensorboards.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/training-operator/kubeflow.org_mpijobs.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/training-operator/kubeflow.org_mxjobs.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/training-operator/kubeflow.org_paddlejobs.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/training-operator/kubeflow.org_pytorchjobs.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/training-operator/kubeflow.org_tfjobs.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/templates/training-operator/kubeflow.org_xgboostjobs.yaml create mode 100644 packs/kubeflow-crds-1.9.1/charts/kubeflow-crds/values.yaml create mode 100644 packs/kubeflow-crds-1.9.1/logo.png create mode 100644 packs/kubeflow-crds-1.9.1/pack.json create mode 100644 packs/kubeflow-crds-1.9.1/values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/README.md create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy-8.2.0.tgz create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/.helmignore create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/Chart.lock create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/Chart.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/README.md create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/.helmignore create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/Chart.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/README.md create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/NOTES.txt create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/_configs.tpl create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/_helpers.tpl create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-auth-secret.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-announce-service.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-configmap.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-exporter-script-configmap.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-health-configmap.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-network-policy.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-pdb.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-prometheus-rule.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-role.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-rolebinding.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-secret.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-service.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-serviceaccount.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-servicemonitor.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-ha-statefulset.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-deployment.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-network-policy.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-pdb.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-role.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-rolebinding.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-service.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-serviceaccount.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-haproxy-servicemonitor.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/redis-tls-secret.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/sentinel-auth-secret.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/tests/test-redis-ha-configmap.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/templates/tests/test-redis-ha-pod.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/charts/redis-ha/values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/default-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/extra-args-as-dict-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/extra-args-as-list-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/extra-env-tpl-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/extra-init-container.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/horizontal-pod-autoscaling-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/ingress-extra-paths-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/pdb-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/pod-security-context-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/redis-sentinel-array-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/redis-sentinel-comma-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/redis-standalone-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/servicemonitor-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/ci/tpl-values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/scripts/check-redis.sh create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/NOTES.txt create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/_capabilities.tpl create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/_helpers.tpl create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/_ingress.tpl create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/configmap-authenticated-emails-file.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/configmap-wait-for-redis.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/configmap.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/deployment.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/deprecation.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/extra-manifests.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/google-secret.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/hpa.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/ingress.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/poddisruptionbudget.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/redis-secret.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/secret-alpha.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/secret-authenticated-emails-file.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/secret-htpasswd-file.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/secret.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/service.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/serviceaccount.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/templates/servicemonitor.yaml create mode 100644 packs/oauth2-proxy-8.2.0/charts/oauth2-proxy/values.yaml create mode 100644 packs/oauth2-proxy-8.2.0/logo.png create mode 100644 packs/oauth2-proxy-8.2.0/pack.json create mode 100644 packs/oauth2-proxy-8.2.0/values.yaml diff --git a/packs/kubeflow-1.9.1/README.md b/packs/kubeflow-1.9.1/README.md new file mode 100644 index 00000000..43ddfea8 --- /dev/null +++ b/packs/kubeflow-1.9.1/README.md @@ -0,0 +1,10 @@ +# Description + +# Kubernetes versions supported: + +# Constraints: + +# Cloud types supported: + +# References: + - \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kserve-0.13.0.tgz b/packs/kubeflow-1.9.1/charts/kserve-0.13.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..e180387ac07b370c9b90e6c19c2228499f23f40d GIT binary patch literal 46987 zcmZsi1CS(L_vTyE=Cn0!+qP}nn6_=(J#E`Ir)}GIwT*vu;)t z;-2UC9K1+K6rg_|Ulc%82I7kJM&dH8((W8AhD@sT#!4&}no1n3a;mDVGHOdW1OI@IO; zv*8_YZ=P-2>u$2=^NvsL>uZv2`{L`1ZToXP=W}=6_vJ|M^Fi+GwZyjP?Fz5^ zG`ae9Jys3IMPjN)dxb6d&nO@<-G8gKMA0WFtbRg;63t|L1F-0L5zojntN6LSHRe@Z z9L&n-gU$Q$l?wPY(fj3r>L2TEIHDUzE89C>by|j!?m!r|eC@<+E?k=Z<|Bg` zNhD8)WXI)ZnpnblH)_h!Vyd{_&6BMsKG`t7xZKOy!|U#Gov-WTNG9Q6PxNR!Rz#y3 zF6ywS0!x}8tJ0&zD3Dm}OO+S130?oncWHKp2-BhhWMjjBi`W$~T%pAh zWTol--U~ugpKF0Lt;npxu|q@Ls#(_Pdmt;*?#1@kHJ&Xx3*YZjN~aIyF*6zsGi8QL zbMrn6LDad%WuILlcbTMZaM@w8_)RLiT8&dH}%d}_pOSdO%&uURF;_l+EO%`K~pR@27uvS##ed zo@zpqjCEEGIDOf|==_~tdykfU9@9(pzGq=fdsL>lk+BPdo^-F_V}pBj#Od&umHOw) zM}hQlwLx)<1P8~tIn?E>OOJ89q@ILi6-;?l!&7Wgyo;3UGbDz#d8lQ3V%7PIaFzDD zNTe=Q$>a{)W~7%aCbzwh=e^ZK8oemDzaHkxxi;pDv}5D^sv!qdks1uB&s@2GJ0JhB zw!{bo$z4>ikza^9yQ~_!crstM^~GaD8u@ez4F``>+3`6W<^E=WmOZGFpsoT~lb{4#D&G)U9E z;WxoiWpAS8#lWQY;g!)1Epky}^x1mL;mBUMwE_1SlF)9PavZ)77Zk(gL*-k`IQt^)l3<50<1llXDHVX7#M&_F(*JY~E~+hoy&f2*ce)WWhH>5%0dloiS9 zuAX5DU|)HD2&A8f-`wTt7XrEDYb*9(MV?M9`PEH?dn}fVY)4ARZ_r=*^D0vS(ae<@ytx3`HY6seaS5OvBFunlO0mexMTNC`bx@GR5?##980sA}V#Vil76 zBDhYI_+F){;Tl6tuazo`_SD_G;xXmrN`+s$155m=Qo8Fsmg}K#$6JKrYQVw1 zV__Qa14&q@S;i1DuAKgr*6|n~F`}_-Myr;!KPU35F!k%38bv)?&7LC`H*1_>9!Zzs zBe)F-al(|*>;-yFh(JPI-`>fX0qs0`#AM05D)Ut21|-=$^vK2YQ(zfsLm$WWU7bY0W*kTuT zVNmjpeo93oHx39JC4 zsQF+ES-`Xx{9y|Lcjdp)ToQJWc7hF+`W@Ss(u;~&=; zBW}RIIfehuyiViEN~1b2$Is?^Sr|Qb6PsR2lsysLyh$V1>Sjy~pU{!S|h&VT*O#1J9nQ1Yh7tK;nnV5~DX)ZU}>1O6j z?{TFu_I#XOewgD_hoLf1=hZaX))k5qk({H<;QQWYHEGvP0CE-AncC~=5m8j$u@wlR ztd1J3vAfaXQ3x$?)50k8P}#}sk?+MMtj?De(b--vdL|RYc?Y)PU&0ts^qd?)_|5?yUw+|!1^{NCP8K%{v{K99W0@QhD$1YR zPU_j?Et^#@8yZ!mOK;y>?y|B2{U)iAy3sz7D!gVH>BC7qbaSlS%Y(vD~e)FA|da%UXNdM|0* z9cr@Sp>duMEbvW0ssdJ0Rv49C0@7`CxroNKi}LICY?M|xtp}7pRgO$Bo*hze#r?9% z97QiXwQ(YhRc{7E&)n#NaMm_X(>-4?n?G{!v5TV5>TBwd=cG|BS#!K|yv|Q$o`BD` zLgSg|J|<4J(_Pf>bUO*jkp1L1)!LB1-;mF&$ZY<}jwGw&0Z*C{FK}31yUv;S(_h-` z(rGHtlNg9MUi781d%8ARKy@Z-SB(T&GmKI_=}Zc3u>F{CXE-2e0G{@wu1L2l79Hsb z3{*mg#Mf%19QJ?@zxFIJ5k5x>vIz2*Z<5^UAer&Ir}`n1r5rr6;aB?3VK4@e5RhmB5mT% zb^38&Rt$642%yAkA0itfd#O(PSRNHa+((Ud8Hdkv#Lq_YF$(=5IuNrAJM3{goGO|$ zjoR{*z@=iWqr=;p#|GxxV;I6M5$G6AwvtMhx?1%PZuag7T01K2>je!Gmmmmky46+@ zjs`9P6Ev_31u0a(T_FM_Fz~*R*O^W~!vOk66R$JZL8Vh9ln&*Z{>gl?=d%eTc z>`w~X{}!qEvDZ<)LgGO0w&+c4LsL;VFAj1LAqg!jOtR|bLxw0f?EDjEv%zH^;yG^8b~cr+;rt6 z=nyJGW(Xx-xs!bc;<*qFz{=BG(T)ex_^m6 zBpBHsXNklYrmYLF3H7%tBcrNuLhW}EL%wk274Sivv<7unETLrQI%b6J!$@tk$%y}) zwuZjhy7H2{gD2+U29qdF#m5A27^LRA!6eXA^d$t@AUD7_z<+?Q-^d?x%(8W-*;zdN zQdnCuW1n=Y)xnHnUn%Ba63K=UwyBM{C6g8J-B?E17^ly`-xw1xByj0br`dS6Dv<2w zZR$q1D(=n@nUO@O8h_2nO+~n#ax|dvITgx`TKw&OVMAN{>hFP21DS0;m{RX)k<02Y zm_Y&R%;?OT$^tQh3gJqEW`Zw^_q=mz)1rdJoaGx&uxqAYGA)2_J#|H=* z!mdSr<Gk@U0kC`0d zPCo)mok8Ng8JyQ=huP$vMR0;FRY?kNb4aYzi)5Iii%A4hmK|SEVDFL$dr*zJI=Xu1 zS(O7wip78$^G%x6nx+|Li;&o6IZJBh`L!uE_iGp$j~rC^&|sX8x?X<)1lkscpmNwQ zF^)BPQ0>3{|r4AiK#u z->ug3d82h`=Ro+bf~7rfd7~$1UYA*Je(5rKR%Fo*d2UU?KU?|Cs@Hr^!efp+`h#=L z3!W@(Dwo;g=C_(sfv+W0Fs`Vt6%=s*WCg~Rwfydk8?*zni2e-FYqP!3f?CX*PN5h_ z9v$A37NM-DI0_gGIEY74Q=Z=ngyq5CTsI|k+VBr>`nbM>nQ6bg&|7RyZ(L#b?X8w7 z;*-g@5RU=r`0YM1a~A5oh*wFUo`M1Va$-U9nFzO>)%-ZMC#_9bwA$R%XY4Zqqk-iY zY-q@m>M}X`2OBs6P~Lc;^Yr{+jb&l))t)?}6Q%x+uMeMJGFc%S<@@#A5^xK=kIM$m zH>0*fUbp*+dTKAAS??()>wr1sX&Bck0I`!G!SQ>#nWT#$?bT0rg#)89e!nQ4egftv zPqBFSh(_dL*-3D)F-m`!-Te4~T;HtojFRdFG7MMQ4+-d)y$?2r^2$h*+aqIw^t`1J z6_K&muJ$cF zmbpLEr+zZ@LRwKeyxbfkQAC#6-3kn>+DR5rsO>>HzT;r7*?H$T22whI8!&)q_kO<(F z{G5G$s98U}hm55&!$%;0hea)~sXf7O;aYobR3J#i@U5d6^_lG`;Qle9CBOXkgQd7Y`>-_HwE(y|wA;dILOG&G~kIJ<23&vvA~S zm6++JuxO7+Jd{hL+crCjMCQ-fV0U^lV2d8NF`FrAbn2XxWVDSjS(J~d$!z=nUrkCY zJX~1ACuc+Duhz%grRZN8%2MXbV)2jZMj!l+%)m*H&MF(Wh|~4)CttxZ$vH!$J<6BGNS#&-dlZ5)kT=y!vZkshoh(1baH| zlFM1iaC_-&y*{NyN>@nqwi?%v2Ou*x)Y1gWWWDLc9SX~T_$ocCJZ+lKBXN6;8#m~! zzrT`=3x_rp=qOip8aVq)57b7zItTonJSW$jb8V0sCr+Ro10r=#Wzf8?JOKoS7f$Q2eaZ| zI3FR>ArfwxBh-XI5n$JR(Eq945$<+e73R7%V@f|QPIdt_1Fs+Lidn2cecRN;sk=-W z9B)thYr{Ybi$fvS-YcBQ)hFiwS_E-sDvSnjp`xcZb=Ucb1hJf05iXrG*V#k{sh70Y zPDLhdwm~qae>;mnDCTLseTu$H+Ft;B;Piv-G~+@>j5w>S>G=j2$g zXrz!1wwAOXYX+|f7XJ1}Yl=q`Kg2U(FLu`ACfPOLySe{ut`VZsiK6T85>%v^B7#uG z+xW((@S1iAKXr%P+~~oH;W>9&ni?k$R}f7=^6k1k1}LQ}miwX8F(@Ld!iul~a*-K~ zRsO~DsFo;OUHINPVFtO@y`l_?ZM^p8xS*z|#k~xjZ}hZ}fCh4-R_{kbFZiG8kQ7rw zWnQ-1*Clb!io2=4+`flDh|)5cCa8!U#oRExB5rBYz02%4chQi=YUFt;5Y$ReuSlD) z4Xk}Xe-uTS`op_qiPv&MbUK35$SjNztN$r=4p&dP1|vuZ-qz^Zjc9WNOGxk8@D?#knnBnuP0cH7dIoKx)sM&K-|6`${Zg#VWM)!PmP7HO&ll__ za`Z4W#gE%w_*N{qYJ=R(N`D7F-S!*03leSYh9z){-^@{=+-yVB6~6A9B;`gzLtj7& zg`pAYVO=_%d4B7dD<9qt-ae~6Du{(f86s zHC)`tCj0235z=*@_y$kCx*RSD+_ur1pi+iUz3D4FGyG&e*ZNQVj_Vh{R_F$={2y;G ze!0fi0EN?msMw?f!PSSh*VB6%nFI#*oG)QDE9ImSq zoW9U@>Luk_V?tR_1gjKQ6!)7xg1Hgk|0sM#PoM-bC|=|7gZZgZe74M;x+5v*iEe#N zc%en)eZ6kP6ueFTT`aoaN`+sXe0tAv4XYMA7HrJ7(PnyCHHjfz(%fqEX=6FpIB+Bb ztSN8Du+I0eFE;fkCG86w4u4>Zt#V*j0T?A1=W)k-KMNxV)d{0_D#&;|H-Ob&Bv9{$bH=N@ z94CV!oM-_>Pgx8$OlOa-4F_Z80d`Tb0^_v*~o51PL#K2Sc`gO z2Fwb_m=9Xi<>y>~5z0sI1Ea}d=F?D*MNRANBoEZ!(r(kapeJtb%Hs=#o>{~v(aIX} ztsoN^^sBZBU06bZ)zWP55^SAcR9!o8w$FHNqivm22U^;H?`dsf)#cq8E=8(vM26~AtmcQCOQ|fII#CpFttSZ8 z_&T)~zsNMYYb`x|)^X!ho_HL_j-4Q^ZIl^$10`%6vKq&- z3u*@CMMEp$(7Q-pPlYoZ_0`l-9^-J=D$wl8%D6-oC+^5}TJn)dy))hisy{#*xq8EKqp7%c({k5n_CSXt@~+kdkpE`@8nRNlIB0nIuu zrrA~S#Xx#kX!A=NDvr7ri0mls22UMy!~o(s6Anf3qvKZxy%>NaSErBKD2wq*f_1W({`bEA*HLY^86t(r;Gi5IfxtQ>v*|F)x?DXD+aq5xddo2^QiEOhu(HB zzY5d0K*}I2)Q?(`aS$H1FBZ1)A98`vg_2x>D+umetmKoM=*Oy!X_ZPQo0xsla1YAU z;c%9AEB|(c!DR|y8}72}?6Uvy4|Im^!t-su^RR{hAPRvWSG6y!Mn0}tg|w&#ucXKv z_UO_uk;Xci;F$7~5NJ{xmx!Nqi2SUk{p%8~3peK)OKb%p@p{i_OePWFk{HxkKupjf z`Ln)(Sl~`xVx^?2gFNVj&N`!ALi@k>f~r#B~l3Idel*L z|3`^b*7@mtY+!HR{8q5l1If|sO;G202U$A$`Cg0%EOGYyN*CNu&+C=IP)W$axDz8` zFq@E_9fYG8Saz|xHIVQ{v$&|D z-AK^ooV(b0EOqC1n04olUobA-tWI}_?YtT^^_pI?m1s{r`b{e{lc^PGFQVqL&!S)U3IEYF>_^*U zIhj;~e6>$1(=zPr?`(xdr?Z%s<#c+H>;JfJ;b)Pk-7dEsQ@m<8s2q*8O@Z!e+;-PG zxFmX7ddSmS%Nan_Ryx;TAPUq3?S+AjH!AR!`3+W5uqe8j)F+9M!r)OC_+N>$$v z)R<2v^gt&LVu2+P{i=~R1G*;5>n9=YLv;3Gxw#IY7eh=>U?*Vr$EN|z-*itNTS?8b zpq(~|I0+`bGK;V=TO>KvKui{KIbF@rugp&QDC~-MDt^1gx@Mg8<%nVHkXYYnw>^j29a5|NKYj+X12UDCNf#4vq&dTv1Va6)JAGb{;8)} z6gbXT{o9IWx(53)Gs!uA@galv`gl+s(c$o_IvmR;Xa?o&>g&>VF=Bcyy1j5(N3%c_<(4op}xo zZ)p#==_BBfg>T)9j=TH=O zJOpCbf1%!xnSFTjXn@+AZwyzF^EHXdZsp9!0-_tz-M-9;xA>aFqnXgENey?`z6>k- zo$dBv0r=hQ%yIrftQRxDLNY+PprcZEDGKvbGa2IjbJIaAN%xGviSpK%?OG%TT&i<& zJfQ&XE^PSqzJzNX>eKc8nN4b_t=WWJ9U7?3)r6T%8mR1yTrW6@piDRkJev~(5JbMS zjw-UE1^p`0I_3$i_avLy<_0btCubK|2Lg2^wWvSCW=R-+s`vnVrGP5wXeTQqr=MD2VA%l~fAjdc zX8R$n2}?*cHr}EDrDO?BD)3PFGS7B>_|QLO@Xh=A4VQTMpLqC3>S8In3M{61=?&5F{i=1eg z1-#5Phr4wk>q8;(ETaIoI#<8vVLn*rl+L?V&|uJ`&{IVEe5pi8W4WD$pQE^ZNi;ww zUTg8r{8;HIisKUKby@q$#e!D|5qI@p$mmVjNg|N5D*H&c6B#J*IT7GH`Ga=|rX%p! zTPb}(674-*o*Z6f^dCG1)xg8T##)Lc7E6spQiMf*Fe;J(K>{tZE*j(w57K*BU2hfgZ~Q^vcyr)? zs5?u~rAZMzx2n*ge{4Zn#dEs^kH;F*ZQrRFA8ax%!K5Vez<&rqr09-0vR8%w+`$v@ zM{2S#yMrhKli8D(2}tw$hv%cWlu(3s`Ckt@g0fu9Ig~v0u-D=7(mei1%2=MtlNz0G zsYR9rktXT?vNBzS>$pDLr86{u+pdtOC8OGsN}jaq?I;mU5`0cos{cZ~2N07&vyVyP z2nv^Y?cN2x0R$A6IOp3ae1bSlZJ=?FEU&dQGM6}|A;f4oF_-udP5lM_={$t_V^rfA z+o^9N(&Av9$45AiHYsNA64d_tUxKA5ytNC(w0wO!9qgDfkWKWpS$qRUEYodAzT-hq zvGB0S=SC`86MrQeZn7&49cCOxJO)(7%!HF|j3?{7e{@(D8)q{}IQu+Qs^Ch6w&b=; zMuaxbc=efSUpZ+{^bk58eQb%MKGB|$Ov3bCPI_ogtA9R?WZexN1P`57Wcw0$B~WY zoT%>3IkAgbQTjCGPfC%NMpgZRl#Czx5OGzf6A_L?Od9MYw-rAI|luc&w z(!M&UUt+XYVMOTapg>qV>iJ{-h*gK3Vl~phPd~bm%~U3*MOwNdRg0p@?no)O`0Fjy zc_j@7q&a(QVLN)T`{6<`*z7tMw`dWS!D=Pr_^522EtLUMRWu|w8k$tab8LTREcZ7~ zIUp8x6G?Npkj_TCrjD813D6{ok(ddTYgtmGn=;zFQ$%qVX6`C-k0yBubs5#USH}UY@DFtQ|VfwB<%lFSaFj5 z_ycd7Gq7=L314klve&_^^M024z0?$r7X7ng8?>E=0AghuU*O+WP}t@3+M zf?WgOv!tfF=w-8o5HMGmk9c&t7B(telsZ>f&yx?tVgAh3~?>Jy|P<-?^KU(m=v@x9IK0@)i=t8~d2&8+&kV8Zg?6_g^RWQx8 zf^N|>#D_KrVW540$C>%K?TuI;!hB%Xx!@#1ZsWc@XgC%9u#1h@WCb9xJ#Hj^9CzoA z(&;l%Ra9MlF}G%@ofx|;#9pG{W&JoYO3;E6Ap?8>F&H6ZvrKN5KsdGZiJ)LFA#|ED zw4&$?*bn`mKPt5`XcZtC74TDu4Nipns)F%Re(0mjDntZGYqlrN)K?m|DSWWrk)p0B@0cAK+89G)I zvL54ePFBTDwz**CxtRX4$*rTum^C@2f&8nYsE*q3Y+fl>e=pt)l2%6k25(?rCV?CR z<}9E{Ca;FLOtk<8y?_E;NDM6uo>xQ@oCM|{x|0ZOeR|CkN-lkn2qaN2Bnt!qMTM{R z0TE$9pz+E~m1DI#U+K9~PbN!J-6WnO{|6OCA6TT;hkS{v%oi*hawLuZ;8T1olipaY z^aVNO0%rGwDdF;X5$4IhDp_|G)%*oDEK_={jy_Y`-|@6XgMaFl&=DT_OtkM9hqDVS zVoqX#ga|9o>D#H)&WXMzY|WW!5Q9SG#?)E-9#w0PC(NLaLq|pQi-`z z5O++7K++b7#Sr#VezB+c`w|C`^W-MCgmUs!DSIC_YIcjyg$C zIpfSaNq3QU9SPRSSa^Z$XZ(~oLyS_=oVL%LCzuXJX`J`FAqXoGf{zXHlvH7+f27!? zgt(C#MO7ONEyWlVz@4g-6cQq-aRwqhQ&$Z=!glnrQl4v{xmGAU{}~c5sheh(sr)KK z2uGEiJs%d8%9%6~@Izrk8UAAB%@34|y|%!gy*3b(t8>5~_XGlGW%hm%2I_*ny81vp z-gHkrKIE#tdq+J!#iwgT9f_`(%7-z;PUq(A1TnJ~Hni7nFWFVdeh(Rl$O0a5Sg3EF zxO@uu7nMSQtG@B%{z0)A5-WtdBghn~{phKB#_%x(^bzTzC*;1(PfzLoEgb27d9bN{ zNQ{sHC|P($nrs1(zjtudi6+%K-{O_p6eL+m6?J4OXu+K}>U@m}sWyu7Lz-J>I<_8` z_lj(><_Ph6YpM!2a;zSVJ)JVG&AY1>8LzfDwYQo*zgpL&aWGF!uF5O@hoEp3^V6>{ z;@a;rkTAEh@vEMWa>m7J!E)vUY8lez$H;~zg|x>yb{_AVC6U#ZxA={V2pUXNV^HvC zVMNDL-Ah%Pmi1P`Ef`$O22a;#fOU0e2|fl&5heukIqQG&e=f$Y(O z;CojvbEPDjy-tqF-Z1Ci@5KP`KR=ytZw&skjLs7JMU3U?a-@?O11U$B%MkH4(Ganj z^sUc_nY06VvFynz97f_hDlL!ADn02-2u7k;?03{?exHbFl)!fmW|RP-qK%4|Z#YE! z?Q5=63uPEx2k-rJFr1`Oi*J+=I~cLA9*=5YDK7MeLzQ4x2{|0mi1~h2K1(iJyU| zXXg276B|xj4kPJzX>Ol* zlWN6X0hdcge6#WsJ&C-ADGYspIXbHLsCIERZurG@CT>7(p4MAXKoP#J_M7KLUL zhIMw=u+DoJ%&*^K7((c7?T@r77KNEAuDv|KV^Rf;3YTK22kK{fLn>6qZMDs*yy|=| zUjnWE_A}@ZPZ8TSUH)K5(Lq_Np^a#&{vXF#H_t`^o3cN_hQBM-iwPhXZ#l-~7R#QL z21ayvF9gsQkkx^GdfC6fu$>+wUu%IPupWQs{$t#JR5SUuO}$fRDO9NeHXkoF5>oDB z^voQJW!^AL=U7fRFf^Px#WIgP%yML{b+21>nTr zM%>D72yH_F2DIsI?puwt9%z%OTHI2f9oT{8}lcV9T8`$sMA>-xfwS{ z+QhU{%Xat=qhf$We}j9Q+GTc>{`%3BR8nT=;7~ z|G3QE@`@N7&8<1xEtmZ?7>Kt!;xC_bh@cfYvp1wga9BJQzrgFIqfAEI%WTFz#Gb~U z%%Gopx#`}`nJjN_M-tfx+Gdeyd21;wqnB^gg2T5Z-G)&i*g+2IuPXYYu3CoHg!;-M z_^T1I)bXw=njQ>QW<4^AjTd}Y*w!OShI7g)mbF=%Spmje2$b_aQD9%F;KTc}LG9l) zjlI6^>0oEd52s^K;#xL45uHu)F!W_L<&$J8yM z+jG01#ya0DCV$dV#;qRn_FIM@NF5m;@9Vst6*6(scsn(^0t$RvSE|UT_*HOKpotZD zG5?JM4&O=D9v>svmQAtdTp$1SJmCUgVPh?CqW8@zNC?9AP2CIK;7dPV&FxnjzWJHs zNheJ(i9h~5(~Bctq?=Qxj~$2rxmrs7E1<-3Z%#oRy4`L|3>qBwrzWSl;#6hTDWk;~ z4;~->)7%BG=-qYaJnirr(ksR*_s#7_a$5#(SYD^hgWjIZk^q!C5NO?_}L}Fq4W~ z)v3aptabbD@@WpP*fS$M`hPo61UQWQ&xZSRp`DEQmBY2s%@6`U_@iXt8nMl9%3w4r zdr|Epq3d$W1HmA18)f`e!O@%%^9U>r?|MT{u)Pk4ltn~e{gTSKdkMqrM^=wC0%oVJ zI%FUW*W2@^merB8JP8Cr41sNxFn$+c^sNhT4fl7bA!jN5hCWy(j*GPAnp+avsd#3jHir!?S7j)g_ZTuqr>Y>$kOEld#-aa}l$4 zQC1Wm4ccCACcTl_O$7V%w=WwAD(>1swNwytL+})w#%xBs@jqmNac79Xl=!Y6d(~z zH!vaUE|#p+Xp zFOxqRI%TJqw9e%3EFFGix>lg$IB@J+`{Ar%KdgY#`nuTSVg|E%ld}3tJPM8gt6Uvv znv)BPt9&Zir?8QvS1GK)H%*498V^-kqnIyutU|10_35mVirf zIGVppepeOkIYU~1{%(Bx()p*6rD!(tXSb=`l?EpcFZaq{Cwc;TH&6+2KPi4;X}3&8 z`6R{IUhJ`T09X#DLHdJIdL_lPk4J?uUmecIiV%L_e|2hd(b0x z|6}f^Eqtaau&jA~UTVp9X`7f~V;a~o(W?CP%1|y2NxUXPYz*wEetq7K{xGqk`FFQM z?47*1XcF85^3)DB1@;+54seoW?KQ28dYUauhIM4}O%ct?prBEGn1=W5$*ud*7uscge=;~1a6 zMhD6o=o}jhqk@f~u@EYln5f3iP0odWD;`sQ*tHlN);9T@UT{b>Y{>H?^2WDioT@{W zcR_KrMiVXe<|Kow8D*4v~wTUnFj|WQBJlc7p|BQ}J)u4&h zS1&9Bhavyl3{FN779-zY`Na76%i!CrZGVTXoMz zl^zCP)kmzpTGQi!Tt@t(0h)K3?@_n~=hW!;kr-}m5?CAzzUtgk@gosz*!00uYfF+y z3~#K9b;co?S0uV?tHLvvWJs_W90ucQh)3Wepz%y19Hw!;>&{749xJV^IVqm^6SYj~ z=~gg;S}piqI|x7Zm(RJ7G-$D2P z2RqIE>ofq*gj4LNr=JUjHCx$Rm|pZO-FClYK!OpRAQ2qM9&7;Jtk9h=I2%UF6BGTh zS?o?^oagh*A21JLL3y9)+%T}$?~W(cAC~oYb#~5PWBnpo5DrA%L`MIB+yDY!CqDSe zNTKoC_B!I+y$61yUsAJ8I&f4mDxwOJFrasqX%QcqSke%PNk6d7SZ+RN#XEhikg?6E zwPgnSo4y9sgU@${Ft-G}?5DD|e#B*g!f`qE$|Dy|>1MT9F&zv_!kHu=ezymzMXk;Y zN3DV)89n0bF_yeD|85PiUk}cOfku(axTx8 z;8Bz(Y_OF#W?Mh~4l{ay+E%~FKGI!m8pI#o_j9Du(^weLT@?K$Cak!(V*!@W_beVB zR&zm69IfN**V?0&b)>41(ckDKL!E}z$LXgfQYLIdX54Yq5X^z&uQI+yBG^MK^bhH8 zjDjY6BSXONrG!yZz*0AkMd+eIr1$;&eNXlp4QtlKsvU@RYa-p>Jjdnbp;V`v;vl2{ zaq3!zU>l`6OlOa4fc9oeZk1$;_J$YlTE-x1YH`5w2D46c<11j%P>4;hTJ!q?9uEz+ z;4Q*@^2Uld70uLCQo&y1H!c=ekK*Itj{X~~Gs%v6@h$3mG0zwmW3{aC;T~$sHpL!i z)5m_<$^U3>g;`!vi-+G%9`_P#pt6w;<}&gi_jXo8MupQN<}#~c*zm+an`jO9|3`K^ zLu8r>O7l>rEOa)w453K=$5(b;+GFG-jrN4ZDI!S?dK5%*Ntc|(DP4sZ6(UGjdK{{Z zj?D5wJ%)FP4BW_i@JEn4A56oH4%(C!3k zB$+(JaBM$9UhXP^7ZPk7?f@3B{t7VSinm`);BK`X$N?u-qcddggTHVlq=q*NR87Nc zgLB_faO~bedO$icNyeEZg`5>8FWk%I#|c^fg9H$Ya(SF$P$)IKa$X)ZY<$*RorA@J zFpnso*w1SfxBsod0m)ObudB$U-f`FDiRUk*{p&R2#%h%+tLkv*2O>~l22Y7)#65e& zxNWzdXAis%6Lk2;VTOQcD{?Q91(lI2^7Tb2vb0O#BMZ@SRic?M0XTmGZ9?>?S|K@5WXGhX(UwJRAVkCWf&#;_=4X7WE4 zv;MU-_g4R*e*K{SqIfmgRI4d#7Kji@PZLR`j&IabgI}!{;=_|c+#KUN)Xt=@&Q(YZ z$qkkRYc3TE;1D(-%mEWmz;ys&7gq;fJ>!#yg&CbI(RlHfbCy5<)p8N86#kngfds|$ z#}9RWq)NPq2iY?`e=_B~%%3m86N8Bm@xDTTFJu3)nh~9Z{nM7@f+7m~U+Nty*`ze; zVnHijl=z`Zt#T8u;2HpZWb}ckreK_nJ=G`U$3f*F$gmrw2&{7jQ6HUvL18w$d41~) z3m#p;uqRD9?l2I9yOqkf+pIhoUyle1ah%N@gUz_`;Eph(wze}Dmn<2tcx1HXe zZJ@3hHZ9|H4~UXD=CsKNR6}K6k$Cb7F_&u%a1lj=Fh_Q$CIS5Vm8!NqnhZf!wo>v64?3C`jiMqe zM z_5N>Y@<*s=XRKUR;Q%$^7IUZWCyARG6Jzf6uH*c2q^`~oj>ja`La#tdXZ7ldqI93u z%>LcN(I<2b#>20*mr4A)&dR3`BdAS6SYm_UyjVqkJpXA^y8U0wy>&ny&9Xj-OK^90 zf?IHR2yVeOK!UpmcemiK!QI^a^Og^g>l)&&X{e*9gfY+{pF%22ls7g<_beKlPUB9Jk!D%+8mY?Ce=@FVg6h3C>U z;E-;#Z9o9_xTz=shWhPE$1ym!e=5iVgS0;5e|28+Q3YvR`j56C(X5pZ8fGUZR!(H9 z*v@lvbgYp`s}^k(cVCtaF@Y@u6}<4U;4ML05RkM#J((JAc8>+?gL16)s$ z9>rH8#z)ojS*HWN(ohD1J)M~42ZwK=hoZGlOvv>&KFUN+SfC6uNXsNh*f&Q@QuQ%KV_~Z%6PCw8<=yL1Nf@kFq zl})IpL(zJk*CF}EA$Ebl`o<#agR_KR-^b-fJxVFQk70s2n3#k{Hb6DI?xILS#2Uo} zT^TH?h1uAfKmnXoC zj#OS6WQxc(y<6es0Q-wjVF|HEM^>V6<@4a6mx{JPwXIYF32qLNt09e~*}rh@?|aV4 zZevr>U?J4Wn2BMVtW`7<9~|Bfn36YA!!&#^P&=Zs_++U*R)CqRY4M4#P7j)?@ou5TK5abO$hQB@ZA;KtIB* zE0u~1`jk~g!F6hxyfMd`ZF>F#nj9JDqXbz#B2EF^Odd(kH5k7IzUQ_}J}KOYS_Lm* zJRKp#9;wMWwr^MV;#D%}gs=OgkI?|XqK!|G%sYQlFf@NC32;IyjY++h4eU;G2>nKA zmqB90Y&>QUYJACnDFc{`cMujPs`Te8V4BSMd`Sch$2JB*a6H=002lrh;KF-M04}@@ z;KH?O4TDAiE?oPS3%B{rg)3;R7BQgVW-$zbQ1~1o+89%H9w-SqK=ZGQjK>q7YsbSf zZD>z`5%#gNY5p*KWxkUD=9?%4gQ6k)M^Z4 z^h|OLU7CnpgMIGd+uMltwYkLGs1gBLTZpXGxP%O1mYo`nZ1#A)T@hH;S$p}u8U{n; z!h&nYTLgjg^#I5y8!AR~L&5Kv`(dp*6$+M}GjVKtFaW`J2kbM5AUM8^3Kw!tUE1Bj zZdZ7pTpF@2on`_@hHOTW3;0lp!2@*w3hN(^a3qNcha5pfG;D#(RBGN8!YU8;?Jc&2 zD7ne^Tdd77sZOtEwT2A}hl7rs@$sb(ayGFEt~P!mc{FU?l+4;)(ibemE^Cg9a;qGLN z{RiipjqrbRzSlwk=Zg&UPtI3G7~p&d{Q=IGn*`u|{e=O}cY@0RW|#aPpM^;V;Cx|? zWB|?=WC|AGe7}nToG-`^2!Qh~l7lIgd*ys5xB~59jOc1aQ7!hN%C_ z`Bw5khd4tqD<7bIM+eFHSI(C@_}}Jyjp+YJ&X@5zNR(V??NIqQ=R5y6bN85s^#pLf zyMzA!-#FhV*u!D(cfUlen)1H>5^?f>eEBlijx484wm7NV*3Mb3a5s!7ID#a&W2_YE zy=nX=ZA5Z>1SD_RAZMT2B|)SRT14?}NHdf~Ilh~>U+a1|GhGOEV()y1iw!Lz0uJAG zDbgNj**5Yw6KY|wNYSCwqBf)jg1*xtD8pCYskQf%`WoCx0!a5iEjqnjB$&-51L&p$ zh9fv9i8_GpY0g!E9|uj7Vk4KoOcW8m!vF3l)Onqk?MB!;4a)!EH^E2q-G{^jRSuTS z?Lew#-aw0wcmcMi=}F(K`x&Y4Su{pK1Z_ByvFW;KI`-AZTSP!6SI~XLs=sbD@zVs^ z;6?`Fqv4UGE~26b2Z3COYu5AK$S}H`-zLs9`oVrUiu2}9YMTuEGR{mXsMBl8EmGtQ zqAPzMh&NO?5-2EvoeLYa!nYisO~FGoE*Mzp^4|s-H5+x6p>Jq5sDJD{Hwd`{U5Ut5 z1ebs|HIN(|ojv0S>xV#5AZu~{qRcq*1nRy#v`w!ug$-b zzF6;AtTAjf^Wd2*tfTDN+Z?A;=Sp-%X&&^cK~I8C=RuZ1MS|u?mqb0ixl3R!Z$)7k<JWha{L_ z=WVte86=l4FAZoCf3M@4o~!KK2Z;1?-)IkCO`t{qiP60RipO9-g=(PL0^d$ZzJ3OB z)MGaEbC!`;JQ^E9SedL<{tMySj_-|Stm&m`Zk1qAjf3-e5DP&zG zyy4I<`IG)wAHII)v@TiLAO3qRAE%J!A?E$Y{JLn#69_W~giNZT2^zgcsAGiYT;7lf z`@{k&+Lh{gLzJ! zkv%!ZC|pm?)eBKY`y@Cj^o$sg+#|TxZPULI5z|hO`mPU!iiLB=D#Ca8LMiiJDHju_ z-qh%H$+fDo)zI||teL|BC3>i6kbqV})`Vic9I}rUyxd28S1b573f?}Ui#;1FpQ=5W zIXjp!{52zdBderb0!W=mPFjc$R!KsWOuN*d!29EJlb4AT@r$Rv*&ItN!Z(qmMY3IU zPJM$S9w2ak4Tl?x!h)^<0~~wRZwxqX^BiFYf^%0RCeJr*+EV=Wd-}eL6=8?M4rD{& zf9iZaOsoR2Z^1MFPS_hG(kZUfmOs<{#JAcD<4e&#JV{-I5eb^`Bq?a@M1wnLk;X3M zZ78dTrDaIpY7jNpOVd6Cy@(&4#bVHxaAh20=^4-uhI`3oFMK?F! zGij_FT&3p{dn(Q+f{aUOXmYcyU)%?R4N2H8blZ6NXT)aRLq+4G`=3?%`uUuJPH&zl zmlsaox-*IX_{e=^toz|R-`DS^A%iVzcyr9jsy49=@$`-cEpxD2*-eM7I1$VjfJ;p* zu}NC&Xyp;%FqxKAC8y>#OuwJl7+$!ac!g3NAMBuy7?Bx@#0Z%MibOY!874KD8OHgs z2ixBQ<=(6o6ZDV|;kD1e$Q<|riSE$aC~@~Vw*U1TG^qYVhS5&Wr`}FZ5_)DPM9p{L zkxWc-_6AV>u5yL_g}~x~*E@_E=Ch%4N!_@`r_Ic&;=TekwDcv+{(?D%2DBtQ#gf&Od(2rLPwwIkt_R&9uN>@!VkDN+&39F@_K&R!Cp=T-t`w z(P{leZLLc)z5QlNOY~!oEX@+R1Z*$coz5Gt6sZQQRSk@-B>cEh23@shFf#mj@b$1D zblksm2+>lt5HYJp(Na|(vZ`^?YgHP@iB^O6S?ai7Gr{=XT%%axs)pwy$S5Hh4@)%} z8Baa3)G~9m(Pwb4iuc`vkpuEbU4xMuSgkWCJrK}BPT{IZWTGs>5lyoZp#`fHWc>B z%}y&MDSaqL8YDOmj*7KgG)xMl;1nzhTO7=EsDg}8m?1u>IMgvds25xC@e88x@r~0& zP}0U>of5fqFp}fS*spzfGOP+)h!@hgR!}HjP||toNlb3?&gSB0i&Wxgu;w9??i0;8 z7y*;+DR8WA@fv8Unq{6JmEnGczo+M@OF5XSXX2=HGXIC7jSw!~YV5jtl$No<;uiE| z*)H}}6v?w$kD;VM;I)xt2O_YLs^;a<2DF@*L__N0CTbO=QzIbA!UikDAQ`b^n-2-b zK_kFpBw+ac7)2hL^N2(q>s}vYp5C9w80|G6Z`>K}_4_e`FG2ZS8&UHIZvA~&py*NX z80oHhYeL<=YQ>7K=UfNh2R%Qk;DP^XgC1D65N^E&%>qjo#I3)VFW8|`WLQwgkP-~x z+Tcv+>jgXJ5W-C8MASs^eFF*}X22DIQ^qMXx}I{`pY~chHhQL20+r|%X)E0A-TCj3 znEBX`V=hQ+_smedt>H{7)aU5CI^UFxKRhLn_296ik@VnLq4{BfUK@6XVUI;`!sCn~ zGmhB=zVEdOtVABlqzGe%0?W?R}>%loit}s6Ph`edaDdH9YYjo`J^<#Lt zr(t+{bRxD9bXjVZ47O2W6O+*~Z=v$`^foIhAzZ&rAUhB%zhuf$cRs!_15Dr$IZHSr z<xRs$Y}p5WZihZk?Y z_FB)VQ#?dGHi}^;(tD|_X-2*dESiHZkkyz|B#`x(*r}0jq^2i;fI-K>p(UAs0Yytc zXv8bs!|jODsZpgD@vEwoQ)9T6@#5xGA=1P#^Q#b8(hT5YY6*I9>Nz&iV_0Ta^B0GN=Q@UIgR*>@8jn2@g{1}5a|37C+Z@W6!p-3BJ)2K>lk=?!Z1 z#Xk0z$cz2@kjalAZp>z^;Q|Bq_Td6SSf)RlC=Gu$rN1z};A=tf26GgC`T%D{*E&W-A$!G}(1CkZKLOc!4qUf{qY ztr`4mO8I}zZUC+?`d22yLj+5Q;@-Pq5uJ)Fyxr68pW+VzZ3;UM2Qpg{eI>C!i(FO! z?+9iGm=*o+K}+CaZjUp+;BSvRBJ*e`?k;Y2BYtJzZeIP4_%--{_iy|b0``~k0Ldjl z8k%_L?v|+inLJ*k;Qg849UJ+P*c1J)|N9@|+$H@bHsEX8G~45r&S@9>ISzaU^xyC8 z2dYYby9|CGG=oJDZjW}{N30Bgaz$!mS7HIr$_}CP-aa+95CsO1XO;&b;O+73S(ew6 zYcp_%_jP~TZqA?X?Zt;bID$^Ky>(fpjhGUzvxW_ZJZ!*MFH76+UMklD|MDd>jl=vc zE9)(x(HZmY8VB5oc0D#pjm(dB~tmLK(QtO1^PN@K!G0f0mD6R`;Qgqs}KN5 z{8pg1x_=btg8QoiU2y+Pf&RY5AK?)GB{tw2F>g(d+fE``Z*}9#2WkUw+|M|jF#eis zHbp{kwnbgQEVo{KAKo?)0|$QVONJ$04vG!beZ6D@Bf)k@ibr}KF<-6b?~^##>zyA9;}HFpv7>PfxmgdOYjRWm`<+JR;P& z-}ChJykmU@mnOD@N^r1AgI$!Le%B+a5=rP9r1n4Ko)v>|f(yewImTiaMt_5HHTKNH zRw|HE0HlQo$e5}eIY!X!5r8t9N@P}>&hLjS#XwQonj zlMzvRk@u|K5wclnHYfD(oJWG(bHKNSoXG?ALt2Qy7Tk@Vfmg1H-+n_*uv2Uw>HJnC zc!XLHyaTl~{VB-#AlrmnJ(W4_X7V?nBrv$dHC|JOlxqE=V|kc_Rkp| z<@uduErT698Z6K1d^2Z#klEE;r6e_L22z}E*{4sksP+yre8_Ly77&NFGVbEqa6O4D z*(XUK=QJw98&;&k8?=>}TB*Qu&%%^IqlBGl^k+*9^uMZi0giId-zjdx+b;(Cgc^l~ zqM1H3=$%l>&FX3*#VwE$ zpQEp6i_S}l76#LudiFaX)9uu$jx|0n=R*&iRBR|x{b05#Rmy+wO3@&L)EXkx$Ee|-r7wZgzT(bp^wbA z84C)Qa+)4q$zhlt%5cgMnI0akgP9&KSH#&nIHG}rsr8!Qs8Mj0t^LNyF~51uG1kA6 zxCl=j*AaiTW-gisvWZb+=Db|6e4SlhVCg9g%1TQAL0co!MsW#i+y`gCuX&4mN!TD-M0s4H*tGb6m3GUct zu_8|1dKCcN(1p!vTEK-3SlT?=kJq3nd_egM1W6{WS(9qF_uQhFD)6Jp8mwN%>x8&U zF4L<<8E4t1(k0nqQq}QJ1xUImW}s19IJkX;kd}&e!LY#V>*l=S735+WOIvMHfSvfO zujg_;mXx0HChQ;XYOTV>$lYg1Wf&^|_mVqJUX9v9haC;YgCs==KNszO7pDjqgflrp zUmW60jw5G%p?Yg{NWV!l7HioG=VLEp?(o?3HekytA-Ybxr`lt3$y1@JR(?*(nv%11 zK!fnexH6X@WtuxXYWV9iH;#pZOU99Z=xo$Zi`?KINAz8awz(>&Q@$jjg<*bWcc;A} z)r=~|Uca1pC1(5+&3rl|Pj)F-MlL5wIT)Y1t*}l|Wm@0PN0_ECv{>EuMO@(_I#K3u z>WSyAI||@mY!TVdGX?(gb!UBn!~ayNN42iyG)l7T)YeA;G4nPGp@kN% zO}rv(V}V@3x|d5+Wf#C&y=Bl;4QL|T#)l!V2;9v@7yq6I4nI=))IzeNA8ZTWpmlNr zCiDTM1mdA)E3iWRrhR5f2{kjn&XCsA5BB$h(_WB(-~5}zwoRf>D=NF{EUm^zh0L%p;r6E&Vf5&9#nY;$IEl=)e)hS#zj+n&l_;%#B&+j2~5x z-9=H@;IMk{ls1{D_+Dj=rqdQ+eY02cK0Lo28nb5MLp$L}Y(SxcD;Xu9N3v99iX_-x zV2)hnVE%*vz-C>b?J@R1r0p>Pn??X^8ok11)!(pb&GNesfX&F&f52wdD{MAO1F)$M zz@|C?n_a2^Y}WdAsRFRsIQ%zk3JHcA{X4K}d;Cw>blhtg`#I4frdVG1ukh_%;qi>4Zf-J_0Ya>R9y?pItGCG`Gc5)F zqe_jnO6^mcJE-v+u?5_Du#)`7^30TP_;8CF?TdPgLCc*(!;&*Xk;I_6wd8q^JA_#U zySGa?e@+WKRVp-l=h{j_K<=;$!v$`oTI}sfSf_FI)|~TZ9bw&58Zy@ol<+LRDbqqb zofUR2PNrp`)zJU1@!NwUcs9kDzazMNrPc8cqGIUMgS0+)(3jc_%f&Zdi18VqjCjlO zYE^wOO)i^sN_6K4C9zDZgr-{1KhIWJ&*RM1ep*busK#Lg4hy`OMCd zw@uW0T^3=tO`bwt|G+&M>JJ9tZ<|nse_d5exu|yj+mzSkcs1qmTVz;+xA~cajQ~@A zD|l{n!v%h80Wjt90c81Y%73xwbXoj&R$PoNf3LXgfd6ID$@%AwLN7k$|UxmYCmmmJMZTV!o407AV+8JLPx_?AG zltuTJFg;$U@1M>%;lDK`+O~=PPPcd4#$Z6qXAs~z@w^d&F#RJ?yMC|N!z)XCJuOf3 z^^aJ6OZd}nLF*YQ7jw|a)4R}L-|yy5c%hg-Tuqqn?>TL(l|N>8AQ96aQo=4|!XY|! zJz+xCuDBft%MD)oc7ZKS?v;w?ntiN8$1g4BRuXz>n%-wpAiLOda4{1m-Qo3sT{i{_ zaVSUPtR%5E2O~abN0aTV*WnS~zfaV9cOQ@aONh?zO)5EeCSV^Kc8GV*yR%Y%nN*c9 zDs`nDS(XyDZ&Z*Yn}2_9g2tx{(R|!l&K+qDscy0PRm#v*9$_uWVSg4{8a8YicgIXY zMh-n$O>7UZUom2h#3Ug35vL7X!~=mDYn)x3;;!qjxO$kgK3yx$KV#8wW+?B!T*-f7KQ}v{kF}6s$#}Bv<*# zbWWg1yV14B4+#;<5ag%BaPuhyvE9D@5N}A3#NhB+O!JEg$13GvUl4e37q>g*qqK?G zpAdWYYZgl}(X6CAXboA^H`sCEPn*wyImAp9TK^2O$H6}cHf63<;(EIpw=bT#1BBS8 zxMx~VdrbVUGK!9j`~8qNP;TF+TJ^QO=>6CUr{3&-+CR#RdcVm%DPcVnrA*7hXEC@j z>YA@7>Gv+u#i1J`gn06SiNi5_r$C4?TdU#ob_)|DaFa$FayMWhU+^t>7y~QsNZ&QXo!l*>8qenq+|Z`cc6q84dnnoi{hVXEQ=~)#QA9 z^io9DGAySxlMG^4&E%U(0ec-Q6d&n7mfaJ502Ha>N~ZzdiELx7n+I8$SgiiZR2My% zu*!Fi8~rQt57%nZiKI$BsxL9#Qg5`srnud3t}q;$x@I%;wCI&#I<0VMQDkTKMtqN| zWQMfw$-Xwmujsx+xpQSG&DXhvl%4pYNav-uoSW<;A)?8wN$I5}{p+&p#1E2+aQs41 zr1t6o&Lif)KUw;&q2t*B3`vEMFkV1;xT+<@&W(ZSOR-AtQE29jM)iCZD|$MQIvWoSBhG3&F^}ndsk;)Q^d2rLxEgz?~xt5 z2`aisH8EDtOzyl-9yUTlTeo0l&aeOE{pkz?bDpR3s%A7Pht7zh$5$Xsfhn-c4jG0f_1`Wn7yY&_pD23bE>hNe08E|hL6`j6^2b;gcwUmyH=ZV4tspwCaeuP z<`ziy;Afn=i4 z(fMwM>N5J0#iOIo8}>~E-J6iNzIr)U)Jz%F%0$2dYfr{eW*kD&w&Gj#nlXUjm2>R)F3s%3MR%X(X+F2F<^#A zT+r5?hBggNAx>B9qO~jE!7F9UFXZ@D2ZoazGmxue=a|V-IfX4-&Se4xzd=lD(NZeJ zzAo}#cnx>iFy#1y8}W?IYvT^PVcI5GClOra%hLkbx$-JCQ#%-Y-$!Ck=D}9Pp^HjT z>&&_1xJOk26-XN<I=Upe6!kfEo%~VSydS>=KIClpC(RO=bl~eilqH>dq$>g#Mpl zzL)w;I4JTdok4MHcD@Yt)>jKn3;P{6FVFf)`5M(c{wYCEeVpY8tQ1vLrdEvY2UFjuI-I#-=#h5~!n>d?4rH^|}^s zH#N1 zY8W4SH|u#;Y@R&?3c>_RG6-5ii2O;`Dxm#GEz_1?g{KAtT{<)vnGX1ZH~yq_q#;6- zHbS@>pAXEeq+;>4+9GRw zrnKd10$M*Fo}_`oLolfK6f2&Kr|Pn(hYQLp*}N$QW&=b$gWtvma7Q!{Ab#KDN24^E zJnN8-ks_z7pxojP;EUwKJ|H~+J6=`7-XKL`IV~l8Ei{8fRum-#)k%2#L$$r^qS}Hi?DFBg=EKRyilh4&s8W z{Z2FDe~LlQOrp63VV-)kUz3|KMV(Fn#QkR!Of8XFpPU

8kjcV}bQzQrBq@XVw>vo@^KdrM7xs2NIvMCPJCLt0HC5M0i^`m}Y0LOQ3j_gpgJ| zzM-#1LiQR#<2s3MYF?;CagJXmrMQhI6(@mZ)TQ&R=+GX|kb z%po+7x5ax?wKTlsp>CQOy@Z7t=_zhrYp_v0i59$)4>Sph-Y))>wjYk>K${7tG0W*T zT>*aVWeXt61isk);Z}rxVRFvscgVFj92W=)BShw30mO<3ep4qd$OOm$sw$$t8T~$= zo5|{Z@w>?uN5I(^FQHA!O`#*jJXukPZ|3^B*Km8xZ=O9;%qLBZR+VgnL~eall7Z&wiu`VqYkgM^%ToG5v6 z3YbR@JG~no2)tZE>C2`uSrn` z`BncVDavR1cT$wAaB)NLjJx5|Q%D2_C`JYJo26$(BJI*Zi~-u*qP_qhSAb9Ewk*%@ za_G#$>as{XK|Ui&&%Au;>c@doXRWfaoE~8tJ4aNqO3nQ6zvM){P3+v|u|R`)_a7IX zlNJ`BcL1{$>*?l8X~yqF;FAT}lJIP}F?L1zEE6NG)&gWaVUen}462tpbun}h*74-o zlbbOd@^1gx!zw0+7U}%bq(n~yzeN7N-|&v@?prxM6c-_Mn%2W`4(07P4pev5hQnxe zOqHI(ipgoCI7->UE}ed#eQC8Y_9{&aa<#DK-cMB*xp4|%8^+N){=BAay2P1RlF!)$ z2Gpi42d1d^iIp~?)^9+!QoA_`fX%Gtkb!Kfhftk4{jYjaBPp|1WK~N6!LtmP7$rJD ztvZR5%hyz@dgnmvHxC6iV#lcKBu*jDUc(HwP9b*>-qvr79Lj-YuJPd6trx6POuXg? zyIIn8^wY_aW}0hEV7t2XgWk{CA;?UNFLI;l<(Gpxvq^8xrW`IRK6_GWA*ng$>$u)o zVLs*(Y%hG~}1SPO1xtrxpe5(>al!I3)_Rg|0DZnk5%ex<|+V3MB~2e#>J z14<;Gcz?3Bo5*jr0k(rnJ0eZTn`YOG(X!Zuh~n;rXEP`uOn76iqtRj@4e8s?B|czm zOO&mg*UKWZA<%_Qc&!PPybBOj7)Sb(3LY;oT*!#}U6;s7mV{8zx0DrERz{z!xwJvn zO@w+*{r$Bc=&k~?{^DInLK1bdDfm?~H3mp}i@Z>p0s^$m)pAKbvYf`9<@cYJ-P^xx zK-x8|pQ*jqLVY#Jl<$V8Jjfw_Mq>nQ1RsBqadHgDM)MG9+l*4HHJn5Vz5n*vDADGv zG8usumW9qewOlz(k(5$3jQ~913X2EsW$M$Uyy#IJ2z8MPNj?nH2b&^c5e#fno;#!6 zslgDpaIeTxcIFBztp~qSD`VB{kAx2NF7+iT4EwI9(7e7!-(Ss;Vk8ZM{kqq^pCG^n zB#iVSjJfmH{Gm8?{v=(2`NGeOW~!hcR26u`lKLXeJ5(NdeWOUZZub&U_?-Q96QXi! zmWtEZ_C0j-8wsKCh9j!?tZz&;(H3b?PGeylBt^Low`~U435c7q1yxs1;UbG8gwN*w zSKg;!9fT;3D~LEcwB!!0u14VX`6}8ShcG26&8CahOU8 zlu#iEedVEQ^Ly^_bC_b}!N`XYxj^yBOT8^_h^PYtj1Q+ve|8pf7db|0-S!su)?p5z zzNzsAqsxMsL+W#*x{2yU`+EzhA-}Wuz5CS<7*a^ zk~}oq2knEDsIQaTZJ4u>M&5qB^|TRA+_MS_8kAIq87*gVM^___&sn0erN$d=|u{-VJsKeHldRY!881I zL#s{R+1?)K(N`)^qrXuVV4{?0!JB@)b=$i(M1dXk< z)Jb2z*2A1J>D`^Qe$v|elG~y!F}NSCK~<}+!6Rm$4-ct#iEgb*a?}C(>WO%X^$b|tPowQ1 zM8vk-*_wXa&f&t;C3y?>op;FgN(~ zDXyFoUT6yUX4Yy0%uNs6get7<`7z^GeUY~tr0DnlXqlq1TN|{2;&E9=x4e5!Z`>a*%LkehjVMxFPox^S>_MRR#Nm^I74HEVUj1QeAViK@_Hy z_*R&>Q)dFitr3fYM#$zELZgZpc8Eq1>bs|e&4ZhY*)9gvW{sad1=fDL;YaVWyUf%z zx@NENrZe_=RdDC(9Vix4W?c|HA)<`J(7U&s`UfZ3k{@}p?cdxTGeEVG9-9U2denZ! zJ5Id7!=;xi4iF{Y5*##4Cf9eX4|yO*T;L{;X^q8~sWvnD5X`wj2V+)ykNl+JWJOzK z0ei8k+HGlm-Q`wY5_p`4XPu7`bbl)1ubu?u^6|^E+s-tkrOdK2K8WfOrx&@LgL#5w zlJ2|%rH4sVCPZ430zC?GY0`5Qk~gw8q<4A_;xT0F3xo&+AtdtB8{a0t<{R=X=K!*| zBGBK`k}Da~(8E0kioYwfuldX>L%CxsSY=kYLG0)?%jsr~m<7jEom|Hj-nR?GwgOVv zF=S<1y{g$xrbHvY4BEsgu!`6TJxTJ#fVkN>$x-YQmruPpe%k7Tdloz+aq>c8PHe=P zndt72#)*6BEuY%c*z#*@fJ^P^bOhF@?yPFbSq87fGitVd;L|$rS+NDX#B-iIa<<)a z)ODLT+ie2)WyGz&nzOzlv)a=dAvNxZNcU6JE=kLh2BF>ZWdCKfk?UX;Z=Mx!LW~zD zT(fxU)<;YSE{9;LvQG#6h&x(s$0?@!)ynTs-*azdNW?~Yi-Y!5TMK-a!2=qv9ri$jEsJM33~0mY%Cl6BYY4WM zG@bNSdAmUV&=B-+nXdtw5_lE4pF9VSiY~anWk<{_ZadD5iQ`n{Hg81k?Ya=K>q@ZK z16`o2in`(Riu5jgLq|nblubO>Rg|t}5$r<)DLc!X0(0aw08kWToY zW6#1c-#vyJTV7+BV}H5E5X!9>1ZK($Xl-x>|wfrw>h>K^rkYu`tw&XoGCMR zVw5W$Pw%oCRgiK?LEc5(kmDDw7I{d7xlpuPjmPrEz%m#;)D_ykl>-ZQ=S@n6iPBXO zqUMabI>%x|Imx1R?*=*rLi=G(%Xg~8AB#P4Y82(b=z7&IiIJSXMC?W$Wxeguxq7Ob zjnNmR$Y%M$P#5sM>Q~-0(U;6&D>8^;BbaxNwCLV^>paE76bJL<;ox*W7fc(9g4`Eg z)P>K!2;3KT2y`H>2+I@-s8YDGCt}IxHiB!YL*_@*?hRf%Lb_=VKXGHDFP!isM{pT8 z(?kg_B++_}s%FtEnDuJ)4wjLSHt9n$Ayx@FKvdY!ap|4D*uj&Z^+%*~WZCl@+wM6r z8XTm8$hyCW=KZh*W7h_61RvdSRe9z8$kAifDfsfeM-Jq)4StqbkZ@$927fF6xBwd- z5`HTJ-V@!2n$Bk3=vMKd-k?TYNPwzUM3k}i-*+x?yhpv^j#V-HT{VqhP zvyD2$FSd4P87;Ycc&)@3T*I)$y%z!Pv9jtP>`IXUr6gVU1QPrE4 zCsS;L%52rq3F0mDksr>sr6kbNstx}m@zyHCg7ViS0;F!RZreh5oZf!2E3ON=486|x z4kCdUoQh`Kk(eLAW!hqUyn+`9+8DBYInL%dQ6 zxIg_7xZ*2M6Bb8*9skDM;Ts0a{R8L3Aj;Lyg@+s&?L2sM8ExhKqYd5^76+f;7i`Jt zCY{&=5%S7BL%ECZPT8y*mhQtJ(>ZVmoiwZX$hP5dFpL;=}npC7x0Y6tFkyJku&@0 z-aSNv@lNC-Ca8@f0@IrQCEA2s==+YcEo3o4_n`ah z7BoTx0@@i!{reTANVE(LTrJUWeO=NVbYbTj&)c?gEZ`;dPg4g zbV*DfG))?J3O3c35C5+yjWV0j{bJUM!tEHyHJ7_bv zwWR^lGa=P|kNO>VDwI6OHt*`{YVSbw;7IyvH_|C>kDB~7VTllX zM0(mZ@F2uk;EFVKBZ5BLFYm4{R>h}{#UeuA<($kff9(+qT7wm_u*h5$Z%BF?z)BqX zrYK-DgR~b9!EbhU=U0Inc^Ksnr%xDCdgG!cUkLtwwz5ys)9!w^k&A{JG322>&Z)pt ziCYKd>Fx(%y^wAYZie?ltu9Yj;al1bFZMz9vt;w<>P*!R$Fv3Az$oi_&?%mj#Hs^A z>00=@XAHA)wPledL%}Ta@ZF^pgn>=N%=?+dG)S&Bq3QJ@JX|HgcCpIuwqMyIFHNHI zht;YfhSe@&{r#7ZojCPycnVQf1ZsV7P(wWFs={JmF$KW1Rl0O=I=N#?s`>D*p(WO5 zGTi)9zkK`j39=kNs)+wFj)UAg-*33AFcI{M8(W`vzITrg+D>5OhMh9PqYx>LCE;!Y zCXmT)nD;2_I?6)J>aMr`W7e2iDX4@yX)1&UT;s}P6-TYOO%qq9(eothXu9(IqoIl- zDx&1QLHvT7*xaIdbL%Cio8XbM0gtD78isdfqg!@I?r3^Gn_eTn^{wVY%PaL+&-D@C zEGxCJX1=I*eJ1_7Jg7W-{lW_0lw+mODyjZR z*?e=wi0RO#S!Pt`D#rB*pLP3@(F?z3Gw30-aLIUX=Re-)t9lKgnUiT& zkcglVbU~-gvZsq-X~{!&qBqy&*&_sx&xlW6M4${(VG+7zRCHsL5bD>d=ihPYH-m%_ zunIYYIEfi}wei3Ryxn6PWPu8a_D8~EdQU3wQKxDD2Q^rJ7a5FIV1>mKO* z2UCkWRFwAbevHBRw;;C2A>fKhp`f|NtrU?_XidEN-9~T0zUncxv4ejxIV}r{j#(qwG{ZV_3h5vl^A$Ms1%6Mw7H?5ek-hfC)gL}c# z#nk7p(_iozTF?_;+s&o-`cC=BZhmdRc7)8a^W>wb50)j~xX9PR^T%L5n3?&Sq9{ES zPSiRxzUPof7qlksnLAQ0-Y5l6;sqR)=e>++I&ZWT^pnG(ck?S`BH zcJc6RZePv@`Eg`J=av^y5Oz|&)?I|x)VAX&hSsm{9j8;|n`xbn6DBK%&ap!D)LMcw ze^YQn+dzRdN#Zaw3pDqvE=NBBHK{d{OUyY52|lebIjiVD=8bkWdT?OxnY=u)%H7oh zex8Eq)<4~>e|8e-RMV(fi3^dJs=Yckhly!P;*K{c<8V=&qm23Ln1%BUwCB$=DQ zzX#)haK2j9XVhysPlUTL+)y$$E*l*tG2qV`mJUZaTx4@AO5hRLMU`|T({xApKrQ9M zNxXk{r@={IN#5YH0M4=}iz-i(T`+gi_~GRF*0JUdN}8ApreM4om2WCJq@OzV`%PVV zPjO%+XuR;Vmw^kxi5Ouz-TLIKHG;eR`&^+N%8k8?Nmo`rhnR>e81;A8^6fD544*!p z6s0hzL?%spBkWcFGV{=q2q?%u*_omDgQSEdOqo?D)kT%NT}$9mp8)$&27S|3-nBM~ z+M`|Iw8vz1;|^8@XRIP4t=-AFN+l2N?Q~5^z1Lf~_A#eL%|_TT*}}$cp0KlhJj84T zzrM`g&O_M6y|OKV-U3NX4Mb;a@zJ(hYusz3A$`R=H&|*Vr5Gk7)eMiE7qg#^ls*}G zgL5Ik6#7X}h?wVXGE_Wk<(-7t&us;tc!J|S5NP6HOx|052Lvc=>dsgg*KXLv-j3Rj z_@E-KW?{rz@?VLS^cq{sV7P`v_&{(hlPJ7f-K z2?!iMG|9a_o}w^JE$`nIf3H-YJc~B}WYp2kCdtVawO59-PYgljtdgN&1r#3WV{(K3 z-cwH(NW5vCAfdn+ddTP_K?#%dewaj*R4acJ)~)2+t*7#rbWM2voyn^ej5Ha$A;{3e zm~wSmsB-XCOyzcSsQCAE?hYKdMu9}(|QzJZ?U7_`DFZ$@+Kp^F<6 zsnEA1l3}Tmg>$2HIMJqf#Uo;YeY- zGj0L@4SO9?=BAn@aZzAi)^RN*+d-OK;?fz_Dvwvzww9>urfkwVZdlvYNA zv@d?4PiCL-k{u(AAFGZydOEpq^*Kv` zi}W7%FY>UAgtv^=+AQvLv1yQ?n{kjK1)(4{{!sjzxGo&mKWrYiN{Xj;{FFZ6;txn1 zh|9lwx~nD52FtP*3S-#IWhIz$Afl(*~iyeSN9RI%9jI`b^Yd#QvRw&In9x2L;Q zbdued7~K%h%9WBG@!7>G7c=WBH}HM94xM}MsJoh3^v9EVuRro>|J;w32-s z3Xi@mE;S}|Ko9$MEoW!$=%jU;!t>s6b}jOSM019}6X(>mFg(S|S#;2B>lAA3Wvuo* zpqJA4CNpM;N}!ka>;CfFtw_u5d`5nbDk}Tzi{;6R8gJV(S4B3l+rH77c32p|FsBaV zF=ygCdm#B3JVtYErrj5Ykb38|XF{-PrZJKx{(3l$bO{;dgmekw%FCQ_=>nU^|Gahg zt#==Nb(soroH?gKV(>%98}~LSyNaTDGPh=|j|_6AACAyU_EG1Lv`NN?$Y8m~Kb%FY zi(lcs8`uDkNZr1$igdq%Y^89hf&kJYhpARbwm*9*X|<$CIXZ!(Vpo4$M6aK>$Rd@Y zF;O=c+Wg#o;*Qx^B>@S&AdbU7e6HAKZoa*T{chlenv*F{zcT5Tsr5?(;o`bm=!jQgzZ!URCSlP!tZ#i+ z^|+L;n`x;1INH9)w=8}txF2HBZ9Qx88MVY^*2xF7DUokiuZkS+^_M+t6>sr5Li-fy ztm+l%<~p$Z48c?6)#*;VJDm%X@famBYrN^_1O)q%(fAp7ES36AB&RP>R;|?OQ>fhg z_=<22%nBpsmpeJuHX`1+Ob~44NLu8IUh~4Ivp}r&I2t4Id_vdixQ?S8CW28I!O{ceM?|#w_UsQAV9(DoUx9_?l37Iy$GX=Wen!`Fr>^hEA}RUQ zZp|p1E^sDR?E66&+?9~vi8FCDpT$xFF+>f>ku#83FyPRD1@Ux%hd#tGO`K=EH?W*) z@94WgGH&zZmexn;R5U&<;*XPYtOVmMRZBQJf!V2TYseL(8eazeQcJb=$ttp>crtL7 z#V+u)K81_&sixq=Ww$zy<}z}E8e0h1;7a)>*xgGi9^vhJ>-Z8Gd*1)^Xg%|n?Ee+dD=^f~egOjc;)}okU+!1sG?Ej>CuVjVi8R|<#%2$` z1v5nUX9t?{h2zPq+j#Q!9cCZu+#wW_@VjI_C;Yp0NB(uYSPiqB{4`oz(~z)4zNJAx zw*Z-DetnB0ydWWo@ZGyg4wHnM99kRn}!h<%n-E#F< z7~;+3srQdahy6HUVJ(Qj1dB?5CFu&yZcVx!JYyPa{ar`)b;b~|3p zZs%SBw=~`P#?{*FvBHiPr}GG|D-5?g?|Gfwtxxy$?qPxUSaK&T)X@&@Yl-%vTNDEdzW)r#NsZa7Ml^%M~~p$QtNYg$FLR`xeK5jpeeb zpiJ+?@Gi{m!srg{*q;?+PUiG(Fnh^J#BtSjx@rS$XBuu>NLNF+NP^&k1=QQF7;Zr4 z#9Mno2SzZSiJ6dB61QJpxd21DI_YMmnQh=9$PG`q?T>f719LB>j9(Lglert=mP`O( zB6mV4e7`5yZ@E?6Y&-W2bkWezRz7<>9;J^bokgRmch}Q!+95mhqlab&o%)K~Iwx_g)PGbPDK-L_~-S&SqQRKH0S-m&gO4cJ#2JMZg7{V;Ur! zTrW8hOBPtB1y4Ny-6{(n54JL}eZQ;p3C6#ULY`-L5XWWR#6W%kX~ys+fysD>4dA2+ zgLj~-2E5Z}S|_b{$8Y>#O&6}^I%&9Y?G~olI*yE}YUUxLM@w($vF^$ISj`6x< z>+#3y4)7P_bw{mza@QT42>Ls*MI;P%X_3VyLIP+VM7)rgOWP!zphC^)@`UVN3p5|b z;s%7wWE0vt+o2a=YEyebn(+e%Kf!fXke=%3uwmCZ``xPm@pZp3LE1+oq+NHQsAoQ0 z;ECvZ9y*_zfpK#)nNKzbJ#gG^~2dZy^ zhb8)Qc{nl*;}HQkHKCFbm8IjrC=aDRYUMGB$9MFm&f`0JQ_t}o-8Sadx&14El-BRNC%R%m5|UG*l=S-uxbXEzkX-Cwp)g>~0n}lkn1!X|{bb2C zi>NQt?_&)^HPE0-XdrSH;|1W=>0x-Icw>M8gxolZWHu-rQ+Q{0vGs;{;2n|k#9nNO zTgGo_v^b?5WUvyzHua9lSfE|y;CglS>(rzHovQNPFexz{qa)D zc&pL#%)VDTq4V&CmbMH^w6dmaZsjg62wIC`-%lOjFbO1m%lziYwQfF)nBQ4b|9)nW z#j&NeWn9?_G<5UYaS{jA!;OHuRb?R=#|!d33F3amm%D@q0-Q{p6ctIVj3VM|zIdh0 zgB_GZOC&Sgvz=nQeF!qAjMFat8fGDdG@@Y=9-$W&Y`P7om90k7o}Oot1%$VkHQ$O? z$b1gqlg?G{tak$VUZIFv1RWSiK_jbW4!aWoF;w@J`nKm`7f%>_We2k3R-6S`Na}qT zFz@C{GQRaQ>0ETxlr#;fOUIZ?YBz6&zl4MtE>N?@tls(Q05pLWNzDed@M@>kfPYUo zIi=!eTYm7cx1`ZRoq>Zeg-^we-P^zc*oVvWL0}EY_&3z%8{p{WHv}WYcrRNXYo`yF z=UemVt4TTbwkKu#bMgahE;LtFHhhw zHJ7kjNI}wxMiQh|3>JKAmqtK>z{)Gaq%LTVedL)Z=+**()72m+^q^;6#C&p*%mONw zSD*TUwTt_fV<|bECDKN%K5@gtQVwWXYcAeq1N!VXy2ac-zUa8{7|+;-Hs4`+e;m^v zZBG@|=Ijiv(TDg=^c=y}Aw0(ie7N6JvG^ye_Y@gcUhR;T^Q5V;Xs{l$K>E&hMMc*G zQnfi%_32yJr&nd4J(kDY_zl4vAWpdv(2LKoeW4Z2h9|Kuzt3-(k3^xpRnR*9D+B)rS+gz<{e^G^ay!)p@80hWV> z*@r}8A4?21qCg@-fFj4;4qdFHb(9{yi&~)0M;hz~BWsGnR}M#mdudV}Q$QY)a_e!5 z+h1$99Kfx-s`CJ@MNcPs#^BE2@K49nc3Wk?%zr?Icx1ty4j^I-*AhP+Mh7IvEH`%+ zg(S@^H>WeCA4;aV)|E#6cn|fe{EXbIKlhMv$oW(?t$%{fa&w$tzr>y821(*sZhdZV zE8n}_4xlY=2vFZ!0<^z&LbVNYTY&oQ5?GSZavND^WF7YpL`R^`W^+IILM%NUk4Qvo z7*2D$w^JGDaZqkOSr-y6Fz|rd%iob8J!o%QZ!G)i1pT!fh%ZF-i)`WcPdCy#>`iOD zU~}8{u;{hYyOw3!ThM6$-bsLkfIs>;5+jS&hrP}91ivHf!7Bn!v?5~Cy)>XP0iEU@ zx0UzqA{r!*JPJr+z990apWf}Eqx$VFwPm-tf3zSR8j!mm_4a+5K4J`#$oAnKm_`Tg zme%ihy)S>TdBD7z?c)G^EU_3c<|&2u;lm&f>;O6}bdoVag(Q(2BINNYguurBU<-Qx zL5K$Vt$2dUOA@oK_Xg$qwg5DD03l;0=z!o>)b4jUV3m zwjwY&0;pD$g1s_#mcsxY@DMdQeI*0`N=y}yQX%(%q1+q8$U zYe%!BvGu+6GglZFdbRIOaMItp)?}jiz4P}n(%T5&t@C3=+iNU)sbiR$755kdZ*hN~ zr1)&J*l}(T{#ZDfZhiVHAdlFp%JJWdvP&jew7>SYe~)4FYOt+n$+)~_e4s1Pz0K$F zDAO6loT*>ChT8j3OOV^);K7!FL=gP|gR$+^xvxKkvo}RgrvYeeW6@lr9P22$dpSWP zAL}DI5~Gh7gsTq(C`zknJ$xTrJs);jZwi)6qCNnu$RN7!Fkn!ie9<1i404HY-*zn2 zE9SjuTlh>l$H5OUYCn%F*C_cqqK-~fXaHBBtc~YPsr8AvFQM6cgY}BUFWMG+%rQE@ zXg%DiP20w)x(cD!gdd56wP}O7S)1k>*u=coe0b@gWc#Ix6 zE$va18qk}jv&Rs{2!w|Na{hjggvA0&a*KyKaAM9R@suKV%0k>#tlI(TxTzXj-%TY% za29ozfh;2eAgBq79jxM23h!blnJm^ql3{WzLSttKluGID?Cg`XbayXJhpl9n<+f_? zJv_#O6%ZuGf)$+|ZOY`3btVR`um;)VM*6a?op<-vzwVP)00uq9%HRMA4ToaWm57&w zlf82V&6Sscdh0=aIBPHmUN*aX$l#8qojxAcrGJPj)$L*DiryNrKTQVy$X`+Aq@oX}gJS%x3Askb3CrPC9ZcT5#5mU+zRxh6ENZX^SrApOP#3`${JY#8f|NM2o5EG^OlWmWSHh_@d1Y zX*O1agqi)dfvGFm>purn$R9R-dP9X-l{iQ^4r;jQU&NAeeSGIDK0(rG;etksB*47- z*)xQM$JDClBGrGE*LP2$Oe$$Gl)}bO)aEKD&zPWp3Kr=Nj;4m`rU@?x1sVE%xO}t0 zaJB8;1j=KP!9e`{_s{?LRDJjDxBu&sV1NC;zW62WwK16f-D$Xt-=-cXn$@mpNQA^; zyaD{Ua(`n$`&edwG@Vv2a1bwXR&8H+OA?k6pR<@m#~0^6zPzga(0-V-yZ5!q&ZY#$ zt)1Jlv$so_hRo|-Cn1gIgp*hN!XDf zz~W^E^`!!NOzoXtR4?zR^eFkjTcfWnr071NC&iMt{B9Ps<;McMRu*kM-@8umI`=np z3G;IRFk18Z-nA33?{gv=w}@>6ogAMK-k#FI%C@$rc`JY}7}2^L-M?EnyhtO%#F z!^(#MY218HAY`X4Xa!(5P&QPf>d$I~VeJ=$*vwcBuSrCVqf8TeHgA~j!?I;FcMxp1 zHct*Q<%uR6C^vVmDxOdkBgf4|p^=bS3DmUPq+}9>IKmm_Hor8#`jgq({o6*vs0&C@ ze*!5;^MKuM5QopOH^qruGERTjOtWDnUb28}L98yc1A=|RCp!N$WzmGIp_&orNnqA{ zl9wMTSz8`s+^11_0{XWNPMM&9U_s2zToFDi15w5Y$^W?^viK-70@Xi~I5jvLQF;En zZDbP#8sfNd^w!~SvGkU0Nanbp>?XX_*Czql4$*^>9P7Zh1q;Vv$%~?K!Vl zxUtG%wS~X!T6i3%jNdRzpTq%MhnDrfM_d!hgolIdJZnH%GaZX04r1nK{j)2=hsM9J z5b6+teWjjtSMLK=@)M_@Xm%VeX8yg5V_w0wq4f8h? zrB$!U)F-P)u?c(Ny>IN>X9~mfZPO!Kvr1uf?6f~mB1uCcEI;op&HK%EALwr`OKOkR zkA|-K75#$acq!Wc{%HB8K92`vm>iXg;BNfo@soQWBxIXtd@3?=kA&f-cgCZkVg>bW zXtjD@=8I`-plC77I=m z8u(=r=m#gSpz~E)b}@JNX{_Sbw07y8_>}R*K{f`NNH)oSnWQwwen_Ju^jz|UJl_kJ z=sTh6Omfz0ns3Tp=;vSdW+U{SHSwt|O?psnXrrMT)3QScP&ArO#6ccJYVzFt(_=yU z#I)Vv<7f)E8EES7oF$Uf|5@+Ua@$}1^9JO!21>(UfQQOGQTws)PIUxWx0CAhIJVQs z`Wa<cFg5j<`;cgJi>QB)TbIz%GixQ76?Hc z6$W!vD2a#NE=Kv$H(P|BLVIYQ4r zv$T)VXQ;DfJhR^yr3R#X~{4UQ&T(0rPGU6)0j7 zVNWJF2-awxM4s`)tP1Zh)pxT*8ow`rBttY%>%*}mNG=J&D@+4C3rO`t^<7#;6yeB6 zKJ${0L{fbdA{rr#Zt)t)C6)>qW3bU#K-7nl>4X!){QM8KD4qn+n$S08`zCvh56xM3S ziVsY;6xW=J-V#R(LzW5#Q$zo6K@FY#_r;sz^LJ;LS2cEkeXmA3Gn4rkk-IoB_smD= z-;<9KLjO|#PqmNFF_#~o9~FNwf7RJHK0ZfB=;L#i=~qKUk1DHVtm4&;PlmO@D-BYr;|5+TvsU{5e~b{Ab+4}9 zUmm|cL+9_#ug{O)od17kmpyqHm6$m5Fg@4h)b!PB14A@YKK*h+OP{U|r!QVk56gV~ z@wo|hxFo+NnhpxYi^IdWw5it{8q%!K>sk*lPU=9yjUHtHwIA_!N#qCQB&$X74u{0_ zZ0`7DTBAORbd5vP^?*q4K#1VL)3JjSk8mlf-xHm9;0%-278a&9CZ+ z5JaLm9)0*RwyC-TI z&eko{-41m}$yS`0uizo-{X<72jOI;L=V$N37 zC%)1S(}^aWs(Bl2vD!NWX+|?keh^0Tz`Q4ADyHUv2I_omLIvzk_h7GJRV~q=!%#CMFpZ* zJ#;QLgUv{3G_`S7gs)M+Zof1Z){-TGucUz{6!F!@!qFQ2kelF0OP$Nq$iNbXbg`7m zPA@ZQ$5Grp-Sm)nj5BUmEvmCls9&G;hx1dEL_Xn$mu{ETTc(mP?HF^GvZ!x{Bntofqr9asCqyli^i3SsR;fa$R{Z}*~1#$~7V2M9b z44A%sPf9bL{!=JSa)Y;w`pbra#LHtX{eB?p^V4FGS{G@D4}yHJ4vf|gmt>I>zTxK|38(Y*)zzD> z5q>nDz27C?4e3Nh%`_k!%La3()GK1qI%G*{{aU-992-R=>rlC-(EmTZGNS@vv=aYaQ)7yVsoZd zy>n1VE%26zflL$ zN{z-SV$pEiwq$8BgT~qm2y(diKhtcsYN|%8Lu?Ve>HbWg=kICbz!53 zItV(A%w^O*vsue4b5ar9ik}vYErOcp@76j#LycNTzP=*eq5;u(r!!l4qQuKP*J3(m zjBf=JFY{y0>=^9(>4gF3M8r(L3!;*Q#X)gsD4un^F8HiwEgWw8lMChvB~U%L+X z8QM4uYD*?wW+v_pSt~VOt>1QPU>$*mQ)d&2lR8vlP$^%M0N}|$V^d&?p_EVj0S{>mywMw-RH0R=>KImUeVY+f1VWTkD zsKL!2(+xe-itq;fE>*iWNUnA_l4YfT)kDcZ90(C0k8nxnN)C{XaV4eqlL~L{39Tq~v;DwFQG;+!mlH*9s3D-LzAo&aJ#=sVfqiOaH=0^u6 zIO|HEbTjj(#*Q&oN&-W;%ok{8x~7OLdH?rt!3Gp*XY$Od*^{!Yu(pUXc_svuC)Z<811*Iyd&ISH^3=42~YqKb>JhrT9Z9OV1| zU;jc=eYF1Z$0Yl2^G5T>A5-;*3fkz8KdK-T9_UP#DKvEi)yAYk=|SfTn^fq1&qVWk zY}PlOP@0f4@0xF`cK-ehRr$Ln2GSq1st4x1jIRhHcarc32TG34=hQ3Tc`6Gf`=Geo zEi4oorJ1eJ|C4pgAG-eQpz^o>DuI3X{`&05D3mqF9%W6ZO6)APLp7E>P`DTQN{s2F zDO<>6Z7rv9-zdQA>NC{#yML3^nT=c}^^yr$*6B0Sr)JM|Pbe{v^eWA!EP84*$ygz? z+STDgoAc*#%%7cRPI&@WCVHn3aI>! zWilD3cQ*+S%9J{v*8o$2%x#r^+bx|zIY=yWHxx5&Z_0CgTOxVGZtOl&OT)IEsx>+l z-O3~rDb4aL!EU1M>I|<;sD6mI99)I3Z&_>2er-Iw%vFC@HAGu_bdFd^rGBX|IT>YO zs)8rugEG|o{-NSW?K4jtcr5ZrEX6? zY6~Ez~yR z=Gn&17pN@Ia@Nj&byjzq*nc4I98euEI|F1Id5wb=iwg5YMRe5HNDGMkuR3Ey?Eoo8 zs2(1(bxv=66}3UR4s)Tr51TE9*84EMn>$YG&(L=TVy1KHXe(=9=0kGc?vy7`u7-Z#!(oiRLG1dx$lKc%Cnk)aiNS*JF zuTQ=oM(oV6^p-o5J9U}TL+Ut)oDkoAr>1j7e@{jK%da+iyup%0-rD^B_2J=RX${(m z(J6$|&$g37jiSI!5@mRRMbYccI3af-1Q>M(QmAv(ZYJs@gKWc9nX;nnmbo$;DC3+E z-_bA$4R|C}4>e*s+7!au)sa%}ZW|}aevVK`gMbR+vB($YLDkG}F*OeUX&RV<1XK8C zauI09ug~6H4^U2bnIE6WoW*#N8k;}=lK)nY6EO437MLm; z<-X_2_HMW)Y$agl?#~7SZvPItZzls%JRZU(vJbrjNzgUuPDFuaK!8njk@2l@y3B2y zl+jZc@zmv(#G+~j;Ru~)O#52%Y#DYIz(T0L#!J26H7s(6J(&)YJ|Z$5XN!J*%>o=P zN|&jeEXZ9}uT%U|8sPKnswuu%Oc!kGlhuLl9Uq8wB=Oz|ob|4kYT)S;ZrrhE^&9CL&GC$Q-uku^F(#g~UC^y%ufLbi~ z+VyXClbPO^>&w=Hp$b>se5?YqFVQ8wEymRPuMU-bOT==jV^u^wEQ@T6k7a&$s^2T} zfo5y{ioOx7wV68bz^_bvy5YoLA9FwUpl zNaT_v;>zPVrqLoj@zee#rKCp!fLXw1*$Vs?lRJ5Ed3JpI_G}vZpgHBi|MfYQ-JlH^ zR7$*D+AT%oh_LS?GuXrcoRk4dhRBNWb&glIXNw@H{Ir`f77&~TJE8Nrei=+>(ugjN z&~FJz(u8z6R5N{HB+&}3Fwb2>bT?$W0*^s&nmUX~0-MqFM~qOX+4g&e_>i>Q`Ak^tZ#m z9e!zElW(aYjX+Bjt;26v8TCn>Ct$MR`7>19H0Xqf|H>1W8=FCW)Oca={L7+eMXP^) zgp5wV*+Xll`uEqBUkfcc{Wz@sT6}2IX#epHmG5hZ#Qb%CyxWm3LoD6psUKf{Rr@u) zR#U%yeRz0SOt=>GTAg%r=%@lx4IC{7>&lp*zq98{C;?k|Lg~x-Owzw?Mj0y5fEdH) z8Kgf-2*2DIVk10Gf!_#@D^b{d)DX&+eYg?Gw()Tmh^D^S_%Vz2YW&fJYBm0pM^m*y zt;9ODbt>YLT6=7U1T}We!gBPF`C8<>Sg7w6Hf+|w6pTXuDj2$&#Ie4KF_-n_Zra)9 z{E5|Bpr)LL3KtXXpU=m-!S$2oe3jN&bR?SG1Ey)r=2tsF+S2r?ZjDL$%HOspl*{tT)%#`{t?FCY zOr!Mc^B2`gRuhBi4qv~e*#f2s$Fq43of*Ae3L;g{fK~tV6z)cm*-_f|v=sToTnJ4} zmH>AQ_53O*mP|E+XJP*+oRmFtgr0x%=Rd!E-te>WzfP0Cm!Z`we$lT{gZgIs!vzBpqWxYS~*h-Kre){70$Y+mjgM73Br6)`nUPp zBtJ8;@AGe8eD&Aq;q-9&;^>>hZw@#5mMbBZe)L!v;>fSVKB&(EArh_Xy$pda-k<*Z z?)dH5)y472S)~Uu_tvjC3y*3)AQN+x*1~E0P3g`@IsZ)atJ<=wapBY`WF{T5L~c;dg~)}9NglyDD?>FibO<+3(jVwI@vj`Sv83)KC^rFfpl7@sO zGXJ@ZjG^)-SCkHpVo7oyHfP4)ild|oZsRbiOr+t=N4kO=_9>X4wJCN}RDoU(NYI#Y z%KS!pc2j$!N}XxOHKvZd7bj}u!?5;uW9J>Am&!t}{FZt3xI+4>21%z5qjG)1B1!IQ zRMoi_FF0M%fGo(F@Nl5Te)%fNv{hm3Zm?3AS>E;Dm*tfoIcjElss1&3_;HIADh(%W2`Km`I?4ANF2sTC`y80H#dyajR)Ol>B?u7Z8Iue>f-1r^-6VCS1)EnVk1Aj zfRacW8s#c`dhdILP8Q#OTa{IXpnw_aMc?|G=c3dchM`)u{1Ggx+Dq9a#dcDsg9eZ) zNSU(w3e%vpaW+WTi0w2Lcj=zXYXlo&ZPemL9kqhZveG)qH_5IVi_^@MwSFg;XUErP zl|OyBI4%FFQJrclORP-Fv-w;X(nRlAL>@nr#LO4NEq~1Xi3ZGSwL-5d7Zm9g#o1k~ zbfxODP0$TlA60GX($bifX8Z`9G9unFd3Ki-erCGFsq;viP92TgqdvSI*N~1A8m*Y| z+Q{g4K7U7uPke`cP&gHIF}^F$w=j6V?wdT_@2L1O&1d>#4vVY=O{EO^6Fo7~WVFp^ z1`gsSelcmJ2S9W*)3I58q1-(X#P?Qp zw&SK6O&-g(+O^ShZ#!#GjGl38m9NA`&CppT{IqnzQ3-U|RFY#F5#Ll4`*gQdnGApp zRiWAw-%jPZwrr;VaB1m_zKMnYHK384u5lPR!LYT%!^6YB{Q1xNe-952>;J3&`^DFX zU;pK+zkK!L<;(v#eDU(HfByPE(BYt1w6sJ>%>UzX>#^#S8{62%Hnu%)|0e(d|Nov6 JG$8;Q4*)iNqd))v literal 0 HcmV?d00001 diff --git a/packs/kubeflow-1.9.1/charts/kserve/.helmignore b/packs/kubeflow-1.9.1/charts/kserve/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kserve/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/kubeflow-1.9.1/charts/kserve/Chart.yaml b/packs/kubeflow-1.9.1/charts/kserve/Chart.yaml new file mode 100644 index 00000000..43e9bfd4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kserve/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: kserve +description: KServe CRDs + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.13.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "0.13.0" \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kserve/crds/kserve.yaml b/packs/kubeflow-1.9.1/charts/kserve/crds/kserve.yaml new file mode 100644 index 00000000..cc727039 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kserve/crds/kserve.yaml @@ -0,0 +1,21920 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.0 + labels: + app: kserve + app.kubernetes.io/name: kserve + name: clusterservingruntimes.serving.kserve.io +spec: + group: serving.kserve.io + names: + kind: ClusterServingRuntime + listKind: ClusterServingRuntimeList + plural: clusterservingruntimes + singular: clusterservingruntime + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.disabled + name: Disabled + type: boolean + - jsonPath: .spec.supportedModelFormats[*].name + name: ModelType + type: string + - jsonPath: .spec.containers[*].name + name: Containers + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + type: object + builtInAdapter: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + memBufferBytes: + type: integer + modelLoadingTimeoutMillis: + type: integer + runtimeManagementPort: + type: integer + serverType: + type: string + type: object + containers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + disabled: + type: boolean + grpcDataEndpoint: + type: string + grpcEndpoint: + type: string + httpDataEndpoint: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + labels: + additionalProperties: + type: string + type: object + multiModel: + type: boolean + nodeSelector: + additionalProperties: + type: string + type: object + protocolVersions: + items: + type: string + type: array + replicas: + type: integer + storageHelper: + properties: + disabled: + type: boolean + type: object + supportedModelFormats: + items: + properties: + autoSelect: + type: boolean + name: + type: string + priority: + format: int32 + minimum: 1 + type: integer + version: + type: string + required: + - name + type: object + type: array + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + required: + - kind + - name + type: object + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - containers + type: object + status: + type: object + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.0 + labels: + app: kserve + app.kubernetes.io/name: kserve + name: clusterstoragecontainers.serving.kserve.io +spec: + group: serving.kserve.io + names: + kind: ClusterStorageContainer + listKind: ClusterStorageContainerList + plural: clusterstoragecontainers + singular: clusterstoragecontainer + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + disabled: + type: boolean + kind: + type: string + metadata: + type: object + spec: + properties: + container: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + supportedUriFormats: + items: + properties: + prefix: + type: string + regex: + type: string + type: object + type: array + required: + - container + - supportedUriFormats + type: object + type: object + served: true + storage: true +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.0 + labels: + app: kserve + app.kubernetes.io/name: kserve + name: inferencegraphs.serving.kserve.io +spec: + group: serving.kserve.io + names: + kind: InferenceGraph + listKind: InferenceGraphList + plural: inferencegraphs + shortNames: + - ig + singular: inferencegraph + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + maxReplicas: + type: integer + minReplicas: + type: integer + nodes: + additionalProperties: + properties: + routerType: + enum: + - Sequence + - Splitter + - Ensemble + - Switch + type: string + steps: + items: + properties: + condition: + type: string + data: + type: string + dependency: + enum: + - Soft + - Hard + type: string + name: + type: string + nodeName: + type: string + serviceName: + type: string + serviceUrl: + type: string + weight: + format: int64 + type: integer + type: object + type: array + required: + - routerType + type: object + type: object + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + scaleMetric: + enum: + - cpu + - memory + - concurrency + - rps + type: string + scaleTarget: + type: integer + timeout: + format: int64 + type: integer + required: + - nodes + type: object + status: + properties: + annotations: + additionalProperties: + type: string + type: object + conditions: + items: + properties: + lastTransitionTime: + type: string + message: + type: string + reason: + type: string + severity: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + format: int64 + type: integer + url: + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: kubeflow/serving-cert + controller-gen.kubebuilder.io/version: v0.12.0 + labels: + app: kserve + app.kubernetes.io/name: kserve + name: inferenceservices.serving.kserve.io +spec: + group: serving.kserve.io + names: + kind: InferenceService + listKind: InferenceServiceList + plural: inferenceservices + shortNames: + - isvc + singular: inferenceservice + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + - jsonPath: .status.components.predictor.traffic[?(@.tag=='prev')].percent + name: Prev + type: integer + - jsonPath: .status.components.predictor.traffic[?(@.latestRevision==true)].percent + name: Latest + type: integer + - jsonPath: .status.components.predictor.traffic[?(@.tag=='prev')].revisionName + name: PrevRolledoutRevision + type: string + - jsonPath: .status.components.predictor.traffic[?(@.latestRevision==true)].revisionName + name: LatestReadyRevision + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + explainer: + properties: + activeDeadlineSeconds: + format: int64 + type: integer + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + type: object + art: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + config: + additionalProperties: + type: string + type: object + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + type: + type: string + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + automountServiceAccountToken: + type: boolean + batcher: + properties: + maxBatchSize: + type: integer + maxLatency: + type: integer + timeout: + type: integer + type: object + canaryTrafficPercent: + format: int64 + type: integer + containerConcurrency: + format: int64 + type: integer + containers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + deploymentStrategy: + properties: + rollingUpdate: + properties: + maxSurge: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: + type: string + type: object + dnsConfig: + properties: + nameservers: + items: + type: string + type: array + options: + items: + properties: + name: + type: string + value: + type: string + type: object + type: array + searches: + items: + type: string + type: array + type: object + dnsPolicy: + type: string + enableServiceLinks: + type: boolean + hostAliases: + items: + properties: + hostnames: + items: + type: string + type: array + ip: + type: string + type: object + type: array + hostIPC: + type: boolean + hostNetwork: + type: boolean + hostPID: + type: boolean + hostUsers: + type: boolean + hostname: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + type: object + logger: + properties: + mode: + enum: + - all + - request + - response + type: string + url: + type: string + type: object + maxReplicas: + type: integer + minReplicas: + type: integer + nodeName: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: atomic + os: + properties: + name: + type: string + type: object + overhead: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + preemptionPolicy: + type: string + priority: + format: int32 + type: integer + priorityClassName: + type: string + readinessGates: + items: + properties: + conditionType: + type: string + required: + - conditionType + type: object + type: array + resourceClaims: + items: + properties: + name: + type: string + source: + properties: + resourceClaimName: + type: string + resourceClaimTemplateName: + type: string + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + restartPolicy: + type: string + runtimeClassName: + type: string + scaleMetric: + enum: + - cpu + - memory + - concurrency + - rps + type: string + scaleTarget: + type: integer + schedulerName: + type: string + schedulingGates: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + serviceAccountName: + type: string + setHostnameAsFQDN: + type: boolean + shareProcessNamespace: + type: boolean + subdomain: + type: string + terminationGracePeriodSeconds: + format: int64 + type: integer + timeout: + format: int64 + type: integer + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + topologySpreadConstraints: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + format: int32 + type: integer + minDomains: + format: int32 + type: integer + nodeAffinityPolicy: + type: string + nodeTaintsPolicy: + type: string + topologyKey: + type: string + whenUnsatisfiable: + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + x-kubernetes-list-map-keys: + - topologyKey + - whenUnsatisfiable + x-kubernetes-list-type: map + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + required: + - kind + - name + type: object + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + type: object + predictor: + properties: + activeDeadlineSeconds: + format: int64 + type: integer + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + type: object + automountServiceAccountToken: + type: boolean + batcher: + properties: + maxBatchSize: + type: integer + maxLatency: + type: integer + timeout: + type: integer + type: object + canaryTrafficPercent: + format: int64 + type: integer + containerConcurrency: + format: int64 + type: integer + containers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + deploymentStrategy: + properties: + rollingUpdate: + properties: + maxSurge: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: + type: string + type: object + dnsConfig: + properties: + nameservers: + items: + type: string + type: array + options: + items: + properties: + name: + type: string + value: + type: string + type: object + type: array + searches: + items: + type: string + type: array + type: object + dnsPolicy: + type: string + enableServiceLinks: + type: boolean + hostAliases: + items: + properties: + hostnames: + items: + type: string + type: array + ip: + type: string + type: object + type: array + hostIPC: + type: boolean + hostNetwork: + type: boolean + hostPID: + type: boolean + hostUsers: + type: boolean + hostname: + type: string + huggingface: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + type: object + lightgbm: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + logger: + properties: + mode: + enum: + - all + - request + - response + type: string + url: + type: string + type: object + maxReplicas: + type: integer + minReplicas: + type: integer + model: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + modelFormat: + properties: + name: + type: string + version: + type: string + required: + - name + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtime: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + nodeName: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: atomic + onnx: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + os: + properties: + name: + type: string + type: object + overhead: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + paddle: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + pmml: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + preemptionPolicy: + type: string + priority: + format: int32 + type: integer + priorityClassName: + type: string + pytorch: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + readinessGates: + items: + properties: + conditionType: + type: string + required: + - conditionType + type: object + type: array + resourceClaims: + items: + properties: + name: + type: string + source: + properties: + resourceClaimName: + type: string + resourceClaimTemplateName: + type: string + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + restartPolicy: + type: string + runtimeClassName: + type: string + scaleMetric: + enum: + - cpu + - memory + - concurrency + - rps + type: string + scaleTarget: + type: integer + schedulerName: + type: string + schedulingGates: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + serviceAccountName: + type: string + setHostnameAsFQDN: + type: boolean + shareProcessNamespace: + type: boolean + sklearn: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + subdomain: + type: string + tensorflow: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeout: + format: int64 + type: integer + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + topologySpreadConstraints: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + format: int32 + type: integer + minDomains: + format: int32 + type: integer + nodeAffinityPolicy: + type: string + nodeTaintsPolicy: + type: string + topologyKey: + type: string + whenUnsatisfiable: + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + x-kubernetes-list-map-keys: + - topologyKey + - whenUnsatisfiable + x-kubernetes-list-type: map + triton: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + required: + - kind + - name + type: object + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + xgboost: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + protocolVersion: + type: string + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + runtimeVersion: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + storage: + properties: + key: + type: string + parameters: + additionalProperties: + type: string + type: object + path: + type: string + schemaPath: + type: string + type: object + storageUri: + type: string + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + type: object + type: object + transformer: + properties: + activeDeadlineSeconds: + format: int64 + type: integer + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + type: object + automountServiceAccountToken: + type: boolean + batcher: + properties: + maxBatchSize: + type: integer + maxLatency: + type: integer + timeout: + type: integer + type: object + canaryTrafficPercent: + format: int64 + type: integer + containerConcurrency: + format: int64 + type: integer + containers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + deploymentStrategy: + properties: + rollingUpdate: + properties: + maxSurge: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + type: + type: string + type: object + dnsConfig: + properties: + nameservers: + items: + type: string + type: array + options: + items: + properties: + name: + type: string + value: + type: string + type: object + type: array + searches: + items: + type: string + type: array + type: object + dnsPolicy: + type: string + enableServiceLinks: + type: boolean + hostAliases: + items: + properties: + hostnames: + items: + type: string + type: array + ip: + type: string + type: object + type: array + hostIPC: + type: boolean + hostNetwork: + type: boolean + hostPID: + type: boolean + hostUsers: + type: boolean + hostname: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + type: object + logger: + properties: + mode: + enum: + - all + - request + - response + type: string + url: + type: string + type: object + maxReplicas: + type: integer + minReplicas: + type: integer + nodeName: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: atomic + os: + properties: + name: + type: string + type: object + overhead: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + preemptionPolicy: + type: string + priority: + format: int32 + type: integer + priorityClassName: + type: string + readinessGates: + items: + properties: + conditionType: + type: string + required: + - conditionType + type: object + type: array + resourceClaims: + items: + properties: + name: + type: string + source: + properties: + resourceClaimName: + type: string + resourceClaimTemplateName: + type: string + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + restartPolicy: + type: string + runtimeClassName: + type: string + scaleMetric: + enum: + - cpu + - memory + - concurrency + - rps + type: string + scaleTarget: + type: integer + schedulerName: + type: string + schedulingGates: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + securityContext: + properties: + fsGroup: + format: int64 + type: integer + fsGroupChangePolicy: + type: string + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + supplementalGroups: + items: + format: int64 + type: integer + type: array + sysctls: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + serviceAccount: + type: string + serviceAccountName: + type: string + setHostnameAsFQDN: + type: boolean + shareProcessNamespace: + type: boolean + subdomain: + type: string + terminationGracePeriodSeconds: + format: int64 + type: integer + timeout: + format: int64 + type: integer + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + topologySpreadConstraints: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + format: int32 + type: integer + minDomains: + format: int32 + type: integer + nodeAffinityPolicy: + type: string + nodeTaintsPolicy: + type: string + topologyKey: + type: string + whenUnsatisfiable: + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + x-kubernetes-list-map-keys: + - topologyKey + - whenUnsatisfiable + x-kubernetes-list-type: map + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + required: + - kind + - name + type: object + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + type: object + required: + - predictor + type: object + status: + properties: + address: + properties: + CACerts: + type: string + audience: + type: string + name: + type: string + url: + type: string + type: object + annotations: + additionalProperties: + type: string + type: object + components: + additionalProperties: + properties: + address: + properties: + CACerts: + type: string + audience: + type: string + name: + type: string + url: + type: string + type: object + grpcUrl: + type: string + latestCreatedRevision: + type: string + latestReadyRevision: + type: string + latestRolledoutRevision: + type: string + previousRolledoutRevision: + type: string + restUrl: + type: string + traffic: + items: + properties: + configurationName: + type: string + latestRevision: + type: boolean + percent: + format: int64 + type: integer + revisionName: + type: string + tag: + type: string + url: + type: string + type: object + type: array + url: + type: string + type: object + type: object + conditions: + items: + properties: + lastTransitionTime: + type: string + message: + type: string + reason: + type: string + severity: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + modelStatus: + properties: + copies: + properties: + failedCopies: + default: 0 + type: integer + totalCopies: + type: integer + required: + - failedCopies + type: object + lastFailureInfo: + properties: + exitCode: + format: int32 + type: integer + location: + type: string + message: + type: string + modelRevisionName: + type: string + reason: + enum: + - ModelLoadFailed + - RuntimeUnhealthy + - RuntimeDisabled + - NoSupportingRuntime + - RuntimeNotRecognized + - InvalidPredictorSpec + type: string + time: + format: date-time + type: string + type: object + states: + properties: + activeModelState: + default: Pending + enum: + - "" + - Pending + - Standby + - Loading + - Loaded + - FailedToLoad + type: string + targetModelState: + default: "" + enum: + - "" + - Pending + - Standby + - Loading + - Loaded + - FailedToLoad + type: string + required: + - activeModelState + type: object + transitionStatus: + default: UpToDate + enum: + - "" + - UpToDate + - InProgress + - BlockedByFailedLoad + - InvalidSpec + type: string + required: + - transitionStatus + type: object + observedGeneration: + format: int64 + type: integer + url: + type: string + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.0 + labels: + app: kserve + app.kubernetes.io/name: kserve + name: servingruntimes.serving.kserve.io +spec: + group: serving.kserve.io + names: + kind: ServingRuntime + listKind: ServingRuntimeList + plural: servingruntimes + singular: servingruntime + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.disabled + name: Disabled + type: boolean + - jsonPath: .spec.supportedModelFormats[*].name + name: ModelType + type: string + - jsonPath: .spec.containers[*].name + name: Containers + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + affinity: + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + type: object + builtInAdapter: + properties: + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + memBufferBytes: + type: integer + modelLoadingTimeoutMillis: + type: integer + runtimeManagementPort: + type: integer + serverType: + type: string + type: object + containers: + items: + properties: + args: + items: + type: string + type: array + command: + items: + type: string + type: array + env: + items: + properties: + name: + type: string + value: + type: string + valueFrom: + properties: + configMapKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + properties: + key: + type: string + name: + type: string + optional: + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + items: + properties: + configMapRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + type: string + secretRef: + properties: + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + type: string + imagePullPolicy: + type: string + lifecycle: + properties: + postStart: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + name: + type: string + ports: + items: + properties: + containerPort: + format: int32 + type: integer + hostIP: + type: string + hostPort: + format: int32 + type: integer + name: + type: string + protocol: + default: TCP + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + resizePolicy: + items: + properties: + resourceName: + type: string + restartPolicy: + type: string + required: + - resourceName + - restartPolicy + type: object + type: array + x-kubernetes-list-type: atomic + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + restartPolicy: + type: string + securityContext: + properties: + allowPrivilegeEscalation: + type: boolean + capabilities: + properties: + add: + items: + type: string + type: array + drop: + items: + type: string + type: array + type: object + privileged: + type: boolean + procMount: + type: string + readOnlyRootFilesystem: + type: boolean + runAsGroup: + format: int64 + type: integer + runAsNonRoot: + type: boolean + runAsUser: + format: int64 + type: integer + seLinuxOptions: + properties: + level: + type: string + role: + type: string + type: + type: string + user: + type: string + type: object + seccompProfile: + properties: + localhostProfile: + type: string + type: + type: string + required: + - type + type: object + windowsOptions: + properties: + gmsaCredentialSpec: + type: string + gmsaCredentialSpecName: + type: string + hostProcess: + type: boolean + runAsUserName: + type: string + type: object + type: object + startupProbe: + properties: + exec: + properties: + command: + items: + type: string + type: array + type: object + failureThreshold: + format: int32 + type: integer + grpc: + properties: + port: + format: int32 + type: integer + service: + type: string + required: + - port + type: object + httpGet: + properties: + host: + type: string + httpHeaders: + items: + properties: + name: + type: string + value: + type: string + required: + - name + - value + type: object + type: array + path: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + type: string + required: + - port + type: object + initialDelaySeconds: + format: int32 + type: integer + periodSeconds: + format: int32 + type: integer + successThreshold: + format: int32 + type: integer + tcpSocket: + properties: + host: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + format: int64 + type: integer + timeoutSeconds: + format: int32 + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + type: string + terminationMessagePolicy: + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + type: string + name: + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + items: + properties: + mountPath: + type: string + mountPropagation: + type: string + name: + type: string + readOnly: + type: boolean + subPath: + type: string + subPathExpr: + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + type: string + required: + - name + type: object + type: array + disabled: + type: boolean + grpcDataEndpoint: + type: string + grpcEndpoint: + type: string + httpDataEndpoint: + type: string + imagePullSecrets: + items: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + type: array + labels: + additionalProperties: + type: string + type: object + multiModel: + type: boolean + nodeSelector: + additionalProperties: + type: string + type: object + protocolVersions: + items: + type: string + type: array + replicas: + type: integer + storageHelper: + properties: + disabled: + type: boolean + type: object + supportedModelFormats: + items: + properties: + autoSelect: + type: boolean + name: + type: string + priority: + format: int32 + minimum: 1 + type: integer + version: + type: string + required: + - name + type: object + type: array + tolerations: + items: + properties: + effect: + type: string + key: + type: string + operator: + type: string + tolerationSeconds: + format: int64 + type: integer + value: + type: string + type: object + type: array + volumes: + items: + properties: + awsElasticBlockStore: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + azureDisk: + properties: + cachingMode: + type: string + diskName: + type: string + diskURI: + type: string + fsType: + type: string + kind: + type: string + readOnly: + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + properties: + readOnly: + type: boolean + secretName: + type: string + shareName: + type: string + required: + - secretName + - shareName + type: object + cephfs: + properties: + monitors: + items: + type: string + type: array + path: + type: string + readOnly: + type: boolean + secretFile: + type: string + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - monitors + type: object + cinder: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + type: string + required: + - volumeID + type: object + configMap: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + properties: + driver: + type: string + fsType: + type: string + nodePublishSecretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + type: boolean + volumeAttributes: + additionalProperties: + type: string + type: object + required: + - driver + type: object + downwardAPI: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + properties: + medium: + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + properties: + volumeClaimTemplate: + properties: + metadata: + type: object + spec: + properties: + accessModes: + items: + type: string + type: array + dataSource: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + properties: + apiGroup: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + required: + - kind + - name + type: object + resources: + properties: + claims: + items: + properties: + name: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + selector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + type: string + volumeMode: + type: string + volumeName: + type: string + type: object + required: + - spec + type: object + type: object + fc: + properties: + fsType: + type: string + lun: + format: int32 + type: integer + readOnly: + type: boolean + targetWWNs: + items: + type: string + type: array + wwids: + items: + type: string + type: array + type: object + flexVolume: + properties: + driver: + type: string + fsType: + type: string + options: + additionalProperties: + type: string + type: object + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + properties: + datasetName: + type: string + datasetUUID: + type: string + type: object + gcePersistentDisk: + properties: + fsType: + type: string + partition: + format: int32 + type: integer + pdName: + type: string + readOnly: + type: boolean + required: + - pdName + type: object + gitRepo: + properties: + directory: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + glusterfs: + properties: + endpoints: + type: string + path: + type: string + readOnly: + type: boolean + required: + - endpoints + - path + type: object + hostPath: + properties: + path: + type: string + type: + type: string + required: + - path + type: object + iscsi: + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + type: string + initiatorName: + type: string + iqn: + type: string + iscsiInterface: + type: string + lun: + format: int32 + type: integer + portals: + items: + type: string + type: array + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + type: string + nfs: + properties: + path: + type: string + readOnly: + type: boolean + server: + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + properties: + claimName: + type: string + readOnly: + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + properties: + fsType: + type: string + pdID: + type: string + required: + - pdID + type: object + portworxVolume: + properties: + fsType: + type: string + readOnly: + type: boolean + volumeID: + type: string + required: + - volumeID + type: object + projected: + properties: + defaultMode: + format: int32 + type: integer + sources: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + properties: + items: + items: + properties: + fieldRef: + properties: + apiVersion: + type: string + fieldPath: + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + format: int32 + type: integer + path: + type: string + resourceFieldRef: + properties: + containerName: + type: string + divisor: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + name: + type: string + optional: + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + properties: + audience: + type: string + expirationSeconds: + format: int64 + type: integer + path: + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + properties: + group: + type: string + readOnly: + type: boolean + registry: + type: string + tenant: + type: string + user: + type: string + volume: + type: string + required: + - registry + - volume + type: object + rbd: + properties: + fsType: + type: string + image: + type: string + keyring: + type: string + monitors: + items: + type: string + type: array + pool: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + user: + type: string + required: + - image + - monitors + type: object + scaleIO: + properties: + fsType: + type: string + gateway: + type: string + protectionDomain: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + type: boolean + storageMode: + type: string + storagePool: + type: string + system: + type: string + volumeName: + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + properties: + defaultMode: + format: int32 + type: integer + items: + items: + properties: + key: + type: string + mode: + format: int32 + type: integer + path: + type: string + required: + - key + - path + type: object + type: array + optional: + type: boolean + secretName: + type: string + type: object + storageos: + properties: + fsType: + type: string + readOnly: + type: boolean + secretRef: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + type: string + volumeNamespace: + type: string + type: object + vsphereVolume: + properties: + fsType: + type: string + storagePolicyID: + type: string + storagePolicyName: + type: string + volumePath: + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - containers + type: object + status: + type: object + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.0 + labels: + app: kserve + app.kubernetes.io/name: kserve + name: trainedmodels.serving.kserve.io +spec: + group: serving.kserve.io + names: + kind: TrainedModel + listKind: TrainedModelList + plural: trainedmodels + shortNames: + - tm + singular: trainedmodel + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + inferenceService: + type: string + model: + properties: + framework: + type: string + memory: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + storageUri: + type: string + required: + - framework + - memory + - storageUri + type: object + required: + - inferenceService + - model + type: object + status: + properties: + address: + properties: + CACerts: + type: string + audience: + type: string + name: + type: string + url: + type: string + type: object + annotations: + additionalProperties: + type: string + type: object + conditions: + items: + properties: + lastTransitionTime: + type: string + message: + type: string + reason: + type: string + severity: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + format: int64 + type: integer + url: + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: kserve + app.kubernetes.io/instance: kserve-controller-manager + app.kubernetes.io/managed-by: kserve-controller-manager + app.kubernetes.io/name: kserve + name: kserve-controller-manager + namespace: kubeflow +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-leader-election-role + namespace: kubeflow +rules: + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch + - apiGroups: + - "" + resources: + - events + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-manager-role +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apps + resources: + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - get + - update + - apiGroups: + - "" + resources: + - events + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - patch + - update + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - networking.istio.io + resources: + - virtualservices + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - networking.istio.io + resources: + - virtualservices/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - networking.istio.io + resources: + - virtualservices/status + verbs: + - get + - patch + - update + - apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.knative.dev + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.knative.dev + resources: + - services/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.knative.dev + resources: + - services/status + verbs: + - get + - patch + - update + - apiGroups: + - serving.kserve.io + resources: + - clusterservingruntimes + - clusterservingruntimes/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.kserve.io + resources: + - clusterservingruntimes/status + verbs: + - get + - patch + - update + - apiGroups: + - serving.kserve.io + resources: + - clusterstoragecontainers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.kserve.io + resources: + - inferencegraphs + - inferencegraphs/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.kserve.io + resources: + - inferencegraphs/status + verbs: + - get + - patch + - update + - apiGroups: + - serving.kserve.io + resources: + - inferenceservices + - inferenceservices/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.kserve.io + resources: + - inferenceservices/status + verbs: + - get + - patch + - update + - apiGroups: + - serving.kserve.io + resources: + - servingruntimes + - servingruntimes/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.kserve.io + resources: + - servingruntimes/status + verbs: + - get + - patch + - update + - apiGroups: + - serving.kserve.io + resources: + - trainedmodels + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - serving.kserve.io + resources: + - trainedmodels/status + verbs: + - get + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-proxy-role +rules: + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.authorization.kubeflow.org/aggregate-to-kubeflow-kserve-admin: "true" +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true" + name: kubeflow-kserve-admin +rules: [] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true" + rbac.authorization.kubeflow.org/aggregate-to-kubeflow-kserve-admin: "true" + name: kubeflow-kserve-edit +rules: + - apiGroups: + - serving.kserve.io + resources: + - inferenceservices + - servingruntimes + verbs: + - get + - list + - watch + - create + - delete + - deletecollection + - patch + - update + - apiGroups: + - serving.knative.dev + resources: + - services + - services/status + - routes + - routes/status + - configurations + - configurations/status + - revisions + - revisions/status + verbs: + - get + - list + - watch + - create + - delete + - deletecollection + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + rbac.authorization.kubeflow.org/aggregate-to-kubeflow-view: "true" + name: kubeflow-kserve-view +rules: + - apiGroups: + - serving.kserve.io + resources: + - inferenceservices + - servingruntimes + verbs: + - get + - list + - watch + - apiGroups: + - serving.knative.dev + resources: + - services + - services/status + - routes + - routes/status + - configurations + - configurations/status + - revisions + - revisions/status + verbs: + - get + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-leader-election-rolebinding + namespace: kubeflow +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kserve-leader-election-role +subjects: + - kind: ServiceAccount + name: kserve-controller-manager + namespace: kubeflow +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kserve-manager-role +subjects: + - kind: ServiceAccount + name: kserve-controller-manager + namespace: kubeflow +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kserve-proxy-role +subjects: + - kind: ServiceAccount + name: kserve-controller-manager + namespace: kubeflow +--- +apiVersion: v1 +data: + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# ====================================== EXPLAINERS CONFIGURATION ======================================\n# Example\nexplainers: |-\n {\n \"art\": {\n \"image\" : \"kserve/art-explainer\",\n \"defaultImageVersion\": \"latest\"\n }\n }\n# Art Explainer runtime configuration\n explainers: |-\n {\n # Art explainer runtime configuration\n \"art\": {\n # image contains the default Art explainer serving runtime image uri.\n \"image\" : \"kserve/art-explainer\",\n \n # defautltImageVersion contains the Art explainer serving runtime default image version.\n \"defaultImageVersion\": \"latest\"\n }\n }\n \n # ====================================== STORAGE INITIALIZER CONFIGURATION ======================================\n # Example\n storageInitializer: |-\n {\n \"image\" : \"kserve/storage-initializer:v0.13.0\",\n \"memoryRequest\": \"100Mi\",\n \"memoryLimit\": \"1Gi\",\n \"cpuRequest\": \"100m\",\n \"cpuLimit\": \"1\",\n \"caBundleConfigMapName\": \"\",\n \"caBundleVolumeMountPath\": \"/etc/ssl/custom-certs\",\n \"enableDirectPvcVolumeMount\": false,\n \"enableModelcar\": false,\n \"cpuModelcar\": \"10m\",\n \"memoryModelcar\": \"15Mi\"\n }\n storageInitializer: |-\n {\n # image contains the default storage initializer image uri.\n \"image\" : \"kserve/storage-initializer:v0.13.0\",\n \n # memoryRequest is the requests.memory to set for the storage initializer init container.\n \"memoryRequest\": \"100Mi\",\n \n # memoryLimit is the limits.memory to set for the storage initializer init container.\n \"memoryLimit\": \"1Gi\",\n \n # cpuRequest is the requests.cpu to set for the storage initializer init container.\n \"cpuRequest\": \"100m\",\n \n # cpuLimit is the limits.cpu to set for the storage initializer init container.\n \"cpuLimit\": \"1\",\n \n # caBundleConfigMapName is the ConfigMap will be copied to a user namespace for the storage initializer init container.\n \"caBundleConfigMapName\": \"\",\n\n # caBundleVolumeMountPath is the mount point for the configmap set by caBundleConfigMapName for the storage initializer init container.\n \"caBundleVolumeMountPath\": \"/etc/ssl/custom-certs\",\n\n # enableDirectPvcVolumeMount controls whether users can mount pvc volumes directly.\n # if pvc volume is provided in storageuri then the pvc volume is directly mounted to /mnt/models in the user container.\n # rather than symlink it to a shared volume. For more info see https://github.com/kserve/kserve/issues/2737\n \"enableDirectPvcVolumeMount\": true,\n\n # enableModelcar enabled allows you to directly access an OCI container image by\n # using a source URL with an \"oci://\" schema.\n \"enableModelcar\": false,\n\n # cpuModelcar is the cpu request and limit that is used for the passive modelcar container. It can be\n # set very low, but should be allowed by any Kubernetes LimitRange that might apply.\n \"cpuModelcar\": \"10m\",\n\n # cpuModelcar is the memory request and limit that is used for the passive modelcar container. It can be\n # set very low, but should be allowed by any Kubernetes LimitRange that might apply.\n \"memoryModelcar\": \"15Mi\",\n\n # uidModelcar is the UID under with which the modelcar process and the main container is running.\n # Some Kubernetes clusters might require this to be root (0). If not set the user id is left untouched (default)\n \"uidModelcar\": 10\n }\n \n # ====================================== CREDENTIALS ======================================\n # Example\n credentials: |-\n {\n \"storageSpecSecretName\": \"storage-config\",\n \"storageSecretNameAnnotation\": \"serving.kserve.io/storageSecretName\",\n \"gcs\": {\n \"gcsCredentialFileName\": \"gcloud-application-credentials.json\"\n },\n \"s3\": {\n \"s3AccessKeyIDName\": \"AWS_ACCESS_KEY_ID\",\n \"s3SecretAccessKeyName\": \"AWS_SECRET_ACCESS_KEY\",\n \"s3Endpoint\": \"\",\n \"s3UseHttps\": \"\",\n \"s3Region\": \"\",\n \"s3VerifySSL\": \"\",\n \"s3UseVirtualBucket\": \"\",\n \"s3UseAccelerate\": \"\",\n \"s3UseAnonymousCredential\": \"\",\n \"s3CABundle\": \"\"\n }\n }\n # This is a global configuration used for downloading models from the cloud storage.\n # You can override this configuration by specifying the annotations on service account or static secret.\n # https://kserve.github.io/website/master/modelserving/storage/s3/s3/\n # For a quick reference about AWS ENV variables:\n # AWS Cli: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html\n # Boto: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#using-environment-variables\n #\n # The `s3AccessKeyIDName` and `s3SecretAccessKeyName` fields are only used from this configmap when static credentials (IAM User Access Key Secret)\n # are used as the authentication method for AWS S3.\n # The rest of the fields are used in both authentication methods (IAM Role for Service Account & IAM User Access Key Secret) if a non-empty value is provided.\n credentials: |-\n {\n # storageSpecSecretName contains the secret name which has the credentials for downloading the model.\n # This option is used when specifying the storage spec on isvc yaml.\n \"storageSpecSecretName\": \"storage-config\",\n\n # The annotation can be specified on isvc yaml to allow overriding with the secret name reference from the annotation value.\n # When using storageUri the order of the precedence is: secret name reference annotation > secret name references from service account\n # When using storageSpec the order of the precedence is: secret name reference annotation > storageSpecSecretName in configmap\n\n # Configuration for google cloud storage\n \"gcs\": {\n # gcsCredentialFileName specifies the filename of the gcs credential\n \"gcsCredentialFileName\": \"gcloud-application-credentials.json\"\n },\n \n # Configuration for aws s3 storage. This add the corresponding environmental variables to the storage initializer init container.\n # For more info on s3 storage see https://kserve.github.io/website/master/modelserving/storage/s3/s3/\n \"s3\": {\n # s3AccessKeyIDName specifies the s3 access key id name\n \"s3AccessKeyIDName\": \"AWS_ACCESS_KEY_ID\",\n \n # s3SecretAccessKeyName specifies the s3 secret access key name\n \"s3SecretAccessKeyName\": \"AWS_SECRET_ACCESS_KEY\",\n \n # s3Endpoint specifies the s3 endpoint\n \"s3Endpoint\": \"\",\n \n # s3UseHttps controls whether to use secure https or unsecure http to download models.\n # Allowed values are 0 and 1.\n \"s3UseHttps\": \"\",\n \n # s3Region specifies the region of the bucket.\n \"s3Region\": \"\",\n \n # s3VerifySSL controls whether to verify the tls/ssl certificate.\n \"s3VerifySSL\": \"\",\n \n # s3UseVirtualBucket configures whether it is a virtual bucket or not.\n \"s3UseVirtualBucket\": \"\",\n\n # s3UseAccelerate configures whether to use transfer acceleration.\n \"s3UseAccelerate\": \"\",\n \n # s3UseAnonymousCredential configures whether to use anonymous credentials to download the model or not.\n \"s3UseAnonymousCredential\": \"\",\n \n # s3CABundle specifies the path to a certificate bundle to use for HTTPS certificate validation.\n \"s3CABundle\": \"\"\n }\n }\n \n # ====================================== INGRESS CONFIGURATION ======================================\n # Example\n ingress: |-\n {\n \"ingressGateway\" : \"knative-serving/knative-ingress-gateway\",\n \"ingressService\" : \"istio-ingressgateway.istio-system.svc.cluster.local\",\n \"localGateway\" : \"knative-serving/knative-local-gateway\",\n \"localGatewayService\" : \"knative-local-gateway.istio-system.svc.cluster.local\",\n \"ingressDomain\" : \"example.com\",\n \"additionalIngressDomains\": [\"additional-example.com\", \"additional-example-1.com\"],\n \"ingressClassName\" : \"istio\",\n \"domainTemplate\": \"{{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }}\",\n \"urlScheme\": \"http\",\n \"disableIstioVirtualHost\": false,\n \"disableIngressCreation\": false\n }\n ingress: |-\n {\n # ingressGateway specifies the ingress gateway to serve external traffic.\n # The gateway should be specified in format /\n # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer.\n \"ingressGateway\" : \"knative-serving/knative-ingress-gateway\",\n \n # ingressService specifies the hostname of the ingress service.\n # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer.\n \"ingressService\" : \"istio-ingressgateway.istio-system.svc.cluster.local\",\n \n # localGateway specifies the gateway which handles the network traffic within the cluster.\n # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer.\n \"localGateway\" : \"knative-serving/knative-local-gateway\",\n \n # localGatewayService specifies the hostname of the local gateway service.\n # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer.\n \"localGatewayService\" : \"knative-local-gateway.istio-system.svc.cluster.local\",\n \n # ingressDomain specifies the domain name which is used for creating the url.\n # If ingressDomain is empty then example.com is used as default domain.\n # NOTE: This configuration only applicable for raw deployment.\n \"ingressDomain\" : \"example.com\",\n\n # additionalIngressDomains specifies the additional domain names which are used for creating the url.\n \"additionalIngressDomains\": [\"additional-example.com\", \"additional-example-1.com\"]\n\n # ingressClassName specifies the ingress controller to use for ingress traffic.\n # This is optional and if omitted the default ingress in the cluster is used.\n # https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class\n # NOTE: This configuration only applicable for raw deployment.\n \"ingressClassName\" : \"istio\",\n \n # domainTemplate specifies the template for generating domain/url for each inference service by combining variable from:\n # Name of the inference service ( {{ .Name}} )\n # Namespace of the inference service ( {{ .Namespace }} )\n # Annotation of the inference service ( {{ .Annotations.key }} )\n # Label of the inference service ( {{ .Labels.key }} )\n # IngressDomain ( {{ .IngressDomain }} )\n # If domain template is empty the default template {{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }} is used.\n # NOTE: This configuration only applicable for raw deployment.\n \"domainTemplate\": \"{{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }}\",\n \n # urlScheme specifies the url scheme to use for inference service and inference graph.\n # If urlScheme is empty then by default http is used.\n \"urlScheme\": \"http\",\n \n # disableIstioVirtualHost controls whether to use istio as network layer.\n # By default istio is used as the network layer. When DisableIstioVirtualHost is true, KServe does not\n # create the top level virtual service thus Istio is no longer required for serverless mode.\n # By setting this field to true, user can use other networking layers supported by knative.\n # For more info https://github.com/kserve/kserve/pull/2380, https://kserve.github.io/website/master/admin/serverless/kourier_networking/.\n # NOTE: This configuration is only applicable to serverless deployment.\n \"disableIstioVirtualHost\": false,\n\n # disableIngressCreation controls whether to disable ingress creation for raw deployment mode.\n \"disableIngressCreation\": false,\n \n # pathTemplate specifies the template for generating path based url for each inference service.\n # The following variables can be used in the template for generating url.\n # Name of the inference service ( {{ .Name}} )\n # Namespace of the inference service ( {{ .Namespace }} )\n # For more info https://github.com/kserve/kserve/issues/2257.\n # NOTE: This configuration only applicable to serverless deployment.\n \"pathTemplate\": \"/serving/{{ .Namespace }}/{{ .Name }}\"\n }\n \n # ====================================== LOGGER CONFIGURATION ======================================\n # Example\n logger: |-\n {\n \"image\" : \"kserve/agent:v0.13.0\",\n \"memoryRequest\": \"100Mi\",\n \"memoryLimit\": \"1Gi\",\n \"cpuRequest\": \"100m\",\n \"cpuLimit\": \"1\",\n \"defaultUrl\": \"http://default-broker\"\n }\n logger: |-\n {\n # image contains the default logger image uri.\n \"image\" : \"kserve/agent:v0.13.0\",\n \n # memoryRequest is the requests.memory to set for the logger container.\n \"memoryRequest\": \"100Mi\",\n \n # memoryLimit is the limits.memory to set for the logger container.\n \"memoryLimit\": \"1Gi\",\n \n # cpuRequest is the requests.cpu to set for the logger container.\n \"cpuRequest\": \"100m\",\n \n # cpuLimit is the limits.cpu to set for the logger container.\n \"cpuLimit\": \"1\",\n \n # defaultUrl specifies the default logger url. If logger is not specified in the resource this url is used.\n \"defaultUrl\": \"http://default-broker\"\n }\n \n # ====================================== BATCHER CONFIGURATION ======================================\n # Example\n batcher: |-\n {\n \"image\" : \"kserve/agent:v0.13.0\",\n \"memoryRequest\": \"1Gi\",\n \"memoryLimit\": \"1Gi\",\n \"cpuRequest\": \"1\",\n \"cpuLimit\": \"1\",\n \"maxBatchSize\": \"32\",\n \"maxLatency\": \"5000\"\n }\n batcher: |-\n {\n # image contains the default batcher image uri.\n \"image\" : \"kserve/agent:v0.13.0\",\n \n # memoryRequest is the requests.memory to set for the batcher container.\n \"memoryRequest\": \"1Gi\",\n \n # memoryLimit is the limits.memory to set for the batcher container.\n \"memoryLimit\": \"1Gi\",\n \n # cpuRequest is the requests.cpu to set for the batcher container.\n \"cpuRequest\": \"1\",\n \n # cpuLimit is the limits.cpu to set for the batcher container.\n \"cpuLimit\": \"1\"\n\n # maxBatchSize is the default maximum batch size for batcher.\n \"maxBatchSize\": \"32\",\n\n # maxLatency is the default maximum latency in milliseconds for batcher to wait and collect the batch.\n \"maxLatency\": \"5000\"\n }\n \n # ====================================== AGENT CONFIGURATION ======================================\n # Example\n agent: |-\n {\n \"image\" : \"kserve/agent:v0.13.0\",\n \"memoryRequest\": \"100Mi\",\n \"memoryLimit\": \"1Gi\",\n \"cpuRequest\": \"100m\",\n \"cpuLimit\": \"1\"\n }\n agent: |-\n {\n # image contains the default agent image uri.\n \"image\" : \"kserve/agent:v0.13.0\",\n \n # memoryRequest is the requests.memory to set for the agent container.\n \"memoryRequest\": \"100Mi\",\n \n # memoryLimit is the limits.memory to set for the agent container.\n \"memoryLimit\": \"1Gi\",\n \n # cpuRequest is the requests.cpu to set for the agent container.\n \"cpuRequest\": \"100m\",\n \n # cpuLimit is the limits.cpu to set for the agent container.\n \"cpuLimit\": \"1\"\n }\n \n # ====================================== ROUTER CONFIGURATION ======================================\n # Example\n router: |-\n {\n \"image\" : \"kserve/router:v0.13.0\",\n \"memoryRequest\": \"100Mi\",\n \"memoryLimit\": \"1Gi\",\n \"cpuRequest\": \"100m\",\n \"cpuLimit\": \"1\",\n \"headers\": {\n \"propagate\": []\n }\n }\n # router is the implementation of inference graph.\n router: |-\n {\n # image contains the default router image uri.\n \"image\" : \"kserve/router:v0.13.0\",\n \n # memoryRequest is the requests.memory to set for the router container.\n \"memoryRequest\": \"100Mi\",\n \n # memoryLimit is the limits.memory to set for the router container.\n \"memoryLimit\": \"1Gi\",\n \n # cpuRequest is the requests.cpu to set for the router container.\n \"cpuRequest\": \"100m\",\n \n # cpuLimit is the limits.cpu to set for the router container.\n \"cpuLimit\": \"1\",\n \n # Propagate the specified headers to all the steps specified in an InferenceGraph. \n # You can either specify the exact header names or use [Golang supported regex patterns]\n # (https://pkg.go.dev/regexp/syntax@go1.21.3#hdr-Syntax) to propagate multiple headers.\n \"headers\": {\n \"propagate\": [\n \"Authorization\",\n \"Test-Header-*\",\n \"*Trace-Id*\"\n ]\n }\n }\n \n # ====================================== DEPLOYMENT CONFIGURATION ======================================\n # Example\n deploy: |-\n {\n \"defaultDeploymentMode\": \"Serverless\"\n }\n deploy: |-\n {\n # defaultDeploymentMode specifies the default deployment mode of the kserve. The supported values are\n # Serverless, RawDeployment and ModelMesh. Users can override the deployment mode at service level\n # by adding the annotation serving.kserve.io/deploymentMode.For more info on deployment mode visit\n # Serverless https://kserve.github.io/website/master/admin/serverless/serverless/\n # RawDeployment https://kserve.github.io/website/master/admin/kubernetes_deployment/\n # ModelMesh https://kserve.github.io/website/master/admin/modelmesh/\n \"defaultDeploymentMode\": \"Serverless\"\n }\n \n # ====================================== METRICS CONFIGURATION ======================================\n # Example\n metricsAggregator: |-\n {\n \"enableMetricAggregation\": \"false\",\n \"enablePrometheusScraping\" : \"false\"\n }\n # For more info see https://github.com/kserve/kserve/blob/master/qpext/README.md\n metricsAggregator: |-\n {\n # enableMetricAggregation configures metric aggregation annotation. This adds the annotation serving.kserve.io/enable-metric-aggregation to every\n # service with the specified boolean value. If true enables metric aggregation in queue-proxy by setting env vars in the queue proxy container\n # to configure scraping ports.\n \"enableMetricAggregation\": \"false\",\n \n # enablePrometheusScraping configures metric aggregation annotation. This adds the annotation serving.kserve.io/enable-metric-aggregation to every\n # service with the specified boolean value. If true, prometheus annotations are added to the pod. If serving.kserve.io/enable-metric-aggregation is false,\n # the prometheus port is set with the default prometheus scraping port 9090, otherwise the prometheus port annotation is set with the metric aggregation port.\n \"enablePrometheusScraping\" : \"false\"\n }" + agent: |- + { + "image" : "kserve/agent:v0.13.0", + "memoryRequest": "100Mi", + "memoryLimit": "1Gi", + "cpuRequest": "100m", + "cpuLimit": "1" + } + batcher: |- + { + "image" : "kserve/agent:v0.13.0", + "memoryRequest": "1Gi", + "memoryLimit": "1Gi", + "cpuRequest": "1", + "cpuLimit": "1", + "maxBatchSize": "32", + "maxLatency": "5000" + } + credentials: |- + { + "storageSpecSecretName": "storage-config", + "storageSecretNameAnnotation": "serving.kserve.io/storageSecretName", + "gcs": { + "gcsCredentialFileName": "gcloud-application-credentials.json" + }, + "s3": { + "s3AccessKeyIDName": "AWS_ACCESS_KEY_ID", + "s3SecretAccessKeyName": "AWS_SECRET_ACCESS_KEY", + "s3Endpoint": "", + "s3UseHttps": "", + "s3Region": "", + "s3VerifySSL": "", + "s3UseVirtualBucket": "", + "s3UseAccelerate": "", + "s3UseAnonymousCredential": "", + "s3CABundle": "" + } + } + deploy: |- + { + "defaultDeploymentMode": "Serverless" + } + explainers: |- + { + "art": { + "image" : "kserve/art-explainer", + "defaultImageVersion": "latest" + } + } + ingress: |- + { + "ingressGateway": "kubeflow/kubeflow-gateway", + "ingressService": "istio-ingressgateway.istio-system.svc.cluster.local", + "localGateway": "knative-serving/knative-local-gateway", + "localGatewayService": "knative-local-gateway.istio-system.svc.cluster.local", + "ingressDomain": "example.com", + "ingressClassName": "istio", + "domainTemplate": "{{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }}", + "urlScheme": "http", + "disableIstioVirtualHost": false, + "disableIngressCreation": false + } + logger: |- + { + "image" : "kserve/agent:v0.13.0", + "memoryRequest": "100Mi", + "memoryLimit": "1Gi", + "cpuRequest": "100m", + "cpuLimit": "1", + "defaultUrl": "http://default-broker" + } + metricsAggregator: |- + { + "enableMetricAggregation": "false", + "enablePrometheusScraping" : "false" + } + router: |- + { + "image" : "kserve/router:v0.13.0", + "memoryRequest": "100Mi", + "memoryLimit": "1Gi", + "cpuRequest": "100m", + "cpuLimit": "1" + } + storageInitializer: |- + { + "image" : "kserve/storage-initializer:v0.13.0", + "memoryRequest": "100Mi", + "memoryLimit": "1Gi", + "cpuRequest": "100m", + "cpuLimit": "1", + "caBundleConfigMapName": "", + "caBundleVolumeMountPath": "/etc/ssl/custom-certs", + "enableDirectPvcVolumeMount": true, + "enableModelcar": false, + "cpuModelcar": "10m", + "memoryModelcar": "15Mi" + } +kind: ConfigMap +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: inferenceservice-config + namespace: kubeflow +--- +apiVersion: v1 +kind: Secret +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-webhook-server-secret + namespace: kubeflow +--- +apiVersion: v1 +kind: Service +metadata: + annotations: + prometheus.io/port: "8443" + prometheus.io/scheme: https + prometheus.io/scrape: "true" + labels: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager + controller-tools.k8s.io: "1.0" + name: kserve-controller-manager-metrics-service + namespace: kubeflow +spec: + ports: + - name: https + port: 8443 + targetPort: https + selector: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager + controller-tools.k8s.io: "1.0" +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager + controller-tools.k8s.io: "1.0" + name: kserve-controller-manager-service + namespace: kubeflow +spec: + ports: + - port: 8443 + protocol: TCP + targetPort: https + selector: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager + controller-tools.k8s.io: "1.0" +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: kserve-webhook-server-service + namespace: kubeflow +spec: + ports: + - port: 443 + targetPort: webhook-server + selector: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager + controller-tools.k8s.io: "1.0" + name: kserve-controller-manager + namespace: kubeflow +spec: + selector: + matchLabels: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager + controller-tools.k8s.io: "1.0" + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + sidecar.istio.io/inject: "false" + labels: + app: kserve + app.kubernetes.io/name: kserve + control-plane: kserve-controller-manager + controller-tools.k8s.io: "1.0" + spec: + containers: + - args: + - --metrics-addr=127.0.0.1:8080 + - --leader-elect + command: + - /manager + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SECRET_NAME + value: kserve-webhook-server-cert + image: kserve/kserve-controller:v0.13.0 + imagePullPolicy: Always + livenessProbe: + failureThreshold: 5 + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 10 + timeoutSeconds: 5 + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + readinessProbe: + failureThreshold: 10 + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 10 + periodSeconds: 5 + timeoutSeconds: 5 + resources: + limits: + cpu: 100m + memory: 300Mi + requests: + cpu: 100m + memory: 200Mi + securityContext: + allowPrivilegeEscalation: false + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=10 + image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + securityContext: + runAsNonRoot: true + serviceAccountName: kserve-controller-manager + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: kserve-webhook-server-cert +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: serving-cert + namespace: kubeflow +spec: + commonName: kserve-webhook-server-service.kubeflow.svc + dnsNames: + - kserve-webhook-server-service.kubeflow.svc + issuerRef: + kind: Issuer + name: selfsigned-issuer + secretName: kserve-webhook-server-cert +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app: kserve + app.kubernetes.io/name: kserve + name: selfsigned-issuer + namespace: kubeflow +spec: + selfSigned: {} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: kubeflow/serving-cert + creationTimestamp: null + labels: + app: kserve + app.kubernetes.io/name: kserve + name: inferenceservice.serving.kserve.io +webhooks: + - admissionReviewVersions: + - v1beta1 + clientConfig: + caBundle: Cg== + service: + name: kserve-webhook-server-service + namespace: kubeflow + path: /mutate-serving-kserve-io-v1beta1-inferenceservice + failurePolicy: Fail + name: inferenceservice.kserve-webhook-server.defaulter + rules: + - apiGroups: + - serving.kserve.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - inferenceservices + sideEffects: None + - admissionReviewVersions: + - v1beta1 + clientConfig: + caBundle: Cg== + service: + name: kserve-webhook-server-service + namespace: kubeflow + path: /mutate-pods + failurePolicy: Fail + name: inferenceservice.kserve-webhook-server.pod-mutator + namespaceSelector: + matchExpressions: + - key: control-plane + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: serving.kserve.io/inferenceservice + operator: Exists + reinvocationPolicy: IfNeeded + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: kubeflow/serving-cert + creationTimestamp: null + labels: + app: kserve + app.kubernetes.io/name: kserve + name: clusterservingruntime.serving.kserve.io +webhooks: + - admissionReviewVersions: + - v1beta1 + clientConfig: + caBundle: Cg== + service: + name: kserve-webhook-server-service + namespace: kubeflow + path: /validate-serving-kserve-io-v1alpha1-clusterservingruntime + failurePolicy: Fail + name: clusterservingruntime.kserve-webhook-server.validator + rules: + - apiGroups: + - serving.kserve.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - clusterservingruntimes + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: kubeflow/serving-cert + creationTimestamp: null + labels: + app: kserve + app.kubernetes.io/name: kserve + name: inferencegraph.serving.kserve.io +webhooks: + - admissionReviewVersions: + - v1beta1 + clientConfig: + caBundle: Cg== + service: + name: kserve-webhook-server-service + namespace: kubeflow + path: /validate-serving-kserve-io-v1alpha1-inferencegraph + failurePolicy: Fail + name: inferencegraph.kserve-webhook-server.validator + rules: + - apiGroups: + - serving.kserve.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - inferencegraphs + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: kubeflow/serving-cert + creationTimestamp: null + labels: + app: kserve + app.kubernetes.io/name: kserve + name: inferenceservice.serving.kserve.io +webhooks: + - admissionReviewVersions: + - v1beta1 + clientConfig: + caBundle: Cg== + service: + name: kserve-webhook-server-service + namespace: kubeflow + path: /validate-serving-kserve-io-v1beta1-inferenceservice + failurePolicy: Fail + name: inferenceservice.kserve-webhook-server.validator + rules: + - apiGroups: + - serving.kserve.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - inferenceservices + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: kubeflow/serving-cert + creationTimestamp: null + labels: + app: kserve + app.kubernetes.io/name: kserve + name: servingruntime.serving.kserve.io +webhooks: + - admissionReviewVersions: + - v1beta1 + clientConfig: + caBundle: Cg== + service: + name: kserve-webhook-server-service + namespace: kubeflow + path: /validate-serving-kserve-io-v1alpha1-servingruntime + failurePolicy: Fail + name: servingruntime.kserve-webhook-server.validator + rules: + - apiGroups: + - serving.kserve.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - servingruntimes + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: kubeflow/serving-cert + creationTimestamp: null + labels: + app: kserve + app.kubernetes.io/name: kserve + name: trainedmodel.serving.kserve.io +webhooks: + - admissionReviewVersions: + - v1beta1 + clientConfig: + caBundle: Cg== + service: + name: kserve-webhook-server-service + namespace: kubeflow + path: /validate-serving-kserve-io-v1alpha1-trainedmodel + failurePolicy: Fail + name: trainedmodel.kserve-webhook-server.validator + rules: + - apiGroups: + - serving.kserve.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - trainedmodels + sideEffects: None \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kserve/values_lint.yaml b/packs/kubeflow-1.9.1/charts/kserve/values_lint.yaml new file mode 100644 index 00000000..e69de29b diff --git a/packs/kubeflow-1.9.1/charts/kubeflow-0.5.1.tgz b/packs/kubeflow-1.9.1/charts/kubeflow-0.5.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..0ad49be3736b8422ca3cdd2138ab476c329e99a2 GIT binary patch literal 81408 zcmV)zK#{*6iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvHbK5o+KaB6+dKDNoohJRQWJ$iIp2_bS$8lP3r&X*3#*jt&m||BgnZ?0-l54QIVF^|cCqIC zW2D?xmbooS+6w&!9T(Zw3D`_}+G-X5IUfEr9QO?9>JD0A|EE*%3pAHN_jCo!YzO=r zs!wmJAq#8Bf{uIA8vsjN!jt4H0BgrQ0Sk;*?#bTX9O1=!I@Imu-h*Q=HOqed>0mEX z#lcdu&o<`BGC*e(VqZ*sZ4 z-(4>+07>rQO2dorSI=C0{_HjMB3l-lULN=JX8qAhfa~`0RWzbIsq3L zEVXBVwFd|^FoTa^iL5n-u0J(-Dos`iE^Yv}!4v{*qaoAN)L~Ftkp6A2fv#ELQN#Me zFCFj+>=`)}eh}_vccX*BBTwi3kaXVN`R#8PXO#Z)YvXB_qdhPfL}nlKKY#9j{v3|N zm&h{U6Nq}+B*YjEK`?sd53->@(t`2S|3c~igp(7G)=anh%rZyfnYnf`bS`c#O_Ii>vcnnzdQk1|N$rA|X+2Pbhcj__V~9DE>JxM{x)De?u<9 zQ9q9-$HUQZG#sD29=#rUBW>+M@NBOga$@QC0Ej5(qS&KiFteRU%`ph_y*5r>q=iBn z_O_?htx2@?p8;2<{k()$Mf<_B_21!moLT=JO^(OA^Yp=>cGBQ)s#;{w(V+8FNK~9A1IHf#pp)76u1iVb36)gzGjm1D1{B z89-ZO+toD_S#xs534jBAJLCG~MY+Qt&+N5@b4x)0Txdca+fG2_(wqA~5LC11j*5Mt z(0>%v91W~L{gqqcA{KrBI-v@qy#nZ%4I>6(4fpLlD$bU%5c z!*&t2oo8^90p#OxR{-EG zn@+%9_E(>r48ac63{+$7uDy12=$0x=oRgs@xq<9$6z@WFkYpo&RT{v#_O#gySqKxF z5&cqaJJ>d%leMzMkCLsmJ&{W$+WKz+%@uT#e+=f9UNxXf5(%_(Qf_M zMEd-B@5kQx(@L`p|IEWPy1<_K|MrjhhrJ*7!u`1cXUNL$fCtHEa+>hxx7e6yOL)D3 zj)M#c{s!1tTRJ$}_y38Ock9^RR%v_u#h-u4wQkPBW; zpM6ohySnr8B5UrieqIfG7c<}l8`hwb_|PJ7j`+VJ3?7kbf+_Si!v@e?p!vjy)UqX; zETtpq634C4$5^0Y7Up*zftzkz&kLXUlQ;Z5n$Q@FA*dvK^bydR`caU$m4hri1O4ya z!S~(*HC0#8D8GKu|C!P{qC34Y5;~l`uJpS!)Q=#Szs4@=RzF+Pr&(S|F$e#S7FvJ% zn;T7sp#T5tgZ`(!_#m>EOWO*!0YxPG`QnY4N9qEa%b~m2^QmVnvqR2?LEE$pLB076 z2BF`S^<^)Av=;mPlC?BZo_%yZkw+d{fLst9`#=LA3+TbYD_Gh_p`A*OiY~pJ zVX;KRF?1}=dG>S_f_@*ognz~sBwZHtqr$J^(&BU{CyD{(_t)>PPyCa}h?1G@02?o$ zu&DNf^)(mZl6*Cs}5mnPS~*JK~`XPW84K6sf|9aax{D_Zzx zSOF&~nYvuvUP0s5HsM=j8OWOdiY$XdV|a>BWbA`}>aVuwE+;sov|19g+Uzduwdv_E zhI7Z8bo>pA4jnuQ%#>3&sXzx`2H7sc8jx*8M`LU)jWo2lJe~Y_{GHj$m2G+3BLCQa z*z27wG;1C>jgbpxYfJY%%Kk#gfiuq%0&fB}O`ykxy{Xk*Pm>?4pteHO8f49^LSMum zuEJGJ=*t2lGEZ<~LVO*wYRIr3&jcZ%-f|Glkj^z3gcOsLD{Hb0vohz)?8KBMM`)5_ zG)AAN;{3scLnSEHmog$ED-e&RoeZ_kM{@efF{cpeD1F2@cKcnJ35ZcimNLiu*Mfby{8=uv1H+re%i0BT; zE-?%o?S&wT-w|G1xn#rmiD{@9#%!D-&6nu#dp9_ZO_%b2qRd{zI>sa5RZoeZyNzB4 zLtZltGd26uuvjo z3dr-4Uhm#3JBQc>nq#jm185dlIrh|qOMi`ote_qPx%%4m_Tvlaz#au>>SYW554r9d zx_gKFhp*GeR>Z+ZKnoR-P;wlW*%`!@=c~%Mmo;x?+DdVR5{er(eVSw{(_==~F?j|> z&pn78t7zseeJy0tbEa06$r(C@*tBamJ_X8@D{Ld>?H!P3NeR6rE$2!nt3d9qSt9E; z^h~$jJ&``r*e2*?2$syjFHTx1ibzEysy%IoL=!q$5+!m7NR(1aO`=$H<`AFVeEf)! z87}i~prbb7Rd{03w(7 zOMdIN_q}`az1t^9B^&aq5!3YyaHKL(X6mI%lz^lVj3>WRq?)Z(aF0O&Bnci~g?a8y zImYYV=}-?mS^2@5ZY@>DB6ql<`z>9%AO53HDL5$dtqDly#zB^jR+`DRA#*j>PAsLp zmZ!jbuC|wK##lQlp?z7F@{-`Gns}$VN zCSBJoZ|m)%<;r{x+}kF4fZ=toXcR1;16)Xi&Z2-ssrgCd7;hN@mc?IWWt;Z=`EKPv z%{a3y7dslVFs*{Yz+Gq#+|!SajMqm~ZLmN6>Gj~?r-R8rI~pAh z4v(fky?*`rCvAVc&!v_HBvJG-`pBW1w5)9XjB^+3Xq=6$rv)`pGD*(`X^qK>>WaiC zmYvWs@-l>#%3dI?s|-YvCa#jYXt|^XmKrWudEFDZ#}aWdvNEJa<}MJ{eHwR3lT~p| zluXi+N{m--;}pSA%XUqae5@@~l(j%Qrv&5L_pFJO_@5ydq{OrKuZ(->Ac0X19fTj;L#` zb8CYf+gf@nigOD)2)baUIocB9XiXnrIaa1O7kaBVpNXD-KiRR@^92ZR!|<(ep|$bv zY7#<#)}~-f5b_f=!rmUefEISVAn8KO;wQ<7|{S(*DxscD}26%v-IBZMf}O% zgD?v{z~>B^{#Gql$QP`ilelXWONVq&kgWK>`$gY7_A}Pb zKUhuVV%E7%0TaXEkZ0I?B}Hq|p5A5i7++bmOX+N=a6+>7GG{m=OAmb0QJC zK_8p$K!=XEX_g|(D|_L(>);%!8k$^a&RjINpfT`K1&#u3)lucuCP_#*AoH|{ks#If zQbQJjZll|dKp-r&CoZ7B5+52>P#q$g%LX_f^Aso`4@nQR8^bf?7F~oZ+X&Ze?!YT+ zN$QH%%(;PZc`MLBvI^-n@*9GW<&A6*d{k(}7Z{)Vv4$k6ePZKk zu`Sd=bkPnuFVJxJSk0`km4wPk@z#a|E}mZ@XHetCi}yHluwv)89P;2(lHQZv`gAl05MEF^#+e(1# zh2mhAEfWh-uvj=`M!9Y-ftmC3N0#j$DU&z}13+D6FwVvY>fZi#R3o zm$9+3jd#d(*8cMWZ`Z~g;$n7a1w?I~2zD@k6k7rzEEEm9aG9W3C5xrSEF~;50w5?L ztWscGp|lE0mx+s6v{+v3Vsb-=22d+@M5PLpaY^PbW-OIc(ruH+j+OKtk-xmZ;>=|| zlw_1N?HOcOvDJ<(ET-M>+_^e`}lMe3%RHdS2o}WR>UV?}XGtI+Ue#CA74WL4lCro) z*{WVO2AcYc5*Pl<+qO8GX=v_ZYHN;BDgMhxe&z9ByZ7H3Ntr7{nU3a$f8{iU4gbn! z<#XES8mJ!qRltK7`YTsa!{{%DtTNM936-1x?QA7Z&dttGpPV8%{IHv98`fFCf(9FI zhw%V#Z7~pQ!Dp(+gQ=Nvgz#OSE!&e6R#DYx%U-c9S?A>pF;8r>+<>muS;;kkS+d)zaTixgc45EBI*4g=a)pP3bO8`~*rAILE2re4l~3VC<{0MM-&Lx3dfEIGxJ4-e*Ze|~ z+QW8SS50_P(<=SK@=(`KKiwZKy&$R29bLe#q&r$>5!1H2YL_ZbT>f7JK9R;s^f}Oy z_unT6#|K&e?_@IC`G1>8{uKWXJ^?apD6iKyqZe$SuK}O<+`O3@t9SA;NiJ~lh7#g% z!DMRB9j>z;1W9anuDlhz4^ooDk48&mD}NY-(dXso>lq3fK3%6O2;&qw%c9hJHPc{j zwHj`6UdBkK6f`RJ5MZhzl>9q*7|>r6_7g-@=~^+Hkxr?f?NwDYT5|`wE``d%#xtG6 zC1{`R@<;4S*XOMMt6+8Bw(YJWan1ihUr=1-d`p3n`G0h9yq}r>4-WQ^ck_P}>GS7! zBr<#1pSrab`Yn2R*A36@Ld8J#-ex?7SR3~qkY${J(|jGhCB&McVeO?#6#3DR_+5 z>))~+0DacZsRm;c5So_(v83SJ5#$=Eeos)qgBb8LSCRjNAAhARq*-Y=n^1lN5xeNr zoEr#NMGSvnFFGy1A^2DoE&TDna5~l^F7hLtSxA8>|3V%(=V#Bq!Hy!)G~+shx3}lV?=wJcqTp&-))) zIpu9;uBkATK8I)uF3>UQC7P5Qw;4OHt+D;D#|QTva&>zHo#!SQDWXG;yOb%qv<*0% zJDRmNwW8aP#9>)^g`gkT$QfvlgUIjUP^$SW;(VOD&|U88m7J1AUp#%iaqOq(%>E@c-95O2m6u0wwi~FBL)!d&z_9q) z1CEi+Vl{QkNQu_m1KSj`h&-|ldmZu7K|v!6j8`Xnd+H(>s#HO6-_IQ!)WTmHXYkEp;PVqAN!+&od5rDbg(=B zYa*o~e!qGh?E{d5j^;)JCS}smISRQJD9(A(!NN?@Hz>D}14XzZ>NAUGAX?J{}}VGNEQb=iG$8*Nr2>V81W0EWc$xmN2O9LdU=B^yamKg_PC0#8(MoK^;ASiqe?rHTJ332u`3oeETn z_@8{>rikCQkfSI#dB4T^rzA2;OOwD*VkA&0zoB#5ca~L5`No92b{gdGzyW=!|%3u*^*m= zL^-NDH|83*6`vjp*ox9e5_0Q54$NbI&aF1=1gno_7buN~onX&gm2l8V*oiuLs59(@ z2)#TTpmJwQeg)91GbLz0?LjG)>Ut_rG0nzGZV);V&!P+BDpWj~KpDBV8+c@a-ln8k zXz7s!ZXODIOg4l@uJum6u~0;vWG{E>jfI-|+mbgH8j-@5ys=P&EZU4!ktaqtRt05S zz#prEwkPgvtO{;og(b!nt0M1c>2|CNetIPbPFt}m3JHWh+5z^`PKj5?N2f^Rmkn5y>822NF}_00y}0RkO-;kxSplTM34E$%OHp*agLMj*dx zNskXUU9V5>pzc6i9eLPv2Oit5Bv~8HM23cuH4mTUsE)LxYDwCbYg`XyQN^;(JLpu{ zgI;ZPXH&tEQuetQvE|BR`1(o~jFWbR#n`){?Nro-tl02;GRu=Kd)S=Q`X&h5`%zM8 z@M#4dw1gIZ7tBr>m{U4@NFVf#I9pPbj}v--<+uqhezuKK+ok%F0RGdMMr#$p08nN4 z&*RY~7ys#CvcrEik!TZ8+|h#Y&qP7W(4WS1u#6V1{DwWLzb^16jRP6%XHriq(9f)( zsK`$ijaBg34(_v9>S9=hq%JAcXRZgN)LaGgS;BxEK`kIY8M>?j_$=Z_QpQ!lJ(Jox zgZ505)B&((nxN*eo~n?*;=Zi~5y+!XoPfY&LBNd%By4dVaKM~Zkeszz0s~TvS{3v+ z2nDQ?gZhDhT-0(bgn40r#KiDbp#bx8l(OC51_qEvSVcM~j{rMw{n&f|?~8we`vr0Vv^HR)IRLpp)A3p}&1ZlY5Eu^H zKu2s%0tArA;&Ad@YVNL}&Szng+~W47V1x}pu}w{i!YAZnWX%&eC}+XYAjqAsQpRr6 zGRqi^1|;USs4TD805vVIjOA-UUS5mJ^2%A!#>Xbzj5jetiI$b+7*7jL%P%t@H6S;y zMfGt?&U1~A)%+ye#CQ!`&B{&<|0jU|6n*wHP9^XE9F9ig4E}SpKiVLxPBk!RD-g~C;HErWvkM?ib!es(AX6NMsRF)KhFrD)w5$wXsR*j90!pcM z0XzxYhf8j@1|XU3v05OJbhW54Dq=0zM+wAZTR2A$1gS%z3}S-D@s5V zzYSnw;}HoPLm>)d4_ieXwh(2ogYZI02XP0XgcWeIRj|Rz_}waqpd{Dr!vR~1``2yk zUmFqrwgTu^3B0deP@gQ6uSEc#By6vFu$~Y^PXU-$3dc*6CGtpXem-g$HYYi^R1T5j z2a?G~yQ>-m$4{{`;H?RmTSeeDjw!!w2h=XLngsm6Yb5CcF7y8$@8|r#$GiAH%_Q1n zy+(pA;590Z__IbLev37#%@>@aRmL5>M(ucnW0_E$!a1sxSZc>L%#f_uf&3cDIfxVS zis`9}o0vtbAPFrvi?hn8;xDFhAS%ZyyvA$Poya>OEgcBC6H>B0v33~USc^xwP-QqB z%WK5%Q1(n@9X{n`Jd4g7EqRtn1EfT8gZ^bTn(Oy67t>d?PULkkdxrX}@-Y)46Emsb zhNrnuJXD2}cQUV0bAINiEx}>js<*j-W@=BUIhxm~i@xSGRf4_OL637~{A`uqxni!j z%KNOud;30Uj|fROw7*Oibw97s7I>fwh~$=xfb)5cw!{BiM5mzQx9f$@5Fki!OCXagQ|7DDSvY@Jp{z3z1@yMir*LmYv*6Q&{D$Zn7JB#4qXa_H2CBK5tRdl|A3# z5~6PBcZx41|2Ow?qrBfPT#RhuO|xtNCpj zn#+G6ZuKYOrS=!G$$< zR28`rtFJDkn#_Kj`0T&8a)6h%0ZsRJI6YmhscUpn7T4QQbvW(sga<>HjvbLPn@HQMO~ zF|z_bs7AiH=zgZmFcxrFw7ba{Q`zT~)usye@>GtK``B~F&1#vGt!Q*}xN!5$H|@+V z5R$AC`|*`7wUsEKrHGdP2Ej+@41!Qol9Uyq*wXYV;knp+$QlMoNF1jKI1yd>+A>E+ zoiJ76r%Cxb#J%3W5u!Vei-`3zNRPB?oZqdG-W9M$_2#c?Fd36VY3**!byG}=G(YXQ za|-E@=A}^=54(AVzUa0aRDfdnKCIL+L^sbw-opM&vPm1XdO$~YvDNnOpZEMH{D<#x z6Tbvja{p^I9v^1ke;*y}&VL$7)N$qb{meMKN%9Sxzyr%ORD&w3Kc>l&DtMzSrPvMc zW=WBh;bSi~WC8zH#8v4jT#BdYFaL&u`o#^Adn{Bs&JBds$q=~1LZ#w21RvF@px$4} zp1G{2(6Jzfu5|YW#VhK-q(Y%PNerT@=}m$rm5vRnsHSTPlGwMD;!eInD`+B1p^v@4 z;#w-|>Qz*qT2H4)tER&f%2Wq(OjtGDo)E_9^-{v3OJwlg{#! z%N|kQ)csv~it>Tvo?z~pARzLU))%>k=~M29@}u$MIk)PohdeVp_41+cG~Ed0>2aY( zc%-$B5S|_)<<~tkYXKR($}9$IXOp`4knf`OvY{dBtJ1IZ0;3_~1$8X56p=Mu`L#$R z1B$f-QnLxU3AkBasx)u8*|}L(N|dqf!;D=LPF&}IK1k;l&XJ3q=gQCjj*ku}x%0o{ z@$USuiIiFMdL0d-p5_LArS*f2`SSA(oG>Hbh9zBh^#_P7+QkkM)3r1lABrZT%)N;s z`bt1-8J*w=Rg!5e>tg1^uCU$Cbk{Rg2!8%oVThuTYrfD#c^>MFzrm7NX&?^zfGx*z zr5kMc;G3?m64sz2xC~x?ibfUJ{oTww+->hQC$Td2wJl5tn+h2&T0w#^Ns!^7N&E-B zWiIm=E;yWLIp}q|W$tj))M64wuEJ}h3{DCli$&`OA>3kyr!v%Sz4Jz0cYDO;%X_Vd zhpT$8=CXK`yq}vPoi`@Pg%9*hy*pocu`At-16^DbT$a_4jCv-etA)$5TB(JJxwFz$ zWzDLwG=mz!bxK{0336^rZ>FWgb!Fz&me7DqDr9=HZ46+2%v2V2tOLw69dfKQEH@o* ztR=?V3^pdYx?tH>k+@@&Ikd|W$OOohS(Ey++4k^XNG@Gx&aDk{Y-pEmipyCd_Y4hiex)LuhR>XWsqGf8YI|51&5Xo!@@CI=wuXIYmzzS!u5OXgdbG zp_|jYyWg*G->J2;uwBe<s!V8jj6X&Ww-F|Eu$|o8gg!72SFFC zG)G%P?1c83rZeI820S9X04q~NffD*A64(yF3&&p17oKr)ATEw?QL1CXO;sK@4;lyYEZ49Tj{SfS_gZHilCV?{i zpJ(hd@!t-{yZgV5q>LemI+}dgoO=$SX-UCE5M>`E**PZzT0=F=2*vz}0R*X)HH;H1 zkXy!$%Ry~rY&ZSZBzI5nzS2dlu%YN(#a&tz^_&sB_yxfi!;4y9qmNydj~Ka!FF83= zk-OT1nA9q(e;hNJ0|c%pGij^zvCM=t{>!yY$|`+4Goh^V2Q<06z2a*}g6dX!3y!*u z;Xtm_=Z0!yq!rl|l}WYnhd7IkV`ZE)@<3;uywrJdK$LFY#XiT*pE~I@y#0@9sNn_6 zLea`k2OYVy&?V88Dy7V$pi~+fcp#MBu7Vk9>ETczUP^mW7NJO`qEnBHmQkqC^PPHh zv>`sX*6Hcfzj>zlVUV0 z46L?pQQOr6s&eUM!VesQTF}UgVAJ%|7#?%rtg0R9WDF@AWK!)IFK-(*b{)PX6i(Nuo&XS2bRfJ z?Cy>J7R1oqTmCY_5S(UL+M@-Xj~DXKtCr4U{h(^K<)UfNZI?yl3w`ZkdwCXp z1t)JxWf)eNDHyLuXZcFKZ{G4T7E3-$#G&cJe0D`C`UIzh$Q7NMRdM66S2|yUAk0D@ zgh7}b5)lPqrmK9IT}?ltx{#P_BnQT%(O45AbB&}xnKTM(LT0WJ&$~hFEurF(d79Jq zPR*%wh#p9$E2$)QA6E#zD5HS=p-Tq{BM8&A)^eQALpWczDjcfQy0+qT_3HSnXomo8I(TF6oT1jdY~?(J(Yj8q1z_jp3$9E^3yQtzAlcM!QOLI&pU!-5Mi0Q zbSpq%d^D@6!PdaMILTI%M*CndHa)8S+$!XYNsJm-?Et^%G^laX6qtmy9#+PaWZ2;(t~feS_d5bj}0Cj`xqU@m~)2cky4ENvt*L&2MMm zH@~OVLc!1!hK&V^b1TGzp|w~iEU1`6*(fozT9=xo&2!xFc~yAi6NR)0+Yt?AL95uy zc01Md8^?aizTQ_o;a;JEGu8CL%4@F*23iZzQ_5|A?k=al8ZB(t#aAea%J~s?_i@We z)agg7xTWYfMBTFuCa!ZHUAw>7qC)q1RoERSz-zE zr>|rjJ_dHve=H(dp78B+BN>x*sF_EJTUpfY##ebat8j{{;?(6^x~C;3Oc5Qv3`T`w z0JWm=)@VevQbMYnGg^yCksVSqSONfnY8pstP7s zMl+X?RLQ!g6=ZV}C6)9Wbe72SrS!9->F@?R$TsevZd(RtPZrlu+P6i;MS8oi9yR-@ zc)OWKZhLo}3#h4j`QL$9p$#nMYq{=Rs58?2tZ?<2>X)zM0(3o`S8^GewUKM$nno(YY1LaHY8cZ3&b(7~baKqRC>MS2)Mug<7ZPiUh=Z72=B&^F+{ zV<{3V=lu`Cm*0a_^8Wkr{?UHs{>ON7u#5lNNMhL=@tYnTFa3(bth_33r<$%5l}Es@ z%S~9F_em52%Su2NIs#ANmVC#N0p)$9=4Gur{;E{4(l%nOvIwOMUEN#Reh5~DSe4xg zvsx7st%g#qh>2|oms%;S+Yk~}f#Ht0AQd*5@=uX<-yx>_=$NQeXKNfdl{stLk1eC( zg=yL2qTpR=$CD!bBADW-f9VN-p2V;S*qs0|li>N!#x~bW=vMju&-i$MbewztXMeOi z|7jwz2J3G@M=QMllU5b>=}?$Y_Whr9Gj$%!uox0PreVldsjIR zqI4x4KRxQc0P8+~qO_()aNu&fXq4>WJ&CaCDwt^FfUWYLX#WI_Nl$f*wR^hO1cR-f zyfwh!Hk`^eCWdV|vEvtpm^3PQx`;6W_rn->?h5K^%iYFfanU&vj8s#|gK&r%4vC0{ z3QAY`F#F9mtA1}M+V#l3wnHVc(&u&v3S}PKp%Pf>YdZviLT~M4w_l3qQfWrp!=X~? z5IsuFn80qmwZo9K;#)iET5AEH@(|9~tqOosTGv(#HLZ@%O5mkMRo4Fs4P){b<6L<` z*QHlz7>kD@10j8;CKTK%(*tz{)1mUOsMIZntYUO$mHadumZ~m}nh8C{O+D`jk^uwc z_E1{@4dA0$O%1jN4ZumZnl#!+3b5%>?dMie1WaPoxM~MsK&L^Clcug0v6jNh7mG6N zsJ}v!mrwg3Hen{)cB5}?;=+H}-Y#I`hm9aN@4T0RO78!RCdY>v{Kx+BXm|gokwi5P zjQ;jFXZaJZ;Anti4Oyo>wCjG64PZ1KofGXweZ`4u{IAdon#h9gP}lSYj2zq*jsK(l z!|eM{`-eOHS2HQS8@!1+8k~6@4Z@BNc7DOm@!Z-V$F`Qx3ejL-W;*~cAb{2exGSiG zmF8&v+YP~~QPIYcp;^XsxOV;f!J7=EtN-rp+4a@?i=RJzygR?;b4suqS!u5OXgfw> zLpP^)cfViXzEf>%VY|4npxs{{^D}mE8Y2Iyf3-_WzT~(eC}{MpE(qpZC^RRzcXey_V)6$~^G%%54a%zvsnf zLF@_VY&{J>AWRq3kZEcuH1ffDi|e>?kfo!QX38*26y`-i@JO8($&szg$stv_#V)1W z4nGQ-O{!eeD(`QyG*9@&&D zhE80`-X4MZ|9>9%!+nMVnI+j0H@-99^K*X+-RCEv$6d0~cgU4&b*7nauGtdDqi~eO zEX}FA>cy)k=?CYMD!4Kcgvpsn#!YYz?$n-_tB}u*fV?$c^{5ub0=$ zPz%?|Yh|dr*T)-RySvxLD`&n+u=$vYjawgrcs)J^?t+k!XrOV1OEt~nRU zK_|f#1^-K!CKS@Bsp% zG6U!p5_N{9TdWfyz~W67DUhzOHN*f-fK22-5zV3qf^=PC{&p(SN}40(e`m2kA%$ze z2{~9ZeNmUAl`3jQU2n|o$53wG4G7&HiueK31bm(TK)R5XM&q~TALJ7tua>HL(bBYZ z(3?gfP|X@`iFb{MZ(bEqcekafY2WR}q({vTb;k|Y1cR-*-+N)aJF_FXkqgiqz_SnVMEvY0Y}_v z)-&+EbiEG{|KNhDkF|7>i=l;m`Ggr~YfJZ)2WXDHwv6aR3WR5Te%{-+r)M$}WVJYncxfOVgMJju&xfSGDwVuP>8p^`SA3mCFh@Q73p%X0o6;W8Dm$xp zfBo+IBp3zAwtzhY;o&XN!p!c%UYkZh&B`O)wg8&>Y6FlP4j^OLyMgw~gkXv03k)7L z3j=IN6yXI#4zM3BX&otc1y`&mV&~hD^Y<%o4NCg|es)&6*EP`L2nJRX|LfrJFzf$2 znjB7c{=X(t>HPWg?adhox|%B-nAlLy>rq{yzY1HdH4a!|%e4drE9SM12w{aSF3qLE z9WCtg!{s|>u&|b5c=2g#-4QiJ#!Q!@d-0FFRwcLvaliO1Nvl%qa6~XZtJtm%b~jd- zxP@<3k_B^4O;XLan3HhZOFe2*U;meb088+HhlfYm_umgkOS} z-jgZPYYdFeF{k$~`1m)vHe0G$fxnQE$iJ4E0go=rs-BwASI7( zjtg;bZaDa)9Jx`C)a}Gg%Uf0JJK(&{Dt@ILwdAy|o~LG=wdM2+O=B`X+K_~=+drF; zvzqn%HvO`tBIMK5YTU6QF&%crk`yYMr7d&87IMz5C)IggLwdU7b}eWMv7qz7_EF42%2L3d~k0e{kjD0Z>zGa(`yT_rXZ z9t_FO5DG7cG{!F18zPPRe?<&O8xr&226&d;RLwr)yj6T3s$y^9q9gP4#E8bxxj+ZZ~?Z# z6oQ3j874G_y#>ZA_hfHxj__hV_2!*e`}Sh(+nbv9bkDDTZ>s4J&@%R1N8i&{D4=dn zHxab(r)BVjP3F(x-2U#v!EvwWKojX;qdCYM%C30hOU*(v=wfe(xY%Bzzu?|fb77o& zkMwEAe zT@2p50ZD|Ge|sO3=rl>O8{5Tm2NsmQxxTyq`Sv_hK~X#*FtZ(Cg!k$*+V@?cQPA4> zdHvvIaU8sb<`}wdK;xwM9T1S~(Y~(zG=6wWUj7ns6 zc71hu`hP!Myg$FcpvXz4b;Cg$*39wg-R;G1=eP9eY6TN;=r?z!AzvwL|U9>$m?pKfAxXzrH;Wd-d-8?Bng$YW=}@tR|}IT7L+lCh>{u?Z>lU&+oU{ zP#laVY9eDz(s^NR^$b1wNli?eu0z-T6+ZLH>h$dF{O<18^M7xxz{VqGtK~p^DkiqO z^RwIY`|TIrNMiaXg~wVM<|Ve(%fgYwx|tM{1Lwh22M$5qp8tGteO12nV8wN%oCd5N zTFBR)@7e{-kgsZ6^4en?avTVBD#mN+2E7%DZ9`1g!Yz9%QtNUI*TM~aJ37|kn5{zF z`F5mNe7I1TG%2lCBVEeYzZJPMk05H2Xu7>>WJw%kv?9aYK}t=s3)-Q{Okhz&IiV2@ zf?wJ3Nb{XlcurH=Yh-EB?#s7af$kTarL-$s>cLK9@=aQ=SjH_bw+haH8k1{9D>3#t zO}k>Hof$PI+qm(H1x!2FY2EHJPMVrDz$6J3i@e2cM!}&}W5TUy2f{cwYFDPY6RgIh z8noQrTM_d3Kfc%>|KNE4VSF&o;Q#jb#|Jz7UlU0f|0fX$B+(hJARr1(@LB_Y(Aba; z_K{T9UZ9Vx+}J@rSkwv!_+V9Z;~+~%E6tSQohU33VW7AtBw{5b6$%D0$@Pc)K#&Vu zLZh5NXbE94!~&KOJy2V)lALT+Mr@lwN+^T2GESNfPEt894Fx6PqPu*Q$OI!vn*K@y zk>q77Zw0@x03FhV6p!O(Ol zut=?}wHr{RPS&;}kVyRk*opumRg0k`fkOy_RDy=2wqa5MLsCbjTM;azoMJioi3SNF zPDi&UKnMrT3d^Jp1O}lKqrg+!0YRvgDDcx#Adox(QiD`A07ybci@`r~M5vrP))MrC zA|_GRRDyjF7QVJX9~H3372rdd+1g(`DC7KVc-~;g3@sg=&i%QK!wX#I z|D7D?J=oZJg&jJhW~M^pR$>>`qsjZ}Ah+s(1rs-L?tHn+j&-LNpW!T(*W zNV?$*&y%I#5vOectZ(_wwTE;+h^Fw~A&9L(c|n2N6?0(L$zHK>7ek+3xwU|=%1lttr z_qt<6$Y^1=gY`%#cqfFsrJ;MIM{_5Hz6F7N+MYGPo}|3~Q-1$#d_=+j9q%9R)_+YT zf%TsR05GR5oCv_6+(3^Ds;{SN1pyZDDUAZm)!7~lkRePq4zPrFVIW{heJvsZxq3+g zTa>F;5DUoaGUah3hXyQQN1dc#0dc9V=$7SscksR2S61`B`)uj`yyjLM4TqvpwZRry z3|C;Q+5|4L`>|@inuadc%vnR=MG-D)iK3II;41|#G9|5SbH6d@qJSXlj~aw|C>mxne;B|Xb|`nM&1_96jr`PnIYqwa3cQ`Nq^y^tn#d(|Cxdy|Z| z>TYk4(QR+}^obLjp ztM514cfJ?Xq|RZ>&i6us)VXWN`Oc<8WsEEO;PXT^5j=?5s`9b5V)&o}aY!;IA3%sQ zN2o^-s-D4J455-F=>O$;?j@H>{J-OaaW?+XcrqF7{J%{kmN6H1_Oe~OaUM}Ou2<#l zRMU&@b9z-^ypKx!A7%V!+#N5%orGs5kY&IpFa)FIYh3PKKHE6S7PC%%pCsQMI7cpa zp1sdegHg-F_~Xm?Q?}V8PgK2SR2*#+t_vZ!1_=%c?vUW_76=~P-Q5WcZovr2F1g|(Ydeqx1x+h?wIT0a?`9$_s4XXC3l?8V7ttGL#=+{b8}CEFDv zp(y>BCWD`(zeblIE~;)V-;;P;<#h^DIjEwMnaJ4n|CUxc?vG+pA-g#F5H+A*!;WJUTadR8yLlQaz0dDdK zU8~q8QQR(Po3+nmBsd5N%< zi3@uq2USNHGu{EWV=BxS0bHLm?|8qA+g(PGidb72^=fyhsTtGf}dsg^;tvX69-3_ zgE-PI0z96kt}xsm0qV9uu&Mkaa8TW7-7$EAz~TpZWPtz=A(7Q5AVZF&5JI{%twtfH zrs~}hC`Ih_;m4rjS6;mug@lQ`cD;nk8tDaN!$8Dyah~yQHibQuGwig)FkB&tl8f=&;4wRP4*3vR~S2zX#yGr)~!El z)}?M_AjByL3JH`Shf^~i6*05P=7kEfX$|tU>>kFrweHO@sfC%v(G;Uk@FNM^YL+S} z{e333U((SM3|ZM~u#>}B*=nzlCNgl@{%x)1yle5`?OH9Alu_k!aD~IlENfC?cueNz zN9Lz*Ug7ZYcXQKhx^O_}Bu)hBldXQ^-euwR2mbFVYXLN@XKNpdX7cA-8&{dlhZKTk z!&bu6pYp1IMEtwb9rlnSS@76U+)A7$-gJK}@F6WkDxq~hR zr+p*aNp%$a_Q1FoG-E--!NW&Xv0W$@7oqij;r(eav8z6YJ^k~_-0Jq4dd_?>pKG!~?^83v zET{Ub!2xlgIDXW@)8#wlQ#64O_JY=Pfk-pl7?@5&s`y6EDy-b**(t&$nWiF7ER}fa z1EmyxB73yCF{!Gk!`+q=c&8^Z+->zZK*|#qUTzQsolCG|1-*T7@SrEaYd{^Y| zscR|4yAL^6pF`sgp6^*S!+lz)c7nICIndn#iN(D z!jvwrW-*A0JmYK;Ln75DTZ8xDf>p+pdx>zG#1k964B)LIoi*nR)&8LFThhj6F_?3` zQJNw*hyR4g+^Z2XBYYemF<`Bvn@q>o?@7_Fs^pK>HvMj?xnI@<^b?cJhC@Cl&eny- zVj{9gW$FCK7?a>^BNit<#PNEFs?1-BSAwfnWOJq zI#)3&Ri@U7o0C#bQC|l8sk?37cRV1{1;T)H^Tpg|`eGQx;jdw3%2g zRt1-cwiIYgOJeVG*>$a$y=6sGDg=}&TqJq^C6key`y)3yDNhE1yDQaZX9XATZ?h#L zlGs#^Phw;)uSW6->kRFX4DP(WXoVN|xR{P)h1oXFZ3g0Pi2Nd5DqHGxoGIsM;h&@V25v{#~W*x0hfkc}U?b<^uVv7@TU1KP^zo3>E`_xjOCte!R&M3UlKoDwRpx1v^HsgHXPe*029JFA zhXU)~0vmWbBaT|MUX4-yB(aL?Xn8Vv#j+<8PwcAr!#QnNFDV^*^Cnz7d_>ZUxK%fV zt>w}%q@HiMFR!N9#&>Pvmx&UUQ|B^Io9R7%ZOBvh!F|}b3?AR!3$@&Ky8l#NE&g<2 zqxCT`L#d*53Fp}7_pF`eg;qec0rm|+wr$#crEkZiQ9grx)bBpkf5(m{g45-r8@f57 zTeIAT`d8sF<_d`?sTg0>&vxz_*u#8pXjAW$8n1AlLe<8Nt%ZE4oZ=U{45(}IGxuvI zhN7?AQLx1LAs-#$R&YbJ;f_+QN8WD@NR`$|@i=rC(uiqF3rv0fQ~9g-i?=R(Q zH2GiRf*hzhI7>y36)ongh_|6hZVd`8k;gb>TU^fbBe2cqkIGV>7My|SOI_s>pGFW|wQkg=!9-Aikb7i?B)1f%j#q4?Y^q(n@I zfRPUktsd)?gZ&^#r74UA%WzQ9IVOxOr`sXW3Hbj zQ4`1K?>O4Lm}L57sFmNMDNtAF?%GME!0o2UXf&cML^AL+{Ih$THF1EI^>V`E+{W_} zB@S7dg|;desvFIvtgw8SfvKduVarxTsd#-dfBEg4f4`1D7}+(2lbax(0Cfy>S`9L}FzR`q@NF{!=5t<+E~tkTBm+B^GSi#?^i>Xg*SmVcsKrr zno6xu1Kt8cP4MT^Yb=I(yJ$9%_c%1eYAL*e%qH@C_jC@lTGY4M<25Xc299@w7V=*o zFa#d4jD20LE*;feVkg`>QkRoLAD9%Z-=+&fCM|>wz;q zcs0X4C9euTzD=6&94^_J!f0>!@X0Y}2o9d%=>d9!7Toy|VrFAWNi#UaiJ6`U`hRlW zV(Jq{07LcBTPbcRTmt&)ovno+5lOGep1W?~h{8%eAuQXB0Jpcj>)Y5Vi`QZi(u=6Cr&pIkSD?)Q6KP*I#D`t z+NyH%5y{8#OF|jp3x?OdHtpf>kd@gl-vsA*Yz$*rM&b2X4W5WaUcM3NlA!xTUVa%N zLKbhZ+n78QZVvcQJ) znlGZi@k4@{eZ0xtjJQ~%ggq$dA=ABm4BvnI{Q|b|Tto1*-LYGS?H~B^GX;|XoP+O{ zU-q#ID<24*6I+dd6*EywZgvs7=lzx>w8p|fQmT9o3j4~s_H*ucxgp&+@3eH((9^g{ zLWd#*P7fqrk}+ zi@dpbkT<1ulg2fA-sqA@<@N3g(poeSUt>O0cfNQLaNJ@kW$GWZ-8**}fL*}jU2Kjt zJaQr2d0>8VAh_34r5P9CJ+eJjDNeR>`pa|>q-8umvw@H;!? z$U@7yoJ{t%MG4KXnZIHeM<^jZw04u@>M;+Cr|S9c;-bAdm}KsHv`{)ik8E&DTvvOg zTo3$@$;X_D@Z}WfJ~Ym%1tKEa9)aTU+$;WXItV%R9A`^4$qh#vF~0GtMTuTHv4vBRyFnF6Ce z9Ab5J*jukhh*FcmZoaipjk7d$SXeX}jMv$doqk8aB1bp9XzNI$s#4Z?+D;z)jb8iR z!5+4wd2LB$9zmCp>n*+WfWS|$izB)`5n|O(VfgaXaX`GV7+q(aTw_`PPkH3Z*!v)5 zBHeY-HTQKfhHjyNcae#mk8*Q59{KO^y`{WW7w-a;wj+vI?EyW#jLK-q)Pg;X4QEwS zM)4h!Ml02-vM9C<%hb))EOLTwO9l)@G$Fng+dbZZntuBfOI%h ztK-2;rQ@OIcA??kdjm?X*VNRGqmo7=O+at{IIbcm?;({?oB@Ml-J!WNQ{<%{c8GD2d90qhc6)hWQ{dO5br?xqnsIwq^HslU1;25@2ieQa|`a; zZysC+C}q_Qi7pV2g^lfc0`&e*3zuT6;F%UziWIiK*+d#tm$N(x+*#_Y2b)lbbP>&7 z*QnidET$qO&1Ty5=4!>oI;`<1cR`oF#%I0lQJnr4MwN4|MfJJ8ac!YNg9FxxbCGY4 z^kopRPPzl)>Hjw=KK3~q?QZxCTo+FDmt(|+-8xP8A1ks2ed<_)zf2wRN9A7*}S!ZC6XSw-C!RZ2g#OeU%uqoCO|vVP-G75K^2ziKg-&l=fgn7fa>v!)=#FzF8p~5UZ)m#0xzGP0>sI z=$X0O5TA!#D9Z=}%G6~hFO*p8=f47?(!PsE_Te_km6jWN|8_IES8Y zE|gd*WB8GI(9Y@8q&Z+*_c~ZegBk-szP+OR9O0W%8V~{!=i1al6+Y>|+Ydf>?-Rh6 zetSLG!AsK97}X>pDtPbvt;>a77mVXkt}2zVU5x;_k#~YC6?Cf&N8>px7;q7++-%O2 zIt7dKd3@1D#%967}gbZRBxUg?32!PZqkYXSiN$2Lgk_lFR&k_Cl`d}R%=~OBS zlDw>Kk*uH~`TQ^SA-?EdH6(k!^-I(OUAL=6bIpqY?!xnAqqsfI^Z&?vdTd~N@$fir0m5KFQKH?{^l8E~8{ z@8Nvs@fni5EDKGy{LAroayy~<9p13jI}U!8EQmxg3ZEB#6G3{(AJzh=cJtzls-mq0 zlU_I}wOci^aSliO4|CalA#Z5juVDWg)srQ%<1-S+?bj-0`uupovA?X4!ATz~02d;D z2nmQ+e6++i^^bRd*XFnA9`QG%UOFIbQks@x(`|+>=orH`QaT_x%)4%)Dgt$c6VqGy zL$)JV^PQSNvPAqIZ`X9vD=oA!j_Rafb7+8iz~bj)bF4#k+U1O)p3O&=4kJg%3c1h6 zeLk8Hsdtp*rNj%VPh{K7*I74@is@UD>d%M8U`q??S5yYHT+Rjo1!?mPD ze(8I!4|`-CP$YZrIuWYU#tK)O@TL-{j%pn^I?R*GO{Sc2J$T=OLS8nN^Om^p0#hZi zZ=XgkGQeI6ZS1mvF`dH|RlQ~9*54t@4k#hQDK-aq`Gv?V?m>lD-P4Z1f)wr|@QKGJ zro))5Cz+f(uyrZw!QZ^$=a;4c@hT}kf+*c#Exbrw1**(QUX6QA@#?bzYwEgj!cH8q z6(weA zC`8)9jQ%%Ejt#swK>s-o6!x;f{9L(~$AMUyvYU-Lp&B1I1>7ZPb`*QLvV?}xnnRuF z>Y?`IJ^DGuI-evF2TLz!CIEU)tbZi=vScEoHv58b zq4Ah^Xua^~nw73mrhtdFi7Y4PxPhX>_@{fdG|AxXH5`%us$ob!C;iVCp#BBu9rkX9 z+0oE`%0HsN*0Dg*3L<2a;kn{l_rL)KURN{xR{F`9)#>kUL+Z@u#bxJUt5n@{`PA^g zS-wERA;c2%t<6QkF?-75C~^lLNrC@s4ucah*=)Q^bJ|SexbC6X%S)y}xCpV#xHr>p1MoM-YSTI{g6ZLrO)f85!?z0Wh2B1(qlD)WQ$8dA zm9)oB?p?~aco|Y6{J`soMnZwzanY4-Qxp48ye}r!E_yh4d0*xnvTxvII0vAzte_dS zB4nIMociu6nOwA8IJp zTUu=!ge(q%8p~!o=*s4vw>);1ZK&F6)A;%J3`BlKDI<&g zq617$n>W-0UyHDofOF!2xKaTTG)_DPWXHU{jS&i*le10bmB5}W58E?P_0GFcx=x{uuM|dBjE#p#CNUW@Gm9*)wMjcF0$PdMnr9Qo)ZX0 zhG*Ui{|lVoo~Jc0lr&$6bi9rq2?Fj{u>0HV_FMsc%fx*_Hnw%aKDYSJ2NE4@DTQ3* z-vm#zT^n#KfU5&DbJNkrN?8I5gnu`#1+_@O)%`yDC{3M zK2R}xFtrv9&~8aryv|9h^rrLyBaIC20A{U-?+|w1Z>Nt&Q_BgC!GY89UI)#D7a~yC zfah~as`H=c2aK7#DsIEatsYR2?(V;0p^==j$NhT({3cAetxi< z{x#^?5w!pAU&#YyHHh6jsxc0|a*NdkeAi(k`u-}DMO0K@AL{#XbozV@?Vn65;mtaA zt;(4F8qflJdftJS#5YqGd2^k$b_`HDiQ;?i{6Dm{7jKEx!II_rAX^Q?I1X1VpP1zS z!-oW2b1B^VVal-cyTiNCQhsQFGo)LJ)LMMumGEP8oc@G3P?2l0fA@H)WEZUVL1dal z`hAZa=Z3htUuVc)2jX+oMao2TapWbWCsvD(>Kv;O7iH-5IhusQw7UhNx6<=luuzkB zz}~b{Q8O8Nm6Y!&J7Z?-txTeXUgG-ldj6?ec9a!RLj?Ou2V1eOTLE~J-rfT#gCH|U z&!-)5lq2+M8%(gEYXWKR2|tbp2ByC+Y=h;q>rc1AXaD=C;!Q$cuMeY!Da-?HV9=jT zfK>j?4XEwPNWi~q{lion0}Q=!6n_WYP?guFVYgii%yeCFq-=xZ>t9|AV)MHH4tLWP zXbmAiP@}K;arHygyEM26K|zg2HhDV37o(k*SFVmK53HUS;q(-QSB8EMmJBx<-zGHa zL(Z$I()`|jmn&=c zVBH+J<}K-LXwCTjF%712Lp`1@+LsZOphLvXt4*hkX`*oyJ7ik8h!ha(_S@6DH*kH0 zA2`*kx(SJ zF<{=`ospRb1AN~{qpFw!57=>a2ci+kf-f72rYk@ecVs8zSrJz6?u~6-(8*+ z@;=`~z{>x~OLkV%uv)WtE1t#M^(9~|g1Is-4#$|mceYdD&31+LZmi$=XhMO&o6?1+ zvO-!X8tAb-q!SMK^DwgR{?QM z3_3qCVZEz1GxIB<{5IvXfd3||*phqW#eoAQS0;dy zsU;ZzQO0jZAb@Q0DGaa%)%|!?Im#WNulVc7VlB`aF=7AJqz8$%CyaL_8z3hmzkmR- zMVbSEshu=V-Aq7gjTm8l=i`t;|BSGN%Q}(NJ$beMwi+K zIMj91Q|J6lXb{@}6>nMu+hCG;YbbB%L8r6)3w};qk{{}(C~$Iz6w<9V9e;q-)4!&jjbU*|RZ#m#0KZuww(E{z zh&m)lt=`Pj1$q{}2L?Uh`@pkXJD$ElZeyWkpyQ^aGOD_&O;>q+>yFRu5=OB-knl~j zekkd;;j1rF25S{qxmy_kwWzc31rQ$>?|K1_iSxP;{Vzmd!}l++%|PU$Ay1DLfb*F&^u~+ z4-SncSS}f5$shoGwE!LfPBbYUz=R!Qk&&-5I7JC`(Xm8t@p}wImizUZ6=!Fa90v9l zDD4f8-F@S=*MSx=(Mc~tU0`{T8-16H_ka@4*7<);OSlzy0L_FeEZP6#51?0x{= zqBnfD?5@NgPvM)pLvWvHSl291po8(UTVSP0{O#!(@ukg$?1*yuhQ0E7vc|;e>~=hQ z5qsdi*rqKfSlnQi5JxdLg#OX0c)v^Wq|NK!@AYq5zsTyH$}g0tzp4Me0dY*c!G2c@ z$IuJJVqtOK0Ok$gHegn6Ir<3@boTHE1-!X@)7pSa@i4hmPyvWYlYhx z9;dJ``Qw!0Y=C=^L;7S_KZ(qKyi5cd!w;_5mT>P5lXmqf7eoB$W43W5i*YEqm;S zH~+KiMt!t=5V0Z2VjAJQ2)xpt7!o!}g!3v;)OQJ{sMSR)U8<@}vh}K{Tw}6JJN`0r z0-h@J0m9#7QENTLyFP6oPJjjmk!4$Na$nWMS-J8ZNV9!9E(KFou|^3sI)QQ!G$mS+ zx~{nK3pEmXpeV%^YpaTQb=!o#so5y?P?mo7uce8?eWC@d3~B|=i!)^FY&d1w9*ldE zn)%1ExvA@QEJHX&aOuAPmi_8Wgb|((J$9fm|F`FT<700AILox;J?C@3i?_=dXj8h` z{P#&cAVoLj#lara!!o2HolzH*C#&=-L{^Wi_wIbCSqLo5z}ol0mf*%{^8 z<;H(S*2Ud5?eu*p{oId4Qmjeh+v2qJ0vv;@8Y;3=Bu~#ULZfR@*grgrH z#YZo5pB{`JWM2xip-xoXPC#$|GWo3XCpa{@sU`APS2-ViZnN>NTO4qx8YvcF(t;R3 zs=@<{mtA^%wScz0y!O89u5!s9@e!XzZn(GA^gJxIWp5c`k0ax==5qtVA>3oen*guH zL$JNe? z3ng;$8e~HbHy6ND-yGbap@4{B$0wE6in{&#l#?8f;3p8K+(4))>+@(JL}uVOUy+nB zt2)>tTIN5OYg3H=vX%Kq=~&u@{w|Bpr-&Xp;}D>ybw5)jMI*2mZbV;_*V;@MT&V4b zdiACn`Vv=tZq4kC`z%J39z2B!T_{{A{D4lpQq2G%%Pm*r=7n17{On=y_}=)K?)L4! zg*`q9yQ0u7Lm}jFi)Vltm4b&TVRk>WW0mF$g-iX;u5iy$PZOouhHL(HWTDF!5OR=h zPjtBaWeity;FYyZMwZZLg`})MRMM`viodA%O{CR!@x!{AvD6PzzE7x8hL?=GXyWkw zX(9NVpgk^TC%MpPqFrbX{n11SOfPjYwk##^`1>x{&rl7BFACT3N2!(@bn6z4GYh z)rv@7!kFbu6;WT*&X4lMvi(my>UqXDZ^yrK@xIUs>!=uFQPBm?orsIk;4s=HOy@j( z`J3_?(fltHUy7pFccQ?T8JAz#9`>&dqzZM-&IH1R=Ht}4Y0$F9n zvY!IY*Wa)$y}okEULTZKM4Q*cYkmzm5cTPrH0H>Yf^1^FpNSoxe`RQk2Z;QVz2swm zH$lx23N_}>^;O_~#LajyP9z$S$ccK9l)-td{w^7tNV>n2 zRI3xeg-3tDkC7_O|ImX|>j-%nQO72fM2}FXy!jEoQl^m*%+fddCv;#AZ@A7KHR)X^ zVm74q;B^%dIwQ_`IrhM0+d@iHK>vw`-=ZK z6yJg*+@@gWE<%|0=fB#j#|W7{d5XY#x&C_m+6pUs!Dp(w71uB|kmz_x)7iFrPRV&4 zO0MRVc$AV=0QI2D{Vaw~MieYq>6%zjjdnnqYz|EJuN$jl1~HOeD;(+dQ|D!3AyNNU1=etxH0SMwYtkbVcU zK45x%c|EvY<$68FhpX+K0L?+J_D?(?c7s-%Ao>2gnS`;)lhJNYs zwXgo#f|!(1le`DplXgROF`CP?{#@~|s#nN}_(jOR$C2?drNgY&K{d0{WXwW&Vu@v< zqL1g!r*?j{iG$;{<*GLkbeF>t^?&z9Hdf?)96e=$?mMP5|M%7hg&PxnoWKk6NC;oZ zr9d7AAS^Jk4rH8Co=yNH@*e8|3WlkS-wdbroUUaw=CaaSeqH{Qcrhg=0uV9q+4-rBWhLL&?T7H0F_G>`A4Ogn(}X+L zcF#z#Q5;s>4O_nAtE_U?zh3@L&qdH0;51yE56HcDm^9pSr}l#Z*jkfwkPvwNrRN@h zPRsB2w1UplMwjD{k%@!u>+O%HUc0gT)(VmNJ6K;!`E!aKxiP>TXl!S+4VS+1j1>M~ z2t4utS5F+f+qe4NvFyM_m*0x~Ezh|nA<@0Bt;FkEnR}RSwE>2HBzzqe{L7V|$BIi{ z+$*zD9|h*&<-Z5zEb1FQwfh)3htnR~%m1fRIVk=(SIq4eu}5Xl4!QFf9*%Wfxb2B( zZ^JS6?icZ4D)-d1qT2v9|8Go>)N6}B#Srhdrtj&mx6wd_VAlb`XJj*I91`)l*$6P~ zW@+){x?%EO-~BlR-2?lF{~a(eG&ISJNiQclCdFC+EzL^A4zEg3;~(t5ve`bAh?=Zz zVP>=u%%O6(&gql&PsK9CoX5p1xf|(SaGO_?;~Hcw%(Bp`njSHKaOWu!c2NPTI)>cHOef**HxebSdpx^Mx*+}2}N&c+t`uo4O0SL+Gq?|L$uQm#MPoFM! zo!k9@#>ArUfYt&`^nM-M>aaRYC@gwV)8*l5=eZxvW%&ImD~mOLC%t7}UcV`s-|yb> zw>56+Bc`;i+(?|2C-9($nSd{^iv6YTluxSMG#XooWG&Z`D-cP*H-t_e$D;XgGk3NZ zq=dbU9a1VlN0>!e%fh8Ts-rSGpE`d3&^ftukKI2&|L>b=z<%#&HnAa(L}bflnLOhxdih06|qPTOX~dEjUMwm`we+~isy zdD0^@*ZBtjAI9at%0CXA1j~cixedWqA>mGusxd4>vL+q#qgM9al9T8RB-Y zD6FO(Di63@grH{(uYlu!+j8e6U*oZUr)Nn~;o+)47ZtGaT$pj+`E09@8&ZcrWv>A+ z)(wKEqeOnnn#vMq4n=2bA7(**>fpjxZl6JBbarN+?3VR~42^p9@2IWfDZxuW`XU}P=-7aH0`oZ!fh}}{Ss<62-*qd-4Vt8@^X`VpQQO}8dcBR zm?;#+-}b;j;vMyqXK4{S@F?hRJXpZRsBYbMF1gyYY+OWIvubT$w05qiJLe@@_1)u< zfN!kiull3sR>r7{FJA4onol13BlDlz4{MitMW*iUsgp1_TPBGq#V8H5%pZRm4XyUN z3m~Lx%E5xDa$eVP8@}Lo%Q5=%+%KwGmhq`iG)ffgZV8bE@sw2wHqVg_xh*!nl=QF+ z#D<9h+tL^Wpa&W6DGLwk}Rw!HHwtvQ`h~YymZ+!pTFbZ zd-SGq@r4bix*YCxCtjbT1{|QI+l2K`zf|?kiX3ufA85G`WU38)qV$um;P_6m>-R88 zf-D-K@kwr(H@s2+de<_dV;goT)0t}XhhRo2WUcE&(=oy3&oZETC1rPQJ^kia3c{oH z`VYfTD@KJMBxdC^XnV*D?eU8kTAG$To!GQEnd>B8B*G3q;3IC0RUB17btuj35GYi>kmom zC>m^dy@PA{5X@qX;%=phSR3>D3&vopf~K6EqAr1D=aPDOW;A_aOt|*jN+>XEOgac~ zS$jiPAduO-5Oq%yjqF+nt3fhrk{G^?F{N?UBjVigPZgtA{rzdpR$7DLoZJ9@m^-w( zibD2~o>5=4>L4Yj+W8AY_AxW(yzp-cS0I={4eI@ZEH`=zc9`^Mm?^&!ZO%9VOny9^ zh~6i4*56PzHD`H()+Kku;J85cUC+~XyqJvZC>ZM)w;ch9^L!zBi8@3@OO~zV;a7iH z2lI!_L&NQ9rX0w^ul#W^RmsAz86u~=Ni2hSzDfrV)Uv-HAiuyF5ydX8@Z_R#l{dCi zPoY1RX6$8q+~7X}_I|@~25$m5HQicJRLrsLU%)E*-fY+Is&IW;;E$?xL~qz0SmDm2Wrlq~ zv45B5QT0nxr#XiqBZc>6hrh(R^cylx>qiQ|zOGW@yndRgz->6tJe^>T9swutm)FU<2uMP61D;SF zEtZN}s1J53ZU$#*N+$)Ba9v2h+v%_geeFSi!hk-2sBe9nidk~w6fHIvIU>Ukd6drA z`ebbmi>0Loq*m$0xfiK_w!f%t+caWeK2ePa%c)hYD}9&~Sbn-!7R|`yn|!$D+P5e? zdX%9d;C>;AU5g+MI!C#OD%4=9I`ow8U@&@dQ~YrUV#58Joh+5)-y0nI-%z*WdHPy*|!b=-nm;e$iNY6FlPx^I=(Biqc zS46KAhJ`v?N&Z_Vr+d?PBrH`&1D1!)7M7CrhpC#2^<@^fl)%%en7zUiVZfhd`t}*X zjQasZ6q9TSdq}*e2Tss1*cD^g_*{>Xmr^<2RJITIBtTh~RP3l!Jo>|)KTdKuRjd43 z>dgQ3k}mrx3z2T$J$M>)CBPBcTQMIlIHVt z`%Q`To`feSj$)0FFElbWWpQRMSUBE$AZS!74VUZmgc#k%)+Z%LJ`w3+n@wWEo7MMq zbYQkayoLA~hAbTqTuy&byL)>0-(QWsC@plZL~W<0!bVWjQ-UMyuTO4iG)zw)g3V3i~6+WAkF}(t*0~-EdS4 zcv}KA5#g)pdMfz1ty|seB7a>LLBVB^68@T2EQ{=Fd_5*=!q>UxW+PSj|7ZeI75ql@5L8HGFZTKVOU z@6^G@JDUFx?b^Js7IdL(sQeHd@c701J0i`V@-m3?<*L50B@n zyt_3zoV3Z>Q?ehr+rGYSt_R#gvC17!rN_%0?uE2TKhLKEtXK%zAAwb_j4LBX?pJW1 z!t&Z9SdR;M8f%U@0Son}q5x~XFQP$&Pw8QY8(qX56~@rD=%$+jEySsXRN1av_6A&Z zaHWfnspYGwTF(3tQpbo_F#vu5#t2yM@wxh2WOoax{w9c;4Q68KdQW;x&!(=2M~-B3WE0sbwJ; z>qq>7r0g8Jjx&mVqirmnvE4zhWw&~J4>&N-in=iXy3_aG2+`y%>~ zEU*OF$-1qHGc0^-`TO7|c#sDvjy}v3{ zhCdT7n5OLb3#Ky)Q*>h%o=|H31y(=(v8oEJUJGC6ciE38Gg=+(FWZ5d26dD)UV&Lv z4l*n%`+(L*<(Q;(*ouNL8DxXW@&vC%r@}?6u~9@=zv+voyvn?#+`O*XybQ;DQ%jEB zSAcAPTG94O)1u)YWSB+fIQX%2)U>c#&EZ+#Hgf}C=VtL6xk5@_c}MV~hixxF)t4L% z(|~2Y#e0X8DEBYqj=KvD!do^S0}Ly!UjT~=zOf?T+eL&WtS;C^3=JtkEdh5V(2v&~ z{hz+{_kCSe%=6CpxPUOEnTfvJ`9>qECVk_+$!@`rBSNh8}%JF9Fv@$VCtJj;gzNJ#lU!+eyLE@qMx0Fw6RX}@; zWPYKj43)&v(70iTj5yQeyW3R_jNO!Hdxp>W7=?WAIz_y2`za7iScwf!Ip3Jtr4oj9 z5&Ag2*J3$^{B-7`Q+dJWQHI!w(A~ku;75CIhE8h3m8?~2qhRwP zp9?v#LX!8#+Q#07|1dVeFSha5p5L8Ogjc!IGT{i%d^DRb#$QMBV|ak6zcq?i?MnLn zdvbycdwt)}4o$8ewNXP!$UZ4i<`~7_>jjQk|5R-JU_os+g)cv$q}Opi@ny9OT&TJd z-Og-$?#EUm5@I45b=m!%9-GAEQ!cLVc2v!a3**8UiQ(RAYq0p{`8kGO9)jH%>GLhl z5LdQ-Z2z2W9Vw9%2^1wITnYYr&E1M4xFMhgQX|>8Yjb?&es{z*Hj@^vDyShg%26&& zcm`jX@nMFJW|VN#35(Fp?j%j&>H75IjZ4k17K8R5J+7ZNT8O>G1rUQ6wWcQtALe$7 z(lP{M0KvFtE1Uku-0RjG(MX%y7tlk}>pvCmBudde#77|K`RR-771!;*pcmdZt)1-O ziLAhYdw~D_(ebTXIQ?vHp}?__JtOu9pMtHCIs_HNT@H&;JfqZSk(^R&5La^_bxTIh zqRpSqn$5B+-vt|CXpMejrY_v*o#@9H-aFCXujx-y+HHr~boIZe?OUD-<2L^d*J!t! z@r_Z5A6$c>E)2FxNQ{kkt=7v;I+K_T2lob(p3V=)4j*MbE>oKvZqrDg*I3-#W=1!* zGcPT{bS_DIR>7K%bXUz0-|gDcA}edhJG|R{-C(+nV>jbzk-Xk)M9NZ01Jldhn8(u? zP1X?07_dO6nBMPywlTGW!{p+LqER6|m~Y>rysl+jG9XhL>_J~M*5@2{?z3z}L?6qIn7viU38&KU3PhQN;UajTVuc@B=3X}P9BIu>=>3r;@ ziFn0|r@F=JuYokYL$KeT%dWs2$9CK$!EAn6i}HKBvPq(lvS`@-jnA4QG~c@5OsPUu zXQFxNSX=s#{M(s@Hj!XXKn-P4Q+`-&*|sf61Jh6a`0C7k^{;Q0WM6(GihBL;QSC1Y z3w%Skyd>|1j0Q|?c{*eIXh3ss-ZVDf_rd> z;1CitNN{%=cemi~?(Xivd%xW0oDc8w2X>Dhd#ydHYF={|F@{~dkB3(FYS+JYjVM6J z@off+4P}&0~4TMXWoLv z)4)TzN7M`O*p@-BGX~%VlifAA0%Q)EfE1(j@Bb>{#Uwx|G+@0`^NM?W?=|+r7TINx z4G#FIyPmI%nN_N*x(u?60)z$l-fu7W78;S3Thz1dd=JsI_kC|}ZreT~)J34#>NrxU zxAwFPjcu{8D1Ry_YxG;HJY`M$ZmIPe?XQxkz4!6UB6kgD;2g8X-+-KKAb2id_5<0H zJD&3SyC(H+kh!D`6%f#jcYKFLygCzSNXX{S9HiJ8BzI26(>FLw;4(4IrqDaoAY-P% zvxuzQ7ErJht5ueY;NGDvTqX0_FlvB2gb6B*dDNac&L*uIKX%A*pKPHw@MGogg&rGE zmX`s$;@Ot%DxES1`4Dl%SYY%}0`JJ?+gw)#duf29A2-?%n9;7)3O=B*bHS)LlluOy zTn6z++v;CK90=TnUO1aes*}EP2!TnCf4D+V-;U0HeqH=^UnVk>SczrurJHk!62b?q9VQ3F@GZE?D`~97#M1d z^V2U4MB#m>0@QII9)qI=2SxE`3R8Nm5mjL}7-Ek)e=^k7t!=;F$)w$M;b%c+s+INa5)JT@7SdZ%$| zV{`pfh6*={?O%q~8Y_|)?X)y>x^??0d8hulpE=b!yK)p$JO&D{sQg>@z*q#&R`F5N z;th~;^EtuhsNNVD;y)9Sw(+jcDW>t?TvZWj+4?oQ9GPyLLs z1Uv$a9zHr&28D4fReGaKyEvvPt8A;MCxk3R!yNy&TkzaN@!lP&=!5MunbJBFeo#du zU^-q6Y-@J`UMx0-&&I4O%_hv#Q6FakYxLg0`m_q8!*#QoJ+L{XR3xeB)nSj(I%ly? z6Z1iZS=fK{2SvclFIhp%k9820p*jkB+4>4SR|CAtpFDN{#iOiQt6B4rY|fnS{`ER= zy^mTJVNNL!;qT?qb^1b{qV+fVC;dCMgWIrkpyMaPJlw{zno^(Q(c9B#!leTzOclMGZe=J%7XR;{mjkX0&H zeM2|QS0@Fu7cJN6v6}nG#+vqfoXQ0yuURSjAq(8hGAo56{71j)r-kB+S=+a*-R)+< zkCwubdn&Mh{Cw%-ffp92Hv)Zh6I2VEW67$STvwnIk>f+DrY-&coFue>mSdDRN1sXZELZr)Txi$xoyFr7?6Dk3^7r$ zWyj)aU6v%uKr<@JYv42B{tmo98v_R=3S0r;B?o>r=AhSX{@Nz{yI({zTQ0UUKs2jB zSd|FcK7o8YK2HHJcy$3z_W)o^oiPB+XE(uH3STP#H}00*JYWMgP4Ts}*<<0bJdXo~uyi!OQQFMSjI zg{jRc$p_IP{>`)d?ESryS)6AAO6764Z-?`GATJ!PlQsM0D~XNq#eLlI{&jg49zy;> zX8|sGL2R81U47>#L{7UeuC$QqzPZ!i)2-+*t9as%S|(59;gQR~!Zk7>+@Y05Dwo^V z@G&GBk@Has)>F=-EIsr|CKhFv%KJI-JEFclN+wb}9=D$y(|BTc-C;Nv0bAb&fqb~j zn?M#DKEY%LRIUUD?|#>N zKa7bevye;%c;$fwE_L3!k|Swl z%y0(#@?_QBb70a$1L6=^kjYf>{u>#WgkRnFrK2JH*sx5NKU*oUQ_bzJZM0TJF4`tg z{Y4e8{XQISM9CNa3pnUetDA{WG0}}G>sw`-e_nkOLFL|rtU&@MS|4(jdpm{z|3Wf& zpjb@g(%0hJF}@|o_4_}{N{?$}v?8w74h6J9E|XHUQImr=7P}XK@N5d$QhE7&ZOne{ zJJR((BZ~b2+aI`07m&{@(6`xhL{B1UjdHA*rWlA5SumruZ4z(AKY10p6#yy7-^u^JGk@Zh!hae#^&p+~7*ur+Ok@EHtuxgh z{nShCeV5sm(ZiL@15fEY^aYg-*3OC})k!$;>&cd)Eow;!KH%U@#BmVV`~B}I@RIsn z_sKXhfT6W{3EGzkiW%f{6_klU&*z%W91wn z@zA3E)IFbVr!cM!>O0v$T1&)Ub?Lv@ll{-wa!Xv>#N&YKVl}X)@Pc_CIMVGi+0EjM z`Bc%W!jEGRb^2aXlkc8$@-~G6(0Xkel3%umLg+>V6Ys$9e`j5f2?306EQC+{1Mtv3 zo?lIiqEXt324YJVz7L{c~V7 zy2YyB-UyPJ$eKT$zfXEY3|M8I94S9fdsuwQty?=9;B^=T4(Cso0?(=6F$v10F& zDI+%@WB@GK&0HAFadreeCM0hM(i8W+W}+lsxK4 z{W?0dkWcQF=1oCky4`vbsuvS-%s!Pj+yoj}AEC;kuWF_q^IG`o@UXn-(R#M`B{Bv- zu<74QPbD#Ey1p*%$7S7bJr>T``M_VQ{MATPUtrE8>nN)4@MhDzyl+ed2zpxMIKivYYnL8 zR4I35{#WW$Br#9)7ZhcOk!a2Y=7|)$(42nZiCVXuG!78?EBwCqw1uBogY^xqJaVYrK{up3H)^4hcx?rhjT*mmitq?*t}8L9Qyz2LeK62 z0snR$ai1GUl>)xC^PrY9IPg8>wXj$_O{sJl1-;&LOQ()lF5^&8-D6T z&x~L%FOtc{j8F? zS-p!qaa)x^d9txaHp5vkU9>mu@$J|q2%k|8IkRbub}VE$c(9x2SaAsjJF!QU!289< z0qIlw+a|)uF0}cFLuHiv2dWmgP6UOgW>BE!jyrZ21ia|g3IBoiTk@>zOvv}YPwnI*AXbvE^O;D)B8`GxN*TL= z62`NuY-cEu?k}J}{bP>%4-C8)T89E%3{5_pw&c|oTEzW%EjZ1pLr^Bk4R5&Ocacsh zqx4yuZxY|r=2glH%hUba#7vP<*DpVnToEuC8?E918vf~3?dTS;V2&RduRv?h|A-Y< zPrz_@7hTS-cvI<{$9ZfBf}Zk?_Zi zTrGlcd<Eq*=BMNb@@Vg-wY2+qw?4m_Quw@HdKVTwZG}JjKJDy1oFrxYkF_P$j)EyWT7e7# zX%V0+#a#%?)g)qlxEig0rc)Lsau?;lag{rzpjSE)&Q>yUMA*j#+&nfC6lQGwb}rph zDO-QfDmzyyi(VQrQg86INt?z$5;!50=c#_StM4f|A+7%e9KXGg&27KGd`#=t!ETfQ z?pH_H#RA^);B7r~^Cg)BCEN6{3%#ier1ILO*Jb<{R+j>sV;VO?dEYxOs9)|s>(t`% z_fCgwGblbpBb7orh4rcA$1luKces|Jqi zoTdf6=A(3nPqe`lH1Q=3&MZ`HaT>}bxq$ktYW3Pp=`~0$PAG9~5B+L5dU(CJ!|C(u zpzu0>*ai1uyMXbO#xDc?=z3)R^`yxKO8487)0e$hof4DubtINA9Tw(?h6eM;)n0ns zd`vC36jLV>tvc*EN}6l`z~C#x^R_B%yNAKEP1nHBHg@k_p%UMcfUxV<2eQIgpf;x= z1}M%rbaH{~#G$UkZl3sC+m_E#28qj6sBJaQt(1aWCG}~YHDv5eniGL^XFP@>o zuIje|@i@{7AVUNoz54__#<%SOk<{eJBaaZmAh_?+0+1=%=a|XgITw_>$gZgiqi?$U z6t9uqjxxE90tv5f0!2;;cY#NUw=+p7o1s^$-zdK(N10N>Kcvs*>eztHIKqVG$NyTI zjPkl8?Tlup+w`@mMx#_rli!@!YM>an8*v^2mKXd8DC)=JlacD z#!JqJb>t0Bhr<@7?nJ@2$TnV-JyQkCDE4goz4cY~f1DW(XA7@BuRDhtH5Nk`9LuXO zvM`37?H=Ynmv&^QXg#Mz50^1b=}ixpfB$7T&bPmIpOV>#&Q5^I&P)Y=&&8CBrmO*Q zpRMlRL~LsU-aiB}uUBK2An|2vK9%>)EJgyD;oObqBWoiP!wuA#nT%wu9}ZG5MkGlp zk=0|W+t2TAkB5Sv1~aS;Msmk}5uR?@u!s-W-~5=jP~~RcI0_4))%w%7bhsIecerZu3W29U($S&QiO(Ne2RyB#`w8JI3DyXJBL*6|fe< zAGw|4O4w;4R9v@jh!P}mC;n+#oO!uVW&LM?6IYgfeufUS*$K@^qUtGXw6Sq7Z_6Wu za+IlxL&GzG;4k0z36-6#vNn=KSTeK>{PrT0o>+0Bx*wdOj;nk&71jzww{(ShV{+!K zS$vV4_s_1V{y4KW2Ze04lX{a}ll9c7zBsejxP`UueGs#%8{1RKoNsEf=8Uw_QXY;6 zP!E2sgWqvxQ@_aW9V?^txrZ6lhwDxal8_%3sIGk#a{#&JHubpI_l76iq$NMt6U_MF z%r1X9hXiT-plfbb{_?NeX}qrF*w3T;-B?^nK^~{`q>Jx+Y`CM# zVnknXLz~UmsUFA@Thb##^nkF56wXNijti09W378RXbWxcIwP&g zve(IKxT&uyH zL$y~YCUU~I%_Ik5mpKxkxzSC}vN6%k^d|C#pUzXE1Z2bnQ@g3!D!7gkBS>ui#)dYf zi_TaUmLV`Db#uhHgvbl;J9J{*=nwUX2X@;g2w^wb8T+h;rfcJFl;|@CnDX5wmFivL&ysD-twzBV zaP^|X5iv@{ms*z?@{GuBn=nwAS%l;`Z4RyyyCJ{mn=uwq2T{X9`mv-T;UI8P&^oPD zWB3vs1b#cyhc;O{7n+h{V;EqwWf5ogSQBVinGZoA_Kf#<9(-c=7^MsS$7(Ck@HXKd zifWaU$P+}(2+!Z`Y99wV7JSN{^@j>lBx4jcz_3+Y&H1o_Xys4wAAiy zY?3MpVmDK0YGh4n+=-E*Uc#jCodN0Am0vjPdlpYn<*aZwlLYySlVV_uqV!_SkXkvz zvcn}mDWLvJ#p5Xa>AJ$JpFHG_5{Vj+fp$br_FGpydmr^!y|00kUNuw?Y{AcA|62H_ zGE{Vnx@>ey&cG5(7<(hJPTrF!+F%#<|QiJzjd< zL_L9To}6TpqXyQJT}EAWCh@e%e0k72VHjER&q5;uWimZqwk|g}i7I2V7%OZ)TMK3F zcu%4jcBvBK7r7J;#<_?SXAKH$w&jR^ZnVZ4d-$g;4LZo{Fx98k8m0*Ad5}8aa+77P zEvjOcb7=Hw<&O>np4Ndv>1{mfTnl^T!XKw-u!s#FiV>d|*urY}!wof}2fl!ODS znmAP#WuK74hRr!l7FUL(4-PpvV;usb2Mz9UH&He;EL6_Y%V<^dwr=JQdHI*l%CFP@ z9?1Y>1FSgwglvge{us7L;^h&SNnEU9QdaT@jt%ynYN4q3!8d$Iz3O~EcG zy@cV(ma9#ir>vIp60G9~s8AHhx$s&r%)w=9C2iCS&b$epArn1|4L#H5FuZ@<1~?(6 z$oKFxR~Ff3j-ZNsnrf6sgUb+7Eh*VNz)VUE$0i8`O_b zzS)XKIvmSWkc~q9Vr?xdC@8v>6N=t^)V8rzT`k#MBVV&k62S@!5fRUe3Y7$UT#40} zFKOJ=xduxq7m~IP9pxFyC0CNwlf-^RyU!U`b&R!CB5xzqQno!(Z7jb|D7Blm-xWn> zw~;d1p#pl7K%I|66wc;dRn;sPH-q&ubbxoSw;8wkMwSyVp^^?y+0~JzQ z6Vrqla-mE<3%A%v8h6SM#oB1pCnZLdBzMNB^AekOgpl^pp8T`D^hL8{tqFlDs4DuucXU(*XJ-JgV$ z4zVWKYZGSn+X#u$4c6OIo4U|HPAj}Tw@R#icG3ZRXfu2qCW-9zF9)cWy6iICSsKvk z<4VwVtfu$X&alpiAqb{b^JrG_MG+H>8FCY&MOGG>vO= zzZ~>r4hoIdGBN@89UZV-)-eq!-L5IKKOCSqy%ft|=B$t~?jFUM>-dqGkt zh=|i+p_i(TAvk8IvNhcFwMEnEl4$b;wM^4kx`@>dt02lwN?TTx5H6Y_6mGX%Cr09P z@tS=5gfS~O8&5NMdsBu^(b?nPWHXVW+QRC-Jk5U;N5AE{EPIVn2u=Bv^Ju7JB)^5M z&i-vuf?CD*fe~<}vq&djSpJ-9%G$`(w|y94!PeKUnYM+O3X4_H^AcResaWF*xynS4 zDOyyRf~X*xvfiC`9|aLfm?_H48A76?$P}*{l0g_Br?WN@&0I+8>CYgsl9s z;STyuID{xjk>#ck&L+a{gJ{qPre7lwQu%&5Gbb^-CH@p>qI@UHbjJP}ZEF8Dxd9zT zKW2?>56&I!(4+yA0>rN;Z%6N_6+ULv++he%QD8#&3 zk|UIQn%FEJC&q1!b}QnQHcgvkWjfdna@~}cq%8<}X9~hNR}4>-vOmX}su>C#xC(@B zit^n!RQ(pSItY};GDn%_RqO{QGnj^rsb@5n;SjvR`-e%xfjQ(zhm5Jm&&W9ECdmJul-ql$xyaDQNZ70}OL(z{Kss!Gd@xY@_~;P}LPQCv zH>^;ZzQA^ZN{swU9J1+}%SqDN6?_a4IU?>A z`9QZ^#300R<*rs@+2B@r>-mA#vBHz6@Okzc}8 zrmsPsf;VV#7!EEwAs`o8&JSI&sJ=UlmJ*adje)Z@IT`)IE!$~}y_PI^ieZz>4j(FQ z;`rr?8I=4M-5OE4kC32xBG(*2uf%GF$#7xq=(Zx#Zwl(yJ2wd_!~7k=RG(_1+C)Mt zsdTN{rxsvLpeh#@J3)}N9!5F@BZUz1Re|Vge#c-F;v&9WBbUONK{hy3tuD~{{z1)Bu!EbhEwut3f(Vlq=b!-hYy0Er9!8epp7#Qj1Q4PD5%uxnYuD))P z5PsWy1=KglR+G0Md?_FtEe?icsY2w~6@!>m1gj=?_cTflZU{AELDs#DzR{mMrambu zl#BUvM+$KgkJ89{9|sN6&C=U{jOcK5jw^+&x|WE~_(YM-kiwDw7~t zAY_x|&75M%Y_8RkrxLquJvnQNjgTDs=TGObcLS?09FFf85D2pngiVh6p{D5zQ^^6} z^l7Z1O$1^}`_8s-q0nzDU2IP$gHmH0eZO}*Y|N%QqAFJD6PdR0)hK5967{qRk?R%= z1`)J(=HfF-MCtJ>{-PI6PBJ2tu7gyobr*5g>!Gz=V#Tnq|%W zitQt9=nZqG*vC(*THzKgHniMUz{f9>T}hk{naJawk6Bd@S*s<(|7oGr>eQm!9fVm% zeA>I1HKkizcRuxV?J5ZE2$rqsQt(h#)G`q*uE*VxkEVXp)}M%rdi+SXPEYTuqTLu zP?2x@;4;5Wd#o?6K%m>NP{-wTP^6xW_d!RUNbV_ay119|Ng94v#UeDJ3qR8gsWJ(* zI^kB|EhX%hjJXV2=O>z236&RqRU~DfP4zBTi=6tRRA~hK+O*5m*dW2MJqCq&u(MjE z9R_uy=l{$mk3~gTSm~b0g0$?WKx@c4?hnyVc0{L}*VaxOIaJH~jzSKBu82Y>0YR}n zTIbQ%M-*l!@1CzWjnxNvO4t@*F_s1C%)sRir!`ApfB`oR1H0NCip5Mq-c*nQElurs zG8hESwe3+c@|WHHR*(C-V|8^kw$gjCpVhSo?*ffi7cGBVB440Mg4CLD$`!(jgdsFf zm-bT_H+vR3gkMR4TW%*4pAtJ0G?H2t8e?u$(aYc>?*boES|OQ>Xu87&?-D_Z#X)GX znwv@QUM3%EmK}(R-s<4o24Yz^u9PEJH{m;U3#KjFJt5@eA1BuDko^*MxZ4!D2sa3G z^g*A3rx=eNk+3XnGmqyfyI;G%V&zppE|5;ZF~V>r$WrZ${B&F-+2CIieV&C}L?mMK zkeDg&_&6*M1PQJL0Vt|@wMzpuj;{9G!JGmPVT@XHFyS#*DEiivA)9K%Fl)Iv5#~Rd z*x-_9x#wroI-s11Wbw?`>s`c>el%uEnuZwc}c zSC?RZm8&s+9)}!>uTv1+QH@iWn^Wv&t>6oCA%{DSG$|vdp@GxHxQ88{50S2D<<+1wxgtjA0){_v)4F(*)ft{kMeK#`bcB9$n}G2C6?UabbClFkwzQ`2gM&>VYO4B@RS9dxN0WkO zV+x(|Pu{Mlp+_6SAGz|#Kz(*r5p?&5^Fw$apUJ|UVM13`MWp+4#o!tAWgn6$PlqwC zEjUpje@>u=OAu8OL7}05NUaG!jQI|NVghoKO)sBg*>635)X5|$5lXV0xyb^53ln9x znC-6Krr@rQ+HTg!h?xk-=Ft&r=g{m(UYHsZkwcW8!}dp2t+0k~A=_E~+dICGiXsY4 z_1lS@Xo@x}^iL>~5ae&CSypK!HJ=JcY(w63lPCAJm9#~E^pGce&>FjC zm2R>8(1NV4;TE^Sa4WIllj1e*xr0|YkU?0X^hsH!!TY76&Lir8&KtO z@~@hEWkT7UlaM&w2ozX7J4oZS=yvMnK|yxw^GX<^Wj#|5190mR|nnLBa(u~6@ovPkmQ{3*G_TCz1twvr7hi!FM#M@1j& z3Lp-vzu1x-f|r#vI)|URp6KChUpNm5oH%;}z7f3`N>aGg^YV!g1^7`;>k%l=DQ?CK zduE|cFC1;noHWa2S{zekqBYhdoZMOw!gbHHNp~rSOw0TfSO*h+R{9d@{d%+ivc;mT z_A%$i&j}C`5fFo4-Ps{K-@m@Tc+gM7o*CKMISGTF-^G6sa-l8gRzR;71_BUR{&of+ z-_uAwa&+m=p||R+Dxnqb-QP<~?jo-|e|qA9|9*P`Aym@EC$R7MMHC%68?XJIZ^41s zao%6=nkarMH+DTk^&3ysBQC$t?G}mT?x%^)M+cHmBPK9TXfzSBQm(Y4s94lG$-0-v znF`_k+=137ziX%Z=anXdhEVN8mM@ti|D7O)ZfMII%x1lZZyE6WEv? zDHrftDVGWe=40E`5)1~NCSptn%@Yk%Z(K98X+RB#1%$GZw>k6#1@kY;R*8WtY@c+- zm?N~zv~CQWqO>y3>Ygj`%Z)00Y8m<&+GBOTmCNU*@zs_Io(+`YmouA5l{hZji#m`J zFOn{>HExdJzGi2(awzQd(ijND@OASanCQCBUDqf(5M1iv5u0qVcL#6~48zuw#v!lK zSt7#>#YwQ5p_VwN5iKYw3gxeXsJkekLD)!JdYR~{jw_*q?g@PKi=_1H@=XpHQXzVu z;OhT~4U|BC>_@YC;g93`oRn{x`%Uk9oQi0HuzsPj81vf!gq>t_X=Z&7`BY|4qr`Wl zXd1rAZZ0l(Rqj7-_%s$0^cg$wi-^s4+`Zi^vn7tuLW*NQn|QV5J&-1f@Hm%xG!1Jmx})Fwu?&6-!u)-O1Z= zznZxS1d5t)g3O2DW_8C&ARI~u-ECDx1xAB7=YPU4TR`~Z`Pr>7(xP+bXw&`nn1eX1 z*|!LW<|5DR)Ie!M{KU+|!2nsedR@cA;Ujo{Q!~_eMS>n!m|C`_aY_VmWwkv1k!`T4 z3BXv!JrXe)`<4y#q0Ht0H7WB#;Bs{xFwu~(AMK8iTQb!#m2S2GcG1V-~ z0DRxfOV~BhXQYE3G`1V)HMBG8T+Y&+oHlkEY< z8#~%!bv!?Eu>D0>h(3>EUdlpnJl}-{Vf|&?R2lacHi_bIRY(i(KS^jIIE(UImd~C> z!lLc@rJS34bZ#NCRF-M0H2!{jpnOoGCeq+#jh*&wMw1^i$g~8_c!O$aWoe++QR?sm zk+zkIOy+D2PdG;)B-k58`Xz^DU5g(kbNsTut5sQW8Dig{PMv%tqDibPfRmqYnP>fl zRL=Qfj9;X@P?^bxOr^l5Z_xRucS2g`Sk+=PPyICsOKYlpEq&Co=g4N4R32w^s-IU= zrk$*8ZynuI_O|u+!3M?FZE5&rS(0Y;Cu0M@*8c(k&H+u=R_M{iNqS?+eH$zzs$K3U zZECGQkHz&9wirVI`?s<(7fc6W|v(b1+Re z{)VWKjzjqF4#YBoH|*=-b9-`oKQ=NH3wV0^G-Ar__l)dP#dN_@R3`JV;E|#^GxuLH zhBPGvVJD*v6YJ^wgTDP3P+OYw%3 zUp%boH0&MQ8JNl3zjW_buarZ@@-+N208hy&@Hd1D`*oK=r@j$Si)_Bt%)xUxmtT(r z$z#>yYq`<^7|gJ@`9G@vysi5BI<3pvn5D&+EDojj_(UGe*M%)7kh zScy@!8YzJ6av&-pcO3V+>(yT=Fx`5xJZR3k7=~o$w z_Sl4KRwQ(CbdT+9Vr6OOFGFk88HUO^C*CyzgzmAsoM&aPSAy^V@zrCKSgH_4!p;fq zBUaD`gwh264_^(J=@}2q^k00x&rtlbpOgNZb3ccG=HeibthD`&<$99o8rJ9LJC=<2 z%H#%#=dbXjfUd|T$KooHq}Epl__QhZQp@bt5mgIX{2XCRvD6%HpU+q-l4%0xvdOmI zV|Navy}oQQ31Kp&1MwAW{uT8kXjjMo>F!%E%*sEyOyY=)`oS*XblHC;@I?0QxWi+k z#tK-5k@{MD+{PU1Id?oua8?ctAV^& zB3Xo~P<;A{+G7^@kibJY)0A^R^JoOpEv6$FTpDUllg)#GWHb|1iu|h1HvvYDMg9B_ECt$$ z3(MF}?dLASQ*N_lvtri&+1_nQAG#Udc!t;C$V{#N!)K;kz*qHV_1uj&20^~GxkBz7 zE?2_)Erw!$bHxmV0yPc`M@a^3AfH6uZ?V^h>mpv5givK#1KmD~bCyHND*dyL?yKu0 z*T_v;G3^)0&*q6D5yb=ks9K8%<4BtWlGd9r)0zuf3UfEnvhuJz@ljxTbOj1nS5RSKO>n$#rZn>#bpF`Mv zac!*Tzrbsf1T1CN1E^yr|3S|})ZnAtXCcu*WGH(!rtiMED3m*7d0jc8yJsI)(Q6B) z!vKufGoP*xjQIdpMzhJcU2}%r4hQG9EZ1cnkAEq@8y`R9d%-tzeSa0|b>l#u&ClHY zpp-qHGCmSl=#T6Cyg=HQr2^uupo~f^4djLg&g)-CG#u3_Pc+1ycpLq5!(DNo-jsZv zjMjheK9vhcB=}J@)iTwdWgk^(UbNk{%H=(Hvat}OotvrLjlSVuIeR9UI*`?XqCf1e zln(LzJmT$$6vksRVoovk_6e))&$nYQc0a%JFV-q=`y2R*BnmStdCFQUZ2d=AHsXcB zW-V<-bV47NyNg18eg5LQm^*uxaei;KDC4{QNcz9zCFI7}37166ge|EFwuouTi+$~i zYn^vBVS1e%n4drBhM{=;zKB2W$bWa)FP166Iz!2eko~dDlA~r|Q+x)WRSst?WdF6E z8ke$V&FI-)knhd5_-mHNylcp}l3+;Tt`*WtZAWo^Vdjrw`5qzMh@%ucLH?P+ zm(q(?GjL_HB_s)242RsOzOA@%bG8*pL$_v*BQh$VpmQ5*RfrLDJs@5+Zy;7r>bFWD z*0gn~_WZJ69{V5qr51jc>UghYyjFR(!6@KU*c|a9tL#La&uJ81f{j^a(L0^fttjMn zRTD#R#htDrpULEvRNM~o2l~AHjmVX@=Sog6Yv1ktQW6c#wy7=DYL5Q;TA7OH8CuG~ zn-3@L4OxQ1n=R{Upx&3~PWtW_DaklKS8!F3m=*{{j>SF1rC`1_ziprFRbZTnC)7(m zsm^K7Vp$!?&%jSPiBe@`2%s2ScaTDJ3K>QX={h`3#IN-pv^lhzgWcd-if=Xhs_inF zlFWj?DJJs|G-6(4cnquuX32KBM-kSzzQYfByic(f_`el*78(IgWdQDyu{_Aw6hYEO zQ!@3*-8&n4+cdjR5atT|!jl}B_z0oiX zMs?)7E@Krw|c-T<>YSHI67d|OQT~g5B4m5qL)`b3Y zlS8ERn)7(nbxtcJ@CF#60Nz}zPA^WmsNBSi_5$*{Wpn?8m5;*^UloXV1OH-+3B6Oi zkw+!4xT;RGBj}!dY(>ZfxFJu zQqJ^TCTJ_wXfmU(4*9Y=5i)M5vBL7*dzU5+Z>#DClrFEa5|9Pb6GQ{2@A&$1;6+pZ z?V^s2(x&`AErF>nAWzX$Ken9u12P)hiB*X1i0iv`%>7mHTJuw3ucN}P`^%zyh=kWHA^ ztD|_z#+*z>tme0Pu^wI}2I3YGGV@oqp&~ z-=l&1J)BZJ`KaSek4SMCkol=Yys}lN`}hd9y26)yYO4CMukrQSU78|PES>rS8~w@+ z4=ho8A7Nm`r^T}5KAVYUlWl`331Aq3ysJDj`pt2l*WGfei3peUjbh!c znN?z|Rqn`gm^bl6h-S=*>&0!hqvqE1TcH$Di+uWa4hkn8fGlD-@K?NU+jo&8px)=b zE9YL~449%u2EOBU8`fWZcyi--{x(DTeA$LqQFsXaJ6bIWbT<9Aqo5YY->TcQ;a;Tx z<5RZ~0!y5_U0^2``X#_|zgoSQkHg*-$qhSNQv6{V;*@c)ts zR_J7BTprASEgo|x!&~mtI_KFZ_RsAgL^!3Pq&=h<*!v&50fh**Bx z-$YCt_!i&q70hzGk<#h{f&QO`YHWRv&QCP=)wol-&gLryD&$sF-`dQBEV)n?f=UWT zwRNpr-Z1VDG*-Fy`ze6e79ra6+icpQ46l?y7#4egIF~Ml)1wLc zKZe$o@F@EG15xR*agP#RVS-S$6&*1m)dxdcQ|nhBPH!w!0Z3aonu<5Z`R`Tgd!Vf? z9+w^+PA=VPeqK^WdvHG(EdBq}vwooZitAo%u#`JKKG(~cVX~4ka#hE$+ly-UyD32xWE2<@MN%K`7S z)NW^i&Rt+Pkx~J0b@*FQw&4Amxowa&&ZV2pz^BiC5*ioxXK_a2s|3Ij+uPko@Ko!7 z9yCB`{Xf1WlpDYo0?d{F-YmtGk+ytBlKQah0`~I!wwyjgak-W+rMSw2SFD%WB2nA& z=d=~S?WFDVF?YNR60k)fSpQLDd-gEN6|M^OdGrDPVdQmVtgzTVkY|-bpi?U#RzUZ?zM&Uvjc4-$AP&8Me4{^j*)IPhr;HU52^PMr4`fzQVQ%w_ zZF3TS!8fhHCfdq(AvGjPeE z-OWJ?`p}gMATV{hwMS3Xj{YqjXIec^Q^&R_Ijf66PDB64rUDUAE z^odne#L!RpPve_SP(Xa(!3&JHw}*=#R2O!zp9`^MFH87t3~ZzmwH}SvCnWX6NR$mh zO~hZ91E{XF*o_*`lLF!ZOxj@{!&|wZRZ-o2&2GxqnuF$Oc=rWwrpd|`BypA)cAjua z^$cn?d-#z4TN-uuv*F)maMstB4m%W7m>Z;80h6Qe7fUQdPFqIVMurQYDBa;Jg~j1@ zQvftPfBz5byiZRtcN2c#D^P~04KM8VyFz5CE(J12@h}GXQ~fdkR*i?OZ=1cd_<;qLizG5LtTM1p?4gP z{oZN_IZ|CW>Q>~me+!lo$@2+jexnWz1)^D(pKKXn2Q!A`4J?A>M@C}UO`xD>eK&Nl zJ`E)w=6=Fscb|>G-h8AjrxVJSVaY?CjjN7#dd}M$x9s63T#n9*gwVa!W-nii$u^)_)dfN?tY-UrjIKe=fh1Y_D|i; zAf|>tuoo_rKv;$f*Spn3rIeduGjzD@fp#e{n|qom-BnG;epF+-#^e9 za0-Z{l$QvO`1>71{}e&Z6NE9VZM^G9c;^u)|C>PC(hKHLthWK!%pP7pI%H2vK+7u_ zLNVC+W1y|s`8#IQUB6uCW3+~f6!%PP_Wx1!7JgB-(YH6!jYxM%BcOmZ0|Fu;Dc#cD z9YaV2w@4a3jiaW>bW1&dyYo+L) z$IEgo$?oqT0`+SV&%Uu&El1G?%B7VZK=bLF#DlQ0YSOgwsVjS10fp2iJ1Gm}7bIOH z^P*n*u!bow-OgWW@v3??a{FVl4#^Vew`x?`rS(x^6!i-~uGaebabp~~SKWRF7%CnA zXl;lT{!$MqjG9V9AJ9Z8rHv|`Q^V;A;omF4_L6T1jvaeb$ED90{LtfI^Rae zMj%-pfz2p2sozI@OXZlUeC3^ItN7XJi;>%U8qe%UR5UZ1|A&z|NLjqB1`%hnFJlzRX{otZ0m`9b=+Se8Sq3z=G zr%bA=KXViQ7t~T{VO-9ecjgnFzj(a6$pbKARF=lT4pHf;<2ePwWh+ZjGlgy#sk8|A zH7_85UMf-Q)w49S{vZ4zUH)R*P`0veY_THtTfd5>e=K0i{8hx|#inf%<~%5>fM0Qi zemIj@??P)oT4IW^EN&aZKQi%cI_Yr9E=cP;@JE0QNakCqMy!ckLJX&nFl<=TCLcK> zwU}k3ZdWCZahFWEi~mzbH!Kh`q%o+=dp!F;aI1-KFTAZ#@jcbXcQa$^yt<0xx_IL? za4X#1e@!w;`3jWToTY^HI{|E4YYFrEO8yL0K@6tvf`h#*gLz8D=C@RzGD_NJJ7krB#|ZG68YT3jPlGuaj>g*|FnLf-}+X>v*aeIyknU} zshm`DpVjNpP@jjvqX$?yFZYOi20(~y59DLdke?g>n`NB{Ujgp`Ah{m~R>G^Ver`Z) zT+^oe$MF?H^L93b}B%5*IH|0UhZELLaRgUa39n_zr7yzARW~ z_r>OJsL)K7?$H?GA+lVjMr9+GqbwyXDD)HjR&O9_ZSp?PX@m*7TT{>|X%Cf6P#|tS8Q~cUu7ThKY<@WJ#xC=KQdA?Iqk6MMz{B=AeNuHjsh3hCzbSA`3$bfrr*z;60`E%eVNt+ zZ#g2*kR*|?r1nuMDBFx>qtywE-c5BLKPBwui6)K^eKGL&ddHscASO^_WTM9bWFN=& z6{|t4Y<6J;S#<#B@iU@8iaCWO;kgf?Pw<_2)g@)cUS+k2?cRXvxL3FQ07E|WxdT98 zXPro1i&`ITzWa^IHU3{PI%3${hTM|pKZG{|me_e>8vMx0IJCwYhZGKLVZR@%yR-}r zvOKxwLhW#k-0)&>vezQ2-Si3_nE&Lw=MYi=_!koCUSD6FzWR!!Cyz3OO zT9QV|$PfkAK&3+3ZT8#uziY#E&X!k`ezhg*#g!D+^M#GLJaE^0B)Wxf2lOcZweGg= zVQPMvQCL0h@+*e`>vV`S}iqY}_>e6bBp-xqs zW`xg#A*MJEPH)wIP$v07Q~#j+z&(c0AI0k@&4b%k@i&3`<+RjiD<0QYsD&J@1+1vH6&ggHj>I0S6> zdCjk>bH#4=`hmPid#(V|LP;p zU-b=Mp@Z1;wPr#sK6^lq%(%)b{9RQzNii45r2$E&eCmCBk<5TYm1>Dckh(B!!D_WJIwX)fR>Gxl zN*k_8)#4}rJNiha?#N!C+FwZORz%})6lU9~`lZh=tgN1akkt2>Q2fc*S7sv0TTLRp z*glEn>t^~_<_|l>MaTN@n5R8Sl@`U8M~ci_vy0TnynCpQKY*Of6UMz*K7zD?ilkDFZd<21NW;^T#(G zfZp6s0WgBNJZcq~qq}%|EJpI7x3>UI+!?mOcfcjWg8yR*q3o-(LoB@O=o$kO5#@?wMV?7<49kB}s1dHB(5Tzcke5?X~%|J2{^ zs+;fC>)YK064q%KGQR5@k#KWh%jWlvDY6DWzN%3CGhTOqBg2v|kn1kkXk_=<_r1k2 znKAD{yJY15hQFyhTy8%g_8#$FA18>dl|s=zQ0CL*~A=-S5kFL5KaQinh>oJCPq{x8^TMX6XkTyYSN}S+?Az zNht70ak3+p@x49X`3psvj6GBcP(y<`dC0l-RoQno!%E^4u`=3LoG{blUe&^Au zsR@}0>wZO0D!Dy{fS#R6dzTDqzMH{6a|x3y`EHfL4B;$S)rw+6dDpC=H{;wGQE6g2oEV6u>QvwHVhPWv<$$O{yI5Dk13uw_7)HLLu?Bicp{;op$d1 z2CQM#k-k0jPxOHGW!aK{t-XZSgi`}X6#o9cx#9+k``@V3y0O(@F|&r%Ie9!nd-Jof zL=#tNT&}2;j_8f=xc<9AupZ{ky2ca?!V`K03GmT^g3n8KVu59xGqWr8RY76{$8MPT zP!88Ig#4&Lf9eFVO6!KvRn=W9Aogr5egHV*ZprukT~2V?bm-US(&M&Fawdai?^}L* zZ_;#(b1tgVUN?jGWxc+8bk(TQ9N)GcH$y_GWc867)!EYhJCU)`5|#<*yTe%oDe*?C zjlDIOy@*VzxU_Lc33a3x6?H!DRe-i0&wZkj?ZtLK{*POs>At(S<`Xv3gt^7GL)P#+^Jfh-hX)wuHk+&%*d7W z%9yZ)D@3higuaFdNx6H~TErXr>4MVs;V`XETRiWuQq->Nf@zA)gfk>|7yBahxEBpg zHCdQ&f>ccqF$7liQpZHIU!}OSST&bOEW+)U!aDs09s|V?lI?_@k}6XY-i0%GH3uKQ z4T2Y7grA@_Ncf`g>N8vws`hb0Z)g|lUMi7qHK~Zn{+KF%R|;ZM+otYXjPNu zu|}eL$v%TXaro~=!TNc7Zj#1#dw5vYS#iTP;hD9(ZTUl{%+_^oKAssIwUw6ZZAmyV zBR|8ZZHzDDcdFP2;Fe3Iq+5umAO~>mlL{d2(GqxC_Jsh5J}AOpw-o8^>w?@Do|JRo zzQ=?dzL${EB4_D%kR1|b&MiIH-b(G)J%Jp39 zYmn`wMV39$j~0iIWxy03c_mnDigy-qADXqfY65fi5+qka-=65LkOGcuZ=413(6IKQ z15xBnk_1Pew8&W)GMfklr#E}edGW!}36Ppd%?BsERQA2I-q>GQiSV3=}+1 zK=MMk?Rfno5~a7`b?gT`>wRp3lcT7@0zx!fr}fSNeH^uBih%T0TnPe4#!l6GwBKkf z(ve*y5ylwjP9KdeEzj|)t>`eGkJBBMYUN+w82<@>y4-laXtEc;wcw1AMSh0&y7Lni z7iWl1j#jcfV479A(r3-hIJwM(FxW^E|FWw0UIe zJ|)Z@0%B&QLX+|Gf2@l6icvWRz81Jrs_*^c*NDXK)4h~GKVMW-pu`xX_HfVaY)q`Y zV`={#3YrIyOE!3sqqu`

B14rw&-XNmb>sbqe=V{EEe5M&%93E|LxK7G=eBrcXjP}YmZDB|Nsqe()wKh&5^ zb#&;VqaxWQ<+W0?6N1wQY z*}LeEW$pNwp?y=93=r!9nDAg|6^Dj^3j-zw)cod+E_{ z$1lcz6CII;vR&<6)f<6qdU-qWB2fo>6%f+hh)iTA6`BPAu5@6(-OopB6*wt4Sp!(5 z(Fg6kKE~oTc-tm0bvnv_3ZQxe4;6k({{8meCG--mAHG?vZ{S{&6t-m_|q8`>? zW-754(fvEp!5e{>@x{?;>@L?@&OYo?(B;3)5ev?bsL2-T1b;VwBT2U`L}HoX)iQlm z=_kS8L=v9Fm7VhX)%}%ogWIbGb3a66FwEhlola59k3jFSeZ3u|1Jr6leTGoZLdNjbZI)fIQW42jOD`%NQ7Kb= z%)_SUb&OA}>84l};=CQLWZ^a{-ypYogYuueIzrwNwv5ISBuw6R3Vo97 z+xaeuEp&se!kw`T=?Fajw7juzAZ5aS1)Okw1N_#6t8WncMd@mt@-bNWstxPK^{lEM zu@2YlGe!thXHjqEsq}ea)1EhEBgo#wm<_0K>Uo2(Nlq z((Hp#7o`eI~D6tNt4g*ruTl3V~9(@^d>&{N~_k7PI?}D<=f$6Km%A8UIVV ztryxf6zbE5_PC>}>=H3Ic&8tI1o(XKD!W^cp@&=Dx6hW{00AkmN5E963roM}MO7EH z{xRvUqsqQpiY%h%7!*M$GzL`D)B@SRyee)XY3f(db*F1Q%pfx{vGX2-@~3za(`n0t z`jqKE8BnFxFb6&bQWA{)Tg7;O?=`b@*}%AC(!aB)Lqbx4S^n2JIRPfY)e;%w0`)|yB#rHo!}N+ffzlicx@&bP!VG)zPjM^SD%SG zNhnjJKB?-1rXe#K)-$6&ZO-A>7Vw6bZ*>iIVH}+w{N@~V%bcz(%NKrz>1!P+?byE& zz_1_DT1pnt2z&o?_DAYRW!JHBh2v^tHZJ8cK564uYz1E5$q&>040d9abk6iHg}aG= zo#FSBcL^e;7pnZZiA<;asH(%kM6M_$qbS*^@Ig8T1x<_}>;sDv>vgstmxCV~`q1xA zUn;muUvZrL-HO@SJp4qR)Xv%@?Z*uD-4F6Mv`BL}1?lE?sh^zeC$``Tzkf7D{m zGdM@cWIeu&nTlJd&$FJ@|4%t=!9o<8Gls)&2*=n4CdN6RfWTp`D?m~?w?+@TDK2$= zB4k1Pfx|kboR~v@7*I0mV!whccbuSagL%d|ppdlM+voH5%3WdR&-ctbF*bK?m!H=5 zYG04b&6@eX*(=Drr1bEUn~g+wJRi4z59-f?5*wJta=c?i8m|46Y|pAxoSA3x9PT9)|N0)PvDM(et_8;OJ9t!r&JpK91*X@^6H!z@SH z%R_@R`(oy&AKHrIj%C`m)z$VTfCF(4ZfS98u+2Vjt@RH$uXRJ@51kdA48n1uDS|*T zP~tEOPyc8=c7>%^?`}|Y9Omt`%h`iF9dw*r74pYPia#95u`GTo$Cgm(lDjTKFM)5} z;#_kMxT{g!cM*x}VW6w6WU>D$Q5og7cw>bXTB@}rYsblO5XCmyGAMYwkj?VmKH6iW zCCIg9!a~EV7b#%Ry@GCZY{qTBisD$9QR`ripeA)E4e*z#YYn_kVgx3Z$?~oN-KJp# z?MRY?gEyHV8c4hq(X|0xOoOze!17j6CEgI@y~aa;zJvJB2`_YX*WMs0f+I}{45yf^ zcfZ;?Uh|1~?*CCsamr^i$&2JuMU@w3Pq&($JW&Mu-oD*{k-mA4^5RSD-~Lf{^6nz2l#zk4gzHJZZj_g%pj__zJ2*sFxBa4^!y| zqiQ(96gRJp*akVh}AO1^$-d*|3=7+Y3j$ zQ1<)LXoVs6jEHTzo(0cu7M#$Ww>T!5uyZ4H7|`}hD;018?LH*}%zH>H(DxTi`^ZWw zH^U6f{B!kv!V*dqWn(m%w5=ix*69XK*F_<{(dVn^Enqyhk@-R{j_kXlD(IflD- z()7_|V?m50L~Vh|ojBlXfK*Zm#5h)vTmiqgK=&H8mEehg_hWhMLwL@mNwsG|L|Es~ zq(XgTjZ0RM8w3GF)V8O0Ufp?BJzR4xjgCz;iQz+dlP{$iubB*TMS4Bz)n4z(BVl2$ zaPQlGIeW6u4xbNwC$`_=7CG_GF}omYuiYW9&zB+ z-S@U_?wIY&y6KEyzBLohdt0n$&HIcdy%S?G;ahEuZ5RxogDKMUN}mqeBJ{_HO~e+H z(8hGKW*I*a9oO+xfv?(*RC#De96V+&&Y+!$fibOEfmQ(z1>@;s69+g8`tO$DLV4UO z`F=x>X-$$#rm0e=!TuAR;WUvj4|uI%L#Yt*BL`fu2_I22Get2hf|eP>RaNgeCp41v zE|`^nG`+_`@su+5kX@l}8&oH&((21XY(q{qCurvD${3D@*v|`gy;)P`;@}vHP{m)XyzfulNXrY)ol_1&Wnge0J#;UA{`)Z zlFH;>?(&xpYKr$VZT{)B%7?zP`VX~vj6NfJUvKj4Z~Ge)>1mQN&%aeR5K6}sddHBf zy|#Tu-jy&NMpig^T90Z>1{SH2rgi|`5~_CK+_M}8@?&4GfbmRFnShqN2u=tS8c$RA zh!UQ6bbZjw-}LYP&--}-Mqa{=+w}hvD8xws#wF4x-RFqw7lV*s>crfUcDQu3H{yM# z+=AB}&?W$~Dr~?F#60ro6~5MazZ8Wc+5Dqc3@M5Id=-s;bi9$$Dt(LK6!oR!S^NfC zLbc{{^NVjXKFXjV-VzHT$N8UCHf7%s9P7&u4a>RCf^*}+};?B|b#^a_X zZx+521|ZN%W!_#zz~^8%uZU_#biDaRw*XQT-cEKuI~MRglk9BLtfe)c`Zz~;PE5CW zr$z1iLKl9(GnM6G*FA(#Z#0iPsNk^}n-$<5A>D_Jk|Bfu5Hqsz>=Xucl&GJ;yim!I zn04UyE-yvPIZfVvZ857x`)v_;VqI#D$k+i;ZbKObGZfr$Sz zCAtgYhk^-f0fV1S6aVSJuS4L{Ay#@HGH0g^8o!wedtigz{DiCoaxKD~B{FOWP+7Ym{ z{KVtVEKqP5Hbn_#ArX|}!kWP)NqQ;8ouU%Vp7_Re zmgP&q?X>!9ueqcJx2i!Z8UjYNUII@iwT6pe#D`u0zxxEow41nRJyvkZT#fm3IasUl zZ(sD)7fs23#_0LquV}FTkRZ=FnwL=Qq-EgzrTF6*T+)0d_`iu%uXWT(Py$G0B6_}TU~ z0o8H%xz2Ao$5W3tQ6F>J!9r(_CvK>DQ{%`!I}jAi915sr3NduORSahs7>DYn0;W97 z1uzxdhsgR% z+Dl=eJN02501c(H@31xnvl^+aBf^~~5$;ndrJtcZ{FkmMb?UoAPc1I974?t2lvmys z$wTBesd*8MmCKw;x+peT=<7t=2Cx`)FNaIf3P$T}l~Ok1M_SbK{=AL)yGY#|W?9NiL3jd)7%4&xYr$ ztjV+t-rX??0#<_OtWEH3N$;eg)`fo4F;wkzI2X4X#5ogG?$Mf`DCM4kvdg7Qh?`ue z?=0R7p?E&_bS6t=xts2-4*l;E-n5J_>AiohIP4qa6QzB=<5>et-@!@FJGzHI3Lw@V z#xzxtWys^6Jwn!Se>0V)C%sjYYX=>Jlt6Ipz4()}OmQXj?akYh?Od=pIqNveHTf!U zJcJIKk$&8WrSrF&^6YQueeZhhEN{v=mL8jN@_{h{Yx^pl1fHd*k*Ra$nsT>s_^VrMWaSrzo2<0?k(l(6M>+*; zusyaLjVdFQ5|i)dVf0Zi?0HvBf=nedzQ;OS>@D19ekM^=74WLhUVQPnlym02<9lt) za{Jq+eGOTSbmUpP!X7I!-i7OsxX7=xCzW#h*>Xy{O!mC{x_^C&IjFwe-a0;sP}5Pj zSkNd2)h>v~qkdlbVe=JK9g`+@>zz1YNb~nPg#Gi!%*Pd!;y>S|ULpuo&9gUEbL=J? z`D;IWwT18`&bWCoH(HVLB~^SH9S63En8Lj(kokeT#1oxG^Z>>;^2@_)Y35n@I`$GU zu2(e-xbawc-9sq9s-%l?EKT{L;A#e-wZ-j@WvH4-%Ys6nv349390gQmH4ln&Ke6A$ zGmcpHW{ny2&QOk&VuU9jI`g*$q)Xg5DY$YD)xq5g{qIxxf%rPdm%!;syCD=&x|$mR zaxX7*KNMOCyKcSoS?dR7au`_-_S4F;a&-N|n6i3YQh1SqbW6*!EsGvW&;C6lEdO~M z`N@t}>02aa9sL|#L-iWBf)PUH?zUAI4grp$rGQ~}0|z4eGUZ$joE0>4Wfn<0zhj<{e)~&M=KpdJ z$i?wP6C=i(Q1htt{cwqc&ZeT|`vYa%Jmb(>c zp%67pzT8Yds!!s8SI9naCQAZz`$@{Fsced{UkzRj=sR}_6lWg?^FuOFVZ;l}6RZ>?M^e(uZ}GwWgB zZPYyQJPq7fDOaZWbo4JJUq9sfdZtN>qO?^~FR(5Ye4ri{SXd^DxP19ro3)ItlUNwo zy+!%l05p7fh(E2v{_iMXhn{1u1Swn~nm@Yjt(5b6h{>HT-2MJ4l)kO z+}+@6;rv*)X`jq2CO?miX{S4{SgNMyq84c)tnA^-2?Ojipv9mI;dF6NghGucM6EPo z^F|8rXRx4z$r|PGHA+l@FOu;erg??9d1kJ(+H1q+FbjuC&)=p-{|w^h(wF5%N34Vc zzcNH$c7A0zn3Tl*lFKJkKfT=Kv<{!~F0{np7q8Y_C|H+)z3;_&L@~TJuWi5)Zrj)QLwQ{iW;a03K7?8|x9lE7)(tZz`!#}4_&gRo zck6oUT-H_Qy#ES7wiejYxb~!?(l~FL;ckX6N)Q1n&rbK1!$3ohy8H9_Gro|Km&lH| zGq;*XQi#q`fb-;S4h9ON#dA~JuZ_p*3-G0w1sZV+ZfBNkwx993fL4MXIZEO` zDWiJ&;|70gsYSfZ{@~F3eVH(ZdJp*&K%^T-R@MW{?z@SmY@sUt0sr&)7UMU-ZLMk? z?8mOV0};Uc{Zn^i5ydkLS;XMF@k&ssW(9TfMmL%A(TxDsG~G4eCo5Zj`QoiA-|=1L zAKyOgI<}b*yp`C5kv6!+Yg1$jmTbCd8L8pNa|8DfDBU;@C$RpU;xG^XhVPC2TT4}+ zQ8Ga|?Yu*fA;|O}I;Z{1vuJc;ghdgojH7yt=In}%IKjDoB(>p}sgfD~ZqKv+9K&!i z-kEia{aWME+p>ZP+;ggO#tadtS+%5XSm2O#_)eZjdtl@|I4EgvEZO6Cp5>dZwngA= z7fOatmB46C$%{;(CsGU-_{zz3-}R}Dbn;snKh2mG zXKkZZR8Au(n=kf3wM`rC(J49^C>2xh;tUQw+2i*L801I&=HSYi&)XKfT@Sjdw(H1T z4sj+CJM=g=v_FldxQ~p4`eLUI(KXSSUgzM12!!(s`;Fi-7YR!wDJ%An_)u;7*J~X(ww|MhWytuNfd~;;Y=n%F*7|Q)}I@`M>dif9Xup4;b zoeys|uACQz-H%CRN{%{%3rbw>X@rVdyQgz3u6x>i-mvr*Oplc-uo+l7(TY+yC9i)w zz*RO^F}dn4*4jex-Ri!;MaHn9sj8_;@1Sj>cSstrd@z1Kbaofa!X3!L*j~J71WaEJ zIj(flcB{SKwE?8HTBmm$13|Q_pE11Vn-hjS#8a_NSIcD=Rak_c{V|2XiNDr39HL&llI3AiEcIEm-~Rz(yDxVm>mJ`{lJ zmp#&pP}+>-sGA9P18HUjBV4;BgzIZq^LH8mlA#xAd%&y&&K~&KQ)G1*-V|Sp@?>mD z_s5KH>|}zfBDJ5a;`TjwuhD-XehaQslV!J?d>fD|16A2mwe?lY7S8@;xbmXtDPV#5 zGd$-P1|sib2_c2Ncy@EZnbj)4M@<`W4T-|5Ypd56|mc z`5(WeHzv&2-nu(W~rkvAdA`r#Ltnc#Uo(r{vVD{NO1q;8Y z#kC__+HA-Xo(#oA%Gnw(dCp5aQdZ!GI`xX~ub@xufLV6{zreYwi~lY_GpN%h7ny{* zyf4|mD6njm3fvnF zs|^8MQau<&X?HLJemUD|wZ!RN&Hr zZ5&!rdO%O3V#mBh%f(tKLWz2jjsl)@j+*xf?u6CWEP&UZ{et};C~UlNO^T^mYH3E5+*4(0xWt2Fk2sJmb=WJeqsoLumpP z0z{Z~;Z4h{S_^RPO~^?}3M+6O77!lgL~)v-0q4Rg`-%bWnX5 zIT;1yjzqfUcREVhpMCeGOWVZH_STbET9h=L zHY$DOjA!h~TWa_Yl%p%~v+reMH9+dU@e{=kgCi z`#OTlGMiGO=YG5UY12t}ImIO@lJe~1ba!>ZWJ!kLCtfR^AK?_4X0X9+qJm!KEw`4I z;6#GnH^@Ej_9tT2A5(+ECfevA(O>ms%JI)7zGEa0ok)X49;N{8v-jW18v=D+$sA$~ z{v+}qpKLU_(6XOPA~Ac!=tKU&&FP3Em0AVA18u<Z4PU2 z?7hp2d08(*M~ycgBOdH~%TBWGzJ~T~1_T~-b4SXp9BzCImZFLapW}SN)s0KG6;+K( zbPg4UOdpA(KH6J5={qgkQ0X<1KngtS&aH#XS3Vcf4vOs)tYL>2(mMIO&$I{%bBVAZ ziF?M3)5I7J$^aTGUi=7nafiae zX}_=m51z2LtDF!&nM!LFY|``#3)}2HA(J*?MD@hr@bhN~r?GpGR3dKf9jyKXs(?bw z!R_{&XkqRB?pBxX1|!T%XQk5Bpf@3E;+wT%VJ`09Y~R1nOp&rgZGL;aTZ80B1u!0i z3vyY%Y(0WN1ZzN!p(jEaA$psR*Qw8?tHE#ghmC=}R5%mY5jFF~<35hj?)yFw2&Z5K zUnmly8uE~a17u{gP$!<PXWc8VaRU& z!5@OZlSYS|=UT@tO&dsm)}Q>4Xv(iZupz}ho}8MUTZr>nQ^}@4pInF z=YxlIGm(e;GeR25YCooQH>{y#=9P~JeiiO#J}y+Nolbi*!URIJAtlBJS)_#au%(45 zSk5jKjBpd z;0=-?XNc-b4wq_0A;;yJrvOx8yeQ@UjsJ01!X#i-tEuO|emnsL4Kld;3VGn#)9to@ zi_y0{%w3`#?tGXtntd@H?IZlc2Q)>AEXC{WUV_Rlb8J-on#E!8Rm5) z;pQ)AvA3XiRYQj_Z)Aw~zPYB~G!;bPW$DojM!u8XcJOR@pQUGF+>mtShw|lN-~dnd zzlvBakCw4-49odXEqim0r0!iH(9qengY}AHanoM*DTGM;1Wv{PP)xD0Q2SKrVxub6 z!kn78^}DaZ`}z8d;CuD0U5FK>_i4qhX;~3y@o?`;O2$9J87>yTR~l4sT)y{OwL~`L-y(*> zbu@B^I_vi`C_8Zcv&aXU{x%PN5Ry1Uc>X*u>y5~C2t0mm2$xTgeEzMkTeyDfZ<@E) zruC;BXz<*xowTi|Jk3sRpEw)vmie`#>PdKFhX%F8`+mo>VJU&fR}MdDUul@%6g%AJ zDOf}VvHu?r#hdIG=gJNIZOKY7bO)A%ZGoeF2eT`!^WX-y1Iw~%8m-Bt)h1lD@Qsq6>ce``* z`wp*bq5fhKQyuc9{w>r}67lYP0TD;#A1J1%6PLG;n`RZ$IN(P#oQ26QvpmX29tc~U z24p6f6}Y)}(^0X-+?z5Knczj8I`HItJdk9b!4%XTd zpL{<1x;eq7P<4qoZQfmdp)B_Fd@^REsIPh|)I-rY1BUgv;%@aFs~)` z(Onqu-}E->04r-c=x}Mydicb0DgXp3G{C2$E~B!qkxc%OOrKd$M%iZ zdS=8biI~>gG(r9-76tF#Rnf%Pj~)S&A-^BPO`!!Q@ejdisfhI;!;?e6*SszaUX)Wh ztoKbmwr!;wh+%ns*$U0J3De=bE6_7}0yiLy7=1>t8V{bLBp@vQg*FROtX>vKD zm`h+hs4p^E5N~W^yotUneShd_{LtwUy$o@+}F39VL1us;0z^qnlfa-S=^yvTQV08~U}e z2UEvyebsdYSUJd{xByLr-T`Mm6}1Q)wDSY->q8nV)HuS$5a`x2zOlfh*x5ZLupMo!$Lam%?S1INz>(6`H;zQWRdM<|I`?~ zxJh;KYK63vo5G{`HS~V{M2_wzLVh=A#QP_N3YGkQLuxD|)5tqJOv^D0Rn5y}X&SpD zKAo5C62fThHXgF(vrRScyWGPhduQ4ySLjzvnu9$=@9OhRJqZ@0k;6nZ85Zq(huE9d zYZxHf3{sLVexual-Do7U8X7QpC&XhZvMbe(q#jK^u_q|US|aI<&f!Mlk{E-BzJUEg zBB7lC#Rv8QOE5F*j{2>2%x$FOdQSq;+sQ_BqqdX8Kr$`W4|TQ&T9~1j&a7 zcc=>*gX$JEoo1W5360(F<-lNbCAtN-o3(uReWWIxG@PJNY}j=bwRKUXgkqRZxxK); z2D=@wJ`9x1Vm|?2pvL#=wTA$jCp=QRE50Qvp3t}IeyFY+x&F`4-SyrD?pYsjilgEcF;3j7 zS3KyQeI5iT63sr07nuIZno5X!w{h@I1D8)}<5mBCr8jq3f~Cjzv8+^z5mI;W_gAd9 zzRzts&Mw5KU}v8#*lgN7wwLyH$wHF$#rD_edW^97#QLP}b1+wbG*k9xP>-@YO;g|x^&ME6Akmj4=y^LLlG4j_t?WNw7B&HH z8$uxokT+JBC?(#)7{s|XTvelSLNEQ`h;2iWePv}aJT#z>VJN0QUc`t3ikP9R<4~B} zp(i9Bk;i!@CnUk}sk@Kj((`a3g+eyTOon36Gl!Jvoz)ir5hV_yZKs2iW<0Sm-McJu zbO`+a{2(pMY+Fin*&QZ=58FnHSh_#CdMNZZU(ybf=3tqRWoO|2rX2`foVC8O5lT<_ zC(Za~jAS4lJAZBInuRCocfNwY`c#odCqKTL-@)c|x{R~Og*%Iy!tCZ$rp(>H!09Z1 zW2^nI`yf_hw_oIkUO_f+x+=$iz&0%3a1%f@IE?~MPX-tBh@CZ5>-_;H?0+l2_3hjE z8S?@yB*`W=yNo?k;!~A1Cxs8~|Kosk3T|qqRw)ufAycNmi7#v}jnhtZVdq*8=YAYv zyWsD-+ykU+n+Xj&gVZo!dPX$dZ;WYra9uori!S0>&pruvNl=A4qbC+$d@u8lFHPr9Yxk6gX7cLz*!OIx3nVx#{x2U)f}iS z51uthmQ=;rve1*~Lze#v^Ne|CGeZ!VV~=d+%%$rWnU_Z?q$8pFG| zSL^_L!B_?q()vx{joFXt2SlHn{(jmE*t~LupY9N1g5=ZZXW9`77fzY4Z(LotaWy^A zjKz8FY%{)jgz)1Z-Zqe^&*Qb){^kv=ybaRLV-gGPCTbjbdW}pIO!descyLV(_6Xsg zv$Jl5-IMKA@WB84(i%$21X)`9Ow?7PgoGwD4gRzqjZ0{jrjm)1Wd5!PpmJp9zd1%u zB~4xlG7e4(1jt5#d2!K-IlxFE1a9>?G*JL2j`Wgq&`N5R`_tYd`{o10JH-?enilJ~bm)L9~hmpNArZ&Iz^^962V0ILY zU}$$vAwRG!UQ=i|qG-y7BM_R3wPSXVKgHX|bKUqhr{=5F?aK-?3K3dJTTa{%rl_4E zR4|(ki>yXSmh?H~3w!8jB*mI4)z#ePEqUwtF}Lse@wli;L~Uh0(}84KVv^{jw08*& zbd)zy>+ip0ZdMDgqKGT*r=&M=xm0LG%=fvn?rFd7J%snq7CKepEPxJ%k=#vSgweLh1NVv+#HOj`68Kx)1rIUc4QAe4&g>X*s3+ zj&69;^NJ!!{RCuXg=k3iYg)C@yvqql$?1jHY4;t{8^_16%Oj^^l_o+Fv2}!kxTODzMTUA>@(R>Qi3fjSxzqyih ze?2Yu2~3k+v3Kb{irHi6(>BCi=cmw3h>Qy+cm9>trJ?wlBo9pBJkYSQKLY)`x-Wr} zfXQ+g0!F$X0L+Ym81hb0m%n5jjZ4==TVvsbiEX`SAN_ic#x-g%R{3^9ZAr@qKZW$g z8mZPJdhTvd)>dd2MF$-Sxz6ch-~4N1lJDR4SmtgRC;0yYKRLk0bDxS=Gu7}2^)X=ui5?R zdUn^p9Zc@~R|5|zj{Wl9$qsIpg@RPsK`0CSF6NCbr`???sowId%m%_9Ty+)f`Zhko z!6s!EUO0N)M6X(O+UiX>K|9Js_1107B-#HKA|Fzne z)&1XIN{;h?`G~)9hus_)zd4Wo8Bu)`sg{Z3n^e&rkbBdsKRT@5B6gMvowq{g{VvgY zcV9B?|9Js_10^l~w-vJgchB4HYX9Fy$+7<*81eU*4eWcfgs0&6Mh#ho+*_6Sl1cuH zgQ;x~=hog5<$vqE6O8}ub}IbG{gkrqe`63I&3SVqfg zzst^L(ErQ)U$y@CP-kbQpIV2_FsyS1&l%n4*b;}~ zT*w8dp5!5uomsy-j-TH!3U&TAB)j`$!lBM{p3jXu9mn@pSksy0e=_37w)oHIt+Sx~ zKfi2O@_#R77xF&|PR2C}es(6+7cr@>ypt*df7F_V=20#-1G1@5T z$>PyQvT5^RI|XS>R4x{`wXkg4-B!ZhCXh$qTOv((i&?Ekb^G-?Cd>M!UFTsDCjcy< zq8bF*&YSO{qDFKXe><(?0I*_H%+5)R^zdGLIqz5(UxK{%!PR)spAM`)9`3K*KduKi z1M81)@Q5A5LKPVe77LDXC?w>MJhV;_OXlHqzBs}m4u`sVLyvy4k#&NcvJb8E$#*ff zzBsg>YjAl~Tjp`)Z+{O%>ckoTT%+lR7-k+)_ml5oT>UYj;lcer4cb-7Rh;u*V};bU zveYm^W!I5<|JM!V|7mwSRsQGwlv8jI8AC*)fMFoUA3Uv)2IhvM%8IrGI+Pya64A!V zDVVMl3aFuTTNI!xq^e-4;<@m7P_*S6K#&TVvO!$HdVYtRd~ymj3+e>C6zNcqEUbb5 z@u~qvn)(c|#=kUK0y-iUN3=t)B-_}@rkCk;hLuqj?A_}?du4VAErn%{%ebk;v_ep6R;WcE0% z>jaxW)g`Pkf>jlfCVkeVhW?zpj^y=!);((n@t@k=Zl_xR`zYor(4UF2TrtpTbz1dK ztJ4P46#}2EnF0D7&4Zqto}7XkMM4@yGB7k55x`am^mQn$kp1KhuoM;0X|%vg^M#uA zsP^jrIXMN-*Z^zz3^dGuK@ni4L@{R?Kwl-KGoWZd!fRbspe7+99GFYr6hi;9NZ>hx ziUuH%u>K72!uuY8j5Ev&PlMHLK0Q4(Am`RpteUELlQwULSA)CBpx$Y;_%{!liYVo| zofLv(Fn2P#60i*Yz zfA=r&X?S=21|Ws45CQ0`PE7tW0gBm=NH#ldf{>4a1r`iZ9ZAYUk$?)dr2&@+Eb#^r zjZ1z+EbX3J;#*bLihU;&YE|Y z#>vTo;58qphPWOudB=o-Um-;wr_=kf$h7qlYO;#R8({t>O!X($oByU*v;U2${jWKs z=;G|;w9ZUc-1(5;G;0Gx_+mN7_aqSX(2Ffej>z*~g~*QPBo!%#<6u}MIJfNrQNk_C5W z-B4BQ64WW!Skm2+wpP9TB-{YzzQJiNu&UxG^MN%yf~sNe9E$lRrYNS>=6mMeKrIv^ zhJm;=$x6KE1!6eIAS_!_i%2iyd12#T&_s{Yv`QSUo$_VO+E4ncyx0!7|-rU<7w>;sJ(5yZPi|# z1nP`m5`pUDUrgrY^KkOezZw2l-_%-Wlfn4&U_2Y%_CE|vrZTR&FyHi-=DiW*J)smsv)Z!DWGQo%TP}Ud4U)d(G3r+8?na8s^aZDC1~u z!%3uQ46qdWj=90bJfM7MGZh365wjqbqEIughm-!VH-p)5G98X)li~H?sz0v10`J~g zSMNcVUBMjS(|wTKaks;};b``8G?|9iT2PKhR^dMOS0t41#{A+8X%d#v%lR`y^ksDY z{j00NWHS3S_*d=K8}Pzli~8FauU<7|#6Puvh-T2;I3gKzA8*0nWNF zgK7V|Kkd&xjPI|w3>jVx;wEA2mYs>2^er=*8NPdlnTgQ?f~>^6mcq!5J1~>}?0!7F zyBgm2Z)`RQKTpjy(Fr?E%4qrT=IcNh(qRh7W$>GhZaN&;c^#;1@|F zUB8sgP1|uoW??e4C<0snk^C4S>KyRS}s-#h(lxu2zz2@O=u^5pf@tvIw*BANDRB#G-Q6=07!oKwIm9f4;o|HBUd*df@jzzWFPW5j9T^GbeN4j7J54 zcc2~lo{J6l4*dQ{kl)x95@t8P;!fbM@c;I0-DtE4Z8N#S)2`a=3m2$$e$V z-=z1J2eTvfWl%=&XLCx!Kt$LTZJdD8_CH_r|kTPe)qJ+P?#6K@Lm){B0~;PP9-0uEQ? z!2(a-S$v-k7k8N56GY<$W9S_p-~PzR zm7^_XUbxn0+zOEIEB>XV8|FGWZ>=+Sob#msTr)rJv|6`H`XaMS1_|L*!d+ChY1TIF zYJVudRo~KOQHHrvivSzQwuJ1nYaPjoxtA6ec`=W&X>yrVvBX1Es($7>kd<^QIC2Gv z+wr&KlM%RBD3UGt(^L|cRl!*UTA1m`2}e&UbxEhV{o;t9k&DsQc&pR_Hr z+|RL)GAgA`dsd7k8KoSWmadxiriHsP}F2Cp%&jQ|6X~%CxjQ z)6zC3m~5-o_qoTC<@ZJT*89injB>0Nt1?VS-BznruIUJA8|0R+!VU z!adq+J&yxWb^=Sw(qeUSKoXR8OhAZKdW&V+` z5e^-9dv?}2AGI99I#|*TU&Y?u*Ua$viGIg3LlFB(W=5trkKHog-o}D`d8~%{_Ev`Z z^POBc9GhwWNX?@MG})AYLIis`2p`l+ls;pH6$yY--djNNM9VV_RKx&3{)iZH%FN@F zCDt6M)@&xI)(#C&i3;`Z>`&WFfV3s)H@@mb(b&ruVhBEy$mrN0hYc6{OiLG^L~fqkn?g)n?%Ln(&~l{qY94zj?dp zk3bI#8c5?^relqwmz`GYRm?kr(U-L=i%0gXquLuT%v43 z{HMJX2j$6*OmQ?h%0=Xe3mU+&*TAQ@)XM23)INs69Dx_H6XZqXWNK~F?xyV{!!w_n z+M)ILC-f{JKvs~*5|)wNJ9!QM=etg$-DsKX)l@ubui0EGY-P+F5?(i*DeMHMH0LUw zH~BZsIg}oeCO0XOnww5j2u^A?$NKk-|It|D)0@sOos-w#f4%E8ICvEglrc92yZ{|d z2Dk7TbXuLWS9$s9g!vEw0!^fCc+K5kPELjbQpMXdR>ZhY@J5l53=|DO&4IddQC1cT zQf2za^ZiM}sDLL$Rn3tT8GU3IWXq{YSD~UY^py!v5o(Ttoru7VofC~{h<@Z#q=CMg ziodpW(`;q^Qm7oC5D!#w%vT(|H7g16VLyS;p_kjyl??LVvt;UyrdSt!8~nRY&?2-g zq~U*d&ja|M-PT#F%Kx>O@+)Smusjiq9;^*&9=B{@IZfd~>q(LYGND-W-9cHS%yOez z{f8;e`WHh!Q zMPvBn6etTD4bJ?4GxRLpwzWyOGE0mRq#{U>&5T093aR?SPzA2BRfWmDqx|xNzqEpc z0U7B?laVGpgO}8pi(g+gPCOv%K!&{|ATWo z5*UDjVYAZEk0;PzD^sgBC?X&Eq5Y0S+B>n{<^x4O0bt1i>LcF~k4^wEsfjnl$y&hU z`&^v)?*jR`2Wr0}NDu)vi-VzjZ$GJ>oLCLK#^wRtX>UWt5>z?b3C9&QYZ8EYmZ5-W z9D42n8B33dG!y}}r8}M;J>d1<5L{y_L32U~8mC~m@cwFHwQ|^pH-I2+0|6r3e1Qqa zpIz%%vw$$rUj|goL0l`^SiDSy9m#@@=mG8rB#aO4J3R~MVGX~!KXv&}!fJhW|M0*R z+i~$85eaFGLj}HVd0xBacV0fvPUJe@578kW(-PIM-IVpw%D3<#VF=%gyMUeK|M zm(LTOAShp9jq=R7fXP2Do@S-rOGfla&dOQYkPLgq^0 zcB)=r2KgQYvMT)Z&6+~uveTYW07$yg1MOC8?ffF{CVQaWd3&o^zuH&7dA{>y(-0>* zr+XrDCW^drS7J2{MXo%7d3bi_oo)BlZ~VvouaVH|2(67QD_21gY z^gow@Q6u47YJqj;U1Vu1EMWne%_C5iAzjTeB=VLEC`hhaJ@?hp_&%2gf9B*PvJ^$p zzryTkj^7$GMFLhH1i`+7HSbuAJ^2matN6*gv#WTC4fZg;>491ko2pT#NtLBG!-jS3 zyTC+3!}o-1Nlve*iuOqDD=YMsA)-O`#{1(MX@>6yo}`ISOogGf=g!5X)dS6c8~QUt zr0IFWy8+zUtK0KLk+9YS=C3Ci$up!;Ot?s(;X0V!vro-)@mLhQ|94HKAAs*!B-s-g_0}AC!7<*LYa9{e#r!eZqy7ui7|vbRoSTEdQ>$$be(tGj7(dBZ zLv)8n*MU6m=Bs6FXzApM`BF~0rt~4^PLQnz`}G1<+0jPnwLs_1yhDK`gNxz}BN6dx z{FD(DQzSX(L;(IW6zMT6>o|=ozMlXHH1y<1G7mi&QK{!1@uOs2Kt5{dDOAgYu3{(y z=&&4LLsX-Z)NkSyu& z1pnE4@3Txk1G zco3Q$oJr@B!=OmECtBbgAAdYB+`fy21bG?76#3{m`MgYJpSn~u$`F(RUO1U}tY`c^ zR|~NEbtqwNvRQ_Hzk%}`yu`jo-0nZpQ0N=`LG%~XCmj97^a=aEpgMfg5P6Tu`r2dd z7Y(a#RU9&+;|*eMDT?YQMvK_>ABOg@ojMfyb8Lu9??26nKho6aKdnjR6_<5!`Q&+r zdoJ_jP69{zjdgiNbyEf2AS*S1N4h!#ZVNfit3eUr>Dd6*)Mrj}{w$0b@>9p+A<|7BK!_-NkOtzW`lZj#{%Y zhN}72OC3|H%vEGNr-52ueS*)l_9hse4Qh8tqzF0n45}|JzdVROJ!HPF3ga zyU}zo@rep9O?dzPX&;Eqk#gjG&09eYKwYQc$=njW!s6p}dM|SDD%2V>!^&pKvvS`3 zI=dea-VcAPCFKY!sZV_Rad4yqlQK9|Nh&mz6#cnpY0UxhszQ0LJ-C62%5x_LDx$WB zgS~DY0z&lq3}N-`d}RGde`c6StNOxF)uP`@h71c45LR1$fxqSFAr{JBPM;@NSVqyS z3B2T~^FjMnu66anQc+^om#0Q+d9f8_-qnS^>R33StSM4A$eRw8uRNZFhcCZcv&Oe) z%j1Lp=p{vvl|Ghhjixp+CkQ?&+A_$ytEGcKok8&*am}-DT~I`IgD5?-dQ;i()@bSo zSo0`0Le;WlgF=Nq_J*I0;3EP<9?NG@^%CMf!%%n-idI_(MLTDu(-k`qC-xYYC{`pa zBY_BIF0d8W4k%jEcqwgpjVH{I6`Z`jItA9(^a;nTFK?Aa_pjgTHkC2PtbPyKss=>l z(GR$8@;1c^!Kzz?>lCq~t)Ygr;_}aGkH9nH_oQBONdsaw3#zK!%v}kC=@Twd7!WF2 z!xZ^>g9t?j6b5O$lqL+W?jOL|wj!2GT+)r)hX6@8oWODWxZ(6}a1d*)#(B+42?CJ` z&79FsE5)3~7_1GIDY`18h}m45z64c?XWJ6B=!P(vdJi59+h=e0Ieo)d5~QG}VGVhX z8vOBlD4gkP?MA0o`fv#|;;u%_GUw(UH1S!EacehPAC#OU7pTNPc-F(D@${SA z|IobVP73vV)mSRpu10gI8#L2cde8Su-DnCIin=bi6Fn9(D0sfN?_W$oMl{3_Z75h= zzA#81X>$!VxI}f6p(d49NH$bOTZ+F=xnp_VS0@e37>~FVGw)B%)F<@(r_Gl=7dJ?g zeOFdu7Oda~0XIdnJN~|qX7RCbM-EmQmiprDcwx`?Nx>=Qtk%JkxvSb%J&Ogt%S+6F zYGD3~?+xV+u2JY?%W@-P1ijURhheBiArB9SsUE0l8%0(ik7!)#Mi8MwRNn)&yU)Yx zVZW9@2(IN+D*fB*h`x0O&rWDAIy~4J5q2QHeBXdt+x$<*{LdLrd+i%m%~;#7mcE+5 zVDc!U5&RBGB~|cblNZ!;i)QD0ARMWz5MKLE!#t+0v7s@KQ&7T!`O^~MnxU$H22E_9 z4(B9$pt-_p)ciNzJVVVt==w(TNgd&AC*n&&JX7DN3Brb;1tLh3P;+TzB$GX_)uFC5 zH|<8}ta+*UHczql+^mMG_NntiD*S9MbQYx0+`nhiXSm#+n1D}L$ zk-d-n7s0;T1<4*b|DXgOi|D>v^F$l|vJS=w%3sVg(nym~=}Yn&GPs-7Xb!tYIMYgm z?ye!rib(v-iP$qcyd0aDgjS@r>O4t5PlIcYpBE#RUDK>>gVlQ5`)YV%pNjv5=k}@n zkC>V1(60qQ@lVcEx4S}#f+FW zSEiVWV2z6(Ylmd!>0RGQ;Ar6y0%xqmB+yvq;F7v3h^JM!r2tPE&(8yCU**6 zDhtou>l+_^v5Wobs8ZrGUwyXb4_7e6K|OSfRI8;M0|M-)8w30cJ7gl@bJFRp9;nGk zRwPqi%rq>cnU2WJUX+1FXeo)-%(}L}19wz&)1D6=nYOPoHG}Q;cdzqG7qOF=e+yR~L2r-H{@?rNF@X+L(3l z24-*3n73^|D6uyETImW?mQc|t_|hNW4evhmz@JX&u-$6zF!C#6(3BtTMyDfSa~PK~ z;-|AWade$xWr{cTjDNoQU>muEoGq#t=2|y^62X*mEE>)XjjkZXEca9^d%v2x4rt|) zc0Jp;6*>E!#SP?9Tb4^v7}3ACJuAq6Ih&Tb#5!30H(9{oZ5im)MXX%V|?wb$flsfwe`$M+7AE zMTP;=s3G8LDDpN{D9z@^cyEOWyJ}Ks(@nS4JlAzB*KKCX9-@Kk;b;HmJmUaBCmvoz zQ|;rb*$rH^;O-li_r-Yh3Dg$c`@UvRMCYQRB(6PPiSa`p=w}`v;UdD860YN%5nQ^q z;#h_3R3SS*X~>S`v+qfU>K*1ttRuegWED-7HM&(agCW`j?X$C%@9EVFNsj_1$bIPq z*cS2DO{Hm0@DoL(>G`+k zZLt_Tjm~+awFZa_e>*m*i>C$SnyN!0jd;v?zfkoW+v^nUcI6v|^ zQEjcqy|u>OQWm}8O1zT)7^r*~KzW6XTB zlOoAnt(NsDC_2Z6#*{U>whcl8BJ7rfd%1_8tZ7Z2su0<0k-W<$xyQpHG-Psu;>c8EMQ>$E<_Aa}jgH)3mxXbJxcYxm%IdL5j=mc#PY*6(X z@a%#}wp;j&4Tq?Pcw$+%Y3&9Wi@xC(ew?Yfos`1q7w#e@5+^ug2|5kXm*s@-tnrKb z*!n-mjq?ZHt`Q@OMC+2-hvs_l_Iu5e2sKCZBO66q`Y9-y6|G?J9HGzL>^Hs-o&8VX z2-&-ft~dM&v(<-(7g6BbY7rG$L=j7bDl(EFX*j#R*bRE1#_fc)T^hJwyw;i>kCHIA*D~4$Z?gmJKeLb zy3(R=Y8grvp=XHmV3bOdQv@1HnWC>8({ygZz{Sk}$KKU8w~Zs|`>bDqvOef;E23mM zo*k=p_bTg5X1y6FzSx=Bs;jFkL_!kEB*7y<+1k1ve}!%U1mCO|+cVBYteUCF1RJm2 zXf%N5xkwdT;PR_uA=hkE>XUOJu^3MmIg@fh6}vM~fac#*zw93WmrLo}A-(eRVwyRp z@u#+Xr9<*}F$-45!HlX()Otv6-kDdvyIVxm^xa0M~DM8coTyiar+pjdmQjC3D%RI$j}E(^zLrt3$RF|BhFp?oTTm zSv}sx;_io4d8TlSeAJxj54Omv^B!`2lh8J}3HP|0pt4vjn5=oOLqg+)$hlgY3zj)e zBav)hfl}&lxz1QFGS$*bwMkJm#ww)9+5kGGhfQ=274i5k+c(>UvX}Yew?L>6w z#&c-7TF+=6udkKJGM+9TvZ)D+I8CJz+4e02!le;DEG4+M>RFKZ70da2O)~8-AhsIK zvXa1KRAf@+j3y)PFOLk}s~mxb0HJBm1=8BKk1Qi@h3=%}D3QgiWRS3tYYFHEoW^8H z(?~CH19G827(`R&JeLXroOpbG5sMj(9j&zm-VUIRULn(MEX1u|3xkv<0e1Bp2v){a zs(20S=Vtmpxl;cHKM6pvrO3^4p3t1*G5>iHgA{vP)D*YGsm{FyDG?)Y=t2vPDq!t3 zXWRl+R}LY8>pclhoJKrA*IFfRyC_loS(2$W-jckXXJkghTb4%H{*KO##__rYlf(-l zcN|G@wY(!BG@p(}CCB+_H7VJWj!e2Mpcp2Su^Mwa(6>S3A^ME<;``(e>2CCD)+vDk z6Rrl5&{zuMV4zBh=~)rpGDQZ4kRg|YR|ZEeq$!y(0{#4o$P+!77ojYB>4{tJ_33j- zK0ZBuYSHopBu{WLZxq?8Iv!xL*M~jk{W8d>Z6=1A;4%~$ls!6x79ZM91@eKg$a9uz zo3*5Q6pE+}yPb9dFxFfV`We5xJymG8s=^ z|Hr=N+CtsVtZbLZg&yv356d6!TJ;!LOO}(A$9gP3)Z}xKdlhWX5m<`A>)N0hK-^UV zx-9S6I`G3nLAr-16!2!Vz_QiwYMMVL4HLVgYT+qKO%s}nY|fekD~6sxoIDSl35;46 zQx03zmZk;J%S4iCpN7ZYIl}Delxy#xY3U%Cr{As_~lD!_tR%>_v3oIyULpv z)jf_!jqv&gMs@qbh&~&S$NNe4wk@&p{r-)cM^{h&0o>G zt8TT}CU>*ne)*K5(akA0)4EMubsNSM!~<{Nu?V%@m*(D!zkgQQdD(3olzT3ua{yO% z0-tmMS9ag_9l%MPL~mPn-fRV!qS0)>eCon&ZOr(3INwJO!?sLJnvjOehcky1`_{T4 z-Xy5+7C(N3RCb9&kzUgKpZJ{lyC^Q3X@$6dXjRhag!)3qHRJlP?H=FyzigE`;Y;gGNGmeUhnAnx~V2;p2S z%(bF1OPNHn!i3)Qq)2LST;NE8n(Dzo!%*ZAg4UIS_uzFFE8U{(Ze%2nNV%K!G!loa z$tWl#LTnY!x?1)d!^o$ncoOjlR-yp@X44_en$05E(2`SfboIx#M`fzkR@JFa#x7Zx zq@z+JT4i|IoI9g>!xKY93S^eZ2#^}ipM>6%*jQfB+{^X#fBjU7v7y@)%h!Y_+J2aj zqGYPbkgpQY=CXUGy`tD1gppp`Tr*~6$pUjq1n{LQ%44~0G!(v;qtlbgStdh*T`Y=x;!N@yTkHAS_%8LP^4;#Qlp@6lrK% z(;p+u7pJF40J8VFbah)=O)?Q14~nsrHNahm(L#uYx%L9KOpa!ST+hV)!1u8XW#^`E zYPJ3#BKC>tfdM*zO&JwQvi4|!@*)LFbv`GeP+0-<7}l~B2i3@nv_y)RH1Y6+wH4Lo z-Jn_NiBVQy!fGyPzYi@KxIG_}4*SCpz8a<`affzDMD}Kc!B&e%NlDu$G+kp6bXn+1 z@W=`^AfvD?Hs>Lvk^y<6MYG5wHTEV8TLdj^peMLN;P*$pWy`~qu#;tIW|P>)tBvG7 zp|_OKjQbATo{nEl%CotB&23q@;WRn*Zo%7q@KbLeyz^$&X~*5D@#OUZA?D!V?d#wX z3cR~83%q~lHibz{6_ZNO>ynG~KW*6yB|c{nRm>(dx0`>)bR|5YI}H)CHw%aVwx`m1 z!swzrtoG}w?(yWHx(C&LIjXBvZ14--%oWRj5&5n5hTrj&%jJ}O|J`dBUrviezh=3d z5+EFOzJUGeQR?ZW-5F`mtDg^CAoix${y|F*TKd~-X_$-Dq8jUE+rLDrmu{bL&cW&J zzALen=FM}Rvx|ZJ$`fMCeE7$Mq8$|NH}YgZ2*t=e7s;-tNy`Azu;6CnIHB1PLL$MM zCgtgo8ypu&atkNMXxOUcKKtj}FN1jp+3tmrX!b}@d zb%?9zxKr^ivE8YWef*MUquY5ljA@aE%a)hUgh4#T+yl?erj!uF<9{rvjnuBqC*f^GpfvxLSoJ566@o-FU#b zgwzIreHvUn1xJR!sU*N@O$?_>VJ3H%DjL}n)Tl!*uMTW~KzfI-S2UeAqzIqv~D%(t88$6f|{&x=u#Xeb3w-)WnnMD=Y zIC~*G+0bfHWwIIvli;i|CpEC)UK;7pMkBY#v#_;!T4D0`-`0Xw?AWw=@vXS25i3@6 zDvmKOcsXfAXQEJ} zIsM;JA3!XITJSJYv8;XQT^a@%?*DLG_;@`24*h7AYttMC4ekea4|jS$777k)>R~3Q z^N`9Skq#7*MFwXXBDWvLXqbzRBc;hB+Gdk@{GbUw`xJ!j-FRaRB}l4iAaGP z?!O1scY{}Cu*hjz#55oLkJ)Ier?Gecbx(qzwt^avjgr*vZplpjh~d((<+s!qvHL*( z*N`?nJw5$SzwXr-Ryz4rh=Y1?y9K(hS~*+n@vU&l!dt|hG5sP9$ONtsoHIUz`9%8W zc}R}_;4!+@Xq3_-ndy3dKdxK&D$N^gZYvRrcuM|ubE92wTerX8-AZrwqhapaI#72cGo3ZQrYW!B%ewUN@han!Dp~0v{?{&WULrNkS#Cl}F`HK65l0h(aH zwPwQdl#))(FoklMKUk=aaiB--lNZbU&`v+RK6gF?KrokWsWr-(Hk|le(QaVrX_I1a ze005`$A<0-qq~EkJtIi=P%g$w>U5aJK)1*MS50QP^Lbb6HHvE+y=VQ^o>}{CE5O$G zmF)oAIUtCxD3A5fCPfOmrma%0*KT@_`uyo9f~$w1MmTDQbFJRzKH(IYLi{H-sS9(* zwER(7KJBErK@VLqFjyPZ)h{}JW!ux3)S5omoV?oZho{z+guPpw+cy-(q`F4d*{-?M z%sQBMXeesy*|)v!lV6rpu@$=G*sVdcWI?qUfsLnMXDsxFh?bWXibPyHn(?i_$OVfjJeesV@+L__*Wd|@jI)U7WhWfYw4dwIZ{{O1i$!=VUy(W7`sFDu3k+_3 z>0-bCfcDg#baZ=|THrg2kH^!w$P;r@X~iYiInOx|*_eKHIz=K87VcE3Up?nR;}=21 zR*0EsE=!NBh>@*6PZt<%b8ou!(2R$mW_f}xJtRkM3(KJL$EL^OkLb!c?98`1-pNtx zDBdMoJMr3Y<&^wiuR6%8Cc0MhUUQT`V6@A}(T(rZZoRH{+gSQ;ZQrNtd$qn37Kw!N zbn2fiB0y#DoIuNa(kH-osAnJ?%;ofIU)1K;@}yd|{>&urnqe#NcbsBvQTCi;T^0A5 iWXHjz_iu;i@Eo4Qb9i3(^Zx+=0RR90M``{5xD5dCmkpi( literal 0 HcmV?d00001 diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/.helmignore b/packs/kubeflow-1.9.1/charts/kubeflow/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/Chart.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/Chart.yaml new file mode 100644 index 00000000..17a1b167 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/Chart.yaml @@ -0,0 +1,27 @@ +apiVersion: v2 +name: kubeflow +description: A Helm chart for Kubeflow + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.5.1 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.9.1" +maintainers: + - name: Kubeflow + url: https://github.com/kromanow94/kubeflow-manifests diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/files/pipelines-profile-controller/sync.py b/packs/kubeflow-1.9.1/charts/kubeflow/files/pipelines-profile-controller/sync.py new file mode 100644 index 00000000..88caaa62 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/files/pipelines-profile-controller/sync.py @@ -0,0 +1,425 @@ +# Copyright 2020-2021 The Kubeflow Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# NOTE: this file probably needs some parametrization... + +from http.server import BaseHTTPRequestHandler, HTTPServer +import json +import os +import base64 + + +def main(): + settings = get_settings_from_env() + server = server_factory(**settings) + server.serve_forever() + + +def get_settings_from_env(controller_port=None, + visualization_server_image=None, frontend_image=None, + visualization_server_tag=None, frontend_tag=None, disable_istio_sidecar=None, + minio_host=None, minio_access_key=None, minio_secret_key=None, + kfp_default_pipeline_root=None, metadata_grpc_service_host=None, + metadata_grpc_service_port=None, ml_pipeline_sa_principal=None): + """ + Returns a dict of settings from environment variables relevant to the controller + + Environment settings can be overridden by passing them here as arguments. + + Settings are pulled from the all-caps version of the setting name. The + following defaults are used if those environment variables are not set + to enable backwards compatibility with previous versions of this script: + visualization_server_image: gcr.io/ml-pipeline/visualization-server + visualization_server_tag: value of KFP_VERSION environment variable + frontend_image: gcr.io/ml-pipeline/frontend + frontend_tag: value of KFP_VERSION environment variable + disable_istio_sidecar: Required (no default) + minio_host: Not required (no default) + minio_access_key: Required (no default) + minio_secret_key: Required (no default) + metadata_grpc_service_host: Required (no default) + metadata_grpc_service_port: Required (no default) + ml_pipeline_sa_principal: Required (no default) + """ + settings = dict() + settings["controller_port"] = \ + controller_port or \ + os.environ.get("CONTROLLER_PORT", "8080") + + settings["visualization_server_image"] = \ + visualization_server_image or \ + os.environ.get("VISUALIZATION_SERVER_IMAGE", "gcr.io/ml-pipeline/visualization-server") + + settings["frontend_image"] = \ + frontend_image or \ + os.environ.get("FRONTEND_IMAGE", "gcr.io/ml-pipeline/frontend") + + # Look for specific tags for each image first, falling back to + # previously used KFP_VERSION environment variable for backwards + # compatibility + settings["visualization_server_tag"] = \ + visualization_server_tag or \ + os.environ.get("VISUALIZATION_SERVER_TAG") or \ + os.environ["KFP_VERSION"] + + settings["frontend_tag"] = \ + frontend_tag or \ + os.environ.get("FRONTEND_TAG") or \ + os.environ["KFP_VERSION"] + + settings["disable_istio_sidecar"] = \ + disable_istio_sidecar if disable_istio_sidecar is not None \ + else os.environ.get("DISABLE_ISTIO_SIDECAR") == "true" + + settings["minio_host"] = \ + minio_host or \ + os.environ.get("MINIO_HOST") + + settings["minio_access_key"] = \ + minio_access_key or \ + base64.b64encode(bytes(os.environ.get("MINIO_ACCESS_KEY"), 'utf-8')).decode('utf-8') + + settings["minio_secret_key"] = \ + minio_secret_key or \ + base64.b64encode(bytes(os.environ.get("MINIO_SECRET_KEY"), 'utf-8')).decode('utf-8') + + # KFP_DEFAULT_PIPELINE_ROOT is optional + settings["kfp_default_pipeline_root"] = \ + kfp_default_pipeline_root or \ + os.environ.get("KFP_DEFAULT_PIPELINE_ROOT") + + settings["metadata_grpc_service_host"] = \ + metadata_grpc_service_host or \ + os.environ.get("METADATA_GRPC_SERVICE_HOST") + + settings["metadata_grpc_service_port"] = \ + metadata_grpc_service_port or \ + os.environ.get("METADATA_GRPC_SERVICE_PORT") + + settings["ml_pipeline_sa_principal"] = \ + ml_pipeline_sa_principal or \ + os.environ.get("ML_PIPELINE_SA_PRINCIPAL") + + return settings + + +def server_factory(visualization_server_image, + visualization_server_tag, frontend_image, frontend_tag, + disable_istio_sidecar, minio_access_key, minio_secret_key, + minio_host=None, kfp_default_pipeline_root=None, + metadata_grpc_service_host=None, metadata_grpc_service_port=None, + ml_pipeline_sa_principal=None, url="", controller_port=8080): + """ + Returns an HTTPServer populated with Handler with customized settings + """ + class Controller(BaseHTTPRequestHandler): + def sync(self, parent, attachments): + # parent is a namespace + namespace = parent.get("metadata", {}).get("name") + + pipeline_enabled = parent.get("metadata", {}).get( + "labels", {}).get("pipelines.kubeflow.org/enabled") + + if pipeline_enabled != "true": + return {"status": {}, "attachments": []} + + desired_configmap_count = 1 + desired_resources = [] + if kfp_default_pipeline_root: + desired_configmap_count = 2 + desired_resources += [{ + "apiVersion": "v1", + "kind": "ConfigMap", + "metadata": { + "name": "kfp-launcher", + "namespace": namespace, + }, + "data": { + "defaultPipelineRoot": kfp_default_pipeline_root, + }, + }] + + # Compute status based on observed state. + desired_status = { + "kubeflow-pipelines-ready": + len(attachments["Secret.v1"]) == 1 and + len(attachments["ConfigMap.v1"]) == desired_configmap_count and + len(attachments["Deployment.apps/v1"]) == 2 and + len(attachments["Service.v1"]) == 2 and + len(attachments["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and + len(attachments["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and + "True" or "False" + } + + # Generate the desired attachments object(s). + desired_resources += [ + { + "apiVersion": "v1", + "kind": "ConfigMap", + "metadata": { + "name": "metadata-grpc-configmap", + "namespace": namespace, + }, + "data": { + "METADATA_GRPC_SERVICE_HOST": + metadata_grpc_service_host, + "METADATA_GRPC_SERVICE_PORT": + metadata_grpc_service_port, + }, + }, + # Visualization server related manifests below + { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "labels": { + "app": "ml-pipeline-visualizationserver" + }, + "name": "ml-pipeline-visualizationserver", + "namespace": namespace, + }, + "spec": { + "selector": { + "matchLabels": { + "app": "ml-pipeline-visualizationserver" + }, + }, + "template": { + "metadata": { + "labels": { + "app": "ml-pipeline-visualizationserver" + }, + "annotations": disable_istio_sidecar and { + "sidecar.istio.io/inject": "false" + } or {}, + }, + "spec": { + "containers": [{ + "image": f"{visualization_server_image}:{visualization_server_tag}", + "imagePullPolicy": + "IfNotPresent", + "name": + "ml-pipeline-visualizationserver", + "ports": [{ + "containerPort": 8888 + }], + "resources": { + "requests": { + "cpu": "50m", + "memory": "200Mi" + }, + "limits": { + "cpu": "500m", + "memory": "1Gi" + }, + } + }], + "serviceAccountName": + "default-editor", + }, + }, + }, + }, + { + "apiVersion": "networking.istio.io/v1alpha3", + "kind": "DestinationRule", + "metadata": { + "name": "ml-pipeline-visualizationserver", + "namespace": namespace, + }, + "spec": { + "host": "ml-pipeline-visualizationserver", + "trafficPolicy": { + "tls": { + "mode": "ISTIO_MUTUAL" + } + } + } + }, + { + "apiVersion": "security.istio.io/v1beta1", + "kind": "AuthorizationPolicy", + "metadata": { + "name": "ml-pipeline-visualizationserver", + "namespace": namespace, + }, + "spec": { + "selector": { + "matchLabels": { + "app": "ml-pipeline-visualizationserver" + } + }, + "rules": [{ + "from": [{ + "source": { + "principals": [ml_pipeline_sa_principal] + } + }] + }] + } + }, + { + "apiVersion": "v1", + "kind": "Service", + "metadata": { + "name": "ml-pipeline-visualizationserver", + "namespace": namespace, + }, + "spec": { + "ports": [{ + "name": "http", + "port": 8888, + "protocol": "TCP", + "targetPort": 8888, + }], + "selector": { + "app": "ml-pipeline-visualizationserver", + }, + }, + }, + # Artifact fetcher related resources below. + { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "labels": { + "app": "ml-pipeline-ui-artifact" + }, + "name": "ml-pipeline-ui-artifact", + "namespace": namespace, + }, + "spec": { + "selector": { + "matchLabels": { + "app": "ml-pipeline-ui-artifact" + } + }, + "template": { + "metadata": { + "labels": { + "app": "ml-pipeline-ui-artifact" + }, + "annotations": disable_istio_sidecar and { + "sidecar.istio.io/inject": "false" + } or {}, + }, + "spec": { + "containers": [{ + "name": + "ml-pipeline-ui-artifact", + "image": f"{frontend_image}:{frontend_tag}", + "imagePullPolicy": + "IfNotPresent", + "ports": [{ + "containerPort": 3000 + }], + "env": [ + { + "name": "MINIO_HOST", + "value": minio_host, + }, + { + "name": "MINIO_ACCESS_KEY", + "valueFrom": { + "secretKeyRef": { + "key": "accesskey", + "name": "mlpipeline-minio-artifact" + } + } + }, + { + "name": "MINIO_SECRET_KEY", + "valueFrom": { + "secretKeyRef": { + "key": "secretkey", + "name": "mlpipeline-minio-artifact" + } + } + } + ], + "resources": { + "requests": { + "cpu": "10m", + "memory": "70Mi" + }, + "limits": { + "cpu": "100m", + "memory": "500Mi" + }, + } + }], + "serviceAccountName": + "default-editor" + } + } + } + }, + { + "apiVersion": "v1", + "kind": "Service", + "metadata": { + "name": "ml-pipeline-ui-artifact", + "namespace": namespace, + "labels": { + "app": "ml-pipeline-ui-artifact" + } + }, + "spec": { + "ports": [{ + "name": + "http", # name is required to let istio understand request protocol + "port": 80, + "protocol": "TCP", + "targetPort": 3000 + }], + "selector": { + "app": "ml-pipeline-ui-artifact" + } + } + }, + ] + print('Received request:\n', json.dumps(parent, sort_keys=True)) + print('Desired resources except secrets:\n', json.dumps(desired_resources, sort_keys=True)) + # Moved after the print argument because this is sensitive data. + desired_resources.append({ + "apiVersion": "v1", + "kind": "Secret", + "metadata": { + "name": "mlpipeline-minio-artifact", + "namespace": namespace, + }, + "data": { + "accesskey": minio_access_key, + "secretkey": minio_secret_key, + }, + }) + + return {"status": desired_status, "attachments": desired_resources} + + def do_POST(self): + # Serve the sync() function as a JSON webhook. + observed = json.loads( + self.rfile.read(int(self.headers.get("content-length")))) + desired = self.sync(observed["object"], observed["attachments"]) + + self.send_response(200) + self.send_header("Content-type", "application/json") + self.end_headers() + self.wfile.write(bytes(json.dumps(desired), 'utf-8')) + + return HTTPServer((url, int(controller_port)), Controller) + + +if __name__ == "__main__": + main() diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/mlpipeline-minio-artifact.txt b/packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/mlpipeline-minio-artifact.txt new file mode 100644 index 00000000..a81fc402 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/mlpipeline-minio-artifact.txt @@ -0,0 +1,12 @@ +Kubeflow Pipelines requires the Object Store K8s Secret name to be 'mlpipeline-minio-artifact'. +This is because the K8s Secret Name and Secret Keys are hardcoded: +* <=2.1.0: + https://github.com/kubeflow/pipelines/blob/2.1.0/backend/src/v2/objectstore/object_store.go#L292 +* >=2.2.0 (state as of 2nd May 2024) + https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L39 + +If the Secret Name is not provided in any of the following fields, the Secret +'mlpipeline-minio-artifact' will be created with the provided plaintext values: +* .Values.pipelines.config.objectStore.existingSecretName +* .Values.pipelines.config.objectStore.accessKey.secretKeyRef.name +* .Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/objectstore-accesskey-secretaccesskey-secret-ref.txt b/packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/objectstore-accesskey-secretaccesskey-secret-ref.txt new file mode 100644 index 00000000..46d7198e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/files/validation-messages/objectstore-accesskey-secretaccesskey-secret-ref.txt @@ -0,0 +1,3 @@ +Both of the following values must be either nil or 'mlpipeline-minio-artifact' at the same time: +* .Values.pipelines.config.objectStore.accessKey.secretKeyRef.name +* .Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_NOTES.txt b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_NOTES.txt new file mode 100644 index 00000000..8029e06b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "kubeflow.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "kubeflow.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "kubeflow.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "kubeflow.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_deployment.yaml new file mode 100644 index 00000000..48b618f6 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_deployment.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "kubeflow.fullname" . }} + labels: + {{- include "kubeflow.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "kubeflow.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "kubeflow.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "kubeflow.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.service.port }} + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/_helpers.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/_helpers.tpl new file mode 100644 index 00000000..2765e201 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/_helpers.tpl @@ -0,0 +1,398 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "kubeflow.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "kubeflow.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "kubeflow.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "kubeflow.common.labels" -}} +helm.sh/chart: {{ include "kubeflow.chart" . }} +{{ include "kubeflow.common.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Common selector labels +*/}} +{{- define "kubeflow.common.selectorLabels" -}} +app.kubernetes.io/name: {{ include "kubeflow.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Indicates if Kubeflow is deployed in cluster mode. +*/}} +{{- define "kubeflow.deploymentMode.cluster" -}} +{{- ternary true "" (eq .Values.deploymentMode "cluster") -}} +{{- end }} + +{{/* +Indicates if Kubeflow is deployed in namespace mode. +TODO: use ternary for other conditionals. +*/}} +{{- define "kubeflow.deploymentMode.namespace" -}} +{{- ternary true "" (eq .Values.deploymentMode "namespace") -}} +{{- end }} + +{{- define "kubeflow.isMultiuser" -}} +{{- ternary "true" "false" (include "kubeflow.deploymentMode.cluster" . | eq "true") -}} +{{- end }} + +{{- define "kubeflow.deploymentMode.scopedRoleBindingKind" -}} +{{- ternary "ClusterRoleBinding" "RoleBinding" (include "kubeflow.deploymentMode.cluster" . | eq "true") -}} +{{- end }} + +{{- define "kubeflow.deploymentMode.scopedRoleKind" -}} +{{- ternary "ClusterRole" "Role" (include "kubeflow.deploymentMode.cluster" . | eq "true") -}} +{{- end }} + +{{/* +Indicates if should integrate with cert-manager. +*/}} +{{- define "kubeflow.certManagerIntegration.enabled" -}} +{{- ternary true "" .Values.certManagerIntegration.enabled -}} +{{- end }} + +{{/* +Kubeflow Component Names. + +Changing this function will reflect on all component and subcomponent names. +*/}} +{{- define "kubeflow.component.name" -}} +{{- $componentName := index . 0 -}} +{{- $context := index . 1 -}} +{{- $componentName }} +{{- end }} + + +{{/* +Component specific labels +*/}} +{{- define "kubeflow.component.labels" -}} +{{ include "kubeflow.component.selectorLabels" . }} +{{- end }} + +{{/* +Component specific selector labels +*/}} +{{- define "kubeflow.component.selectorLabels" -}} +app.kubernetes.io/component: {{ . }} +{{- end }} + +{{/* +subcomponent specific labels +*/}} +{{- define "kubeflow.component.subcomponent.labels" -}} +{{ include "kubeflow.component.subcomponent.selectorLabels" . }} +{{- end }} + +{{/* +subcomponent specific selector labels +*/}} +{{- define "kubeflow.component.subcomponent.selectorLabels" -}} +app.kubernetes.io/subcomponent: {{ . }} +{{- end }} + +{{/* +Role and ClusterRole aggregation rule labels +*/}} +{{- define "kubeflow.aggregationRule.labelBase" -}} +{{- $labelPrefix := "rbac.authorization.kubeflow.org/aggregate-to" -}} +{{- $roleName := . -}} +{{- printf "%s-%s: \"%s\"" + $labelPrefix + $roleName + "true" + -}} +{{- end -}} + +{{/* +Component Service. +*/}} +{{- define "kubeflow.component.svc.name" -}} +{{- $componentName := . -}} +{{ print $componentName }} +{{- end }} + +{{- define "kubeflow.component.svc.addressWithNs" -}} +{{- $ctx := index . 0 -}} +{{- $componentName := index . 1 -}} +{{ printf "%s.%s" + $componentName + (include "kubeflow.namespace" $ctx) +}} +{{- end }} + +{{- define "kubeflow.component.svc.addressWithSvc" -}} +{{- $ctx := index . 0 -}} +{{- $componentName := index . 1 -}} +{{ printf "%s.%s.svc" + $componentName + (include "kubeflow.namespace" $ctx) +}} +{{- end }} + +{{- define "kubeflow.component.svc.fqdn" -}} +{{- $ctx := index . 0 -}} +{{- $componentName := index . 1 -}} +{{ printf "%s.%s.svc.%s" + $componentName + (include "kubeflow.namespace" $ctx) + $ctx.Values.clusterDomain +}} +{{- end }} + +{{/* +Namespace for all resources to be installed into +If not defined in values file then the helm release namespace is used +By default this is not set so the helm release namespace will be used + +This gets around an problem within helm discussed here +https://github.com/helm/helm/issues/5358 +{{- default .Values.namespace .Release.Namespace }} +*/}} +{{- define "kubeflow.namespace" -}} +{{- default .Release.Namespace .Values.namespace }} +{{- end -}} + + +{{- define "kubeflow.component.autoscaling.enabled" -}} +{{- $defaultAutoscaling := index . 0 -}} +{{- $componentAutoscaling := index . 1 -}} +{{- if $componentAutoscaling -}} + {{- if eq nil $componentAutoscaling.enabled -}} + {{- $defaultAutoscaling.enabled }} + {{- else -}} + {{- $componentAutoscaling.enabled }} + {{- end -}} +{{- else -}} + {{- $defaultAutoscaling.enabled }} +{{- end -}} +{{- end }} + + +{{- define "kubeflow.component.autoscaling.minReplicas" -}} +{{- $defaultAutoscaling := index . 0 -}} +{{- $componentAutoscaling := index . 1 -}} +{{- if $componentAutoscaling -}} + {{- default $defaultAutoscaling.minReplicas $componentAutoscaling.minReplicas }} +{{- else -}} + {{- $defaultAutoscaling.minReplicas }} +{{- end -}} +{{- end }} + +{{- define "kubeflow.component.autoscaling.maxReplicas" -}} +{{- $defaultAutoscaling := index . 0 -}} +{{- $componentAutoscaling := index . 1 -}} +{{- if $componentAutoscaling -}} + {{- default $defaultAutoscaling.maxReplicas $componentAutoscaling.maxReplicas }} +{{- else -}} + {{- $defaultAutoscaling.maxReplicas }} +{{- end -}} +{{- end }} + +{{- define "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" -}} +{{- $defaultAutoscaling := index . 0 -}} +{{- $componentAutoscaling := index . 1 -}} +{{- if $componentAutoscaling -}} + {{- default $defaultAutoscaling.targetCPUUtilizationPercentage $componentAutoscaling.targetCPUUtilizationPercentage }} +{{- else -}} + {{- $defaultAutoscaling.targetCPUUtilizationPercentage }} +{{- end -}} +{{- end }} + +{{- define "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" -}} +{{- $defaultAutoscaling := index . 0 -}} +{{- $componentAutoscaling := index . 1 -}} +{{- if $componentAutoscaling -}} + {{- default $defaultAutoscaling.targetMemoryUtilizationPercentage $componentAutoscaling.targetMemoryUtilizationPercentage }} +{{- else -}} + {{- $defaultAutoscaling.targetMemoryUtilizationPercentage }} +{{- end -}} +{{- end }} + + +{{- define "kubeflow.component.image" -}} +{{- $default := index . 0 -}} +{{- $component := index . 1 -}} +{{- $registry := default $default.registry $component.registryOverwrite -}} +{{- $repository := $component.repository -}} +{{- $tag := $component.tag -}} +{{- printf "%s/%s:%s" $registry $repository $tag }} +{{- end }} + +{{- define "kubeflow.component.imagePullPolicy" -}} +{{- $default := index . 0 -}} +{{- $component := index . 1 -}} +{{- $imagePullPolicy := default $default.pullPolicy $component.pullPolicyOverwrite -}} +{{- $imagePullPolicy }} +{{- end }} + +{{- define "kubeflow.component.serviceAccountName" -}} +{{- $componentName := index . 0 -}} +{{- $componentSA := index . 1 -}} +{{- if $componentSA.create }} + {{- default $componentName $componentSA.name }} +{{- else }} + {{- default "default" $componentSA.name -}} +{{- end }} +{{- end }} + +{{- define "kubeflow.component.serviceAccountPrincipal" -}} +{{- $ctx := index . 0 -}} +{{- $saName := index . 1 -}} +{{- printf "%s/ns/%s/sa/%s" + $ctx.Values.clusterDomain + (include "kubeflow.namespace" $ctx) + $saName +}} +{{- end }} + +{{- define "kubeflow.component.authorizationPolicyExtAuthName" -}} +{{- $componentName := index . 0 -}} +{{- $istioIntegration := index . 1 -}} +{{- $providerName := $istioIntegration.envoyExtAuthzHttpExtensionProviderName -}} +{{ printf "%s-%s" $componentName $providerName }} +{{- end }} + +{{/* +Kubeflow Component Security Context. +*/}} +{{- define "kubeflow.component.containerSecurityContext" -}} +{{- $defaultContext := index . 0 -}} +{{- $componentContext := index . 1 -}} +{{- if $componentContext -}} + {{- toYaml $componentContext }} +{{- else if $defaultContext -}} + {{- toYaml $defaultContext }} +{{- end }} +{{- end }} + +{{/* +Kubeflow Component Scheduling. + +TODO: investigate if this can be simply used like: +{{- include "mychart.affinity" . | nindent 8 }} +{{- include "mychart.nodeSelector" . | nindent 8 }} +{{- include "mychart.tolerations" . | nindent 8 }} +{{- include "mychart.topologySpreadConstraints" . | nindent 8 }} +https://chat.openai.com/share/c66d86ba-3b98-4942-a605-56b98889a313 +*/}} +{{- define "kubeflow.component.topologySpreadConstraints" -}} +{{- $defaultConstraints := index . 0 -}} +{{- $componentConstraints := index . 1 -}} +{{- if $componentConstraints -}} + {{- toYaml $componentConstraints }} +{{- else if $defaultConstraints -}} + {{- toYaml $defaultConstraints }} +{{- end }} +{{- end }} + +{{- define "kubeflow.component.nodeSelector" -}} +{{- $defaultNodeSelector := index . 0 -}} +{{- $componentNodeSelector := index . 1 -}} +{{- if $componentNodeSelector -}} + {{- toYaml $componentNodeSelector }} +{{- else if $defaultNodeSelector -}} + {{- toYaml $defaultNodeSelector }} +{{- end }} +{{- end }} + +{{- define "kubeflow.component.tolerations" -}} +{{- $defaultTolerations := index . 0 -}} +{{- $componentTolerations := index . 1 -}} +{{- if $componentTolerations -}} + {{- toYaml $componentTolerations }} +{{- else if $defaultTolerations -}} + {{- toYaml $defaultTolerations }} +{{- end }} +{{- end }} + +{{- define "kubeflow.component.affinity" -}} +{{- $defaultAffinity := index . 0 -}} +{{- $componentAffinity := index . 1 -}} +{{- if $componentAffinity -}} + {{- toYaml $componentAffinity }} +{{- else if $defaultAffinity -}} + {{- toYaml $defaultAffinity }} +{{- end }} +{{- end }} + +{{- define "kubeflow.component.terminationGracePeriodSeconds" -}} +{{- $defaultTerminationGracePeriodSeconds := index . 0 -}} +{{- $componentTerminationGracePeriodSeconds := index . 1 -}} +{{- if $componentTerminationGracePeriodSeconds -}} + {{- toYaml $componentTerminationGracePeriodSeconds }} +{{- else if $defaultTerminationGracePeriodSeconds -}} + {{- toYaml $defaultTerminationGracePeriodSeconds }} +{{- end }} +{{- end }} + +{{- define "kubeflow.component.pdb.create" -}} +{{- $componentEnabled := index . 0 -}} +{{- $defaultPDB := index . 1 -}} +{{- $componentPDB := index . 2 -}} +{{- and + (or $defaultPDB $componentPDB) + ($componentEnabled | eq "true") +}} +{{- end }} + +{{- define "kubeflow.component.pdb.values" -}} +{{- $defaultPDB := index . 0 -}} +{{- $componentPDB := index . 1 -}} +{{ toYaml (default $defaultPDB $componentPDB) }} +{{- end }} + +{{/* +Environment Entries parametrization with plaintext value +or through Secrets. +*/}} +{{- define "kubeflow.component.env.spec" -}} +{{- $envName := index . 0 -}} +{{- $defaultSecretName := index . 1 -}} +{{- $entryConfig := index . 2 -}} +{{- $secretName := default $defaultSecretName $entryConfig.secretKeyRef.name -}} +{{- $secretKey := $entryConfig.secretKeyRef.key -}} +{{- $entryValue := $entryConfig.value -}} +- name: {{ $envName }} + {{- if $secretName }} + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: {{ $secretKey }} + {{- else }} + value: {{ $entryValue | quote }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.admissionWebhook.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.admissionWebhook.tpl new file mode 100644 index 00000000..f765184d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.admissionWebhook.tpl @@ -0,0 +1,301 @@ +{{/* +Kubeflow Admission Webhook object names. +*/}} +{{- define "kubeflow.admissionWebhook.baseName" -}} +{{- printf "admission-webhook" }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.admissionWebhook.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.admissionWebhook.name" .) + .Values.admissionWebhook.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.tlsCertSecretName" -}} +{{ printf "%s-%s" (include "kubeflow.admissionWebhook.name" .) "tls-certs" }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.certIssuerName" -}} +{{ printf "%s-%s" (include "kubeflow.admissionWebhook.name" .) "selfsigned-issuer" }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.certName" -}} +{{ printf "%s-%s" (include "kubeflow.admissionWebhook.name" .) "cert" }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.webhookName" -}} +{{ print (include "kubeflow.admissionWebhook.name" .) }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.admissionWebhook.name" .) +}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.mainClusterRoleBindingName" -}} +{{- include "kubeflow.admissionWebhook.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdAdminName" -}} +{{- printf "poddefaults-admin" }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdEditName" -}} +{{- printf "poddefaults-edit" }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdViewName" -}} +{{- printf "poddefaults-view" }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdAdminClusterRoleName" -}} +{{- printf "%s-%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.admissionWebhook.name" .) (include "kubeflow.admissionWebhook.kfPdAdminName" .) }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdEditClusterRoleName" -}} +{{- printf "%s-%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.admissionWebhook.name" .) (include "kubeflow.admissionWebhook.kfPdEditName" .) }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdViewClusterRoleName" -}} +{{- printf "%s-%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.admissionWebhook.name" .) (include "kubeflow.admissionWebhook.kfPdViewName" .) }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdAdminClusterRoleLabelName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.admissionWebhook.kfPdAdminName" .) }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdEditClusterRoleLabelName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.admissionWebhook.kfPdEditName" .) }} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.admissionWebhook.kfPdAdminClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.admissionWebhook.kfPdAdminClusterRoleLabelName" .) -}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.kfPdEditClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.admissionWebhook.kfPdEditClusterRoleLabelName" .) -}} +{{- end }} + +{{/* +Kubeflow Admission Webhook Service. +*/}} +{{- define "kubeflow.admissionWebhook.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.admissionWebhook.name" . +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.admissionWebhook.name" .) +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.admissionWebhook.name" .) +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.admissionWebhook.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Admission Webhook object labels. +*/}} +{{- define "kubeflow.admissionWebhook.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.admissionWebhook.name" .) }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.admissionWebhook.name" .) }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.partOfLabel" -}} +app.kubernetes.io/part-of: kubeflow-profile +{{- end }} + +{{/* +Kubeflow Admission Webhook container image settings. +*/}} +{{- define "kubeflow.admissionWebhook.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.admissionWebhook.image +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.admissionWebhook.image +)}} +{{- end }} + +{{/* +Kubeflow Admission Webhook Autoscaling and Availability. +*/}} +{{- define "kubeflow.admissionWebhook.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.admissionWebhook.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.admissionWebhook.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.admissionWebhook.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.admissionWebhook.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.admissionWebhook.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Admission Webhook Security Context. +*/}} +{{- define "kubeflow.admissionWebhook.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.admissionWebhook.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Admission Webhook Scheduling. +*/}} +{{- define "kubeflow.admissionWebhook.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.admissionWebhook.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.admissionWebhook.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.admissionWebhook.tolerations +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.admissionWebhook.affinity +)}} +{{- end }} + +{{/* +Kubeflow Admission Webhook enable and create toggles. +*/}} +{{- define "kubeflow.admissionWebhook.enabled" -}} +{{- .Values.admissionWebhook.enabled }} +{{- end }} + +{{- define "kubeflow.admissionWebhook.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.admissionWebhook.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.admissionWebhook.enabled" . | eq "true") + .Values.admissionWebhook.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.admissionWebhook.enabled" . | eq "true") + .Values.admissionWebhook.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.admissionWebhook.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.admissionWebhook.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.admissionWebhook.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Admission Webhook certificate manager. +*/}} +{{- define "kubeflow.admissionWebhook.enabledWithCertManager" -}} +{{- ternary true "" ( + and + (include "kubeflow.admissionWebhook.enabled" . | eq "true" ) + (include "kubeflow.certManagerIntegration.enabled" . | eq "true" ) +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.centraldashboard.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.centraldashboard.tpl new file mode 100644 index 00000000..47c4e880 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.centraldashboard.tpl @@ -0,0 +1,221 @@ +{{/* +Kubeflow Centraldashboard object names. +*/}} +{{- define "kubeflow.centraldashboard.baseName" -}} +{{- printf "centraldashboard" }} +{{- end }} + +{{- define "kubeflow.centraldashboard.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.centraldashboard.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.centraldashboard.name" .) + .Values.centraldashboard.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.centraldashboard.roleName" -}} +{{- include "kubeflow.centraldashboard.name" . }} +{{- end }} + +{{- define "kubeflow.centraldashboard.roleBindingName" -}} +{{- include "kubeflow.centraldashboard.name" . }} +{{- end }} + +{{- define "kubeflow.centraldashboard.clusterRoleName" -}} +{{- include "kubeflow.centraldashboard.name" . }} +{{- end }} + +{{- define "kubeflow.centraldashboard.clusterRoleBindingName" -}} +{{- include "kubeflow.centraldashboard.name" . }} +{{- end }} + +{{- define "kubeflow.centraldashboard.config.name" -}} +{{ printf "%s-config" (include "kubeflow.centraldashboard.name" .) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.authorizationPolicyExtAuthName" -}} +{{ include "kubeflow.component.authorizationPolicyExtAuthName" ( + list + (include "kubeflow.centraldashboard.name" .) + .Values.istioIntegration +)}} +{{- end }} + +{{/* +Kubeflow Centraldashboard Service. +*/}} +{{- define "kubeflow.centraldashboard.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.centraldashboard.name" . +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.centraldashboard.name" .) +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.centraldashboard.name" .) +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.centraldashboard.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Centraldashboard object labels. +*/}} +{{- define "kubeflow.centraldashboard.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.centraldashboard.name" .) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.centraldashboard.name" .) }} +{{- end }} + +{{/* +Kubeflow Centraldashboard container image settings. +*/}} +{{- define "kubeflow.centraldashboard.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.centraldashboard.image) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.centraldashboard.image) }} +{{- end }} + +{{/* +Kubeflow Centraldashboard Autoscaling and Availability. +*/}} +{{- define "kubeflow.centraldashboard.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.centraldashboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.centraldashboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.centraldashboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.centraldashboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.centraldashboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.centraldashboard.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.centraldashboard.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Centraldashboard Security Context. +*/}} +{{- define "kubeflow.centraldashboard.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.centraldashboard.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Centraldashboard Scheduling. +*/}} +{{- define "kubeflow.centraldashboard.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.centraldashboard.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.centraldashboard.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.centraldashboard.tolerations +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.centraldashboard.affinity +)}} +{{- end }} + +{{/* +Kubeflow Centraldashboard enable and create toggles. +*/}} +{{- define "kubeflow.centraldashboard.enabled" -}} +{{- .Values.centraldashboard.enabled }} +{{- end }} + +{{- define "kubeflow.centraldashboard.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.centraldashboard.enabled" . | eq "true") + .Values.istioIntegration.enabled +)}} +{{- end }} + +{{- define "kubeflow.centraldashboard.rbac.createRoles" -}} +{{- and + (include "kubeflow.centraldashboard.enabled" . | eq "true") + .Values.centraldashboard.rbac.create }} +{{- end }} + +{{- define "kubeflow.centraldashboard.createServiceAccount" -}} +{{- and + (include "kubeflow.centraldashboard.enabled" . | eq "true") + .Values.centraldashboard.serviceAccount.create +}} +{{- end }} + +{{- define "kubeflow.centraldashboard.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.centraldashboard.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.centraldashboard.podDisruptionBudget +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.dexIntegration.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.dexIntegration.tpl new file mode 100644 index 00000000..0121a79e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.dexIntegration.tpl @@ -0,0 +1,61 @@ +{{/* +Dex Integration object names. +*/}} +{{- define "kubeflow.dexIntegration.baseName" -}} +{{- printf "dex" }} +{{- end }} + +{{- define "kubeflow.dexIntegration.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.dexIntegration.baseName" .) + . +)}} +{{- end }} + +{{/* +Dex Service. +*/}} +{{- define "kubeflow.dexIntegration.svc.fqdn" -}} +{{ printf "%s.%s.svc.%s" + .Values.dexIntegration.svc.name + .Values.dexIntegration.svc.namespace + .Values.clusterDomain +}} +{{- end }} + +{{/* +Dex Integration object labels. +*/}} +{{- define "kubeflow.dexIntegration.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.dexIntegration.name" .) }} +{{- end }} + +{{/* +Dex Integration enable and create toggles. +*/}} +{{- define "kubeflow.dexIntegration.enabled" -}} +{{- or + ( + and + (eq .Values.dexIntegration.integrationMode "istio") + .Values.istioIntegration.enabled + .Values.dexIntegration.enabled + ) + ( + and + (eq .Values.dexIntegration.integrationMode "ingress") + .Values.dexIntegration.enabled + ) +}} +{{- end }} + + +{{- define "kubeflow.dexIntegration.istio.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.dexIntegration.enabled" . | eq "true") + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istio.authorizationPolicy.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istio.authorizationPolicy.tpl new file mode 100644 index 00000000..1f8ffe44 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istio.authorizationPolicy.tpl @@ -0,0 +1,14 @@ +{{ define "istio.authorizationPolicy" }} +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + name: "{{ .name }}" + namespace: "{{ .namespace }}" +spec: + action: "{{ default "ALLOW" .action }}" + rules: + - {} + selector: + matchLabels: + {{- toYaml .labels | nindent 6 -}} +{{- end}} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istioIntegration.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istioIntegration.tpl new file mode 100644 index 00000000..394f5696 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.istioIntegration.tpl @@ -0,0 +1,133 @@ +{{/* +Istio Integration object names. +*/}} + +{{- define "kubeflow.istioIntegration.baseName" -}} +{{- print "istio-integration" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.istioIntegration.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.istioIntegration.istioAdminRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "istio-admin" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.istioEditRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "istio-edit" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.istioViewRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "istio-view" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.m2m.requestAuthenticationName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "m2m" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.m2m.selfSigned.jobName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "configure-self-signed-m2m" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.m2m.selfSigned.inClusterClusterRoleBindingName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "unauthenticated-oidc-viewer" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.userAuth.requestAuthenticationName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "user-auth" }} +{{- end }} + +{{- define "kubeflow.istioIntegration.extAuth.authorizationPolicyName" -}} +{{- printf "%s-ext-auth-%s" + (include "kubeflow.fullname" .) + .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName +}} +{{- end }} + +{{- define "kubeflow.istioIntegration.jwtRequire.authorizationPolicyName" -}} +{{- printf "%s-jwt-require" + (include "kubeflow.fullname" .) +}} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.istioIntegration.istioAdminRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.istioIntegration.istioAdminRoleName" .) -}} +{{- end }} + +{{/* +Istio Integration object labels. +*/}} +{{- define "kubeflow.istioIntegration.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.istioIntegration.name" .) }} +{{- end }} + +{{/* +Istio Integration enable and create toggles. +*/}} +{{- define "kubeflow.istioIntegration.enabled" -}} +{{- .Values.istioIntegration.enabled }} +{{- end }} + +{{- define "kubeflow.istioIntegration.m2m.enabled" -}} +{{- and + (include "kubeflow.istioIntegration.enabled" . | eq "true" ) + .Values.istioIntegration.m2m.enabled +}} +{{- end }} + +{{- define "kubeflow.istioIntegration.m2m.selfSigned.autoJwksDiscovery" -}} +{{- and + (include "kubeflow.istioIntegration.enabled" . | eq "true" ) + .Values.istioIntegration.m2m.selfSigned.autoJwksDiscovery +}} +{{- end }} + +{{- define "kubeflow.istioIntegration.authorizationMode.granular" -}} +{{- ternary true "" (eq .Values.istioIntegration.authorizationMode "granular") -}} +{{- end }} + +{{- define "kubeflow.istioIntegration.authorizationMode.ingressgateway" -}} +{{- ternary true "" (eq .Values.istioIntegration.authorizationMode "ingressgateway") -}} +{{- end }} + +{{- define "kubeflow.istioIntegration.istioIngressGateway.serviceAccountPrincipal" -}} +{{- printf "%s/ns/%s/sa/%s" + .Values.clusterDomain + .Values.istioIntegration.ingressGatewayNamespace + .Values.istioIntegration.ingressGatewayServiceAccountName +}} +{{- end }} + +{{- define "kubeflow.istioIntegration.kubeflowJwksProxy.name" -}} +{{- printf "%s-jwks-proxy" + (include "kubeflow.fullname" .) +}} +{{- end -}} + +{{- define "kubeflow.istioIntegration.kubeflowJwksProxy.labels" -}} +app.kubernetes.io/name: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.name" . }} +{{- end -}} + +{{- define "kubeflow.istioIntegration.kubeflowJwksProxy.namespace" -}} +{{ include "kubeflow.namespace" . }} +{{- end -}} + +{{- define "kubeflow.istioIntegration.jwksUri" -}} +http://{{ include "kubeflow.istioIntegration.kubeflowJwksProxy.name" . }}.{{ include "kubeflow.istioIntegration.kubeflowJwksProxy.namespace" . }}.svc.cluster.local/openid/v1/jwks +{{- end -}} + +{{- define "kubeflow.istioIntegration.kubeflowJwksProxy.enabled" -}} +{{- and + (include "kubeflow.istioIntegration.enabled" . | eq "true" ) + .Values.istioIntegration.kubeflowJwksProxy.enabled +}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.controller.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.controller.tpl new file mode 100644 index 00000000..cb70ec8a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.controller.tpl @@ -0,0 +1,332 @@ +{{/* +Kubeflow Katib Controller object names. +*/}} +{{- define "kubeflow.katib.controller.baseName" -}} +{{- printf "katib-controller" }} +{{- end }} + +{{- define "kubeflow.katib.controller.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.katib.controller.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.katib.controller.name" .) + .Values.katib.controller.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.katib.controller.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.mainClusterRoleName" -}} +{{- include "kubeflow.katib.controller.name" . }} +{{- end }} + +{{- define "kubeflow.katib.controller.mainClusterRoleBindingName" -}} +{{- include "kubeflow.katib.controller.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.controller.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.katib.controller.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.katib.controller.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.katib.controller.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.controller.kfNbAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-admin" }} +{{- end }} + +{{- define "kubeflow.katib.controller.kfNbEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-edit" }} +{{- end }} + +{{- define "kubeflow.katib.controller.kfNbViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-view" }} +{{- end }} + +{{- define "kubeflow.katib.controller.configMapName" -}} +{{/* +katib-config ConfigMap name is hardcoded +https://github.com/kubeflow/katib/blob/0e2ba6efc1bc18b1d1d72b90046598a00f02a2c3/pkg/controller.v1beta1/consts/const.go#L109 +https://github.com/kubeflow/katib/blob/0e2ba6efc1bc18b1d1d72b90046598a00f02a2c3/pkg/util/v1beta1/katibconfig/config.go#L164 +{{- printf "%s-%s" (include "kubeflow.katib.controller.name" .) "config" }} +*/}} +{{- printf "katib-config" }} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.katib.controller.kfNbAdminClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.katib.controller.kfNbAdminClusterRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Katib Controller Service. +*/}} +{{- define "kubeflow.katib.controller.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.katib.controller.name" . +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.katib.controller.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.katib.controller.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.katib.controller.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller object labels. +*/}} +{{- define "kubeflow.katib.controller.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.controller.name" .) }} +{{- end }} + +{{- define "kubeflow.katib.controller.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.controller.name" .) }} +{{- end }} + +{{/* +Kubeflow Katib Controller container image settings. +*/}} +{{- define "kubeflow.katib.controller.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.katib.controller.image +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.katib.controller.image +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller Autoscaling and Availability. +*/}} +{{- define "kubeflow.katib.controller.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.katib.controller.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller Security Context. +*/}} +{{- define "kubeflow.katib.controller.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.katib.controller.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller Scheduling. +*/}} +{{- define "kubeflow.katib.controller.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.katib.controller.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.katib.controller.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.katib.controller.tolerations +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.katib.controller.affinity +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller enable and create toggles. +*/}} +{{- define "kubeflow.katib.controller.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.enabled" . | eq "true") + .Values.katib.controller.enabled +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.katib.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.controller.enabled" . | eq "true") + .Values.katib.controller.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.katib.controller.enabled" . | eq "true") + .Values.katib.controller.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.katib.controller.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.katib.controller.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller certificate manager. +*/}} +{{- define "kubeflow.katib.controller.enabledWithCertManager" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.controller.enabled" . | eq "true" ) + (include "kubeflow.certManagerIntegration.enabled" . | eq "true" ) +)}} +{{- end }} + +{{- define "kubeflow.katib.controller.certIssuerName" -}} +{{ printf "%s-%s" (include "kubeflow.katib.controller.name" .) "selfsigned-issuer" }} +{{- end }} + +{{- define "kubeflow.katib.controller.tlsCertSecretName" -}} +{{ printf "%s-%s" (include "kubeflow.katib.controller.name" .) "tls-certs" }} +{{- end }} + +{{- define "kubeflow.katib.controller.validatingWebhookName" -}} +{{ printf "%s-%s" (include "kubeflow.katib.controller.name" .) "validating" }} +{{- end }} + +{{- define "kubeflow.katib.controller.mutatingWebhookName" -}} +{{ printf "%s-%s" (include "kubeflow.katib.controller.name" .) "mutating" }} +{{- end }} + +{{- define "kubeflow.katib.controller.certName" -}} +{{ printf "%s-%s" (include "kubeflow.katib.controller.name" .) "cert" }} +{{- end }} + +{{/* +Kubeflow Katib Controller Admission Webhooks. +*/}} +{{- define "kubeflow.katib.controller.webhook.baseName" -}} +{{ printf "katib.kubeflow.org" }} +{{- end }} + +{{- define "kubeflow.katib.controller.mutatingWebhook.name" -}} +{{ printf "%s" (include "kubeflow.katib.controller.webhook.baseName" .) }} +{{- end }} + +{{- define "kubeflow.katib.controller.validatingWebhook.name" -}} +{{ printf "%s" (include "kubeflow.katib.controller.webhook.baseName" .) }} +{{- end }} + +{{/* +{{- define "kubeflow.katib.controller.mutatingWebhook.experimentDefaulter.name" -}} +{{ printf "%s.%s" "defaulter.experiment" (include "kubeflow.katib.controller.mutatingWebhook.name" .) }} +{{- end }} +*/}} + diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.dbmanager.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.dbmanager.tpl new file mode 100644 index 00000000..7f796cb7 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.dbmanager.tpl @@ -0,0 +1,358 @@ +{{/* +Kubeflow Katib dbmanager object names. +*/}} +{{- define "kubeflow.katib.dbmanager.baseName" -}} +{{- printf "katib-db-manager" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.katib.dbmanager.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.katib.dbmanager.name" .) + .Values.katib.dbmanager.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.katib.dbmanager.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.mainClusterRoleName" -}} +{{- include "kubeflow.katib.dbmanager.name" . }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.mainClusterRoleBindingName" -}} +{{- include "kubeflow.katib.dbmanager.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.katib.dbmanager.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.katib.dbmanager.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.kfNbAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-admin" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.kfNbEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-edit" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.kfNbViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-view" }} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.katib.dbmanager.kfNbAdminClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.katib.dbmanager.kfNbAdminClusterRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Katib dbmanager Service. +*/}} +{{- define "kubeflow.katib.dbmanager.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.katib.dbmanager.name" . +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.katib.dbmanager.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.katib.dbmanager.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.katib.dbmanager.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Katib dbmanager object labels. +*/}} +{{- define "kubeflow.katib.dbmanager.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.dbmanager.name" .) }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.dbmanager.name" .) }} +{{- end }} + +{{/* +Kubeflow Katib dbmanager container image settings. +*/}} +{{- define "kubeflow.katib.dbmanager.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.katib.dbmanager.image +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.katib.dbmanager.image +)}} +{{- end }} + +{{/* +Kubeflow Katib dbmanager Autoscaling and Availability. +*/}} +{{- define "kubeflow.katib.dbmanager.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.dbmanager.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.dbmanager.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.dbmanager.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.dbmanager.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.katib.dbmanager.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Katib dbmanager Security Context. +*/}} +{{- define "kubeflow.katib.dbmanager.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.katib.dbmanager.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Katib dbmanager Scheduling. +*/}} +{{- define "kubeflow.katib.dbmanager.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.katib.dbmanager.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.katib.dbmanager.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.katib.dbmanager.tolerations +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.katib.dbmanager.affinity +)}} +{{- end }} + +{{/* +Kubeflow Katib dbmanager enable and create toggles. +*/}} +{{- define "kubeflow.katib.dbmanager.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.enabled" . | eq "true") + .Values.katib.dbmanager.enabled +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.katib.dbmanager.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.dbmanager.enabled" . | eq "true") + .Values.katib.dbmanager.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.katib.dbmanager.enabled" . | eq "true") + .Values.katib.dbmanager.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.katib.dbmanager.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.katib.dbmanager.podDisruptionBudget +)}} +{{- end }} + +{{/* +Environment names for database config. +*/}} +{{/* +FYI, This env var is actually the driver +*/}} +{{- define "kubeflow.katib.dbmanager.config.db.driver.env.name" -}} +{{- "DB_NAME" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.host.env.name" -}} +{{- "KATIB_MYSQL_DB_HOST" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.port.env.name" -}} +{{- "KATIB_MYSQL_DB_PORT" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.databaseName.env.name" -}} +{{- "KATIB_MYSQL_DB_DATABASE" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.user.env.name" -}} +{{- "DB_USER" }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.password.env.name" -}} +{{- "DB_PASSWORD" }} +{{- end }} + +{{/* +Environment Entries parametrization for database configuration with plaintext +value or through Secrets. +*/}} + +{{- define "kubeflow.katib.dbmanager.config.db.driver.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.katib.dbmanager.config.db.driver.env.name" . ) + .Values.katib.dbmanager.config.db.existingSecretName + .Values.katib.dbmanager.config.db.driver +) }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.katib.dbmanager.config.db.host.env.name" . ) + .Values.katib.dbmanager.config.db.existingSecretName + .Values.katib.dbmanager.config.db.host +) }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.port.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.katib.dbmanager.config.db.port.env.name" . ) + .Values.katib.dbmanager.config.db.existingSecretName + .Values.katib.dbmanager.config.db.port +) }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.databaseName.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.katib.dbmanager.config.db.databaseName.env.name" . ) + .Values.katib.dbmanager.config.db.existingSecretName + .Values.katib.dbmanager.config.db.databaseName +) }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.user.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.katib.dbmanager.config.db.user.env.name" . ) + .Values.katib.dbmanager.config.db.existingSecretName + .Values.katib.dbmanager.config.db.user +) }} +{{- end }} + +{{- define "kubeflow.katib.dbmanager.config.db.password.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.katib.dbmanager.config.db.password.env.name" . ) + .Values.katib.dbmanager.config.db.existingSecretName + .Values.katib.dbmanager.config.db.password +) }} +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.tpl new file mode 100644 index 00000000..742037f5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.tpl @@ -0,0 +1,265 @@ +{{/* +Kubeflow Katib object names. +*/}} +{{- define "kubeflow.katib.baseName" -}} +{{- printf "katib" }} +{{- end }} + +{{- define "kubeflow.katib.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.katib.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.katib.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.katib.name" .) + .Values.katib.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.katib.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.katib.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.mainClusterRoleName" -}} +{{- include "kubeflow.katib.name" . }} +{{- end }} + +{{- define "kubeflow.katib.mainClusterRoleBindingName" -}} +{{- include "kubeflow.katib.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.katib.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.katib.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.katib.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.adminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-admin" }} +{{- end }} + +{{- define "kubeflow.katib.editClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-edit" }} +{{- end }} + +{{- define "kubeflow.katib.viewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-view" }} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.katib.adminClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.katib.adminClusterRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Katib Controller Service. +*/}} +{{- define "kubeflow.katib.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.katib.name" . +)}} +{{- end }} + +{{- define "kubeflow.katib.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.katib.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.katib.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.katib.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller object labels. +*/}} +{{- define "kubeflow.katib.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.name" .) }} +{{- end }} + +{{- define "kubeflow.katib.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.name" .) }} +{{- end }} + +{{/* +Kubeflow Katib Controller container image settings. +*/}} +{{- define "kubeflow.katib.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.katib.image +)}} +{{- end }} + +{{- define "kubeflow.katib.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.katib.image +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller Autoscaling and Availability. +*/}} +{{- define "kubeflow.katib.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.katib.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller Security Context. +*/}} +{{- define "kubeflow.katib.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.katib.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Katib Controller Scheduling. +*/}} +{{- define "kubeflow.katib.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.katib.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.katib.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.katib.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.katib.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.katib.tolerations +)}} +{{- end }} + +{{- define "kubeflow.katib.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.katib.affinity +)}} +{{- end }} + +{{/* +Kubeflow Katib enable and create toggles. +*/}} +{{- define "kubeflow.katib.enabled" -}} +{{- ternary true "" .Values.katib.enabled }} +{{- end }} + +{{- define "kubeflow.katib.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.katib.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.enabled" . | eq "true") + .Values.katib.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.katib.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.katib.enabled" . | eq "true") + .Values.katib.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.katib.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.katib.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.katib.podDisruptionBudget +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.ui.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.ui.tpl new file mode 100644 index 00000000..732a69e3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.katib.ui.tpl @@ -0,0 +1,277 @@ +{{/* +Kubeflow Katib ui object names. +*/}} +{{- define "kubeflow.katib.ui.baseName" -}} +{{- printf "katib-ui" }} +{{- end }} + +{{- define "kubeflow.katib.ui.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.katib.ui.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.katib.ui.name" .) + .Values.katib.ui.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.katib.ui.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.mainClusterRoleName" -}} +{{- include "kubeflow.katib.ui.name" . }} +{{- end }} + +{{- define "kubeflow.katib.ui.mainClusterRoleBindingName" -}} +{{- include "kubeflow.katib.ui.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.ui.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.katib.ui.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.katib.ui.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.katib.ui.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.katib.ui.kfNbAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-admin" }} +{{- end }} + +{{- define "kubeflow.katib.ui.kfNbEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-edit" }} +{{- end }} + +{{- define "kubeflow.katib.ui.kfNbViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "katib-view" }} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.katib.ui.kfNbAdminClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.katib.ui.kfNbAdminClusterRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Katib ui Service. +*/}} +{{- define "kubeflow.katib.ui.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.katib.ui.name" . +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.katib.ui.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.katib.ui.name" .) +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.katib.ui.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Katib ui object labels. +*/}} +{{- define "kubeflow.katib.ui.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.ui.name" .) }} +{{- end }} + +{{- define "kubeflow.katib.ui.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.katib.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.katib.ui.name" .) }} +{{- end }} + +{{/* +Kubeflow Katib ui container image settings. +*/}} +{{- define "kubeflow.katib.ui.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.katib.ui.image +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.katib.ui.image +)}} +{{- end }} + +{{/* +Kubeflow Katib ui Autoscaling and Availability. +*/}} +{{- define "kubeflow.katib.ui.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.ui.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.katib.ui.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.ui.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.katib.ui.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.katib.ui.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Katib ui Security Context. +*/}} +{{- define "kubeflow.katib.ui.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.katib.ui.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Katib ui Scheduling. +*/}} +{{- define "kubeflow.katib.ui.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.katib.ui.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.katib.ui.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.katib.ui.tolerations +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.katib.ui.affinity +)}} +{{- end }} + +{{/* +Kubeflow Katib ui enable and create toggles. +*/}} +{{- define "kubeflow.katib.ui.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.enabled" . | eq "true") + .Values.katib.ui.enabled +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.katib.ui.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.ui.enabled" . | eq "true") + .Values.katib.ui.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.katib.ui.enabled" . | eq "true") + .Values.katib.ui.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.katib.ui.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.katib.ui.podDisruptionBudget +)}} +{{- end }} + +{{- define "kubeflow.katib.ui.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.katib.ui.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.knativeIntegration.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.knativeIntegration.tpl new file mode 100644 index 00000000..549d337d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.knativeIntegration.tpl @@ -0,0 +1,43 @@ +{{/* +Knative Integration helpers. +*/}} + +{{- define "kubeflow.knativeIntegration.enabled" -}} +{{- .Values.knativeIntegration.enabled }} +{{- end }} + +{{/* +Knative Serving helpers. +*/}} + +{{- define "kubeflow.knativeIntegration.knativeServing.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.knativeIntegration.enabled" . | eq "true") + .Values.knativeIntegration.knativeServing.enabled +)}} +{{- end }} + +{{/* +Knative Eventing helpers. +*/}} + +{{- define "kubeflow.knativeIntegration.knativeEventing.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.knativeIntegration.enabled" . | eq "true") + .Values.knativeIntegration.knativeEventing.enabled +)}} +{{- end }} + +{{/* +KNative Istio Ingregration helpers. +*/}} + +{{- define "kubeflow.knativeIntegration.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.knativeIntegration.enabled" . | eq "true") + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kserveModelsWebApp.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kserveModelsWebApp.tpl new file mode 100644 index 00000000..dcb2e50f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kserveModelsWebApp.tpl @@ -0,0 +1,125 @@ +{{/* +Kubeflow Kserve Models Web App object names. +*/}} +{{- define "kubeflow.kserveModelsWebApp.baseName" -}} +{{- printf "kserve-models-web-app" }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.kserveModelsWebApp.baseName" .) + . +)}} +{{- end }} + +{{/* +Kubeflow Kserve Models Web App enable and create toggles. +*/}} +{{- define "kubeflow.kserveModelsWebApp.enabled" -}} +{{- ternary true "" + .Values.kserveModelsWebApp.enabled +}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.createServiceAccount" -}} +{{- ternary true "" ( + and + (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true") + .Values.kserveModelsWebApp.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" (list (include "kubeflow.kserveModelsWebApp.name" .) .Values.kserveModelsWebApp.serviceAccount) }} +{{- end }} + +{{/* +Kubeflow Kserve Models Web App object labels. +*/}} +{{- define "kubeflow.kserveModelsWebApp.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.kserveModelsWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.configMapName" -}} +{{- printf "%s-%s" (include "kubeflow.kserveModelsWebApp.name" .) "viewer-spec" }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.kserveModelsWebApp.name" .) +}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.mainClusterRoleBindingName" -}} +{{- include "kubeflow.kserveModelsWebApp.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.rbac.createRole" -}} +{{- ternary true "" ( + and + (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true") + .Values.kserveModelsWebApp.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.kserveModelsWebApp.image) }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.kserveModelsWebApp.image) }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.kserveModelsWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.kserveModelsWebApp.name" . +)}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.kserveModelsWebApp.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.kserveModelsWebApp.tolerations +)}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.kserveModelsWebApp.affinity +)}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.kserveModelsWebApp.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.kserveModelsWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.kserveModelsWebApp.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.kserveModelsWebApp.autoscaling) }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kubeflowRoles.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kubeflowRoles.tpl new file mode 100644 index 00000000..db57117e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.kubeflowRoles.tpl @@ -0,0 +1,121 @@ +{{- define "kubeflow.roles.baseName" -}} +{{- print "kubeflow-roles" }} +{{- end }} + +{{- define "kubeflow.roles.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.roles.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.roles.name" .) }} +{{- end }} + +{{/* +Kubeflow Main Role Names. +*/}} +{{- define "kubeflow.kubeflowRoles.kubeflowAdminRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "admin" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowEditRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "edit" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowViewRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "view" }} +{{- end }} + + +{{/* +Kubeflow Kubernetes Role Names. +*/}} +{{- define "kubeflow.kubeflowRoles.kubernetesAdminRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "kubernetes-admin" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubernetesEditRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "kubernetes-edit" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubernetesViewRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "kubernetes-view" }} +{{- end }} + +{{/* +Kubeflow Pipelines Role Names. +*/}} +{{- define "kubeflow.kubeflowRoles.kubeflowPipelinesAdminRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "pipelines-admin" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowPipelinesEditRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "pipelines-edit" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowPipelinesViewRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "pipelines-view" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.aggregateToKubeflowPipelinesEditRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "aggregate-pipelines-edit" }} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.aggregateToKubeflowPipelinesViewRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "aggregate-pipelines-view" }} +{{- end }} + +{{/* + ################################### + ### Role Aggreation Rule Labels ### + ################################### +*/}} + +{{/* +Kubeflow Main Role Labels. +*/}} +{{- define "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubeflowAdminRoleName" .) -}} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubeflowEditRoleName" .) -}} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubeflowViewRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Kubernetes Role Labels. +*/}} +{{- define "kubeflow.kubeflowRoles.kubernetesAdminRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubernetesAdminRoleName" .) -}} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubernetesEditRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubernetesEditRoleName" .) -}} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubernetesViewRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubernetesViewRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Pipelines Role Labels. +*/}} +{{- define "kubeflow.kubeflowRoles.kubeflowPipelinesAdminRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubeflowPipelinesAdminRoleName" .) -}} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowPipelinesEditRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubeflowPipelinesEditRoleName" .) -}} +{{- end }} + +{{- define "kubeflow.kubeflowRoles.kubeflowPipelinesViewRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.kubeflowRoles.kubeflowPipelinesViewRoleName" .) -}} +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.modelRegistry.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.modelRegistry.tpl new file mode 100644 index 00000000..396d5ee0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.modelRegistry.tpl @@ -0,0 +1,269 @@ +{{/* +Kubeflow Model Registry object names. +*/}} +{{- define "kubeflow.modelRegistry.baseName" -}} +{{- printf "model-registry" }} +{{- end }} + +{{- define "kubeflow.modelRegistry.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.modelRegistry.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.modelRegistry.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.modelRegistry.name" .) + .Values.modelRegistry.serviceAccount +)}} +{{- end }} + +{{/* +Kubeflow Model Registry Service. +*/}} +{{- define "kubeflow.modelRegistry.svc.name" -}} +{{ printf "%s-%s" + (include "kubeflow.component.svc.name" ( + include "kubeflow.modelRegistry.name" . + )) + "service" +}} +{{- end }} + +{{- define "kubeflow.modelRegistry.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.modelRegistry.svc.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Model Registry object labels. +*/}} +{{- define "kubeflow.modelRegistry.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.modelRegistry.name" .) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.modelRegistry.name" .) }} +{{- end }} + +{{/* +Kubeflow Model Registry Scheduling. +*/}} +{{- define "kubeflow.modelRegistry.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.modelRegistry.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.modelRegistry.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.modelRegistry.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.modelRegistry.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.modelRegistry.tolerations +)}} +{{- end }} + +{{- define "kubeflow.modelRegistry.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.modelRegistry.affinity +)}} +{{- end }} + +{{/* +Kubeflow Model registrry enable and create toggles. +*/}} +{{- define "kubeflow.modelRegistry.enabled" -}} +{{- ternary true "" .Values.modelRegistry.enabled }} +{{- end }} + +{{- define "kubeflow.modelRegistry.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.modelRegistry.enabled" . | eq "true") + .Values.modelRegistry.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.modelRegistry.configMapName" -}} +{{- printf "%s" (include "kubeflow.modelRegistry.name" .) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.modelRegistry.enabled" . | eq "true") + .Values.istioIntegration.enabled +)}} +{{- end }} + +{{- define "kubeflow.modelRegistry.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.modelRegistry.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.modelRegistry.podDisruptionBudget +)}} +{{- end }} + +{{/* +Image configuration. +*/}} + +{{- define "kubeflow.modelRegistry.rest.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.modelRegistry.rest.image) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.rest.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.modelRegistry.rest.image .Values.modelRegistry.rest.image) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.grpc.image" -}} +{{ include "kubeflow.component.image" (list .Values.modelRegistry.grpc.image .Values.modelRegistry.grpc.image) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.grpc.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.modelRegistry.grpc.image .Values.modelRegistry.grpc.image) }} +{{- end }} + +{{/* +Kubeflow model-registry Autoscaling and Availability. +*/}} +{{- define "kubeflow.modelRegistry.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.modelRegistry.autoscaling) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.modelRegistry.autoscaling) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.modelRegistry.autoscaling) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.modelRegistry.autoscaling) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.modelRegistry.autoscaling) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.modelRegistry.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow model-registry Security Context. +*/}} +{{- define "kubeflow.modelRegistry.rest.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.modelRegistry.rest.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.modelRegistry.grpc.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.modelRegistry.grpc.containerSecurityContext +)}} +{{- end }} + +{{/* +Environment names for database config. +*/}} +{{- define "kubeflow.modelRegistry.config.db.user.env.name" -}} +{{- "MYSQL_USER_NAME" }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.password.env.name" -}} +{{- "MYSQL_PASSWORD" }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.host.env.name" -}} +{{- "MYSQL_HOST" }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.port.env.name" -}} +{{- "MYSQL_PORT" }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.dbName.env.name" -}} +{{- "MYSQL_DBNAME" }} +{{- end }} + +{{/* +Environment Entries parametrization for database configuration with plaintext +value or through Secrets. +*/}} + +{{- define "kubeflow.modelRegistry.config.db.user.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.modelRegistry.config.db.user.env.name" . ) + .Values.modelRegistry.config.db.existingSecretName + .Values.modelRegistry.config.db.user +) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.password.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.modelRegistry.config.db.password.env.name" . ) + .Values.modelRegistry.config.db.existingSecretName + .Values.modelRegistry.config.db.password +) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.modelRegistry.config.db.host.env.name" . ) + .Values.modelRegistry.config.db.existingSecretName + .Values.modelRegistry.config.db.host +) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.port.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.modelRegistry.config.db.port.env.name" . ) + .Values.modelRegistry.config.db.existingSecretName + .Values.modelRegistry.config.db.port +) }} +{{- end }} + +{{- define "kubeflow.modelRegistry.config.db.dbName.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.modelRegistry.config.db.dbName.env.name" . ) + .Values.modelRegistry.config.db.existingSecretName + .Values.modelRegistry.config.db.dbName +) }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.networkPolicies.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.networkPolicies.tpl new file mode 100644 index 00000000..a93a8008 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.networkPolicies.tpl @@ -0,0 +1,31 @@ +{{/* +Kubeflow Network Policies object names. +*/}} +{{- define "kubeflow.networkPolicies.baseName" -}} +{{- printf "network-policies" }} +{{- end }} + +{{- define "kubeflow.networkPolicies.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.networkPolicies.baseName" .) + . +)}} +{{- end }} + +{{/* +Kubeflow Network Policies enable and create toggles. +*/}} +{{- define "kubeflow.networkPolicies.enabled" -}} +{{- ternary true "" ( + .Values.networkPolicies.enabled +)}} +{{- end }} + +{{/* +Kubeflow Network Policies object labels. +*/}} +{{- define "kubeflow.networkPolicies.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.networkPolicies.name" .) }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.controller.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.controller.tpl new file mode 100644 index 00000000..e42b8918 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.controller.tpl @@ -0,0 +1,272 @@ +{{/* +Kubeflow Notebooks Controller object names. +*/}} +{{- define "kubeflow.notebooks.controller.baseName" -}} +{{- printf "notebooks-controller" }} +{{- end }} + +{{- define "kubeflow.notebooks.controller.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.notebooks.controller.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.notebooks.controller.name" .) + .Values.notebooks.controller.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.notebooks.controller.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.controller.name" .) +}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.mainClusterRoleBindingName" -}} +{{- include "kubeflow.notebooks.controller.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.notebooks.controller.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.controller.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.notebooks.controller.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.notebooks.controller.kfNbAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "notebooks-admin" }} +{{- end }} + +{{- define "kubeflow.notebooks.controller.kfNbEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "notebooks-edit" }} +{{- end }} + +{{- define "kubeflow.notebooks.controller.kfNbViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "notebooks-view" }} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.notebooks.controller.kfNbAdminClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.notebooks.controller.kfNbAdminClusterRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Notebooks Controller Service. +*/}} +{{- define "kubeflow.notebooks.controller.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.notebooks.controller.name" . +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.notebooks.controller.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.notebooks.controller.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.notebooks.controller.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Controller object labels. +*/}} +{{- define "kubeflow.notebooks.controller.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.controller.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.controller.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.controller.name" .) }} +{{- end }} + +{{/* +Kubeflow Notebooks Controller container image settings. +*/}} +{{- define "kubeflow.notebooks.controller.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.notebooks.controller.image +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.notebooks.controller.image +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Controller Autoscaling and Availability. +*/}} +{{- define "kubeflow.notebooks.controller.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.notebooks.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.notebooks.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.notebooks.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.notebooks.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.notebooks.controller.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Controller Security Context. +*/}} +{{- define "kubeflow.notebooks.controller.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.notebooks.controller.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Controller Scheduling. +*/}} +{{- define "kubeflow.notebooks.controller.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.notebooks.controller.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.notebooks.controller.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.notebooks.controller.tolerations +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.notebooks.controller.affinity +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Controller enable and create toggles. +*/}} +{{- define "kubeflow.notebooks.controller.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.enabled" . | eq "true") + .Values.notebooks.controller.enabled +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.notebooks.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.controller.enabled" . | eq "true") + .Values.notebooks.controller.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.notebooks.controller.enabled" . | eq "true") + .Values.notebooks.controller.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.controller.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.notebooks.controller.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.notebooks.controller.podDisruptionBudget +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.jupyterWebApp.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.jupyterWebApp.tpl new file mode 100644 index 00000000..bd88015a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.jupyterWebApp.tpl @@ -0,0 +1,241 @@ +{{/* +Kubeflow Notebooks Jupyter Web App object names. +*/}} +{{- define "kubeflow.notebooks.jupyterWebApp.baseName" -}} +{{- printf "jupyter-web-app" }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.notebooks.jupyterWebApp.baseName" .) + . +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Jupyter Web App object labels. +*/}} +{{- define "kubeflow.notebooks.jupyterWebApp.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.jupyterWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.jupyterWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.notebooks.jupyterWebApp.image) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.notebooks.jupyterWebApp.image) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.notebooks.jupyterWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.notebooks.jupyterWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.notebooks.jupyterWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.notebooks.jupyterWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.notebooks.jupyterWebApp.autoscaling) }} +{{- end }} + + +{{- define "kubeflow.notebooks.jupyterWebApp.spawnerUI.configMapName" -}} +{{- printf "%s-%s" (include "kubeflow.notebooks.jupyterWebApp.name" .) "config" }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.logos.configMapName" -}} +{{- $customConfigMap := .Values.notebooks.jupyterWebApp.logos.customConfigMap -}} +{{- if $customConfigMap -}} + {{- print $customConfigMap }} +{{- else -}} + {{- printf "%s-%s" (include "kubeflow.notebooks.jupyterWebApp.name" .) "logos" }} +{{- end -}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.jupyterWebApp.name" .) +}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.mainClusterRoleBindingName" -}} +{{- include "kubeflow.notebooks.jupyterWebApp.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.kfNbUiAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "notebooks-ui-admin" }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.kfNbUiEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "notebooks-ui-edit" }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.kfNbUiViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "notebooks-ui-view" }} +{{- end }} + +{{/* +Kubeflow Notebooks Jupyter Web App enable and create toggles. +*/}} +{{- define "kubeflow.notebooks.jupyterWebApp.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.enabled" . | eq "true") + .Values.notebooks.jupyterWebApp.enabled +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + .Values.istioIntegration.enabled + (include "kubeflow.notebooks.jupyterWebApp.enabled" . | eq "true" ) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.jupyterWebApp.enabled" . | eq "true") + .Values.notebooks.jupyterWebApp.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.notebooks.jupyterWebApp.enabled" . | eq "true") + .Values.notebooks.jupyterWebApp.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.logos.createConfigMap" -}} +{{- and + (include "kubeflow.notebooks.jupyterWebApp.enabled" . | eq "true") + (not .Values.notebooks.jupyterWebApp.logos.customConfigMap) +}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" (list (include "kubeflow.notebooks.jupyterWebApp.name" .) .Values.notebooks.jupyterWebApp.serviceAccount) }} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.authorizationPolicyExtAuthName" -}} +{{ include "kubeflow.component.authorizationPolicyExtAuthName" ( + list + (include "kubeflow.notebooks.jupyterWebApp.name" .) + .Values.istioIntegration +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Jupyter Web App Service. +*/}} +{{- define "kubeflow.notebooks.jupyterWebApp.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.notebooks.jupyterWebApp.name" . +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.notebooks.jupyterWebApp.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.notebooks.jupyterWebApp.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.notebooks.jupyterWebApp.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Jupyter Web App Security Context. +*/}} +{{- define "kubeflow.notebooks.jupyterWebApp.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.notebooks.jupyterWebApp.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.notebooks.jupyterWebApp.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.notebooks.jupyterWebApp.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.notebooks.jupyterWebApp.tolerations +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.notebooks.jupyterWebApp.affinity +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.notebooks.jupyterWebApp.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.notebooks.jupyterWebApp.podDisruptionBudget +)}} +{{- end }} + +{{- define "kubeflow.notebooks.jupyterWebApp.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.notebooks.jupyterWebApp.podDisruptionBudget +)}} +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.pvcviewerController.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.pvcviewerController.tpl new file mode 100644 index 00000000..0247b236 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.pvcviewerController.tpl @@ -0,0 +1,368 @@ +{{/* +Kubeflow Notebooks PVC Viewer Controller object names. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.baseName" -}} +{{- printf "pvcviewer-controller" }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.notebooks.pvcviewerController.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.manager.name" -}} +{{- printf "%s-%s" + (include "kubeflow.notebooks.pvcviewerController.name" .) + "manager" +}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.name" -}} +{{- printf "%s-%s" + (include "kubeflow.notebooks.pvcviewerController.name" .) + "kube-rbac-proxy" +}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.notebooks.pvcviewerController.name" .) + .Values.notebooks.pvcviewerController.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.pvcviewerController.name" .) +}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.mainClusterRoleBindingName" -}} +{{- include "kubeflow.notebooks.pvcviewerController.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.pvcviewerController.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.notebooks.pvcviewerController.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.metricsReaderClusterRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.pvcviewerController.name" .) + "metrics-reader" +}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.metricsReaderClusterRoleBindingName" -}} +{{- include "kubeflow.notebooks.pvcviewerController.metricsReaderClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.proxyClusterRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.pvcviewerController.name" .) + "proxy" +}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.proxyClusterRoleBindingName" -}} +{{- include "kubeflow.notebooks.pvcviewerController.proxyClusterRoleName" . }} +{{- end }} + + +{{- define "kubeflow.notebooks.pvcviewerController.tlsCertSecretName" -}} +{{ printf "%s-%s" (include "kubeflow.notebooks.pvcviewerController.name" .) "tls-certs" }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.certIssuerName" -}} +{{ printf "%s-%s" (include "kubeflow.notebooks.pvcviewerController.name" .) "selfsigned-issuer" }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.certName" -}} +{{ printf "%s-%s" (include "kubeflow.notebooks.pvcviewerController.name" .) "cert" }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.mutatingWebhookName" -}} +{{ printf "%s-%s" (include "kubeflow.notebooks.pvcviewerController.name" .) "mutating" }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.validatingWebhookName" -}} +{{ printf "%s-%s" (include "kubeflow.notebooks.pvcviewerController.name" .) "validating" }} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller Service. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.manager.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.notebooks.pvcviewerController.manager.name" . +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.manager.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.notebooks.pvcviewerController.manager.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.manager.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.notebooks.pvcviewerController.manager.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.manager.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.notebooks.pvcviewerController.manager.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.name" . +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.webhook.port" -}} +{{- .Values.notebooks.pvcviewerController.manager.webhook.port }} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller object labels. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.pvcviewerController.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.pvcviewerController.name" .) }} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller Manager container image settings. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.manager.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.notebooks.pvcviewerController.manager.image +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.manager.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.notebooks.pvcviewerController.manager.image +)}} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller Kube RBAC Proxy container image settings. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.notebooks.pvcviewerController.kubeRbacProxy.image +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.notebooks.pvcviewerController.kubeRbacProxy.image +)}} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller Autoscaling and Availability. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.notebooks.pvcviewerController.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.notebooks.pvcviewerController.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.notebooks.pvcviewerController.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.notebooks.pvcviewerController.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.notebooks.pvcviewerController.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller Security Context. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.manager.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.notebooks.pvcviewerController.manager.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.notebooks.pvcviewerController.kubeRbacProxy.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.securityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.notebooks.pvcviewerController.securityContext +)}} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller Scheduling. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.notebooks.pvcviewerController.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.nodeSelector" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.nodeSelector + .Values.notebooks.pvcviewerController.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.notebooks.pvcviewerController.tolerations +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.notebooks.pvcviewerController.affinity +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.terminationGracePeriodSeconds" -}} +{{ include "kubeflow.component.terminationGracePeriodSeconds" ( + list + .Values.defaults.terminationGracePeriodSeconds + .Values.notebooks.pvcviewerController.terminationGracePeriodSeconds +)}} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller enable and create toggles. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.enabled" . | eq "true") + .Values.notebooks.pvcviewerController.enabled +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.notebooks.pvcviewerController.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.pvcviewerController.enabled" . | eq "true") + .Values.notebooks.pvcviewerController.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.notebooks.pvcviewerController.enabled" . | eq "true") + .Values.notebooks.pvcviewerController.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.pvcviewerController.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.notebooks.pvcviewerController.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.notebooks.pvcviewerController.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Notebooks PVC Viewer Controller certificate manager. +*/}} +{{- define "kubeflow.notebooks.pvcviewerController.enabledWithCertManager" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.pvcviewerController.enabled" . | eq "true" ) + (include "kubeflow.certManagerIntegration.enabled" . | eq "true" ) +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.tpl new file mode 100644 index 00000000..61539601 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.tpl @@ -0,0 +1,126 @@ +{{/* +Kubeflow Notebooks object names. +*/}} +{{- define "kubeflow.notebooks.baseName" -}} +{{- printf "notebooks" }} +{{- end }} + +{{- define "kubeflow.notebooks.baseRbacName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.notebooks.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.notebooks.baseName" .) + . +)}} +{{- end }} + +{{/* +Kubeflow Notebooks object labels. +*/}} +{{- define "kubeflow.notebooks.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.notebooks.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.notebooks.name" .) }} +{{- end }} + +{{/* +Kubeflow Notebooks container image settings. +*/}} +{{- define "kubeflow.notebooks.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.notebooks.image) }} +{{- end }} + +{{- define "kubeflow.notebooks.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.notebooks.image) }} +{{- end }} + +{{/* +Kubeflow Notebooks Autoscaling and Availability. +*/}} +{{- define "kubeflow.notebooks.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.notebooks.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.notebooks.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.notebooks.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.notebooks.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.notebooks.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.notebooks.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Security Context. +*/}} +{{- define "kubeflow.notebooks.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.notebooks.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Scheduling. +*/}} +{{- define "kubeflow.notebooks.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.notebooks.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.notebooks.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.notebooks.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.notebooks.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.notebooks.tolerations +)}} +{{- end }} + +{{- define "kubeflow.notebooks.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.notebooks.affinity +)}} +{{- end }} + +{{/* +Kubeflow Notebooks enable and create toggles. +*/}} +{{- define "kubeflow.notebooks.enabled" -}} +{{- ternary true "" .Values.notebooks.enabled }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.volumesWebApp.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.volumesWebApp.tpl new file mode 100644 index 00000000..600147a4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.notebooks.volumesWebApp.tpl @@ -0,0 +1,229 @@ +{{/* +Kubeflow Notebooks Volumes Web App object names. +*/}} +{{- define "kubeflow.notebooks.volumesWebApp.baseName" -}} +{{- printf "volumes-web-app" }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.notebooks.volumesWebApp.baseName" .) + . +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Volumes Web App object labels. +*/}} +{{- define "kubeflow.notebooks.volumesWebApp.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.volumesWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.notebooks.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.notebooks.volumesWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.notebooks.volumesWebApp.image) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.viewerImage" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.notebooks.volumesWebApp.config.viewer.image) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.notebooks.volumesWebApp.image) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.notebooks.volumesWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.notebooks.volumesWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.notebooks.volumesWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.notebooks.volumesWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.notebooks.volumesWebApp.autoscaling) }} +{{- end }} + + +{{- define "kubeflow.notebooks.volumesWebApp.configMapName" -}} +{{- printf "%s-%s" (include "kubeflow.notebooks.volumesWebApp.name" .) "viewer-spec" }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.notebooks.volumesWebApp.name" .) +}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.mainClusterRoleBindingName" -}} +{{- include "kubeflow.notebooks.volumesWebApp.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.kfVolUiAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "volumes-ui-admin" }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.kfVolUiEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "volumes-ui-edit" }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.kfVolUiViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "volumes-ui-view" }} +{{- end }} + +{{/* +Kubeflow Notebooks Volumes Web App enable and create toggles. +*/}} +{{- define "kubeflow.notebooks.volumesWebApp.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.enabled" . | eq "true") + .Values.notebooks.volumesWebApp.enabled +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + .Values.istioIntegration.enabled + (include "kubeflow.notebooks.volumesWebApp.enabled" . | eq "true" ) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.notebooks.volumesWebApp.enabled" . | eq "true") + .Values.notebooks.volumesWebApp.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.notebooks.volumesWebApp.enabled" . | eq "true") + .Values.notebooks.volumesWebApp.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" (list (include "kubeflow.notebooks.volumesWebApp.name" .) .Values.notebooks.volumesWebApp.serviceAccount) }} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.authorizationPolicyExtAuthName" -}} +{{ include "kubeflow.component.authorizationPolicyExtAuthName" ( + list + (include "kubeflow.notebooks.volumesWebApp.name" .) + .Values.istioIntegration +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Volumes Web App Service. +*/}} +{{- define "kubeflow.notebooks.volumesWebApp.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.notebooks.volumesWebApp.name" . +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.notebooks.volumesWebApp.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.notebooks.volumesWebApp.name" .) +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.notebooks.volumesWebApp.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Notebooks Volumes Web App Security Context. +*/}} +{{- define "kubeflow.notebooks.volumesWebApp.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.notebooks.volumesWebApp.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.notebooks.volumesWebApp.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.notebooks.volumesWebApp.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.notebooks.volumesWebApp.tolerations +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.notebooks.volumesWebApp.affinity +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.notebooks.volumesWebApp.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.notebooks.volumesWebApp.podDisruptionBudget +)}} +{{- end }} + +{{- define "kubeflow.notebooks.volumesWebApp.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.notebooks.volumesWebApp.podDisruptionBudget +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.oauth2ProxyIntegration.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.oauth2ProxyIntegration.tpl new file mode 100644 index 00000000..aa4170a3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.oauth2ProxyIntegration.tpl @@ -0,0 +1,6 @@ +{{- define "kubeflow.oauth2ProxyIntegration.istio.enabled" -}} +{{- and + (include "kubeflow.istioIntegration.enabled" . | eq "true" ) + .Values.oauth2ProxyIntegration.enabled +}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.config.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.config.tpl new file mode 100644 index 00000000..a86fc88f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.config.tpl @@ -0,0 +1,108 @@ +{{/* +Kubeflow Pipelines Cache config. +*/}} + +{{/* +Environment names for the env spec parametrization. +*/}} +{{- define "kubeflow.pipelines.cache.config.db.user.env.name" -}} +{{- "DBCONFIG_USER" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.password.env.name" -}} +{{- "DBCONFIG_PASSWORD" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.host.env.name" -}} +{{- "DBCONFIG_HOST" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.port.env.name" -}} +{{- "DBCONFIG_PORT" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.cacheDatabaseName.env.name" -}} +{{- "DBCONFIG_CACHE_DB_NAME" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.driver.env.name" -}} +{{- "DBCONFIG_DRIVER" }} +{{- end }} + + +{{/* +Environment Entries parametrization with plaintext value +or through Secrets. +*/}} +{{- define "kubeflow.pipelines.cache.config.db.user.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.user.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.user +) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.password.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.password.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.password +) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.host.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.host +) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.port.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.port.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.port +) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.cacheDatabaseName.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.cacheDatabaseName.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.cacheDatabaseName +) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.pipelineDatabaseName.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.pipelineDatabaseName.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.pipelineDatabaseName +) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.conMaxLifetime.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.conMaxLifetime.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.conMaxLifetime +) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.config.db.driver.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.cache.config.db.driver.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.driver +) }} +{{- end }} + diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.tpl new file mode 100644 index 00000000..28654916 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.cache.tpl @@ -0,0 +1,252 @@ +{{/* +Kubeflow Pipelines Cache object names. +*/}} +{{- define "kubeflow.pipelines.cache.baseName" -}} +{{- printf "ml-pipeline-cache" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.cache.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.cache.name" .) + .Values.pipelines.cache.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.pipelines.cache.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.roleName" -}} +{{- include "kubeflow.pipelines.cache.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.roleBindingName" -}} +{{- include "kubeflow.pipelines.cache.roleName" . }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.tlsCertSecretName" -}} +{{ printf "%s-%s" (include "kubeflow.pipelines.cache.name" .) "tls-certs" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.certIssuerName" -}} +{{ printf "%s-%s" (include "kubeflow.pipelines.cache.name" .) "selfsigned-issuer" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.certName" -}} +{{ printf "%s-%s" (include "kubeflow.pipelines.cache.name" .) "cert" }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.webhookName" -}} +{{ print (include "kubeflow.pipelines.cache.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines Cache Service. +*/}} +{{- define "kubeflow.pipelines.cache.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.cache.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.cache.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.cache.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.cache.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Cache object labels. +*/}} +{{- define "kubeflow.pipelines.cache.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.cache.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.cache.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.cacheEnabledLabel" -}} +pipelines.kubeflow.org/cache_enabled: "true" +{{- end }} + +{{- define "kubeflow.pipelines.cache.cacheDisabledLabel" -}} +pipelines.kubeflow.org/cache_enabled: "false" +{{- end }} + +{{/* +Kubeflow Pipelines Cache container image settings. +*/}} +{{- define "kubeflow.pipelines.cache.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.cache.image +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.cache.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines Cache Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.cache.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.cache.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.cache.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.cache.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.cache.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.cache.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.cache.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.cache.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Cache Security Context. +*/}} +{{- define "kubeflow.pipelines.cache.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.cache.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Cache Scheduling. +*/}} +{{- define "kubeflow.pipelines.cache.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.cache.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.cache.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.cache.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.cache.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Cache enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.cache.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.cache.enabled +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.cache.enabled" . | eq "true") + .Values.pipelines.cache.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.createServiceAccount" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.cache.enabled" . | eq "true") + .Values.pipelines.cache.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.enabledWithCertManager" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.cache.enabled" . | eq "true" ) + (include "kubeflow.certManagerIntegration.enabled" . | eq "true" ) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.cache.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.cache.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataEnvoy.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataEnvoy.tpl new file mode 100644 index 00000000..34ed877b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataEnvoy.tpl @@ -0,0 +1,197 @@ +{{/* +Kubeflow Pipelines Metadata Envoy object names. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.baseName" -}} +{{- printf "ml-pipeline-metadata-envoy" }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.metadataEnvoy.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.metadataEnvoy.name" .) + .Values.pipelines.metadataEnvoy.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.roleName" -}} +{{- include "kubeflow.pipelines.metadataEnvoy.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.roleBindingName" -}} +{{- include "kubeflow.pipelines.metadataEnvoy.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Envoy Service. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.metadataEnvoy.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.metadataEnvoy.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Envoy object labels. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.metadataEnvoy.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.metadataEnvoy.name" .) }} +{{- end }} + + +{{/* +Kubeflow Pipelines Metadata Envoy container image settings. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.metadataEnvoy.image +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.metadataEnvoy.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines Metadata Envoy Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.metadataEnvoy.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.metadataEnvoy.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.metadataEnvoy.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.metadataEnvoy.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.metadataEnvoy.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.metadataEnvoy.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Envoy Security Context. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.metadataEnvoy.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Envoy Scheduling. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.metadataEnvoy.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.metadataEnvoy.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.metadataEnvoy.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataEnvoy.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.metadataEnvoy.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Envoy enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.enabled" -}} +{{- and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.metadataEnvoy.enabled +}} +{{- end }} + +{{/* +NOTE: Currently metadata-envoy doesn't define any rbac. +Let's be consistent and define functions around Service Account and RBAC. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.rbac.createRoles" -}} +{{- and + (include "kubeflow.pipelines.metadataEnvoy.enabled" . | eq "true") + (((default (dict "create" false) .Values.pipelines.metadataEnvoy.rbac).create)) + .Values.pipelines.metadataEnvoy.rbac.create }} +{{- end }} + +{{/* +NOTE: metadata-envoy doesn't define ServiceAccount. +Let's be consistent and define functions around Service Account and RBAC. + +TODO: creation of service account shouldn't depend on if rbac is created. +People might want to define their own RBAC. +*/}} +{{- define "kubeflow.pipelines.metadataEnvoy.createServiceAccount" -}} +{{- and + (include "kubeflow.pipelines.metadataEnvoy.enabled" . | eq "true") + .Values.pipelines.metadataEnvoy.serviceAccount.create +}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.config.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.config.tpl new file mode 100644 index 00000000..ce8449e1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.config.tpl @@ -0,0 +1,76 @@ +{{/* +Kubeflow Pipelines Metadata GRPC Server config. +*/}} + +{{/* +Environment names. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.user.env.name" -}} +{{- "DBCONFIG_USER" }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.password.env.name" -}} +{{- "DBCONFIG_PASSWORD" }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.host.env.name" -}} +{{- "DBCONFIG_HOST" }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.port.env.name" -}} +{{- "DBCONFIG_PORT" }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.mlmdDatabaseName.env.name" -}} +{{- "DBCONFIG_MLMD_DB_NAME" }} +{{- end }} + + +{{/* +Environment Entries parametrization with plaintext value +or through Secrets. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.user.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.metadataGrpcServer.config.db.user.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.user +) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.password.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.metadataGrpcServer.config.db.password.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.password +) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.metadataGrpcServer.config.db.host.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.host +) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.port.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.metadataGrpcServer.config.db.port.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.port +) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.config.db.mlmdDatabaseName.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.metadataGrpcServer.config.db.mlmdDatabaseName.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.mlmdDatabaseName +) }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.tpl new file mode 100644 index 00000000..067db59d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataGrpcServer.tpl @@ -0,0 +1,209 @@ +{{/* +Kubeflow Pipelines Metadata GRPC Server object names. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.baseName" -}} +{{- printf "ml-pipeline-metadata-grpc-server" }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.metadataGrpcServer.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.metadataGrpcServer.name" .) + .Values.pipelines.metadataGrpcServer.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.roleName" -}} +{{- include "kubeflow.pipelines.metadataGrpcServer.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.roleBindingName" -}} +{{- include "kubeflow.pipelines.metadataGrpcServer.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata GRPC Server Service. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.metadataGrpcServer.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.metadataGrpcServer.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.metadataGrpcServer.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.metadataGrpcServer.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata GRPC Server object labels. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.metadataGrpcServer.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.metadataGrpcServer.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata GRPC Server container image settings. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.metadataGrpcServer.image +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.metadataGrpcServer.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines Metadata GRPC Server Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.metadataGrpcServer.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.metadataGrpcServer.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.metadataGrpcServer.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.metadataGrpcServer.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.metadataGrpcServer.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.metadataGrpcServer.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata GRPC Server Security Context. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.metadataGrpcServer.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata GRPC Server Scheduling. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.metadataGrpcServer.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.metadataGrpcServer.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.metadataGrpcServer.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.metadataGrpcServer.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata GRPC Server enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.metadataGrpcServer.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.metadataGrpcServer.enabled +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.rbac.createRoles" -}} +{{- and + (include "kubeflow.pipelines.metadataGrpcServer.enabled" . | eq "true") + .Values.pipelines.metadataGrpcServer.rbac.create }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.createServiceAccount" -}} +{{- and + (include "kubeflow.pipelines.metadataGrpcServer.enabled" . | eq "true") + .Values.pipelines.metadataGrpcServer.serviceAccount.create +}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataGrpcServer.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.metadataGrpcServer.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataWriter.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataWriter.tpl new file mode 100644 index 00000000..7185d771 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.metadataWriter.tpl @@ -0,0 +1,204 @@ +{{/* +Kubeflow Pipelines Metadata Writer object names. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.baseName" -}} +{{- printf "ml-pipeline-metadata-writer" }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.metadataWriter.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.metadataWriter.name" .) + .Values.pipelines.metadataWriter.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.roleName" -}} +{{- include "kubeflow.pipelines.metadataWriter.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.roleBindingName" -}} +{{- include "kubeflow.pipelines.metadataWriter.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Writer Service. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.metadataWriter.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.metadataWriter.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.metadataWriter.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.metadataWriter.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Writer object labels. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.metadataWriter.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.metadataWriter.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Writer container image settings. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.metadataWriter.image +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.metadataWriter.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines Metadata Writer Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.metadataWriter.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.metadataWriter.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.metadataWriter.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.metadataWriter.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.metadataWriter.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.metadataWriter.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Writer Security Context. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.metadataWriter.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Writer Scheduling. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.metadataWriter.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.metadataWriter.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.metadataWriter.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.metadataWriter.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Metadata Writer enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.metadataWriter.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.metadataWriter.enabled +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.metadataWriter.enabled" . | eq "true") + .Values.pipelines.metadataWriter.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.metadataWriter.createServiceAccount" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.metadataWriter.enabled" . | eq "true") + .Values.pipelines.metadataWriter.serviceAccount.create +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.config.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.config.tpl new file mode 100644 index 00000000..ae1fb959 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.config.tpl @@ -0,0 +1,243 @@ +{{/* +Kubeflow Pipelines ML Pipeline (api-server) config. +*/}} + +{{/* +NOTE/TODO: KFP 2.0.2 supports postresql. This needs to be handled. +https://github.com/kubeflow/pipelines/blob/2.0.2/backend/src/apiserver/client_manager/client_manager.go#L47 + +relic variables +https://github.com/kubeflow/pipelines/blob/2.0.2/manifests/kustomize/base/pipeline/ml-pipeline-apiserver-deployment.yaml#L36 + +mysql config +https://github.com/kubeflow/pipelines/blob/2.0.2/manifests/kustomize/base/pipeline/ml-pipeline-apiserver-deployment.yaml#L73 + +DBConfig.MySQLConfig.Host == DBCONFIG_MYSQLCONFIG_HOST +DBConfig.PostgreSQLConfig.Host == DBCONFIG_POSTGRESQLCONFIG_HOST +*/}} + +{{/* +Environment names for database config. +*/}} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L46 +{{- define "kubeflow.pipelines.mlPipeline.config.db.user.env.name" -}} +{{- "DBCONFIG_MYSQLCONFIG_USER" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L47 +{{- define "kubeflow.pipelines.mlPipeline.config.db.password.env.name" -}} +{{- "DBCONFIG_MYSQLCONFIG_PASSWORD" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L44 +{{- define "kubeflow.pipelines.mlPipeline.config.db.host.env.name" -}} +{{- "DBCONFIG_MYSQLCONFIG_HOST" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L45 +{{- define "kubeflow.pipelines.mlPipeline.config.db.port.env.name" -}} +{{- "DBCONFIG_MYSQLCONFIG_PORT" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L48 +{{- define "kubeflow.pipelines.mlPipeline.config.db.pipelineDatabaseName.env.name" -}} +{{- "DBCONFIG_MYSQLCONFIG_DBNAME" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L53 +{{- define "kubeflow.pipelines.mlPipeline.config.db.conMaxLifetime.env.name" -}} +{{- "DBCONFIG_CONMAXLIFETIME" }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.driver.env.name" -}} +{{- "DB_DRIVER_NAME" }} +{{- end }} + +{{/* +Environment names for object store config. +*/}} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L408 +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.secure.env.name" -}} +{{- "OBJECTSTORECONFIG_SECURE" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L411 +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.bucketName.env.name" -}} +{{- "OBJECTSTORECONFIG_BUCKETNAME" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L402 +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.host.env.name" -}} +{{- "OBJECTSTORECONFIG_HOST" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L409 +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.accessKey.env.name" -}} +{{- "OBJECTSTORECONFIG_ACCESSKEY" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L410 +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.secretAccessKey.env.name" -}} +{{- "OBJECTSTORECONFIG_SECRETACCESSKEY" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L403 +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.port.env.name" -}} +{{- "OBJECTSTORECONFIG_PORT" }} +{{- end }} + +# This env name is currently hardcoded: +# https://github.com/kubeflow/pipelines/blob/63ca91850a9f42a357f3417110a3011ddbf43290/backend/src/apiserver/client_manager.go#L405 +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.region.env.name" -}} +{{- "OBJECTSTORECONFIG_REGION" }} +{{- end }} + +{{/* +Environment Entries parametrization for database configuration with plaintext +value or through Secrets. +*/}} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.user.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.db.user.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.user +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.password.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.db.password.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.password +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.db.host.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.host +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.port.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.db.port.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.port +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.pipelineDatabaseName.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.db.pipelineDatabaseName.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.pipelineDatabaseName +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.conMaxLifetime.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.db.conMaxLifetime.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.conMaxLifetime +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.db.driver.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.db.driver.env.name" . ) + .Values.pipelines.config.db.existingSecretName + .Values.pipelines.config.db.driver +) }} +{{- end }} + +{{/* +Environment Entries parametrization for object store config with plaintext value +or through Secrets. +*/}} + +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.secure.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.objectStore.secure.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.secure +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.bucketName.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.objectStore.bucketName.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.bucketName +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.objectStore.host.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.host +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.accessKey.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.objectStore.accessKey.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.accessKey +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.secretAccessKey.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.objectStore.secretAccessKey.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.secretAccessKey +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.port.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.objectStore.port.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.port +) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.config.objectStore.region.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.mlPipeline.config.objectStore.region.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.region +) }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.tpl new file mode 100644 index 00000000..01c46265 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.mlPipeline.tpl @@ -0,0 +1,220 @@ +{{/* +Kubeflow Pipelines ML Pipeline (api-server) object names. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.baseName" -}} +{{- printf "ml-pipeline" }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.mlPipeline.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.mlPipeline.name" .) + .Values.pipelines.mlPipeline.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.pipelines.mlPipeline.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.roleName" -}} +{{- include "kubeflow.pipelines.mlPipeline.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.roleBindingName" -}} +{{- include "kubeflow.pipelines.mlPipeline.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Service. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.mlPipeline.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.mlPipeline.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.mlPipeline.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.mlPipeline.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline object labels. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.mlPipeline.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.mlPipeline.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline container image settings. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.mlPipeline.image +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.mlPipeline.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines ML Pipeline Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.mlPipeline.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.mlPipeline.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.mlPipeline.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.mlPipeline.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.mlPipeline.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.mlPipeline.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Security Context. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.mlPipeline.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Scheduling. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.mlPipeline.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.mlPipeline.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.mlPipeline.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.mlPipeline.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.mlPipeline.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.mlPipeline.enabled +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.mlPipeline.enabled" . | eq "true") + .Values.pipelines.mlPipeline.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.createServiceAccount" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.mlPipeline.enabled" . | eq "true") + .Values.pipelines.mlPipeline.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.mlPipeline.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.mlPipeline.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.persistenceAgent.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.persistenceAgent.tpl new file mode 100644 index 00000000..8cabf331 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.persistenceAgent.tpl @@ -0,0 +1,208 @@ +{{/* +Kubeflow Pipelines Persistence Agent object names. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.baseName" -}} +{{- printf "ml-pipeline-persistenceagent" }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.persistenceAgent.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.persistenceAgent.name" .) + .Values.pipelines.persistenceAgent.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.pipelines.persistenceAgent.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.roleName" -}} +{{- include "kubeflow.pipelines.persistenceAgent.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.roleBindingName" -}} +{{- include "kubeflow.pipelines.persistenceAgent.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines Persistence Agent Service. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.persistenceAgent.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.persistenceAgent.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.persistenceAgent.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.persistenceAgent.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Persistence Agent object labels. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.persistenceAgent.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.persistenceAgent.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines Persistence Agent container image settings. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.persistenceAgent.image +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.persistenceAgent.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines Persistence Agent Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.persistenceAgent.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.persistenceAgent.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.persistenceAgent.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.persistenceAgent.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.persistenceAgent.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.persistenceAgent.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Persistence Agent Security Context. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.persistenceAgent.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Persistence Agent Scheduling. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.persistenceAgent.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.persistenceAgent.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.persistenceAgent.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.persistenceAgent.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Persistence Agent enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.persistenceAgent.enabled" -}} +{{- and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.persistenceAgent.enabled +}} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.rbac.createRoles" -}} +{{- and + (include "kubeflow.pipelines.persistenceAgent.enabled" . | eq "true") + .Values.pipelines.persistenceAgent.rbac.create }} +{{- end }} + +{{- define "kubeflow.pipelines.persistenceAgent.createServiceAccount" -}} +{{- and + (include "kubeflow.pipelines.persistenceAgent.enabled" . | eq "true") + .Values.pipelines.persistenceAgent.serviceAccount.create +}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.config.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.config.tpl new file mode 100644 index 00000000..e32e67db --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.config.tpl @@ -0,0 +1,51 @@ +{{/* +Kubeflow Pipelines Profile Controller config. +*/}} + +{{/* +Environment names for object store config. +*/}} + +{{- define "kubeflow.pipelines.profileController.config.objectStore.host.env.name" -}} +{{- "MINIO_HOST" }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.config.objectStore.accessKey.env.name" -}} +{{- "MINIO_ACCESS_KEY" }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.config.objectStore.secretAccessKey.env.name" -}} +{{- "MINIO_SECRET_KEY" }} +{{- end }} + +{{/* +Environment Entries parametrization for object store configuration with plaintext +value or through Secrets. +*/}} + +{{- define "kubeflow.pipelines.profileController.config.objectStore.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.profileController.config.objectStore.host.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.host +) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.config.objectStore.accessKey.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.profileController.config.objectStore.accessKey.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.accessKey +) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.config.objectStore.secretAccessKey.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.profileController.config.objectStore.secretAccessKey.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.secretAccessKey +) }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.tpl new file mode 100644 index 00000000..952cace6 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.profileController.tpl @@ -0,0 +1,227 @@ +{{/* +Kubeflow Pipelines Profile Controller object names. +*/}} +{{- define "kubeflow.pipelines.profileController.baseName" -}} +{{- printf "ml-pipeline-profile-controller" }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.profileController.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.profileController.name" .) + .Values.pipelines.profileController.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.pipelines.profileController.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.roleName" -}} +{{- include "kubeflow.pipelines.profileController.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.roleBindingName" -}} +{{- include "kubeflow.pipelines.profileController.roleName" . }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.configMapName" -}} +{{- printf "%s-%s" + (include "kubeflow.pipelines.profileController.name" .) + "sync" +}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Service. +*/}} +{{- define "kubeflow.pipelines.profileController.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.profileController.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.profileController.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.profileController.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.profileController.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline object labels. +*/}} +{{- define "kubeflow.pipelines.profileController.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.profileController.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.profileController.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline container image settings. +*/}} +{{- define "kubeflow.pipelines.profileController.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.profileController.image +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.profileController.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines ML Pipeline Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.profileController.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.profileController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.profileController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.profileController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.profileController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.profileController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.profileController.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Security Context. +*/}} +{{- define "kubeflow.pipelines.profileController.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.profileController.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Scheduling. +*/}} +{{- define "kubeflow.pipelines.profileController.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.profileController.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.profileController.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.profileController.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.profileController.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.profileController.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.profileController.enabled +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.profileController.enabled" . | eq "true") + .Values.pipelines.profileController.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.createServiceAccount" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.profileController.enabled" . | eq "true") + .Values.pipelines.profileController.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.profileController.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.profileController.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.scheduledWorkflow.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.scheduledWorkflow.tpl new file mode 100644 index 00000000..7fcad61e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.scheduledWorkflow.tpl @@ -0,0 +1,209 @@ +{{/* +Kubeflow Pipelines Scheduled Workflow object names. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.baseName" -}} +{{- printf "ml-pipeline-scheduledworkflow" }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.scheduledWorkflow.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.scheduledWorkflow.name" .) + .Values.pipelines.scheduledWorkflow.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.pipelines.scheduledWorkflow.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.roleName" -}} +{{- include "kubeflow.pipelines.scheduledWorkflow.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.roleBindingName" -}} +{{- include "kubeflow.pipelines.scheduledWorkflow.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines Scheduled Workflow Service. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.scheduledWorkflow.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.scheduledWorkflow.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.scheduledWorkflow.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.scheduledWorkflow.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Scheduled Workflow object labels. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.scheduledWorkflow.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.scheduledWorkflow.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines Scheduled Workflow container image settings. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.scheduledWorkflow.image +)}} + +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.scheduledWorkflow.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines Scheduled Workflow Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.scheduledWorkflow.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.scheduledWorkflow.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.scheduledWorkflow.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.scheduledWorkflow.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.scheduledWorkflow.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.scheduledWorkflow.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Scheduled Workflow Security Context. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.scheduledWorkflow.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Scheduled Workflow Scheduling. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.scheduledWorkflow.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.scheduledWorkflow.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.scheduledWorkflow.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.scheduledWorkflow.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Scheduled Workflow enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.scheduledWorkflow.enabled" -}} +{{- and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.scheduledWorkflow.enabled +}} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.rbac.createRoles" -}} +{{- and + (include "kubeflow.pipelines.scheduledWorkflow.enabled" . | eq "true") + .Values.pipelines.scheduledWorkflow.rbac.create }} +{{- end }} + +{{- define "kubeflow.pipelines.scheduledWorkflow.createServiceAccount" -}} +{{- and + (include "kubeflow.pipelines.scheduledWorkflow.enabled" . | eq "true") + .Values.pipelines.scheduledWorkflow.serviceAccount.create +}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.tpl new file mode 100644 index 00000000..b3218d9a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.tpl @@ -0,0 +1,150 @@ +{{/* +Kubeflow Pipelines object names. +*/}} +{{- define "kubeflow.pipelines.baseName" -}} +{{- printf "pipelines" }} +{{- end }} + +{{- define "kubeflow.pipelines.baseRbacName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.pipelines.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.rbac.cacheDeployer.serviceAccountName" -}} +{{- $saName := printf "%s-%s" (include "kubeflow.pipelines.baseRbacName" .) "cache-deployer" -}} +{{- include "kubeflow.component.serviceAccountName" (list $saName .Values.pipelines.serviceAccount) }} +{{- end }} + +{{- define "kubeflow.pipelines.rbac.cacheDeployer.clusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.pipelines.baseRbacName" .) "cache-deployer" }} +{{- end }} + +{{- define "kubeflow.pipelines.rbac.cacheDeployer.clusterRoleBindingName" -}} +{{- include "kubeflow.pipelines.rbac.cacheDeployer.clusterRoleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines object labels. +*/}} +{{- define "kubeflow.pipelines.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines container image settings. +*/}} + +{{- define "kubeflow.pipelines.image" -}} +{{- $default := index . 0 -}} +{{- $pipelinesDefault := index . 1 -}} +{{- $component := index . 2 -}} +{{- $registry := default $default.registry (default $pipelinesDefault.registry $component.registryOverwrite) -}} +{{- $repository := $component.repository -}} +{{- $tag := default $pipelinesDefault.tag $component.tagOverwrite -}} +{{- printf "%s/%s:%s" $registry $repository $tag }} +{{- end }} + +{{- define "kubeflow.pipelines.imagePullPolicy" -}} +{{- $default := index . 0 -}} +{{- $pipelinesDefault := index . 1 -}} +{{- $component := index . 2 -}} +{{- $imagePullPolicy := default $default.pullPolicy (default $pipelinesDefault.pullPolicy $component.pullPolicyOverwrite) -}} +{{- $imagePullPolicy }} +{{- end }} + +{{/* +Kubeflow Pipelines Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Security Context. +*/}} +{{- define "kubeflow.pipelines.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Scheduling. +*/}} +{{- define "kubeflow.pipelines.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.enabled" -}} +{{- ternary true "" .Values.pipelines.enabled }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.config.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.config.tpl new file mode 100644 index 00000000..cb4c8c35 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.config.tpl @@ -0,0 +1,51 @@ +{{/* +Kubeflow Pipelines UI config. +*/}} + +{{/* +Environment names for object store config. +*/}} + +{{- define "kubeflow.pipelines.ui.config.objectStore.host.env.name" -}} +{{- "MINIO_HOST" }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.config.objectStore.accessKey.env.name" -}} +{{- "MINIO_ACCESS_KEY" }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.config.objectStore.secretAccessKey.env.name" -}} +{{- "MINIO_SECRET_KEY" }} +{{- end }} + +{{/* +Environment Entries parametrization for object store configuration with plaintext +value or through Secrets. +*/}} + +{{- define "kubeflow.pipelines.ui.config.objectStore.host.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.ui.config.objectStore.host.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.host +) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.config.objectStore.accessKey.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.ui.config.objectStore.accessKey.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.accessKey +) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.config.objectStore.secretAccessKey.env.spec" -}} +{{- include "kubeflow.component.env.spec" ( + list + (include "kubeflow.pipelines.ui.config.objectStore.secretAccessKey.env.name" . ) + .Values.pipelines.config.objectStore.existingSecretName + .Values.pipelines.config.objectStore.secretAccessKey +) }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.tpl new file mode 100644 index 00000000..3dda1b1e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.ui.tpl @@ -0,0 +1,233 @@ +{{/* +Kubeflow Pipelines UI (aka ml-pipeline-ui) object names. +*/}} +{{- define "kubeflow.pipelines.ui.baseName" -}} +{{- printf "ml-pipeline-ui" }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.ui.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.ui.name" .) + .Values.pipelines.ui.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.pipelines.ui.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.configMapName" -}} +{{- include "kubeflow.pipelines.ui.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.roleName" -}} +{{- include "kubeflow.pipelines.ui.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.roleBindingName" -}} +{{- include "kubeflow.pipelines.ui.roleName" . }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.authorizationPolicyExtAuthName" -}} +{{ include "kubeflow.component.authorizationPolicyExtAuthName" ( + list + (include "kubeflow.pipelines.ui.name" .) + .Values.istioIntegration +)}} +{{- end }} + +{{/* +Kubeflow Pipelines UI Service. +*/}} +{{- define "kubeflow.pipelines.ui.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.ui.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.ui.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.ui.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.ui.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines UI object labels. +*/}} +{{- define "kubeflow.pipelines.ui.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.ui.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.ui.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines UI container image settings. +*/}} +{{- define "kubeflow.pipelines.ui.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.ui.image +)}} + +{{- end }} + +{{- define "kubeflow.pipelines.ui.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.ui.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines UI Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.ui.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.ui.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.ui.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.ui.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.ui.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.ui.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.ui.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.ui.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines UI Security Context. +*/}} +{{- define "kubeflow.pipelines.ui.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.ui.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines UI Scheduling. +*/}} +{{- define "kubeflow.pipelines.ui.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.ui.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.ui.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.ui.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.ui.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines UI enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.ui.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.ui.enabled +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.ui.enabled" . | eq "true") + .Values.pipelines.ui.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.createServiceAccount" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.ui.enabled" . | eq "true") + .Values.pipelines.ui.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.ui.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.ui.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.viewerCrd.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.viewerCrd.tpl new file mode 100644 index 00000000..59fb4d63 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.viewerCrd.tpl @@ -0,0 +1,209 @@ +{{/* +Kubeflow Pipelines ML Pipeline object names. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.baseName" -}} +{{- printf "ml-pipeline-viewer-crd" }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.viewerCrd.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.viewerCrd.name" .) + .Values.pipelines.viewerCrd.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.serviceAccountPrincipal" -}} +{{- include "kubeflow.component.serviceAccountPrincipal" ( + list + . + (include "kubeflow.pipelines.viewerCrd.serviceAccountName" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.roleName" -}} +{{- include "kubeflow.pipelines.viewerCrd.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.roleBindingName" -}} +{{- include "kubeflow.pipelines.viewerCrd.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Service. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.viewerCrd.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.viewerCrd.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.viewerCrd.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.viewerCrd.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline object labels. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.viewerCrd.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.viewerCrd.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline container image settings. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.viewerCrd.image +)}} + +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.viewerCrd.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines ML Pipeline Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.viewerCrd.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.viewerCrd.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.viewerCrd.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.viewerCrd.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.viewerCrd.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.viewerCrd.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Security Context. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.viewerCrd.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline Scheduling. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.viewerCrd.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.viewerCrd.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.viewerCrd.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.viewerCrd.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines ML Pipeline enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.viewerCrd.enabled" -}} +{{- and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.viewerCrd.enabled +}} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.rbac.createRoles" -}} +{{- and + (include "kubeflow.pipelines.viewerCrd.enabled" . | eq "true") + .Values.pipelines.viewerCrd.rbac.create }} +{{- end }} + +{{- define "kubeflow.pipelines.viewerCrd.createServiceAccount" -}} +{{- and + (include "kubeflow.pipelines.viewerCrd.enabled" . | eq "true") + .Values.pipelines.viewerCrd.serviceAccount.create +}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.visualization.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.visualization.tpl new file mode 100644 index 00000000..e40b4663 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.pipelines.visualization.tpl @@ -0,0 +1,213 @@ +{{/* +Kubeflow Pipelines Visualization object names. +*/}} +{{- define "kubeflow.pipelines.visualization.baseName" -}} +{{- printf "ml-pipeline-visualizationserver" }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.pipelines.visualization.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.pipelines.visualization.name" .) + .Values.pipelines.visualization.serviceAccount) +}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.roleName" -}} +{{- include "kubeflow.pipelines.visualization.name" . }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.roleBindingName" -}} +{{- include "kubeflow.pipelines.visualization.roleName" . }} +{{- end }} + +{{/* +Kubeflow Pipelines Visualization Service. +*/}} +{{- define "kubeflow.pipelines.visualization.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.pipelines.visualization.name" . +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.pipelines.visualization.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.pipelines.visualization.name" .) +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.pipelines.visualization.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Visualization object labels. +*/}} +{{- define "kubeflow.pipelines.visualization.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.visualization.name" .) }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.pipelines.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.pipelines.visualization.name" .) }} +{{- end }} + +{{/* +Kubeflow Pipelines Visualization container image settings. +*/}} +{{- define "kubeflow.pipelines.visualization.image" -}} +{{- include "kubeflow.pipelines.image" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.visualization.image +)}} + +{{- end }} + +{{- define "kubeflow.pipelines.visualization.imagePullPolicy" -}} +{{- include "kubeflow.pipelines.imagePullPolicy" ( + list + .Values.defaults.image + .Values.pipelines.defaults.image + .Values.pipelines.visualization.image +)}} +{{- end }} + + +{{/* +Kubeflow Pipelines Visualization Autoscaling and Availability. +*/}} +{{- define "kubeflow.pipelines.visualization.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.pipelines.visualization.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.pipelines.visualization.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.pipelines.visualization.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.visualization.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.pipelines.visualization.autoscaling) }} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.pipelines.visualization.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Visualization Security Context. +*/}} +{{- define "kubeflow.pipelines.visualization.containerSecurityContext" -}} +{{- include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.pipelines.visualization.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Visualization Scheduling. +*/}} +{{- define "kubeflow.pipelines.visualization.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.pipelines.visualization.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.pipelines.visualization.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.pipelines.visualization.tolerations +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.pipelines.visualization.affinity +)}} +{{- end }} + +{{/* +Kubeflow Pipelines Visualization enable and create toggles. +*/}} +{{- define "kubeflow.pipelines.visualization.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.enabled" . | eq "true") + .Values.pipelines.visualization.enabled +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.visualization.enabled" . | eq "true") + .Values.pipelines.visualization.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.createServiceAccount" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.visualization.enabled" . | eq "true") + .Values.pipelines.visualization.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.pipelines.visualization.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.pipelines.visualization.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.profilesController.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.profilesController.tpl new file mode 100644 index 00000000..1e317202 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.profilesController.tpl @@ -0,0 +1,205 @@ +{{/* +Kubeflow Profiles Controller object names. +TODO: define profilesController.manager, standardize kubeflow.component.name template (and maybe others) to include ctx either as always first or always last. +*/}} +{{- define "kubeflow.profilesController.baseName" -}} +{{- printf "profiles-controller" }} +{{- end }} + +{{- define "kubeflow.profilesController.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.profilesController.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.profilesController.kfam.name" -}} +{{- printf "%s-%s" + (include "kubeflow.profilesController.name" .) + "kfam" +}} +{{- end }} + + +{{- define "kubeflow.profilesController.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.profilesController.name" .) + .Values.profilesController.serviceAccount +)}} +{{- end }} + +{{/* +'cluster-admin' role should not be used... +This is the default in kubeflow/manifests and kubeflow/kubeflow. +TODO: use proper cluster role dedicated to profiles-controller. +*/}} +{{- define "kubeflow.profilesController.mainClusterRoleName" -}} +{{- printf "cluster-admin" -}} +{{- end }} + + +{{- define "kubeflow.profilesController.mainClusterRoleBindingName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.profilesController.name" .) +}} +{{- end }} + +{{- define "kubeflow.profilesController.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.profilesController.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.profilesController.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.profilesController.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.profilesController.namespaceLabelsConfigMapName" -}} +{{- printf "%s-%s" + (include "kubeflow.profilesController.name" .) + "namespace-labels" +}} +{{- end }} + +# --- +{{/* +Kubeflow Profiles Controller Service. +*/}} +{{- define "kubeflow.profilesController.kfam.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.profilesController.kfam.name" . +)}} +{{- end }} + +{{- define "kubeflow.profilesController.kfam.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.profilesController.kfam.name" .) +)}} +{{- end }} + +{{- define "kubeflow.profilesController.kfam.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.profilesController.kfam.name" .) +)}} +{{- end }} + +{{- define "kubeflow.profilesController.kfam.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.profilesController.kfam.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Profiles Controller object labels. +*/}} +{{- define "kubeflow.profilesController.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.profilesController.name" .) }} +{{- end }} + +{{- define "kubeflow.profilesController.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.profilesController.name" .) }} +{{- end }} + +{{/* +Kubeflow Profiles Controller container image settings. +*/}} +{{- define "kubeflow.profilesController.manager.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.profilesController.manager.image) }} +{{- end }} + +{{- define "kubeflow.profilesController.kfam.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.profilesController.kfam.image) }} +{{- end }} + +{{- define "kubeflow.profilesController.manager.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.profilesController.manager.image) }} +{{- end }} + +{{- define "kubeflow.profilesController.kfam.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.profilesController.kfam.image) }} +{{- end }} + +{{/* +Kubeflow Profiles Controller Autoscaling and Availability. +*/}} +{{- define "kubeflow.profilesController.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.profilesController.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.profilesController.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.profilesController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.profilesController.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.profilesController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.profilesController.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.profilesController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.profilesController.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.profilesController.autoscaling) }} +{{- end }} + +{{- define "kubeflow.profilesController.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.profilesController.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Profiles Controller enable and create toggles. +*/}} +{{- define "kubeflow.profilesController.enabled" -}} +{{- .Values.profilesController.enabled }} +{{- end }} + +{{- define "kubeflow.profilesController.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + (include "kubeflow.profilesController.enabled" . | eq "true" ) + .Values.istioIntegration.enabled +)}} +{{- end }} + +{{- define "kubeflow.profilesController.rbac.createRoles" -}} +{{- and + (include "kubeflow.profilesController.enabled" . | eq "true") + .Values.profilesController.rbac.create }} +{{- end }} + +{{- define "kubeflow.profilesController.createServiceAccount" -}} +{{- and + (include "kubeflow.profilesController.enabled" . | eq "true") + .Values.profilesController.serviceAccount.create +}} +{{- end }} + +{{- define "kubeflow.profilesController.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.profilesController.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.profilesController.podDisruptionBudget +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.controller.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.controller.tpl new file mode 100644 index 00000000..d85efb99 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.controller.tpl @@ -0,0 +1,314 @@ +{{/* +Kubeflow Tensorboard Controller object names. +*/}} +{{- define "kubeflow.tensorboard.controller.baseName" -}} +{{- printf "tensorboard-controller" }} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.tensorboard.controller.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.manager.name" -}} +{{- printf "%s-%s" + (include "kubeflow.tensorboard.controller.name" .) + "manager" +}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.kubeRbacProxy.name" -}} +{{- printf "%s-%s" + (include "kubeflow.tensorboard.controller.name" .) + "kube-rbac-proxy" +}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.tensorboard.controller.name" .) + .Values.tensorboard.controller.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.tensorboard.controller.name" .) +}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.mainClusterRoleBindingName" -}} +{{- include "kubeflow.tensorboard.controller.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.leaderElectionRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.tensorboard.controller.name" .) + "leader-election" +}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.leaderElectionRoleBindingName" -}} +{{- include "kubeflow.tensorboard.controller.leaderElectionRoleName" . }} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.metricsReaderClusterRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.tensorboard.controller.name" .) + "metrics-reader" +}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.metricsReaderClusterRoleBindingName" -}} +{{- include "kubeflow.tensorboard.controller.metricsReaderClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.proxyClusterRoleName" -}} +{{- printf "%s-%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.tensorboard.controller.name" .) + "proxy" +}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.proxyClusterRoleBindingName" -}} +{{- include "kubeflow.tensorboard.controller.proxyClusterRoleName" . }} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller Manager Metrics Service. +*/}} + +{{- define "kubeflow.tensorboard.controller.metricsService.svc.name" -}} +{{- printf "%s-%s" + ( include "kubeflow.component.svc.name" ( + include "kubeflow.tensorboard.controller.name" . + )) + "controller-manager-metrics-service" +}} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller object labels. +*/}} +{{- define "kubeflow.tensorboard.controller.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.tensorboard.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.tensorboard.controller.name" .) }} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.tensorboard.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.tensorboard.controller.name" .) }} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller Manager container image settings. +*/}} +{{- define "kubeflow.tensorboard.controller.manager.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.tensorboard.controller.manager.image +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.manager.tensorboardImage" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.tensorboard.controller.manager.config.tensorboard.image +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.manager.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.tensorboard.controller.manager.image +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller Kube RBAC Proxy container image settings. +*/}} +{{- define "kubeflow.tensorboard.controller.kubeRbacProxy.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.tensorboard.controller.kubeRbacProxy.image +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.kubeRbacProxy.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.tensorboard.controller.kubeRbacProxy.image +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller Autoscaling and Availability. +*/}} +{{- define "kubeflow.tensorboard.controller.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.tensorboard.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.tensorboard.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.tensorboard.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.tensorboard.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.tensorboard.controller.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller Security Context. +*/}} +{{- define "kubeflow.tensorboard.controller.manager.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.tensorboard.controller.manager.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.kubeRbacProxy.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.tensorboard.controller.kubeRbacProxy.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.securityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.tensorboard.controller.securityContext +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller Scheduling. +*/}} +{{- define "kubeflow.tensorboard.controller.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.tensorboard.controller.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.nodeSelector" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.nodeSelector + .Values.tensorboard.controller.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.tensorboard.controller.tolerations +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.tensorboard.controller.affinity +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.terminationGracePeriodSeconds" -}} +{{ include "kubeflow.component.terminationGracePeriodSeconds" ( + list + .Values.defaults.terminationGracePeriodSeconds + .Values.tensorboard.controller.terminationGracePeriodSeconds +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Controller enable and create toggles. +*/}} +{{- define "kubeflow.tensorboard.controller.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.tensorboard.enabled" . | eq "true") + .Values.tensorboard.controller.enabled +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.tensorboard.controller.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.tensorboard.controller.enabled" . | eq "true") + .Values.tensorboard.controller.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.tensorboard.controller.enabled" . | eq "true") + .Values.tensorboard.controller.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.controller.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.tensorboard.controller.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.tensorboard.controller.podDisruptionBudget +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tensorboardsWebApp.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tensorboardsWebApp.tpl new file mode 100644 index 00000000..482aef7d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tensorboardsWebApp.tpl @@ -0,0 +1,220 @@ +{{/* +Kubeflow Tensorboard Tensorboards Web App object names. +*/}} +{{- define "kubeflow.tensorboard.tensorboardsWebApp.baseName" -}} +{{- printf "tensorboards-web-app" }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.tensorboard.tensorboardsWebApp.baseName" .) + . +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Tensorboards Web App object labels. +*/}} +{{- define "kubeflow.tensorboard.tensorboardsWebApp.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.tensorboard.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.tensorboard.name" .) }} +{{ include "kubeflow.component.subcomponent.labels" (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.tensorboard.tensorboardsWebApp.image) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.tensorboard.tensorboardsWebApp.image) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.tensorboard.tensorboardsWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.tensorboard.tensorboardsWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.tensorboard.tensorboardsWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.tensorboard.tensorboardsWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.tensorboard.tensorboardsWebApp.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) +}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.mainClusterRoleBindingName" -}} +{{- include "kubeflow.tensorboard.tensorboardsWebApp.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.kfTenUiAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "tensorboards-ui-admin" }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.kfTenUiEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "tensorboards-ui-edit" }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.kfTenUiViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "tensorboards-ui-view" }} +{{- end }} + +{{/* +Kubeflow Tensorboard Tensorboards Web App enable and create toggles. +*/}} +{{- define "kubeflow.tensorboard.tensorboardsWebApp.enabled" -}} +{{- ternary true "" ( + and + (include "kubeflow.tensorboard.enabled" . | eq "true") + .Values.tensorboard.tensorboardsWebApp.enabled +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.createIstioIntegrationObjects" -}} +{{- ternary true "" ( + and + .Values.istioIntegration.enabled + (include "kubeflow.tensorboard.tensorboardsWebApp.enabled" . | eq "true" ) +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.tensorboard.tensorboardsWebApp.enabled" . | eq "true") + .Values.tensorboard.tensorboardsWebApp.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.tensorboard.tensorboardsWebApp.enabled" . | eq "true") + .Values.tensorboard.tensorboardsWebApp.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" (list (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) .Values.tensorboard.tensorboardsWebApp.serviceAccount) }} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.authorizationPolicyExtAuthName" -}} +{{ include "kubeflow.component.authorizationPolicyExtAuthName" ( + list + (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) + .Values.istioIntegration +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Tensorboards Web App Service. +*/}} +{{- define "kubeflow.tensorboard.tensorboardsWebApp.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.tensorboard.tensorboardsWebApp.name" . +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.svc.addressWithNs" -}} +{{ include "kubeflow.component.svc.addressWithNs" ( + list + . + (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.svc.addressWithSvc" -}} +{{ include "kubeflow.component.svc.addressWithSvc" ( + list + . + (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.svc.fqdn" -}} +{{ include "kubeflow.component.svc.fqdn" ( + list + . + (include "kubeflow.tensorboard.tensorboardsWebApp.name" .) +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Tensorboards Web App Security Context. +*/}} +{{- define "kubeflow.tensorboard.tensorboardsWebApp.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.tensorboard.tensorboardsWebApp.containerSecurityContext +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.tensorboard.tensorboardsWebApp.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.tensorboard.tensorboardsWebApp.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.tensorboard.tensorboardsWebApp.tolerations +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.tensorboard.tensorboardsWebApp.affinity +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.tensorboard.tensorboardsWebApp.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.tensorboard.tensorboardsWebApp.podDisruptionBudget +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tensorboardsWebApp.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.tensorboard.tensorboardsWebApp.podDisruptionBudget +)}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tpl new file mode 100644 index 00000000..a341569c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.tensorboard.tpl @@ -0,0 +1,126 @@ +{{/* +Kubeflow Tensorboard object names. +*/}} +{{- define "kubeflow.tensorboard.baseName" -}} +{{- printf "tensorboard" }} +{{- end }} + +{{- define "kubeflow.tensorboard.baseRbacName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) (include "kubeflow.tensorboard.name" .) }} +{{- end }} + +{{- define "kubeflow.tensorboard.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.tensorboard.baseName" .) + . +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard object labels. +*/}} +{{- define "kubeflow.tensorboard.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.tensorboard.name" .) }} +{{- end }} + +{{- define "kubeflow.tensorboard.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.tensorboard.name" .) }} +{{- end }} + +{{/* +Kubeflow Tensorboard container image settings. +*/}} +{{- define "kubeflow.tensorboard.image" -}} +{{ include "kubeflow.component.image" (list .Values.defaults.image .Values.tensorboard.image) }} +{{- end }} + +{{- define "kubeflow.tensorboard.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" (list .Values.defaults.image .Values.tensorboard.image) }} +{{- end }} + +{{/* +Kubeflow Tensorboard Autoscaling and Availability. +*/}} +{{- define "kubeflow.tensorboard.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" (list .Values.defaults.autoscaling .Values.tensorboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" (list .Values.defaults.autoscaling .Values.tensorboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" (list .Values.defaults.autoscaling .Values.tensorboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" (list .Values.defaults.autoscaling .Values.tensorboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" (list .Values.defaults.autoscaling .Values.tensorboard.autoscaling) }} +{{- end }} + +{{- define "kubeflow.tensorboard.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.tensorboard.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Security Context. +*/}} +{{- define "kubeflow.tensorboard.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.tensorboard.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard Scheduling. +*/}} +{{- define "kubeflow.tensorboard.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.tensorboard.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.tensorboard.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.tensorboard.tolerations +)}} +{{- end }} + +{{- define "kubeflow.tensorboard.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.tensorboard.affinity +)}} +{{- end }} + +{{/* +Kubeflow Tensorboard enable and create toggles. +*/}} +{{- define "kubeflow.tensorboard.enabled" -}} +{{- ternary true "" .Values.tensorboard.enabled }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.trainingOperator.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.trainingOperator.tpl new file mode 100644 index 00000000..f41eabe4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/kubeflow.trainingOperator.tpl @@ -0,0 +1,234 @@ +{{/* +Kubeflow Training Operator object names. +*/}} +{{- define "kubeflow.trainingOperator.baseName" -}} +{{- printf "training-operator" }} +{{- end }} + +{{- define "kubeflow.trainingOperator.name" -}} +{{- include "kubeflow.component.name" ( + list + (include "kubeflow.trainingOperator.baseName" .) + . +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.serviceAccountName" -}} +{{- include "kubeflow.component.serviceAccountName" ( + list + (include "kubeflow.trainingOperator.name" .) + .Values.trainingOperator.serviceAccount +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.mainClusterRoleName" -}} +{{- printf "%s-%s" + (include "kubeflow.fullname" .) + (include "kubeflow.trainingOperator.name" .) +}} +{{- end }} + +{{- define "kubeflow.trainingOperator.mainClusterRoleBindingName" -}} +{{- include "kubeflow.trainingOperator.mainClusterRoleName" . }} +{{- end }} + +{{- define "kubeflow.trainingOperator.kfTrAdminClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "training-admin" }} +{{- end }} + +{{- define "kubeflow.trainingOperator.kfTrEditClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "training-edit" }} +{{- end }} + +{{- define "kubeflow.trainingOperator.kfTrViewClusterRoleName" -}} +{{- printf "%s-%s" (include "kubeflow.fullname" .) "training-view" }} +{{- end }} + +{{/* +Role Aggregation Rule Labels +*/}} +{{- define "kubeflow.trainingOperator.kfTrAdminClusterRoleLabel" -}} +{{- include "kubeflow.aggregationRule.labelBase" (include "kubeflow.trainingOperator.kfTrAdminClusterRoleName" .) -}} +{{- end }} + +{{/* +Kubeflow Training Operator Service. +*/}} +{{- define "kubeflow.trainingOperator.svc.name" -}} +{{ include "kubeflow.component.svc.name" ( + include "kubeflow.trainingOperator.name" . +)}} +{{- end }} + +{{/* +Kubeflow Training Operator object labels. +*/}} +{{- define "kubeflow.trainingOperator.labels" -}} +{{ include "kubeflow.common.labels" . }} +{{ include "kubeflow.component.labels" (include "kubeflow.trainingOperator.name" .) }} +{{- end }} + +{{- define "kubeflow.trainingOperator.selectorLabels" -}} +{{ include "kubeflow.common.selectorLabels" . }} +{{ include "kubeflow.component.selectorLabels" (include "kubeflow.trainingOperator.name" .) }} +{{- end }} + +{{/* +Kubeflow Training Operator container image settings. +*/}} +{{- define "kubeflow.trainingOperator.image" -}} +{{ include "kubeflow.component.image" ( + list + .Values.defaults.image + .Values.trainingOperator.image +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.imagePullPolicy" -}} +{{ include "kubeflow.component.imagePullPolicy" ( + list + .Values.defaults.image + .Values.trainingOperator.image +)}} +{{- end }} + +{{/* +Kubeflow Training Operator Autoscaling and Availability. +*/}} +{{- define "kubeflow.trainingOperator.autoscaling.minReplicas" -}} +{{ include "kubeflow.component.autoscaling.minReplicas" ( + list + .Values.defaults.autoscaling + .Values.trainingOperator.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.autoscaling.maxReplicas" -}} +{{ include "kubeflow.component.autoscaling.maxReplicas" ( + list + .Values.defaults.autoscaling + .Values.trainingOperator.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.autoscaling.targetCPUUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetCPUUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.trainingOperator.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.autoscaling.targetMemoryUtilizationPercentage" -}} +{{ include "kubeflow.component.autoscaling.targetMemoryUtilizationPercentage" ( + list + .Values.defaults.autoscaling + .Values.trainingOperator.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.pdb.values" -}} +{{- include "kubeflow.component.pdb.values" ( + list + .Values.defaults.podDisruptionBudget + .Values.trainingOperator.podDisruptionBudget +)}} +{{- end }} + +{{/* +Kubeflow Training Operator Security Context. +*/}} +{{- define "kubeflow.trainingOperator.containerSecurityContext" -}} +{{ include "kubeflow.component.containerSecurityContext" ( + list + .Values.defaults.containerSecurityContext + .Values.trainingOperator.containerSecurityContext +)}} +{{- end }} + +{{/* +Kubeflow Training Operator Scheduling. +*/}} +{{- define "kubeflow.trainingOperator.topologySpreadConstraints" -}} +{{ include "kubeflow.component.topologySpreadConstraints" ( + list + .Values.defaults.topologySpreadConstraints + .Values.trainingOperator.topologySpreadConstraints +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.nodeSelector" -}} +{{ include "kubeflow.component.nodeSelector" ( + list + .Values.defaults.nodeSelector + .Values.trainingOperator.nodeSelector +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.tolerations" -}} +{{ include "kubeflow.component.tolerations" ( + list + .Values.defaults.tolerations + .Values.trainingOperator.tolerations +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.affinity" -}} +{{ include "kubeflow.component.affinity" ( + list + .Values.defaults.affinity + .Values.trainingOperator.affinity +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.terminationGracePeriodSeconds" -}} +{{ include "kubeflow.component.terminationGracePeriodSeconds" ( + list + .Values.defaults.terminationGracePeriodSeconds + .Values.trainingOperator.terminationGracePeriodSeconds +)}} +{{- end }} + +{{/* +Kubeflow Training Operator enable and create toggles. +*/}} +{{- define "kubeflow.trainingOperator.enabled" -}} +{{- .Values.trainingOperator.enabled }} +{{- end }} + +{{- define "kubeflow.trainingOperator.autoscaling.enabled" -}} +{{ include "kubeflow.component.autoscaling.enabled" ( + list + .Values.defaults.autoscaling + .Values.trainingOperator.autoscaling +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.rbac.createRoles" -}} +{{- ternary true "" ( + and + (include "kubeflow.trainingOperator.enabled" . | eq "true") + .Values.trainingOperator.rbac.create +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.createServiceAccount" -}} +{{- ternary true "" ( +and + (include "kubeflow.trainingOperator.enabled" . | eq "true") + .Values.trainingOperator.serviceAccount.create +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.pdb.create" -}} +{{- include "kubeflow.component.pdb.create" ( + list + (include "kubeflow.trainingOperator.enabled" .) + .Values.defaults.podDisruptionBudget + .Values.trainingOperator.podDisruptionBudget +)}} +{{- end }} + +{{- define "kubeflow.trainingOperator.tlsCertSecretName" -}} +{{- printf "training-operator-webhook-cert" }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/validation.tpl b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/validation.tpl new file mode 100644 index 00000000..d484876b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_helpers/validation.tpl @@ -0,0 +1,51 @@ +{{/* +Dex validations. +*/}} + +{{- if (ne .Values.dexIntegration.integrationType "internal" ) -}} +{{- fail "Currently only 'dexIntegration.integrationType: internal' is supported." -}} +{{- end }} + +{{- if (ne .Values.dexIntegration.integrationMode "istio" ) -}} +{{- fail "Currently only 'dexIntegration.integrationMode: istio' is supported." -}} +{{- end }} + +{{- if (ne .Values.pipelines.config.db.driver.value "mysql" ) -}} +{{- fail "Currently only 'pipelines.config.db.driver: mysql' is supported." -}} +{{- end }} + +{{/* +Kubeflow Pipelines validations. +*/}} + +# vars +{{- $hardcodedSecretName := "mlpipeline-minio-artifact" -}} +{{- $objectStoreCredentialsSecretKeyRefMessage := (.Files.Get "files/validation-messages/objectstore-accesskey-secretaccesskey-secret-ref.txt") -}} +{{- $secretConstraintsGeneralMessage := (.Files.Get "files/validation-messages/mlpipeline-minio-artifact.txt") -}} + +# Check if the secret name for object store is either nil or $hardcodedSecretName. +{{- range $key, $val := (dict + ".Values.pipelines.config.objectStore.existingSecretName" .Values.pipelines.config.objectStore.existingSecretName + ".Values.pipelines.config.objectStore.accessKey.secretKeyRef.name" .Values.pipelines.config.objectStore.accessKey.secretKeyRef.name + ".Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name" .Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name +) }} + {{- if not (has $val (list nil $hardcodedSecretName)) -}} + {{- fail (printf "%s must be one of [nil, '%s'], current value: %s\n\n%s" + $key $hardcodedSecretName $val $secretConstraintsGeneralMessage + ) }} + {{- end }} +{{- end }} + +# Check if objectStore accessKey and secretAccessKey references are the same. +{{- if (ne + .Values.pipelines.config.objectStore.accessKey.secretKeyRef.name + .Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name +)}} +{{- fail (printf "%s\n%s" + $objectStoreCredentialsSecretKeyRefMessage + $secretConstraintsGeneralMessage +) -}} +{{- end }} + +{{/* +*/}} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_hpa.yaml new file mode 100644 index 00000000..d0957663 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "kubeflow.fullname" . }} + labels: + {{- include "kubeflow.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "kubeflow.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_ingress.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_ingress.yaml new file mode 100644 index 00000000..07285334 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "kubeflow.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "kubeflow.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_service.yaml new file mode 100644 index 00000000..4cdb4258 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "kubeflow.fullname" . }} + labels: + {{- include "kubeflow.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "kubeflow.selectorLabels" . | nindent 4 }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/_serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_serviceaccount.yaml new file mode 100644 index 00000000..8cea7961 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/_serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "kubeflow.serviceAccountName" . }} + labels: + {{- include "kubeflow.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.certificate.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.certificate.yaml new file mode 100644 index 00000000..d53bfd94 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.certificate.yaml @@ -0,0 +1,23 @@ +{{- if (include "kubeflow.admissionWebhook.enabledWithCertManager" . )}} + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.certName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + commonName: {{ include "kubeflow.admissionWebhook.certName" . }} + dnsNames: + - {{ include "kubeflow.admissionWebhook.svc.name" . }} + - {{ include "kubeflow.admissionWebhook.svc.addressWithNs" . }} + - {{ include "kubeflow.admissionWebhook.svc.addressWithSvc" . }} + - {{ include "kubeflow.admissionWebhook.svc.fqdn" . }} + isCA: true + issuerRef: + kind: Issuer + name: {{ include "kubeflow.admissionWebhook.certIssuerName" . }} + secretName: {{ include "kubeflow.admissionWebhook.tlsCertSecretName" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.issuer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.issuer.yaml new file mode 100644 index 00000000..32d6fb74 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/certmanager.issuer.yaml @@ -0,0 +1,13 @@ +{{- if (include "kubeflow.admissionWebhook.enabledWithCertManager" . )}} + +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.certIssuerName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selfSigned: {} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/cluster-role-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/cluster-role-binding.yaml new file mode 100644 index 00000000..6fbf8a8c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/cluster-role-binding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.admissionWebhook.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.admissionWebhook.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.admissionWebhook.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterrole.main.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterrole.main.yaml new file mode 100644 index 00000000..d06cc62d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterrole.main.yaml @@ -0,0 +1,23 @@ +{{- if (include "kubeflow.admissionWebhook.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.mainClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - poddefaults + verbs: + - get + - watch + - list + - update + - create + - patch + - delete + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterroles.user.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterroles.user.yaml new file mode 100644 index 00000000..260a2836 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/clusterroles.user.yaml @@ -0,0 +1,52 @@ +{{- if (include "kubeflow.admissionWebhook.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.kfPdAdminClusterRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.admissionWebhook.kfPdAdminClusterRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.kfPdEditClusterRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.admissionWebhook.kfPdEditClusterRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + {{- include "kubeflow.admissionWebhook.kfPdAdminClusterRoleLabel" . | nindent 4 }} + {{- include "kubeflow.admissionWebhook.kfPdEditClusterRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.kfPdViewClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - poddefaults + verbs: + - get + - list + - watch + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/deployment.yaml new file mode 100644 index 00000000..25e4aba4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/deployment.yaml @@ -0,0 +1,88 @@ +{{- if (include "kubeflow.admissionWebhook.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.admissionWebhook.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.admissionWebhook.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.admissionWebhook.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.admissionWebhook.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: {{ include "kubeflow.admissionWebhook.baseName" . }} + image: {{ include "kubeflow.admissionWebhook.image" . }} + imagePullPolicy: {{ include "kubeflow.admissionWebhook.imagePullPolicy" . }} + + args: + - --tlsCertFile=/etc/webhook/certs/tls.crt + - --tlsKeyFile=/etc/webhook/certs/tls.key + + ports: + - containerPort: {{ .Values.admissionWebhook.service.targetPort }} + name: https-webhook + + {{- with .Values.admissionWebhook.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + volumeMounts: + - mountPath: /etc/webhook/certs + name: webhook-cert + readOnly: true + + {{- with include "kubeflow.admissionWebhook.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.admissionWebhook.serviceAccountName" . }} + + volumes: + - name: webhook-cert + secret: + secretName: {{ include "kubeflow.admissionWebhook.tlsCertSecretName" . }} + + {{- with include "kubeflow.admissionWebhook.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.admissionWebhook.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.admissionWebhook.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.admissionWebhook.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/hpa.yaml new file mode 100644 index 00000000..ced53e74 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/hpa.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.admissionWebhook.autoscaling.enabled" . | eq "true") -}} + +{{- $componentName := include "kubeflow.admissionWebhook.name" . -}} +{{- $minReplicas := include "kubeflow.admissionWebhook.autoscaling.minReplicas" . -}} +{{- $maxReplicas := include "kubeflow.admissionWebhook.autoscaling.maxReplicas" . -}} +{{- $targetCPUUtilizationPercentage := include "kubeflow.admissionWebhook.autoscaling.targetCPUUtilizationPercentage" . -}} +{{- $targetMemoryUtilizationPercentage := include "kubeflow.admissionWebhook.autoscaling.targetMemoryUtilizationPercentage" . -}} + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ $componentName }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ $componentName }} + minReplicas: {{ $minReplicas }} + maxReplicas: {{ $maxReplicas }} + metrics: + {{- if $targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ $targetCPUUtilizationPercentage }} + {{- end }} + {{- if $targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ $targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/mutatingwebhook.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/mutatingwebhook.yaml new file mode 100644 index 00000000..f68da31c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/mutatingwebhook.yaml @@ -0,0 +1,42 @@ +{{- if (include "kubeflow.admissionWebhook.enabled" .) -}} + +{{- $ca := printf "%s/%s" + (include "kubeflow.namespace" .) + (include "kubeflow.admissionWebhook.certName" .) +-}} + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ $ca }} + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.webhookName" . }} +webhooks: +- admissionReviewVersions: + - v1beta1 + - v1 + clientConfig: + caBundle: "" + service: + name: {{ include "kubeflow.admissionWebhook.svc.name" .}} + namespace: {{ include "kubeflow.namespace" . }} + path: /apply-poddefault + failurePolicy: Fail + name: {{ include "kubeflow.admissionWebhook.svc.addressWithSvc" . }} + namespaceSelector: + matchLabels: + {{- include "kubeflow.admissionWebhook.partOfLabel" . | nindent 6}} + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/poddisruptionbudget.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/poddisruptionbudget.yaml new file mode 100644 index 00000000..eb40ded0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.admissionWebhook.pdb.create" . | eq "true") -}} + +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.admissionWebhook.selectorLabels" . | nindent 6 }} + {{- with (include "kubeflow.admissionWebhook.pdb.values" .) }} + {{- . | nindent 2 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service-account.yaml new file mode 100644 index 00000000..4dd2f725 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service-account.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.admissionWebhook.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.admissionWebhook.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service.yaml new file mode 100644 index 00000000..188bd516 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/admission-webhook/service.yaml @@ -0,0 +1,24 @@ +{{- if (include "kubeflow.admissionWebhook.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.admissionWebhook.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.admissionWebhook.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: https-webhook + port: {{ .Values.admissionWebhook.service.port }} + targetPort: https-webhook + selector: + {{- include "kubeflow.admissionWebhook.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.admissionWebhook.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.extAuthz.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.extAuthz.yaml new file mode 100644 index 00000000..05f4f630 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.extAuthz.yaml @@ -0,0 +1,41 @@ +{{- if and + (include "kubeflow.centraldashboard.createIstioIntegrationObjects" . | eq "true") + (include "kubeflow.istioIntegration.authorizationMode.granular" . | eq "true") +-}} + +# NOTE: this AuthorizationPolicy forces traffic through ext authz http extension +# so we don't have to provide configuration to allow traffic only from +# istio-ingressgateway. The .spec.rules.to.operations.notPaths is configured for +# CloudFlare integration and allows only static, non-secret assets to be +# accessible without the Istio Auth. + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.authorizationPolicyExtAuthName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: CUSTOM + provider: + name: {{ .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} + rules: + - to: + - operation: + notPaths: + - /favicon* + - /webcomponentsjs* + - /vendor.bundle.js + - /app.bundle.js + - /dashboard_lib.bundle.js + - /assets* + - /app.css + # Exclude paths used by Knative healthchecks + - /metrics + - /healthz + selector: + matchLabels: + {{- include "kubeflow.centraldashboard.selectorLabels" . | nindent 6 }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.yaml new file mode 100644 index 00000000..9466a5f4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/authorizationpolicy.yaml @@ -0,0 +1,20 @@ +{{- if (include "kubeflow.centraldashboard.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.centraldashboard.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + namespaces: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole-binding.yaml new file mode 100644 index 00000000..e4c35d5e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole-binding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.centraldashboard.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.clusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.centraldashboard.clusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.centraldashboard.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole.yaml new file mode 100644 index 00000000..eaf15ddb --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/clusterrole.yaml @@ -0,0 +1,21 @@ +{{- if (include "kubeflow.centraldashboard.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.clusterRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - events + - namespaces + - nodes + verbs: + - get + - list + - watch + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/configmap.centraldashboard-config.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/configmap.centraldashboard-config.yaml new file mode 100644 index 00000000..66524329 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/configmap.centraldashboard-config.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.centraldashboard.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.config.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + settings: |- + { + "DASHBOARD_FORCE_IFRAME": {{ .Values.centraldashboard.config.forceIFrame }} + } + links: |- + {{- .Values.centraldashboard.config.links | toJson | nindent 4 }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/deployment.yaml new file mode 100644 index 00000000..e23efadd --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/deployment.yaml @@ -0,0 +1,99 @@ +{{- if (include "kubeflow.centraldashboard.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.centraldashboard.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.centraldashboard.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.centraldashboard.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.centraldashboard.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: {{ include "kubeflow.centraldashboard.baseName" . }} + image: {{ include "kubeflow.centraldashboard.image" . }} + imagePullPolicy: {{ include "kubeflow.centraldashboard.imagePullPolicy" . }} + + env: + - name: USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: USERID_PREFIX + value: {{ .Values.auth.userIdPrefix | quote }} + - name: PROFILES_KFAM_SERVICE_HOST + value: {{ include "kubeflow.profilesController.kfam.svc.fqdn" . }} + - name: REGISTRATION_FLOW + value: {{ .Values.centraldashboard.config.enableRegistrationFlow | quote }} + - name: DASHBOARD_LINKS_CONFIGMAP + value: {{ include "kubeflow.centraldashboard.config.name" . }} + - name: LOGOUT_URL + value: {{ .Values.centraldashboard.config.logoutURL | quote }} + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + + ports: + - containerPort: 8082 + protocol: TCP + + livenessProbe: + httpGet: + path: /healthz + port: 8082 + initialDelaySeconds: 30 + periodSeconds: 30 + + {{- with .Values.centraldashboard.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.centraldashboard.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.centraldashboard.serviceAccountName" . }} + + {{- with include "kubeflow.centraldashboard.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.centraldashboard.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.centraldashboard.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.centraldashboard.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/hpa.yaml new file mode 100644 index 00000000..7847d47c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/hpa.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.centraldashboard.autoscaling.enabled" . | eq "true") -}} + +{{- $componentName := include "kubeflow.centraldashboard.name" . -}} +{{- $minReplicas := include "kubeflow.centraldashboard.autoscaling.minReplicas" . -}} +{{- $maxReplicas := include "kubeflow.centraldashboard.autoscaling.maxReplicas" . -}} +{{- $targetCPUUtilizationPercentage := include "kubeflow.centraldashboard.autoscaling.targetCPUUtilizationPercentage" . -}} +{{- $targetMemoryUtilizationPercentage := include "kubeflow.centraldashboard.autoscaling.targetMemoryUtilizationPercentage" . -}} + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ $componentName }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ $componentName }} + minReplicas: {{ $minReplicas }} + maxReplicas: {{ $maxReplicas }} + metrics: + {{- if $targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ $targetCPUUtilizationPercentage }} + {{- end }} + {{- if $targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ $targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/poddisruptionbudget.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/poddisruptionbudget.yaml new file mode 100644 index 00000000..3d1b7d08 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.centraldashboard.pdb.create" . | eq "true") -}} + +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.centraldashboard.selectorLabels" . | nindent 6 }} + {{- with (include "kubeflow.centraldashboard.pdb.values" .) }} + {{- . | nindent 2 }} + {{- end }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role-binding.yaml new file mode 100644 index 00000000..ffe58d2c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role-binding.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.centraldashboard.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.roleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "kubeflow.centraldashboard.roleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.centraldashboard.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role.yaml new file mode 100644 index 00000000..e9cd371b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/role.yaml @@ -0,0 +1,31 @@ +{{- if (include "kubeflow.centraldashboard.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.roleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + - "app.k8s.io" + resources: + - applications + - pods + - pods/exec + - pods/log + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service-account.yaml new file mode 100644 index 00000000..2fa04106 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service-account.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.centraldashboard.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.centraldashboard.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service.yaml new file mode 100644 index 00000000..9dd2352b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.centraldashboard.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.centraldashboard.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 8082 + selector: + {{- include "kubeflow.centraldashboard.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.centraldashboard.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/virtual-service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/virtual-service.yaml new file mode 100644 index 00000000..8bdc1f5e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/centraldashboard/virtual-service.yaml @@ -0,0 +1,27 @@ +{{- if (include "kubeflow.centraldashboard.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1beta1 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.centraldashboard.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: / + rewrite: + uri: / + route: + - destination: + host: {{ include "kubeflow.centraldashboard.svc.fqdn" . }} + port: + number: 80 + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/dex-integration/virtualservice.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/dex-integration/virtualservice.yaml new file mode 100644 index 00000000..ba581a5c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/dex-integration/virtualservice.yaml @@ -0,0 +1,29 @@ +{{- if (include "kubeflow.dexIntegration.istio.enabled" . | eq "true") -}} + +{{- $vsName := include "kubeflow.dexIntegration.name" . -}} +{{- $svcName := .Values.dexIntegration.svc.name -}} +{{- $svcNamespace := .Values.dexIntegration.svc.namespace -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.dexIntegration.labels" . | nindent 4 }} + name: {{ $vsName }} + namespace: {{ $svcNamespace }} +spec: + gateways: + - {{ include "kubeflow.namespace" . }}/{{ .Values.istioIntegration.gateway.name }} + hosts: + - "{{ default "*" .Values.dexIntegration.host }}" + http: + - match: + - uri: + prefix: {{ .Values.dexIntegration.urlPrefix }}/ + route: + - destination: + host: {{ include "kubeflow.dexIntegration.svc.fqdn" . }} + port: + number: {{ .Values.dexIntegration.svc.port }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/deployment.yaml new file mode 100644 index 00000000..b5c8526e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/deployment.yaml @@ -0,0 +1,55 @@ +{{- if (include "kubeflow.istioIntegration.kubeflowJwksProxy.enabled" . | eq "true") -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.name" . }} + namespace: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.namespace" . }} + labels: + {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.labels" . | nindent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.labels" . | nindent 6 }} + template: + metadata: + labels: + {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.labels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.name" . }} + containers: + - name: kubectl-proxy + image: docker.io/bitnami/kubectl + ports: + - name: http + containerPort: 8080 + startupProbe: + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 2 + httpGet: + path: /openid/v1/jwks + port: http + livenessProbe: + initialDelaySeconds: 15 + periodSeconds: 15 + timeoutSeconds: 5 + httpGet: + path: /openid/v1/jwks + port: http + readinessProbe: + initialDelaySeconds: 15 + periodSeconds: 15 + timeoutSeconds: 5 + httpGet: + path: /openid/v1/jwks + port: http + args: + - proxy + - --address=0.0.0.0 + - --port=8080 + - --accept-hosts=.* + - --accept-paths=^(?:/openid/v1/jwks)|(?:/.well-known/openid-configuration)$ + - --reject-methods=^(POST|PUT|PATCH|DELETE|HEAD|OPTIONS|CONNECT|TRACE)$ +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service-account.yaml new file mode 100644 index 00000000..78653c59 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service-account.yaml @@ -0,0 +1,9 @@ +{{- if (include "kubeflow.istioIntegration.kubeflowJwksProxy.enabled" . | eq "true") -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.name" . }} + namespace: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.namespace" . }} + labels: + {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.labels" . | nindent 4 }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service.yaml new file mode 100644 index 00000000..61dbc4a9 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-jwks-proxy/service.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.istioIntegration.kubeflowJwksProxy.enabled" . | eq "true") -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.name" . }} + namespace: {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.namespace" . }} + labels: + {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.labels" . | nindent 4 }} +spec: + ports: + - name: http + port: 80 + targetPort: http + selector: + {{ include "kubeflow.istioIntegration.kubeflowJwksProxy.labels" . | nindent 4 }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-roles.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-roles.yaml new file mode 100644 index 00000000..49d20176 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/cluster-roles.yaml @@ -0,0 +1,60 @@ +{{- if .Values.istioIntegration.enabled }} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.istioIntegration.istioAdminRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.istioIntegration.istioAdminRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + {{- include "kubeflow.istioIntegration.istioAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.istioIntegration.istioEditRoleName" . }} +rules: +- apiGroups: + - istio.io + - networking.istio.io + resources: ["*"] + verbs: + - get + - list + - watch + - create + - delete + - deletecollection + - patch + - update + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.istioIntegration.istioViewRoleName" . }} +rules: +- apiGroups: + - istio.io + - networking.istio.io + resources: ["*"] + verbs: + - get + - list + - watch + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/gateway.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/gateway.yaml new file mode 100644 index 00000000..808f57b0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/gateway.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.istioIntegration.enabled" . | eq "true") -}} + +apiVersion: networking.istio.io/v1beta1 +kind: Gateway +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + name: {{ .Values.istioIntegration.gateway.name }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + {{- toYaml .Values.istioIntegration.gateway.selector | nindent 4 }} + servers: + {{- toYaml .Values.istioIntegration.gateway.servers | nindent 4 }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.jwt-require.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.jwt-require.yaml new file mode 100644 index 00000000..dfb75908 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.jwt-require.yaml @@ -0,0 +1,41 @@ +{{- if and + (include "kubeflow.istioIntegration.enabled" . | eq "true") + (include "kubeflow.istioIntegration.authorizationMode.ingressgateway" . | eq "true") +-}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + name: {{ include "kubeflow.istioIntegration.jwtRequire.authorizationPolicyName" . }} + namespace: {{ .Values.istioIntegration.ingressGatewayNamespace }} +spec: + action: DENY + rules: + - from: + - source: + notRequestPrincipals: ["*"] + to: + - operation: + notPaths: + # Exclude dex paths, otherwise users won't be able to log in. + - /dex/* + - /dex/** + - /oauth2/* + # Exclude paths which are safe to cache by Cloudflare. + - /favicon* + - /webcomponentsjs* + - /vendor.bundle.js + - /app.bundle.js + - /dashboard_lib.bundle.js + - /assets* + - /app.css + # Exclude paths used by Knative healthchecks + - /metrics + - /healthz + selector: + matchLabels: + {{- toYaml .Values.istioIntegration.gateway.selector | nindent 6 }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.oauth2-proxy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.oauth2-proxy.yaml new file mode 100644 index 00000000..7f4dfcf6 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/authorizationpolicy.oauth2-proxy.yaml @@ -0,0 +1,48 @@ +{{- if and + (include "kubeflow.istioIntegration.enabled" . | eq "true") + (include "kubeflow.istioIntegration.authorizationMode.ingressgateway" . | eq "true") +-}} + +# NOTE: this AuthorizationPolicy forces traffic through ext authz http extension. +# The .spec.rules.to.operations.notPaths is configured for +# CloudFlare integration and allows only static, non-secret assets to be +# accessible without the Istio Auth. + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + name: {{ include "kubeflow.istioIntegration.extAuth.authorizationPolicyName" . }} + namespace: {{ .Values.istioIntegration.ingressGatewayNamespace }} +spec: + action: CUSTOM + provider: + name: {{ .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} + rules: + - when: + - key: request.headers[authorization] + notValues: ["*"] + to: + - operation: + notPaths: + # Exclude dex paths, otherwise users won't be able to log in. + - /dex/* + - /dex/** + - /oauth2/* + # Exclude paths which are safe to cache by Cloudflare. + - /favicon* + - /webcomponentsjs* + - /vendor.bundle.js + - /app.bundle.js + - /dashboard_lib.bundle.js + - /assets* + - /app.css + # Exclude paths used by Knative healthchecks + - /metrics + - /healthz + selector: + matchLabels: + {{- toYaml .Values.istioIntegration.gateway.selector | nindent 6 }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/requestauthentication.user-auth.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/requestauthentication.user-auth.yaml new file mode 100644 index 00000000..9ebd6f72 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-external-auth/requestauthentication.user-auth.yaml @@ -0,0 +1,26 @@ +{{- if (include "kubeflow.istioIntegration.enabled" . | eq "true") -}} + +apiVersion: security.istio.io/v1beta1 +kind: RequestAuthentication +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + name: {{ include "kubeflow.istioIntegration.userAuth.requestAuthenticationName" . }} + namespace: {{ .Values.istioIntegration.ingressGatewayNamespace }} +spec: + selector: + matchLabels: + {{- toYaml .Values.istioIntegration.gateway.selector | nindent 6 }} + jwtRules: + - issuer: {{ .Values.istioIntegration.userAuth.issuer }} + forwardOriginalToken: true + outputClaimToHeaders: + - claim: {{ .Values.istioIntegration.userAuth.userClaim }} + header: {{ .Values.auth.userHeaderName }} + - claim: {{ .Values.istioIntegration.m2m.groupsClaim }} + header: {{ .Values.auth.groupsHeaderName }} + fromHeaders: + - name: {{ .Values.auth.authHeader.name }} + prefix: {{ .Values.auth.authHeader.prefix }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-m2m/requestauthentication.m2m.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-m2m/requestauthentication.m2m.yaml new file mode 100644 index 00000000..547b0184 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/istio-integration/istio-m2m/requestauthentication.m2m.yaml @@ -0,0 +1,29 @@ +{{- if (include "kubeflow.istioIntegration.m2m.enabled" . | eq "true") -}} + +apiVersion: security.istio.io/v1beta1 +kind: RequestAuthentication +metadata: + labels: + {{- include "kubeflow.istioIntegration.labels" . | nindent 4 }} + name: {{ include "kubeflow.istioIntegration.m2m.requestAuthenticationName" . }} + namespace: {{ .Values.istioIntegration.ingressGatewayNamespace }} +spec: + selector: + matchLabels: + {{- toYaml .Values.istioIntegration.gateway.selector | nindent 6 }} + jwtRules: + - issuer: {{ .Values.istioIntegration.m2m.issuer }} + forwardOriginalToken: true + outputClaimToHeaders: + - claim: {{ .Values.istioIntegration.m2m.userClaim }} + header: {{ .Values.auth.userHeaderName }} + - claim: {{ .Values.istioIntegration.m2m.groupsClaim }} + header: {{ .Values.auth.groupsHeaderName }} + fromHeaders: + - name: {{ .Values.auth.authHeader.name }} + prefix: {{ .Values.auth.authHeader.prefix }} +{{- if .Values.istioIntegration.kubeflowJwksProxy.enabled }} + jwksUri: {{ include "kubeflow.istioIntegration.jwksUri" . }} +{{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.certificate.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.certificate.yaml new file mode 100644 index 00000000..1082e03e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.certificate.yaml @@ -0,0 +1,22 @@ +{{- if (include "kubeflow.katib.controller.enabledWithCertManager" . )}} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.certName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + isCA: true + commonName: {{ include "kubeflow.katib.controller.svc.addressWithSvc" . }} + dnsNames: + - {{ include "kubeflow.katib.controller.svc.name" . }} + - {{ include "kubeflow.katib.controller.svc.addressWithNs" . }} + - {{ include "kubeflow.katib.controller.svc.addressWithSvc" . }} + - {{ include "kubeflow.katib.controller.svc.fqdn" . }} + issuerRef: + kind: Issuer + name: {{ include "kubeflow.katib.controller.certIssuerName" . }} + secretName: {{ include "kubeflow.katib.controller.tlsCertSecretName" . }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.issuer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.issuer.yaml new file mode 100644 index 00000000..c845f543 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/certmanager.issuer.yaml @@ -0,0 +1,12 @@ +{{- if (include "kubeflow.katib.controller.enabledWithCertManager" . )}} +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.certIssuerName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selfSigned: {} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/configmap.katib-config.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/configmap.katib-config.yaml new file mode 100644 index 00000000..cc6b6138 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/configmap.katib-config.yaml @@ -0,0 +1,17 @@ +{{- if (include "kubeflow.katib.enabled" .) -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + katib-config.yaml: | + --- + apiVersion: config.kubeflow.org/v1beta1 + kind: KatibConfig + {{- .Values.katib.config | toYaml | nindent 4 }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/deployment.yaml new file mode 100644 index 00000000..53e03415 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/deployment.yaml @@ -0,0 +1,80 @@ +{{- if (include "kubeflow.katib.controller.enabled" .) -}} + +{{- $autoscalingEnabled := include "kubeflow.katib.controller.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.katib.controller.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.katib.controller.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.katib.controller.selectorLabels" . | nindent 8 }} + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "8080" + spec: + containers: + - name: {{ include "kubeflow.katib.controller.baseName" . }} + image: {{ include "kubeflow.katib.controller.image" . }} + command: ["./katib-controller"] + args: + - --katib-config=/katib-config.yaml + ports: + - name: webhook + containerPort: {{ .Values.katib.controller.service.webhook.targetPort }} + protocol: TCP + - name: metrics + containerPort: {{ .Values.katib.controller.service.metrics.targetPort }} + protocol: TCP + - name: healthz + containerPort: {{ .Values.katib.controller.service.healthz.targetPort }} + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + livenessProbe: + httpGet: + path: /healthz + port: healthz + env: + - name: KATIB_CORE_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumeMounts: + - mountPath: /tmp/cert + name: cert + readOnly: true + - mountPath: /katib-config.yaml + name: katib-config + subPath: katib-config.yaml + readOnly: true + {{- with .Values.katib.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "kubeflow.katib.controller.serviceAccountName" . }} + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: {{ include "kubeflow.katib.controller.tlsCertSecretName" . }} + - name: katib-config + configMap: + name: {{ include "kubeflow.katib.controller.configMapName" . }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrole.yaml new file mode 100644 index 00000000..80c75812 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrole.yaml @@ -0,0 +1,133 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.mainClusterRoleName" . }} +rules: + - apiGroups: + - "" + resources: + - services + verbs: + - "get" + - "list" + - "watch" + - "create" + - "delete" + - apiGroups: + - "" + resources: + - events + verbs: + - "create" + - "patch" + - "update" + - apiGroups: + - "" + resources: + - serviceaccounts + - persistentvolumes + - persistentvolumeclaims + verbs: + - "get" + - "list" + - "watch" + - "create" + - apiGroups: + - "" + resources: + - namespaces + - configmaps + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "" + resources: + - pods + - pods/status + verbs: + - "get" + - apiGroups: + - "" + resources: + - secrets + verbs: + - "get" + - "list" + - "watch" + - "patch" + - apiGroups: + - apps + resources: + - deployments + verbs: + - "get" + - "list" + - "watch" + - "create" + - "delete" + - apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + verbs: + - "get" + - "create" + - "list" + - "watch" + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - "get" + - "list" + - "watch" + - "create" + - "delete" + - apiGroups: + - kubeflow.org + resources: + - tfjobs + - pytorchjobs + - mpijobs + - xgboostjobs + - mxjobs + verbs: + - "get" + - "list" + - "watch" + - "create" + - "delete" + - apiGroups: + - kubeflow.org + resources: + - experiments + - experiments/status + - experiments/finalizers + - trials + - trials/status + - trials/finalizers + - suggestions + - suggestions/status + - suggestions/finalizers + verbs: + - "*" + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - "get" + - "watch" + - "list" + - "patch" +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrolebinding.yaml new file mode 100644 index 00000000..7603b5e2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/clusterrolebinding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.katib.controller.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.katib.controller.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/serviceaccount.yaml new file mode 100644 index 00000000..0aac5e86 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/rbac/serviceaccount.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +{{- if (include "kubeflow.katib.controller.createServiceAccount" . | eq "true") -}} + +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.katib.controller.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/service.yaml new file mode 100644 index 00000000..00ec19fd --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/service.yaml @@ -0,0 +1,30 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +{{- if (include "kubeflow.katib.controller.enabled" . | eq "true") -}} +--- +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.katib.controller.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: webhook + port: {{ .Values.katib.controller.service.webhook.port }} + targetPort: {{ .Values.katib.controller.service.webhook.targetPort }} + protocol: TCP + - name: metrics + port: {{ .Values.katib.controller.service.metrics.port }} + targetPort: {{ .Values.katib.controller.service.metrics.targetPort }} + - name: healthz + port: {{ .Values.katib.controller.service.healthz.port }} + targetPort: {{ .Values.katib.controller.service.healthz.targetPort }} + selector: + {{- include "kubeflow.katib.controller.selectorLabels" . | nindent 4 }} +{{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/trial-templates.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/trial-templates.yaml new file mode 100644 index 00000000..b4a64e9a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/trial-templates.yaml @@ -0,0 +1,80 @@ +{{- if (include "kubeflow.katib.enabled" .) -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + name: trial-templates + namespace: kubeflow + labels: + katib.kubeflow.org/component: trial-templates +data: + defaultTrialTemplate.yaml: |- + apiVersion: batch/v1 + kind: Job + spec: + template: + spec: + containers: + - name: training-container + image: docker.io/kubeflowkatib/pytorch-mnist-cpu:v0.17.0 + command: + - "python3" + - "/opt/pytorch-mnist/mnist.py" + - "--epochs=1" + - "--batch-size=16" + - "--lr=${trialParameters.learningRate}" + - "--momentum=${trialParameters.momentum}" + restartPolicy: Never + # For ConfigMap templates double quotes must set in commands to correct parse JSON parameters in Trial Template (e.g nn_config, architecture) + enasCPUTemplate: |- + apiVersion: batch/v1 + kind: Job + spec: + template: + spec: + containers: + - name: training-container + image: docker.io/kubeflowkatib/enas-cnn-cifar10-cpu:v0.17.0 + command: + - python3 + - -u + - RunTrial.py + - --num_epochs=1 + - "--architecture=\"${trialParameters.neuralNetworkArchitecture}\"" + - "--nn_config=\"${trialParameters.neuralNetworkConfig}\"" + restartPolicy: Never + pytorchJobTemplate: |- + apiVersion: kubeflow.org/v1 + kind: PyTorchJob + spec: + pytorchReplicaSpecs: + Master: + replicas: 1 + restartPolicy: OnFailure + template: + spec: + containers: + - name: pytorch + image: docker.io/kubeflowkatib/pytorch-mnist-cpu:v0.17.0 + command: + - "python3" + - "/opt/pytorch-mnist/mnist.py" + - "--epochs=1" + - "--lr=${trialParameters.learningRate}" + - "--momentum=${trialParameters.momentum}" + Worker: + replicas: 2 + restartPolicy: OnFailure + template: + spec: + containers: + - name: pytorch + image: docker.io/kubeflowkatib/pytorch-mnist-cpu:v0.17.0 + command: + - "python3" + - "/opt/pytorch-mnist/mnist.py" + - "--epochs=1" + - "--lr=${trialParameters.learningRate}" + - "--momentum=${trialParameters.momentum}" + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.mutating.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.mutating.yaml new file mode 100644 index 00000000..41508813 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.mutating.yaml @@ -0,0 +1,67 @@ +{{- if (include "kubeflow.katib.controller.enabled" .) -}} + +{{- $ca := printf "%s/%s" + (include "kubeflow.namespace" .) + (include "kubeflow.katib.controller.certName" .) +-}} + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ $ca }} + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.mutatingWebhook.name" . }} +webhooks: + - name: defaulter.experiment.katib.kubeflow.org + clientConfig: + service: + name: {{ include "kubeflow.katib.controller.svc.name" .}} + namespace: {{ include "kubeflow.namespace" . }} + path: /mutate-experiment + sideEffects: None + admissionReviewVersions: + - v1 + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - experiments + - name: mutator.pod.katib.kubeflow.org + clientConfig: + service: + name: {{ include "kubeflow.katib.controller.svc.name" .}} + namespace: {{ include "kubeflow.namespace" . }} + path: /mutate-pod + sideEffects: None + admissionReviewVersions: + - v1 + namespaceSelector: + matchLabels: + katib.kubeflow.org/metrics-collector-injection: enabled + # Once the AdmissionWebhookMatchConditions feature gate is enabled by default, we should switch to control based on userInfo. + # REF: + # - AdmissionWebhookMatchConditions: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions + # - Tracking issue: https://github.com/kubeflow/katib/issues/2206 + objectSelector: + matchExpressions: + - key: katib.kubeflow.org/metrics-collector-injection + operator: NotIn + values: + - disabled + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.validating.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.validating.yaml new file mode 100644 index 00000000..0e319962 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/controller/webhook.validating.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.katib.controller.enabled" .) -}} + +{{- $ca := printf "%s/%s" + (include "kubeflow.namespace" .) + (include "kubeflow.katib.controller.certName" .) +-}} + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ $ca }} + labels: + {{- include "kubeflow.katib.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.validatingWebhook.name" . }} +webhooks: + - name: validator.experiment.katib.kubeflow.org + clientConfig: + service: + name: {{ include "kubeflow.katib.controller.svc.name" .}} + namespace: {{ include "kubeflow.namespace" . }} + path: /validate-experiment + sideEffects: None + admissionReviewVersions: + - v1 + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - experiments +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/deployment.yaml new file mode 100644 index 00000000..e51c77ab --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/deployment.yaml @@ -0,0 +1,56 @@ +{{- if (include "kubeflow.katib.dbmanager.enabled" . | eq "true") -}} + + {{- $autoscalingEnabled := include "kubeflow.katib.dbmanager.autoscaling.enabled" . -}} + {{- $replicas := include "kubeflow.katib.dbmanager.autoscaling.minReplicas" . -}} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.katib.dbmanager.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.dbmanager.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.katib.dbmanager.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.katib.dbmanager.selectorLabels" . | nindent 8 }} + {{- with .Values.katib.dbmanager.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + containers: + - name: {{ include "kubeflow.katib.dbmanager.baseName" . }} + image: {{ include "kubeflow.katib.dbmanager.image" . }} # docker.io/kubeflowkatib/katib-db-manager + env: + {{- include "kubeflow.katib.dbmanager.config.db.driver.env.spec" . | nindent 12 }} + {{- include "kubeflow.katib.dbmanager.config.db.host.env.spec" . | nindent 12 }} + {{- include "kubeflow.katib.dbmanager.config.db.port.env.spec" . | nindent 12 }} + {{- include "kubeflow.katib.dbmanager.config.db.databaseName.env.spec" . | nindent 12 }} + {{- include "kubeflow.katib.dbmanager.config.db.user.env.spec" . | nindent 12 }} + {{- include "kubeflow.katib.dbmanager.config.db.password.env.spec" . | nindent 12 }} + command: + - "./katib-db-manager" + ports: + - name: api + containerPort: 6789 + livenessProbe: + grpc: + port: 6789 + initialDelaySeconds: 10 + periodSeconds: 60 + failureThreshold: 5 + {{- with .Values.katib.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/service.yaml new file mode 100644 index 00000000..61c101d9 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/db-manager/service.yaml @@ -0,0 +1,24 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +{{- if (include "kubeflow.katib.dbmanager.enabled" . | eq "true") -}} +--- +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.katib.dbmanager.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.katib.dbmanager.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.dbmanager.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + type: {{ .Values.katib.dbmanager.service.type }} + ports: + - port: 6789 + protocol: TCP + name: api + selector: + {{- include "kubeflow.katib.dbmanager.selectorLabels" . | nindent 4 }} +{{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/authorizationpolicy.yaml new file mode 100644 index 00000000..eec5f552 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/authorizationpolicy.yaml @@ -0,0 +1,22 @@ +{{- if (include "kubeflow.katib.ui.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.katib.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.katib.ui.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + namespaces: + # in upstream this is directly the istio-ingressgateway service account + # apps/katib/upstream/installs/katib-with-kubeflow/istio-authorizationpolicy.yaml + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/deployment.yaml new file mode 100644 index 00000000..247aa719 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/deployment.yaml @@ -0,0 +1,52 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +{{- if (include "kubeflow.katib.ui.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.katib.ui.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.katib.ui.autoscaling.minReplicas" . -}} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.katib.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.katib.ui.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.katib.ui.selectorLabels" . | nindent 8 }} + {{- with .Values.katib.ui.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + containers: + - name: {{ include "kubeflow.katib.ui.baseName" . }} + image: {{ include "kubeflow.katib.ui.image" . }} # kubeflowkatib/katib-ui + command: + - "./katib-ui" + args: + - "--port=8080" + env: + - name: KATIB_CORE_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: APP_DISABLE_AUTH + value: 'false' + ports: + - name: ui + containerPort: 8080 + serviceAccountName: {{ include "kubeflow.katib.ui.serviceAccountName" . }} + +{{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrole.yaml new file mode 100644 index 00000000..684b80da --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrole.yaml @@ -0,0 +1,44 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + {{- include "kubeflow.katib.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.mainClusterRoleName" . }} +rules: + - apiGroups: + - "" + resources: + - configmaps + - namespaces + verbs: + - "*" + - apiGroups: + - kubeflow.org + resources: + - experiments + - trials + - suggestions + verbs: + - "*" + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + # the following only in multi-user mode + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrolebinding.yaml new file mode 100644 index 00000000..03faad7d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/clusterrolebinding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + {{- include "kubeflow.katib.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.katib.ui.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.katib.ui.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/serviceaccount.yaml new file mode 100644 index 00000000..5539ff04 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/rbac/serviceaccount.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +{{- if (include "kubeflow.katib.ui.createServiceAccount" . | eq "true") -}} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.katib.ui.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.katib.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/service.yaml new file mode 100644 index 00000000..e90780e9 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.katib.enabled" . | eq "true") -}} +{{- if (include "kubeflow.katib.ui.enabled" . | eq "true") -}} +--- +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.katib.ui.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.katib.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + type: ClusterIP + ports: + - port: 80 + protocol: TCP + name: ui + targetPort: 8080 + selector: + {{- include "kubeflow.katib.ui.selectorLabels" . | nindent 4 }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/virtualservice.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/virtualservice.yaml new file mode 100644 index 00000000..e55ca465 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/ui/virtualservice.yaml @@ -0,0 +1,38 @@ +{{- if (include "kubeflow.katib.ui.createIstioIntegrationObjects" .) -}} + +# apps/katib/upstream/installs/katib-with-kubeflow/ui-virtual-service.yaml + +apiVersion: networking.istio.io/v1beta1 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.katib.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.katib.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.katib.urlPrefix }} # upstream contains trailing forward slash + rewrite: + uri: {{ .Values.katib.urlPrefix }} # upstream contains trailing forward slash + route: + - destination: + host: {{ include "kubeflow.katib.ui.svc.fqdn" . }} + port: + number: 80 + # maybe we don't need this... + headers: + request: + add: + x-forwarded-prefix: {{ .Values.katib.urlPrefix }} + Tracing-Context: {{ include "kubeflow.katib.ui.baseName" . }} + response: + add: + Tracing-Context: {{ include "kubeflow.katib.ui.baseName" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-admin.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-admin.yaml new file mode 100644 index 00000000..6b2c6d1c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-admin.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.katib.adminClusterRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.katib.adminClusterRoleLabel" . | nindent 8 }} +rules: [] diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-edit.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-edit.yaml new file mode 100644 index 00000000..5d0abdb0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-edit.yaml @@ -0,0 +1,35 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.katib.adminClusterRoleLabel" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.katib.editClusterRoleName" . }} +rules: + - apiGroups: + - kubeflow.org + resources: + - experiments + - trials + - suggestions + verbs: + - get + - list + - watch + - create + - delete + - deletecollection + - patch + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-view.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-view.yaml new file mode 100644 index 00000000..c82d58f9 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/katib/user-roles/clusterrole.kubeflow-katib-view.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.kubernetesViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.katib.viewClusterRoleName" . }} +rules: + - apiGroups: + - kubeflow.org + resources: + - experiments + - trials + - suggestions + verbs: + - get + - list + - watch diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.authrizationpolicies.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.authrizationpolicies.yaml new file mode 100644 index 00000000..d9ac47bc --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.authrizationpolicies.yaml @@ -0,0 +1,41 @@ +{{- if (include "kubeflow.knativeIntegration.createIstioIntegrationObjects" .) }} +--- +{{ include "istio.authorizationPolicy" (dict + "name" "activator-service" + "namespace" .Values.knativeIntegration.knativeServing.namespace + "action" "ALLOW" + "labels" (dict "app" "activator")) +}} + +--- +{{ include "istio.authorizationPolicy" (dict + "name" "autoscaler" + "namespace" .Values.knativeIntegration.knativeServing.namespace + "action" "ALLOW" + "labels" (dict "app" "autoscaler")) +}} + +--- +{{ include "istio.authorizationPolicy" (dict + "name" "controller" + "namespace" .Values.knativeIntegration.knativeServing.namespace + "action" "ALLOW" + "labels" (dict "app" "controller")) +}} + +--- +{{ include "istio.authorizationPolicy" (dict + "name" "istio-webhook" + "namespace" .Values.knativeIntegration.knativeServing.namespace + "action" "ALLOW" + "labels" (dict "app" "net-istio-webhook")) +}} + +--- +{{ include "istio.authorizationPolicy" (dict + "name" "webhook" + "namespace" .Values.knativeIntegration.knativeServing.namespace + "action" "ALLOW" + "labels" (dict "role" "webhook")) +}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.destinationrules.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.destinationrules.yaml new file mode 100644 index 00000000..7bd24f81 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/istio.destinationrules.yaml @@ -0,0 +1,16 @@ +{{/* +DestinationRule for mTLS +*/}} +{{- if (include "kubeflow.knativeIntegration.createIstioIntegrationObjects" .) }} + +apiVersion: "networking.istio.io/v1alpha3" +kind: DestinationRule +metadata: + name: knative + namespace: {{ .Values.knativeIntegration.knativeServing.namespace }} +spec: + host: "*.{{ .Values.knativeIntegration.knativeServing.namespace }}.svc.cluster.local" + trafficPolicy: + tls: + mode: ISTIO_MUTUAL +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.eventing.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.eventing.yaml new file mode 100644 index 00000000..9722fdf8 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.eventing.yaml @@ -0,0 +1,11 @@ +{{- if (include "kubeflow.knativeIntegration.knativeEventing.enabled" .) }} + +apiVersion: operator.knative.dev/v1beta1 +kind: KnativeEventing +metadata: + name: {{ .Values.knativeIntegration.knativeEventing.name }} + namespace: {{ .Values.knativeIntegration.knativeEventing.namespace }} +spec: + {{- toYaml .Values.knativeIntegration.knativeEventing.operatorSpec | nindent 2 -}} +{{- end }} + diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.serving.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.serving.yaml new file mode 100644 index 00000000..b9dac742 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/knative-integration/operator.knative.serving.yaml @@ -0,0 +1,10 @@ +{{- if (include "kubeflow.knativeIntegration.knativeServing.enabled" .) }} + +apiVersion: operator.knative.dev/v1beta1 +kind: KnativeServing +metadata: + name: {{ .Values.knativeIntegration.knativeServing.name }} + namespace: {{ .Values.knativeIntegration.knativeServing.namespace }} +spec: + {{- toYaml .Values.knativeIntegration.knativeServing.operatorSpec | nindent 2 -}} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/authorizationpolicy.yaml new file mode 100644 index 00000000..35f11e40 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/authorizationpolicy.yaml @@ -0,0 +1,21 @@ +{{- if (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true") -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.kserveModelsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.kserveModelsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: ALLOW + selector: + matchLabels: + {{- include "kubeflow.kserveModelsWebApp.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + namespaces: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role-binding.yaml new file mode 100644 index 00000000..186102bf --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role-binding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.kserveModelsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.kserveModelsWebApp.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.kserveModelsWebApp.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.kserveModelsWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role.yaml new file mode 100644 index 00000000..1b8c7b14 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cluster-role.yaml @@ -0,0 +1,55 @@ +{{- if (include "kubeflow.kserveModelsWebApp.rbac.createRole" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kserveModelsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.kserveModelsWebApp.mainClusterRoleName" . }} +rules: +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - "" + resources: + - namespaces + - pods + - pods/log + - events + verbs: + - get + - list +- apiGroups: + - serving.kserve.io + resources: + - inferenceservices + - inferenceservices/status + verbs: + - get + - list + - watch + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - serving.knative.dev + resources: + - services + - services/status + - routes + - routes/status + - configurations + - configurations/status + - revisions + - revisions/status + verbs: + - get + - list + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cm.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cm.yaml new file mode 100644 index 00000000..a7e27018 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/cm.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true" ) -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.kserveModelsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.kserveModelsWebApp.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + APP_DISABLE_AUTH: "True" + USERID_HEADER: {{ .Values.auth.userHeaderName | quote }} + APP_PREFIX: "{{ .Values.kserveModelsWebApp.config.urlPrefix }}" + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/deployment.yaml new file mode 100644 index 00000000..b1bbe6ef --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/deployment.yaml @@ -0,0 +1,79 @@ +{{- if (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.kserveModelsWebApp.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.kserveModelsWebApp.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "kubeflow.kserveModelsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.kserveModelsWebApp.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.kserveModelsWebApp.selectorLabels" . | nindent 8 }} + + spec: + containers: + - image: {{ include "kubeflow.kserveModelsWebApp.image" . }} + imagePullPolicy: {{ include "kubeflow.kserveModelsWebApp.imagePullPolicy" . }} + name: {{ include "kubeflow.kserveModelsWebApp.baseName" . }} + {{- with .Values.kserveModelsWebApp.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + envFrom: + - configMapRef: + name: {{ include "kubeflow.kserveModelsWebApp.configMapName" . }} + ports: + - containerPort: 5000 + name: http + livenessProbe: + httpGet: + path: /healthz/liveness + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + readinessProbe: + httpGet: + path: /healthz/readiness + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + serviceAccountName: {{ include "kubeflow.kserveModelsWebApp.serviceAccountName" . }} + {{- with include "kubeflow.kserveModelsWebApp.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.kserveModelsWebApp.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.kserveModelsWebApp.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.kserveModelsWebApp.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service-account.yaml new file mode 100644 index 00000000..2ac59c06 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service-account.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.kserveModelsWebApp.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.kserveModelsWebApp.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.kserveModelsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.kserveModelsWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service.yaml new file mode 100644 index 00000000..8a30246e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/service.yaml @@ -0,0 +1,24 @@ +{{- if (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.kserveModelsWebApp.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.kserveModelsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.kserveModelsWebApp.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 5000 + selector: + {{- include "kubeflow.kserveModelsWebApp.selectorLabels" . | nindent 4 }} + type: {{ .Values.kserveModelsWebApp.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/virtual-service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/virtual-service.yaml new file mode 100644 index 00000000..b93c6adf --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kserve-models-web-app/virtual-service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.kserveModelsWebApp.enabled" . | eq "true") -}} + +apiVersion: networking.istio.io/v1beta1 +kind: VirtualService +metadata: + name: {{ include "kubeflow.kserveModelsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ include "kubeflow.namespace" . }}/{{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.kserveModelsWebApp.config.urlPrefix }}/ + rewrite: + uri: / + route: + - destination: + host: {{ include "kubeflow.kserveModelsWebApp.svc.name" . }}.{{ include "kubeflow.namespace" . }}.svc.cluster.local + port: + number: 80 + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-pipelines-roles.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-pipelines-roles.yaml new file mode 100644 index 00000000..e8c8ae55 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-pipelines-roles.yaml @@ -0,0 +1,146 @@ +# NOTE: IMPORTANT +# We need to separate out actual rules from aggregation rules due to +# https://github.com/kubernetes/kubernetes/issues/65171 +# TL;DR: We can't have both aggregation and rules in a [Cluster]Role. When that +# is the case, the rules get ignored. +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubeflowPipelinesEditRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.kubeflowRoles.kubeflowPipelinesEditRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowPipelinesEditRoleLabel" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubeflowPipelinesViewRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.kubeflowRoles.kubeflowPipelinesViewRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowPipelinesEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.aggregateToKubeflowPipelinesEditRoleName" . }} +rules: +- apiGroups: + - pipelines.kubeflow.org + resources: + - pipelines + - pipelines/versions + verbs: + - create + - delete + - update +- apiGroups: + - pipelines.kubeflow.org + resources: + - experiments + verbs: + - archive + - create + - delete + - unarchive +- apiGroups: + - pipelines.kubeflow.org + resources: + - runs + verbs: + - archive + - create + - delete + - retry + - terminate + - unarchive + - reportMetrics + - readArtifact +- apiGroups: + - pipelines.kubeflow.org + resources: + - jobs + verbs: + - create + - delete + - disable + - enable +- apiGroups: + - kubeflow.org + verbs: + - '*' + resources: + - scheduledworkflows +- apiGroups: + - argoproj.io + verbs: + - '*' + resources: + - cronworkflows + - cronworkflows/finalizers + - workflows + - workflows/finalizers + - workfloweventbindings + - workflowtemplates + - workflowtaskresults + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowPipelinesViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.aggregateToKubeflowPipelinesViewRoleName" . }} +rules: +- apiGroups: + - pipelines.kubeflow.org + resources: + - pipelines + - pipelines/versions + - experiments + - jobs + verbs: + - get + - list +- apiGroups: + - pipelines.kubeflow.org + resources: + - runs + verbs: + - get + - list + - readArtifact +- apiGroups: + - kubeflow.org + resources: + - viewers + verbs: + - create + - get + - delete +- apiGroups: + - pipelines.kubeflow.org + resources: + - visualizations + verbs: + - create diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-roles.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-roles.yaml new file mode 100644 index 00000000..80486ba8 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubeflow-roles.yaml @@ -0,0 +1,43 @@ +# TODO: these roles should only be added in MULTIUSER mode. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubeflowAdminRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubeflowEditRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubeflowViewRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 6 }} +rules: [] diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubernetes-roles.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubernetes-roles.yaml new file mode 100644 index 00000000..cce4366b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/kubeflow-roles/kubernetes-roles.yaml @@ -0,0 +1,296 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubernetesAdminRoleName" . }} +rules: +- apiGroups: + - authorization.k8s.io + resources: + - localsubjectaccessreviews + verbs: + - create +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + - roles + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubernetesEditRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - pods/attach + - pods/exec + - pods/portforward + - pods/proxy + - secrets + - services/proxy + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - impersonate +- apiGroups: + - "" + resources: + - pods + - pods/attach + - pods/exec + - pods/portforward + - pods/proxy + verbs: + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - "" + resources: + - configmaps + - endpoints + - persistentvolumeclaims + - replicationcontrollers + - replicationcontrollers/scale + - secrets + - serviceaccounts + - services + - services/proxy + verbs: + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - apps + resources: + - daemonsets + - deployments + - deployments/rollback + - deployments/scale + - replicasets + - replicasets/scale + - statefulsets + - statefulsets/scale + verbs: + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - extensions + resources: + - daemonsets + - deployments + - deployments/rollback + - deployments/scale + - ingresses + - networkpolicies + - replicasets + - replicasets/scale + - replicationcontrollers/scale + verbs: + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - delete + - deletecollection + - patch + - update +- apiGroups: + - networking.k8s.io + resources: + - ingresses + - networkpolicies + verbs: + - create + - delete + - deletecollection + - patch + - update + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.kubeflowRoles.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.kubeflowRoles.kubernetesViewRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + - endpoints + - persistentvolumeclaims + - persistentvolumeclaims/status + - pods + - replicationcontrollers + - replicationcontrollers/scale + - serviceaccounts + - services + - services/status + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - bindings + - events + - limitranges + - namespaces/status + - pods/log + - pods/status + - replicationcontrollers/status + - resourcequotas + - resourcequotas/status + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch +- apiGroups: + - apps + resources: + - controllerrevisions + - daemonsets + - daemonsets/status + - deployments + - deployments/scale + - deployments/status + - replicasets + - replicasets/scale + - replicasets/status + - statefulsets + - statefulsets/scale + - statefulsets/status + verbs: + - get + - list + - watch +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + - horizontalpodautoscalers/status + verbs: + - get + - list + - watch +- apiGroups: + - batch + resources: + - cronjobs + - cronjobs/status + - jobs + - jobs/status + verbs: + - get + - list + - watch +- apiGroups: + - extensions + resources: + - daemonsets + - daemonsets/status + - deployments + - deployments/scale + - deployments/status + - ingresses + - ingresses/status + - networkpolicies + - replicasets + - replicasets/scale + - replicasets/status + - replicationcontrollers/scale + verbs: + - get + - list + - watch +- apiGroups: + - policy + resources: + - poddisruptionbudgets + - poddisruptionbudgets/status + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses + - ingresses/status + - networkpolicies + verbs: + - get + - list + - watch diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/authorizationpolicy.yaml new file mode 100644 index 00000000..582fd634 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/authorizationpolicy.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.modelRegistry.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: ALLOW + selector: + matchLabels: + {{- include "kubeflow.modelRegistry.selectorLabels" . | nindent 6 }} + rules: + - {} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/cm.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/cm.yaml new file mode 100644 index 00000000..49178724 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/cm.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.modelRegistry.enabled" . | eq "true" ) -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + MODEL_REGISTRY_REST_SERVICE_HOST: "{{ include "kubeflow.modelRegistry.svc.name" . }}" + MODEL_REGISTRY_REST_SERVICE_PORT: "{{ .Values.modelRegistry.service.restPort }}" + MODEL_REGISTRY_GRPC_SERVICE_HOST: "{{ include "kubeflow.modelRegistry.svc.name" . }}" + MODEL_REGISTRY_GRPC_SERVICE_PORT: "{{ .Values.modelRegistry.service.grpcPort }}" + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/deployment.yaml new file mode 100644 index 00000000..8580d239 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/deployment.yaml @@ -0,0 +1,156 @@ +{{- if (include "kubeflow.modelRegistry.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.modelRegistry.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.modelRegistry.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.modelRegistry.selectorLabels" . | nindent 6 }} + + template: + metadata: + {{- with .Values.modelRegistry.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "kubeflow.modelRegistry.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: rest-container + image: {{ include "kubeflow.modelRegistry.rest.image" . }} + imagePullPolicy: {{ include "kubeflow.modelRegistry.rest.imagePullPolicy" . }} + + command: + - /model-registry + - proxy + args: + - --hostname=0.0.0.0 + - --port=$(MODEL_REGISTRY_REST_SERVICE_PORT) + - --mlmd-hostname=localhost + - --mlmd-port=$(MODEL_REGISTRY_GRPC_SERVICE_PORT) + + envFrom: + - configMapRef: + name: {{ include "kubeflow.modelRegistry.configMapName" . }} + + ports: + - name: http-api + containerPort: {{ .Values.modelRegistry.service.restPort }} + + livenessProbe: + initialDelaySeconds: 30 + periodSeconds: 5 + tcpSocket: + port: http-api + timeoutSeconds: 2 + readinessProbe: + initialDelaySeconds: 3 + periodSeconds: 5 + tcpSocket: + port: http-api + timeoutSeconds: 2 + + {{- with .Values.modelRegistry.rest.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.modelRegistry.rest.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + - name: grpc-container + image: {{ include "kubeflow.modelRegistry.grpc.image" . }} + imagePullPolicy: {{ include "kubeflow.modelRegistry.grpc.imagePullPolicy" . }} + + command: + - /bin/metadata_store_server + args: + - "--grpc_port=$(MODEL_REGISTRY_GRPC_SERVICE_PORT)" + - "--mysql_config_user=$({{ include "kubeflow.modelRegistry.config.db.user.env.name" . }})" + - "--mysql_config_password=$({{ include "kubeflow.modelRegistry.config.db.password.env.name" . }})" + - "--mysql_config_host=$({{ include "kubeflow.modelRegistry.config.db.host.env.name" . }})" + - "--mysql_config_port=$({{ include "kubeflow.modelRegistry.config.db.port.env.name" . }})" + - "--mysql_config_database=$({{ include "kubeflow.modelRegistry.config.db.dbName.env.name" . }})" + + env: + {{- include "kubeflow.modelRegistry.config.db.user.env.spec" . | nindent 10 }} + {{- include "kubeflow.modelRegistry.config.db.password.env.spec" . | nindent 10 }} + {{- include "kubeflow.modelRegistry.config.db.host.env.spec" . | nindent 10 }} + {{- include "kubeflow.modelRegistry.config.db.port.env.spec" . | nindent 10 }} + {{- include "kubeflow.modelRegistry.config.db.dbName.env.spec" . | nindent 10 }} + + envFrom: + - configMapRef: + name: {{ include "kubeflow.modelRegistry.configMapName" . }} + + ports: + - name: grpc-api + containerPort: {{ .Values.modelRegistry.service.grpcPort }} + + livenessProbe: + tcpSocket: + port: grpc-api + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + readinessProbe: + tcpSocket: + port: grpc-api + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + + {{- with .Values.modelRegistry.grpc.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.modelRegistry.grpc.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.modelRegistry.serviceAccountName" . }} + + {{- with include "kubeflow.modelRegistry.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.modelRegistry.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.modelRegistry.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.modelRegistry.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/destinationrule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/destinationrule.yaml new file mode 100644 index 00000000..80efb127 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/destinationrule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.modelRegistry.createIstioIntegrationObjects" .) -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.modelRegistry.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/hpa.yaml new file mode 100644 index 00000000..cc2e572f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/hpa.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.modelRegistry.autoscaling.enabled" . | eq "true") -}} + +{{- $componentName := include "kubeflow.modelRegistry.name" . -}} +{{- $minReplicas := include "kubeflow.modelRegistry.autoscaling.minReplicas" . -}} +{{- $maxReplicas := include "kubeflow.modelRegistry.autoscaling.maxReplicas" . -}} +{{- $targetCPUUtilizationPercentage := include "kubeflow.modelRegistry.autoscaling.targetCPUUtilizationPercentage" . -}} +{{- $targetMemoryUtilizationPercentage := include "kubeflow.modelRegistry.autoscaling.targetMemoryUtilizationPercentage" . -}} + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ $componentName }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ $componentName }} + minReplicas: {{ $minReplicas }} + maxReplicas: {{ $maxReplicas }} + metrics: + {{- if $targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ $targetCPUUtilizationPercentage }} + {{- end }} + {{- if $targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ $targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/poddisruptionbudget.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/poddisruptionbudget.yaml new file mode 100644 index 00000000..2e0e639c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.modelRegistry.pdb.create" . | eq "true") -}} + +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.modelRegistry.selectorLabels" . | nindent 6 }} + {{- with (include "kubeflow.modelRegistry.pdb.values" .) }} + {{- . | nindent 2 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/service.yaml new file mode 100644 index 00000000..b241a303 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/service.yaml @@ -0,0 +1,29 @@ +{{- if (include "kubeflow.modelRegistry.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.modelRegistry.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: {{ .Values.modelRegistry.service.restPort }} + protocol: TCP + appProtocol: http + name: http-api + - port: {{ .Values.modelRegistry.service.grpcPort }} + protocol: TCP + appProtocol: grpc + name: grpc-api + selector: + {{- include "kubeflow.modelRegistry.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.modelRegistry.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/serviceaccount.yaml new file mode 100644 index 00000000..92c609b7 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.modelRegistry.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.modelRegistry.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/virtualservice.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/virtualservice.yaml new file mode 100644 index 00000000..4364dfa2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/model-registry/virtualservice.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.modelRegistry.createIstioIntegrationObjects" .) -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.modelRegistry.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.modelRegistry.config.rest.urlPrefix }} + route: + - destination: + host: {{ include "kubeflow.modelRegistry.svc.fqdn" . }} + port: + number: {{ .Values.modelRegistry.service.restPort }} + - match: + - port: {{ .Values.modelRegistry.service.grpcPort }} + - authority: + regex: {{ include "kubeflow.modelRegistry.svc.name" . }}(\..+)?(:{{ .Values.modelRegistry.service.grpcPort }})? + - uri: + prefix: {{ .Values.modelRegistry.config.grpc.urlPrefix }} + route: + - destination: + host: {{ include "kubeflow.modelRegistry.svc.fqdn" . }} + port: + number: {{ .Values.modelRegistry.service.grpcPort }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/admission-webhook.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/admission-webhook.yaml new file mode 100644 index 00000000..8a080b19 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/admission-webhook.yaml @@ -0,0 +1,30 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +{{/* +Admission Webhook is also known as PodDefaults. +*/}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.admissionWebhook.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.admissionWebhook.name" . }} # mutating webhook + # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html + # The kubernetes api server must reach the webhook + ingress: + - ports: + - protocol: TCP + port: {{ .Values.admissionWebhook.service.targetPort }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/centraldashboard.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/centraldashboard.yaml new file mode 100644 index 00000000..319ae42c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/centraldashboard.yaml @@ -0,0 +1,29 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.centraldashboard.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.centraldashboard.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + - podSelector: {} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/default-allow-same-namespace.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/default-allow-same-namespace.yaml new file mode 100644 index 00000000..2f4a76a2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/default-allow-same-namespace.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: default-allow-same-namespace + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: {} + ingress: + - from: + - podSelector: {} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-controller.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-controller.yaml new file mode 100644 index 00000000..56749591 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-controller.yaml @@ -0,0 +1,33 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.controller.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.katib.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.katib.controller.name" . }} + # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html + # The kubernetes api server must reach the webhook + ingress: + - ports: # webhook + - protocol: TCP + port: {{ .Values.katib.controller.service.webhook.targetPort }} + - ports: # metrics + - protocol: TCP + port: {{ .Values.katib.controller.service.metrics.targetPort }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-db-manager.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-db-manager.yaml new file mode 100644 index 00000000..8b0ceff7 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-db-manager.yaml @@ -0,0 +1,34 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.dbmanager.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + # the metrics loggers write directly to this database + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.katib.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.katib.dbmanager.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: app.kubernetes.io/part-of + operator: In + values: + - kubeflow-profile + - podSelector: {} # allow all pods from the same namespace + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-ui.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-ui.yaml new file mode 100644 index 00000000..3d1ce28b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/katib-ui.yaml @@ -0,0 +1,32 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.katib.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.katib.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.katib.ui.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/kserve-models-web-app.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/kserve-models-web-app.yaml new file mode 100644 index 00000000..e10a2f6d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/kserve-models-web-app.yaml @@ -0,0 +1,28 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.kserveModelsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.kserveModelsWebApp.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-apiserver.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-apiserver.yaml new file mode 100644 index 00000000..7cbd166a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-apiserver.yaml @@ -0,0 +1,38 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.pipelines.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.pipelines.mlPipeline.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: app.kubernetes.io/part-of + operator: In + values: + - kubeflow-profile + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-cache.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-cache.yaml new file mode 100644 index 00000000..59c8c7e5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-cache.yaml @@ -0,0 +1,30 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.pipelines.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.pipelines.cache.name" . }} # mutating webhook + # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html + # The kubernetes api server must reach the webhook + ingress: + - ports: + - protocol: TCP + port: {{ .Values.pipelines.cache.service.targetPort }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-envoy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-envoy.yaml new file mode 100644 index 00000000..0c0d70c5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-envoy.yaml @@ -0,0 +1,33 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataEnvoy.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.pipelines.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.pipelines.metadataEnvoy.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + - podSelector: {} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-grpc-server.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-grpc-server.yaml new file mode 100644 index 00000000..b589b84a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-metadata-grpc-server.yaml @@ -0,0 +1,33 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataGrpcServer.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.pipelines.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.pipelines.metadataGrpcServer.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: app.kubernetes.io/part-of + operator: In + values: + - kubeflow-profile + - podSelector: {} # allow all pods from the same namespace + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-ui.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-ui.yaml new file mode 100644 index 00000000..f3a15c20 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/ml-pipeline-ui.yaml @@ -0,0 +1,32 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.pipelines.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.pipelines.ui.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/model-registry.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/model-registry.yaml new file mode 100644 index 00000000..6de89019 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/model-registry.yaml @@ -0,0 +1,39 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.modelRegistry.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.modelRegistry.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: app.kubernetes.io/part-of + operator: In + values: + - kubeflow-profile + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + ports: + - port: {{ .Values.modelRegistry.service.restPort }} + protocol: TCP + - port: {{ .Values.modelRegistry.service.grpcPort }} + protocol: TCP + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-jupyter-web-app.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-jupyter-web-app.yaml new file mode 100644 index 00000000..cec14c84 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-jupyter-web-app.yaml @@ -0,0 +1,33 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.notebooks.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.notebooks.jupyterWebApp.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + - podSelector: {} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-pvcviewer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-pvcviewer.yaml new file mode 100644 index 00000000..2d2cbec1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-pvcviewer.yaml @@ -0,0 +1,30 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.notebooks.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.notebooks.pvcviewerController.name" . }} + # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html + # The kubernetes api server must reach the webhook + ingress: + - ports: + - protocol: TCP + port: {{ include "kubeflow.notebooks.pvcviewerController.webhook.port" . }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-volumes-web-app.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-volumes-web-app.yaml new file mode 100644 index 00000000..f6cc2989 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/notebooks-volumes-web-app.yaml @@ -0,0 +1,33 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.notebooks.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.notebooks.volumesWebApp.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + - podSelector: {} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/tensorboards-web-app.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/tensorboards-web-app.yaml new file mode 100644 index 00000000..2d82dfb6 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/tensorboards-web-app.yaml @@ -0,0 +1,35 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.tensorboard.name" . }} + - key: app.kubernetes.io/subcomponent + operator: In + values: + - {{ include "kubeflow.tensorboard.tensorboardsWebApp.name" . }} + ingress: + - from: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + ports: + - protocol: TCP + port: {{ .Values.tensorboard.tensorboardsWebApp.service.targetPort }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/training-operator-webhook.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/training-operator-webhook.yaml new file mode 100644 index 00000000..63f8914f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/networkpolicies/training-operator-webhook.yaml @@ -0,0 +1,26 @@ +{{- if (include "kubeflow.networkPolicies.enabled" .) -}} + +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "kubeflow.networkPolicies.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.name" . }}-webhook + namespace: {{ include "kubeflow.namespace" . }} +spec: + podSelector: + matchExpressions: + - key: app.kubernetes.io/component + operator: In + values: + - {{ include "kubeflow.trainingOperator.name" . }} + # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html + # The kubernetes api server must reach the webhook + ingress: + - ports: + - protocol: TCP + port: {{ include "kubeflow.notebooks.pvcviewerController.webhook.port" . }} + policyTypes: + - Ingress + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/deployment.yaml new file mode 100644 index 00000000..e3d4808b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/deployment.yaml @@ -0,0 +1,71 @@ +{{- if (include "kubeflow.notebooks.controller.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.notebooks.controller.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.notebooks.controller.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.notebooks.controller.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.notebooks.controller.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: {{ include "kubeflow.notebooks.controller.baseName" . }} + image: {{ include "kubeflow.notebooks.controller.image" . }} + imagePullPolicy: {{ include "kubeflow.notebooks.controller.imagePullPolicy" . }} + + command: + - /manager + + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + + env: + - name: USE_ISTIO + value: {{ .Values.istioIntegration.enabled | quote }} + - name: ISTIO_GATEWAY + value: {{ include "kubeflow.namespace" . }}/{{ .Values.istioIntegration.gateway.name }} + - name: ISTIO_HOST + value: "*" + - name: CLUSTER_DOMAIN + value: {{ .Values.clusterDomain }} + - name: ENABLE_CULLING + value: {{ .Values.notebooks.controller.config.culling.enabled | quote }} + - name: CULL_IDLE_TIME + value: {{ .Values.notebooks.controller.config.culling.idleTimeMinutes | quote }} + - name: IDLENESS_CHECK_PERIOD + value: {{ .Values.notebooks.controller.config.culling.idleCheckPeriodMinutes | quote }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "kubeflow.notebooks.controller.serviceAccountName" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrole.main.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrole.main.yaml new file mode 100644 index 00000000..4eabbe6e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrole.main.yaml @@ -0,0 +1,55 @@ +{{- if (include "kubeflow.notebooks.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.mainClusterRoleName" . }} +rules: +- apiGroups: + - apps + resources: + - statefulsets + verbs: + - '*' +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - watch +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - services + verbs: + - '*' +- apiGroups: + - kubeflow.org + resources: + - notebooks + - notebooks/finalizers + - notebooks/status + verbs: + - '*' +- apiGroups: + - networking.istio.io + resources: + - virtualservices + verbs: + - '*' + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrolebinding.main.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrolebinding.main.yaml new file mode 100644 index 00000000..ae2b88a2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterrolebinding.main.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.notebooks.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.notebooks.controller.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.notebooks.controller.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterroles.user.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterroles.user.yaml new file mode 100644 index 00000000..fba2a5b4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/clusterroles.user.yaml @@ -0,0 +1,62 @@ +{{- if (include "kubeflow.notebooks.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.kfNbAdminClusterRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.notebooks.controller.kfNbAdminClusterRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + {{- include "kubeflow.notebooks.controller.kfNbAdminClusterRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.kfNbEditClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - notebooks + - notebooks/status + verbs: + - get + - list + - watch + - create + - delete + - deletecollection + - patch + - update + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.kfNbViewClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - notebooks + - notebooks/status + verbs: + - get + - list + - watch + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/role.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/role.leader-election.yaml new file mode 100644 index 00000000..d25471a0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/role.leader-election.yaml @@ -0,0 +1,38 @@ +{{- if (include "kubeflow.notebooks.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.leaderElectionRoleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/rolebinding.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/rolebinding.leader-election.yaml new file mode 100644 index 00000000..484fdae7 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/rolebinding.leader-election.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.notebooks.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.leaderElectionRoleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "kubeflow.notebooks.controller.leaderElectionRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.notebooks.controller.serviceAccountName" .}} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/serviceaccount.yaml new file mode 100644 index 00000000..b70de3c9 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/rbac/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.notebooks.controller.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.notebooks.controller.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/service.yaml new file mode 100644 index 00000000..a691d5b4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/controller/service.yaml @@ -0,0 +1,22 @@ +{{- if (include "kubeflow.notebooks.controller.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.notebooks.controller.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.controller.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: 443 + selector: + {{- include "kubeflow.notebooks.controller.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.notebooks.controller.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/NOTES.txt b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/NOTES.txt new file mode 100644 index 00000000..2e8a9be5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/NOTES.txt @@ -0,0 +1 @@ +The Role and RoleBinding were not added because of https://github.com/kubeflow/manifests/issues/2601 diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.extAuth.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.extAuth.yaml new file mode 100644 index 00000000..0a119299 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.extAuth.yaml @@ -0,0 +1,29 @@ +{{- if and + (include "kubeflow.notebooks.jupyterWebApp.createIstioIntegrationObjects" . | eq "true") + (include "kubeflow.istioIntegration.authorizationMode.granular" . | eq "true") +-}} + +# NOTE: this AuthorizationPolicy forces traffic through ext authz http extension +# so we don't have to provide configuration to allow traffic only from +# istio-ingressgateway. The .spec.rules.to.operations.notPaths is configured for +# CloudFlare integration and allows only static, non-secret assets to be +# accessible without the Istio Auth. + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.authorizationPolicyExtAuthName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: CUSTOM + provider: + name: {{ .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} + rules: + - {} + selector: + matchLabels: + {{- include "kubeflow.notebooks.jupyterWebApp.selectorLabels" . | nindent 6 }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.yaml new file mode 100644 index 00000000..8e35226b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/authorizationpolicy.yaml @@ -0,0 +1,20 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.notebooks.jupyterWebApp.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + namespaces: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role-binding.yaml new file mode 100644 index 00000000..aabda11d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role-binding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.notebooks.jupyterWebApp.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.notebooks.jupyterWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role.yaml new file mode 100644 index 00000000..c80c7615 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cluster-role.yaml @@ -0,0 +1,123 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.mainClusterRoleName" . }} +rules: +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - kubeflow.org + resources: + - notebooks + - notebooks/finalizers + - poddefaults + verbs: + - get + - list + - create + - delete + - patch + - update +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete + - get + - list +- apiGroups: + - "" + resources: + - events + - nodes + verbs: + - list +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - list + - get + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.kfNbUiAdminClusterRoleName" . }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.kfNbUiEditClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - notebooks + - notebooks/finalizers + - poddefaults + verbs: + - get + - list + - create + - delete + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.kfNbUiViewClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - notebooks + - notebooks/finalizers + - poddefaults + verbs: + - get + - list +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.logos.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.logos.yaml new file mode 100644 index 00000000..14a24039 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.logos.yaml @@ -0,0 +1,229 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.logos.createConfigMap" . | eq "true" ) -}} + +{{- $jupyterIconSvg := .Values.notebooks.jupyterWebApp.logos.icons.jupyterIconSvg -}} +{{- $jupyterLabLogoSvg := .Values.notebooks.jupyterWebApp.logos.icons.jupyterLabLogoSvg -}} +{{- $groupOneLogoSvg := .Values.notebooks.jupyterWebApp.logos.icons.groupOneLogoSvg -}} +{{- $groupOneIconSvg := .Values.notebooks.jupyterWebApp.logos.icons.groupOneIconSvg -}} +{{- $groupTwoIconSvg := .Values.notebooks.jupyterWebApp.logos.icons.groupTwoIconSvg -}} +{{- $groupTwoLogoSvg := .Values.notebooks.jupyterWebApp.logos.icons.groupTwoLogoSvg -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.logos.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + jupyter-icon.svg: | + {{- if $jupyterIconSvg }} + {{- $jupyterIconSvg | nindent 4 }} + {{ else }} + + Created using Figma 0.90 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {{- end }} + jupyterlab-logo.svg: | + {{- if $jupyterLabLogoSvg }} + {{- $jupyterLabLogoSvg | nindent 4 }} + {{ else }} + + + + + + {{- end }} + group-one-icon.svg: |- + {{- if $groupOneIconSvg }} + {{- $groupOneIconSvg | nindent 4 }} + {{ else }} + + + + + + + + + {{- end }} + group-one-logo.svg: |- + {{- if $groupOneLogoSvg }} + {{- $groupOneLogoSvg | nindent 4 }} + {{ else }} + + + + + + + + + {{- end }} + group-two-icon.svg: |- + {{- if $groupTwoIconSvg }} + {{- $groupTwoIconSvg | nindent 4 }} + {{ else }} + + + + + + + + + {{- end }} + group-two-logo.svg: |- + {{- if $groupTwoLogoSvg }} + {{- $groupTwoLogoSvg | nindent 4 }} + {{ else }} + + + + + + + + + {{- end }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.spawner-ui.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.spawner-ui.yaml new file mode 100644 index 00000000..cd1f6210 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/cm.spawner-ui.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.enabled" . | eq "true" ) -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.spawnerUI.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + spawner_ui_config.yaml: | + spawnerFormDefaults: + {{- toYaml .Values.notebooks.jupyterWebApp.spawnerFormDefaults | nindent 6 }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/deployment.yaml new file mode 100644 index 00000000..265a30ba --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/deployment.yaml @@ -0,0 +1,100 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.notebooks.jupyterWebApp.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.notebooks.jupyterWebApp.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.notebooks.jupyterWebApp.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: {{ include "kubeflow.notebooks.jupyterWebApp.baseName" . }} + image: {{ include "kubeflow.notebooks.jupyterWebApp.image" . }} + imagePullPolicy: {{ include "kubeflow.notebooks.jupyterWebApp.imagePullPolicy" . }} + + ports: + - containerPort: 5000 + protocol: TCP + + {{- with .Values.notebooks.jupyterWebApp.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + volumeMounts: + - mountPath: /etc/config + name: config-volume + - mountPath: /src/apps/default/static/assets/logos + name: logos-volume + + env: + - name: APP_PREFIX + value: {{ .Values.notebooks.jupyterWebApp.urlPrefix }} + - name: UI + value: {{ .Values.notebooks.jupyterWebApp.uiFlavor }} + - name: USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: USERID_PREFIX + value: {{ .Values.auth.userIdPrefix | quote }} + - name: APP_SECURE_COOKIES + value: {{ .Values.notebooks.jupyterWebApp.secureCookies | quote }} + + {{- with include "kubeflow.notebooks.jupyterWebApp.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.notebooks.jupyterWebApp.serviceAccountName" . }} + + volumes: + - name: config-volume + configMap: + name: {{ include "kubeflow.notebooks.jupyterWebApp.spawnerUI.configMapName" . }} + - name: logos-volume + configMap: + name: {{ include "kubeflow.notebooks.jupyterWebApp.logos.configMapName" . }} + + {{- with include "kubeflow.notebooks.jupyterWebApp.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.jupyterWebApp.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.jupyterWebApp.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.jupyterWebApp.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/destination-rule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/destination-rule.yaml new file mode 100644 index 00000000..14497016 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/destination-rule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.notebooks.jupyterWebApp.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/hpa.yaml new file mode 100644 index 00000000..1d82eb32 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/hpa.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.autoscaling.enabled" . | eq "true") -}} + +{{- $componentName := include "kubeflow.notebooks.jupyterWebApp.name" . -}} +{{- $minReplicas := include "kubeflow.notebooks.jupyterWebApp.autoscaling.minReplicas" . -}} +{{- $maxReplicas := include "kubeflow.notebooks.jupyterWebApp.autoscaling.maxReplicas" . -}} +{{- $targetCPUUtilizationPercentage := include "kubeflow.notebooks.jupyterWebApp.autoscaling.targetCPUUtilizationPercentage" . -}} +{{- $targetMemoryUtilizationPercentage := include "kubeflow.notebooks.jupyterWebApp.autoscaling.targetMemoryUtilizationPercentage" . -}} + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ $componentName }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ $componentName }} + minReplicas: {{ $minReplicas }} + maxReplicas: {{ $maxReplicas }} + metrics: + {{- if $targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ $targetCPUUtilizationPercentage }} + {{- end }} + {{- if $targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ $targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/poddisruptionbudget.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/poddisruptionbudget.yaml new file mode 100644 index 00000000..e7552b06 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.pdb.create" . | eq "true") -}} + +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.notebooks.jupyterWebApp.selectorLabels" . | nindent 6 }} + {{- with (include "kubeflow.notebooks.jupyterWebApp.pdb.values" .) }} + {{- . | nindent 2 }} + {{- end }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service-account.yaml new file mode 100644 index 00000000..1ebeb8c6 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service-account.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.notebooks.jupyterWebApp.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service.yaml new file mode 100644 index 00000000..2da61632 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.notebooks.jupyterWebApp.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 5000 + selector: + {{- include "kubeflow.notebooks.jupyterWebApp.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.notebooks.jupyterWebApp.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/virtual-service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/virtual-service.yaml new file mode 100644 index 00000000..1010dd08 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/jupyter-web-app/virtual-service.yaml @@ -0,0 +1,31 @@ +{{- if (include "kubeflow.notebooks.jupyterWebApp.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.notebooks.jupyterWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.jupyterWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.notebooks.jupyterWebApp.urlPrefix }}/ + rewrite: + uri: / + route: + - destination: + host: {{ include "kubeflow.notebooks.jupyterWebApp.svc.fqdn" . }} + port: + number: 80 + headers: + request: + add: + x-forwarded-prefix: {{ .Values.notebooks.jupyterWebApp.urlPrefix }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.certificate.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.certificate.yaml new file mode 100644 index 00000000..554a67eb --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.certificate.yaml @@ -0,0 +1,21 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.enabledWithCertManager" . )}} + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.certName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + dnsNames: + - {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.name" . }} + - {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.addressWithNs" . }} + - {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.addressWithSvc" . }} + - {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.fqdn" . }} + issuerRef: + kind: Issuer + name: {{ include "kubeflow.notebooks.pvcviewerController.certIssuerName" . }} + secretName: {{ include "kubeflow.notebooks.pvcviewerController.tlsCertSecretName" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.issuer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.issuer.yaml new file mode 100644 index 00000000..e52f06f2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/certmanager.issuer.yaml @@ -0,0 +1,13 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.enabledWithCertManager" . )}} + +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.certIssuerName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selfSigned: {} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/deployment.yaml new file mode 100644 index 00000000..5a6e0d6f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/deployment.yaml @@ -0,0 +1,144 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.notebooks.pvcviewerController.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.notebooks.pvcviewerController.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.notebooks.pvcviewerController.selectorLabels" . | nindent 6 }} + + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + traffic.sidecar.istio.io/excludeInboundPorts: {{ include "kubeflow.notebooks.pvcviewerController.webhook.port" . | quote }} + labels: + {{- include "kubeflow.notebooks.pvcviewerController.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: manager + image: {{ include "kubeflow.notebooks.pvcviewerController.manager.image" . }} + imagePullPolicy: {{ include "kubeflow.notebooks.pvcviewerController.manager.imagePullPolicy" . }} + + args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + + ports: + - containerPort: {{ include "kubeflow.notebooks.pvcviewerController.webhook.port" . }} + name: webhook-server + protocol: TCP + + {{- with .Values.notebooks.pvcviewerController.manager.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + + {{- with include "kubeflow.notebooks.pvcviewerController.manager.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + - name: kube-rbac-proxy + image: {{ include "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.image" . }} + imagePullPolicy: {{ include "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.imagePullPolicy" . }} + + args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + + ports: + - containerPort: 8443 + name: https + protocol: TCP + + {{- with .Values.notebooks.pvcviewerController.kubeRbacProxy.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.notebooks.pvcviewerController.serviceAccountName" . }} + + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: {{ include "kubeflow.notebooks.pvcviewerController.tlsCertSecretName" . }} + + {{- with include "kubeflow.notebooks.pvcviewerController.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.pvcviewerController.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.pvcviewerController.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.pvcviewerController.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.pvcviewerController.terminationGracePeriodSeconds" . }} + terminationGracePeriodSeconds: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.pvcviewerController.securityContext" . }} + securityContext: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.manager.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.manager.yaml new file mode 100644 index 00000000..809a6b34 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.manager.yaml @@ -0,0 +1,83 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.mainClusterRoleName" . }} +rules: +- apiGroups: + - apps + resources: + - deployments + verbs: + - create + - get + - list + - update + - watch +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - services + verbs: + - create + - get + - list + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - pvcviewers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - pvcviewers/finalizers + verbs: + - update +- apiGroups: + - kubeflow.org + resources: + - pvcviewers/status + verbs: + - get + - patch + - update +- apiGroups: + - networking.istio.io + resources: + - virtualservices + verbs: + - create + - get + - list + - update + - watch + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.metrics-reader.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.metrics-reader.yaml new file mode 100644 index 00000000..10061844 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.metrics-reader.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.metricsReaderClusterRoleName" . }} +rules: +- nonResourceURLs: + - /metrics + verbs: + - get + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.proxy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.proxy.yaml new file mode 100644 index 00000000..e6dcf396 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrole.proxy.yaml @@ -0,0 +1,23 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.proxyClusterRoleName" . }} +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.manager.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.manager.yaml new file mode 100644 index 00000000..925b08d1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.manager.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.notebooks.pvcviewerController.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.notebooks.pvcviewerController.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.proxy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.proxy.yaml new file mode 100644 index 00000000..17679fc1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/clusterrolebinding.proxy.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.proxyClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.notebooks.pvcviewerController.proxyClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.notebooks.pvcviewerController.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/role.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/role.leader-election.yaml new file mode 100644 index 00000000..d74e2f93 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/role.leader-election.yaml @@ -0,0 +1,43 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.leaderElectionRoleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/rolebinding.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/rolebinding.leader-election.yaml new file mode 100644 index 00000000..a1dd7ce4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/rolebinding.leader-election.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.leaderElectionRoleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "kubeflow.notebooks.pvcviewerController.leaderElectionRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.notebooks.pvcviewerController.serviceAccountName" .}} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_editor_role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_editor_role.yaml new file mode 100644 index 00000000..1c56f01e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_editor_role.yaml @@ -0,0 +1,36 @@ +{{/* +# Permissions for end users to edit pvcviewers. +# Currently not used anywhere. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: clusterrole + app.kubernetes.io/instance: pvcviewer-editor-role + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: pvc-viewer + app.kubernetes.io/part-of: pvc-viewer + app.kubernetes.io/managed-by: kustomize + name: pvcviewer-editor-role +rules: +- apiGroups: + - kubeflow.org + resources: + - pvcviewers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - pvcviewers/status + verbs: + - get + +*/}} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_viewer_role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_viewer_role.yaml new file mode 100644 index 00000000..75545786 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/rbac/volumesviewer_viewer_role.yaml @@ -0,0 +1,32 @@ +{{/* +# Permissions for end users to view pvcviewers. +# Currently not used anywhere. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: clusterrole + app.kubernetes.io/instance: pvcviewer-viewer-role + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: pvc-viewer + app.kubernetes.io/part-of: pvc-viewer + app.kubernetes.io/managed-by: kustomize + name: pvcviewer-viewer-role +rules: +- apiGroups: + - kubeflow.org + resources: + - pvcviewers + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - pvcviewers/status + verbs: + - get + +*/}} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.kube-rbac-proxy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.kube-rbac-proxy.yaml new file mode 100644 index 00000000..895a2baa --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.kube-rbac-proxy.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.notebooks.pvcviewerController.kubeRbacProxy.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.kubeRbacProxy.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: https + port: 8443 + protocol: TCP + targetPort: https + selector: + {{- include "kubeflow.notebooks.pvcviewerController.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.notebooks.pvcviewerController.kubeRbacProxy.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.manager.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.manager.yaml new file mode 100644 index 00000000..8c43a1b1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/service.manager.yaml @@ -0,0 +1,24 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.notebooks.pvcviewerController.manager.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: 443 + protocol: TCP + targetPort: {{ include "kubeflow.notebooks.pvcviewerController.webhook.port" . }} + selector: + {{- include "kubeflow.notebooks.pvcviewerController.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.notebooks.pvcviewerController.manager.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/serviceaccount.yaml new file mode 100644 index 00000000..20fb9750 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.notebooks.pvcviewerController.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/mutating.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/mutating.yaml new file mode 100644 index 00000000..e73b3f18 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/mutating.yaml @@ -0,0 +1,38 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.enabled" .) -}} + +{{- $ca := printf "%s/%s" + (include "kubeflow.namespace" .) + (include "kubeflow.notebooks.pvcviewerController.certName" .) +-}} + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ $ca }} + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.mutatingWebhookName" . }} +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.name" .}} + namespace: {{ include "kubeflow.namespace" . }} + path: /mutate-kubeflow-org-v1alpha1-pvcviewer + failurePolicy: Fail + name: {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.addressWithSvc" . }} + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - pvcviewers + sideEffects: None + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/validating.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/validating.yaml new file mode 100644 index 00000000..2d20fbf1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/pvcviewer-controller/webhook/validating.yaml @@ -0,0 +1,38 @@ +{{- if (include "kubeflow.notebooks.pvcviewerController.enabled" .) -}} + +{{- $ca := printf "%s/%s" + (include "kubeflow.namespace" .) + (include "kubeflow.notebooks.pvcviewerController.certName" .) +-}} + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ $ca }} + labels: + {{- include "kubeflow.notebooks.pvcviewerController.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.pvcviewerController.validatingWebhookName" . }} +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.name" .}} + namespace: {{ include "kubeflow.namespace" . }} + path: /validate-kubeflow-org-v1alpha1-pvcviewer + failurePolicy: Fail + name: {{ include "kubeflow.notebooks.pvcviewerController.manager.svc.addressWithSvc" . }} + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - pvcviewers + sideEffects: None + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.extAuth.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.extAuth.yaml new file mode 100644 index 00000000..6795b4bd --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.extAuth.yaml @@ -0,0 +1,29 @@ +{{- if and + (include "kubeflow.notebooks.volumesWebApp.createIstioIntegrationObjects" . | eq "true") + (include "kubeflow.istioIntegration.authorizationMode.granular" . | eq "true") +-}} + +# NOTE: this AuthorizationPolicy forces traffic through ext authz http extension +# so we don't have to provide configuration to allow traffic only from +# istio-ingressgateway. The .spec.rules.to.operations.notPaths is configured for +# CloudFlare integration and allows only static, non-secret assets to be +# accessible without the Istio Auth. + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.authorizationPolicyExtAuthName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: CUSTOM + provider: + name: {{ .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} + rules: + - {} + selector: + matchLabels: + {{- include "kubeflow.notebooks.volumesWebApp.selectorLabels" . | nindent 6 }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.yaml new file mode 100644 index 00000000..5e58d1fe --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/authorizationpolicy.yaml @@ -0,0 +1,20 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.notebooks.volumesWebApp.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + namespaces: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role-binding.yaml new file mode 100644 index 00000000..f653e7d8 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role-binding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.notebooks.volumesWebApp.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.notebooks.volumesWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role.yaml new file mode 100644 index 00000000..89e780ee --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cluster-role.yaml @@ -0,0 +1,143 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.mainClusterRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - namespaces + - pods + verbs: + - get + - list +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete + - get + - list + - watch + - update + - patch +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - list +- apiGroups: + - kubeflow.org + resources: + - notebooks + verbs: + - list +- apiGroups: + - kubeflow.org + resources: + - pvcviewers + verbs: + - get + - list + - create + - delete + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.kfVolUiAdminClusterRoleName" . }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.kfVolUiEditClusterRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete + - get + - list + - watch + - update + - patch +- apiGroups: + - kubeflow.org + resources: + - pvcviewers + verbs: + - get + - list + - create + - delete + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.kfVolUiViewClusterRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - watch +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - pvcviewers + verbs: + - get + - list + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cm.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cm.yaml new file mode 100644 index 00000000..66630fa8 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/cm.yaml @@ -0,0 +1,59 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.enabled" . | eq "true" ) -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + viewer-spec.yaml: | + # Note: the volumes-web-app allows expanding strings using ${VAR_NAME} + # You may use any environment variable. This lets us e.g. specify images that can be modified using kustomize's image transformer. + # Additionally, 'PVC_NAME', 'NAME' and 'NAMESPACE' are defined + # Name of the pvc is set by the volumes web app + pvc: $NAME + podSpec: + serviceAccountName: {{ .Values.notebooks.volumesWebApp.config.viewer.serviceAccountName }} + containers: + - name: main + image: {{ include "kubeflow.notebooks.volumesWebApp.viewerImage" . }} + env: + - name: FB_ADDRESS + value: "0.0.0.0" + - name: FB_PORT + value: "8080" + - name: FB_DATABASE + value: /tmp/filebrowser.db + - name: FB_NOAUTH + value: "true" + - name: FB_BASEURL + value: /pvcviewers/$NAMESPACE/$NAME/ + readinessProbe: + tcpSocket: + port: 8080 + initialDelaySeconds: 2 + periodSeconds: 10 + # viewer-volume is provided automatically by the volumes web app + volumeMounts: + - name: viewer-volume + mountPath: /srv + workingDir: /srv + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumes: + - name: viewer-volume + persistentVolumeClaim: + claimName: $NAME + networking: + targetPort: 8080 + basePrefix: "/pvcviewers" + rewrite: "/" + timeout: 30s + rwoScheduling: true + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/deployment.yaml new file mode 100644 index 00000000..ec0a8c66 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/deployment.yaml @@ -0,0 +1,94 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.notebooks.volumesWebApp.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.notebooks.volumesWebApp.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.notebooks.volumesWebApp.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: {{ include "kubeflow.notebooks.volumesWebApp.baseName" . }} + image: {{ include "kubeflow.notebooks.volumesWebApp.image" . }} + imagePullPolicy: {{ include "kubeflow.notebooks.volumesWebApp.imagePullPolicy" . }} + + ports: + - containerPort: 5000 + protocol: TCP + + {{- with .Values.notebooks.volumesWebApp.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + volumeMounts: + - mountPath: /etc/config/viewer-spec.yaml + name: viewer-spec + subPath: viewer-spec.yaml + + env: + - name: APP_PREFIX + value: {{ .Values.notebooks.volumesWebApp.config.urlPrefix }} + - name: USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: USERID_PREFIX + value: {{ .Values.auth.userIdPrefix | quote }} + - name: APP_SECURE_COOKIES + value: {{ .Values.notebooks.volumesWebApp.config.secureCookies | quote }} + + {{- with include "kubeflow.notebooks.volumesWebApp.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.notebooks.volumesWebApp.serviceAccountName" . }} + + volumes: + - name: viewer-spec + configMap: + name: {{ include "kubeflow.notebooks.volumesWebApp.configMapName" . }} + + {{- with include "kubeflow.notebooks.volumesWebApp.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.volumesWebApp.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.volumesWebApp.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.notebooks.volumesWebApp.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/destination-rule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/destination-rule.yaml new file mode 100644 index 00000000..a3e276e9 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/destination-rule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.notebooks.volumesWebApp.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/hpa.yaml new file mode 100644 index 00000000..41620b82 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/hpa.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.autoscaling.enabled" . | eq "true") -}} + +{{- $componentName := include "kubeflow.notebooks.volumesWebApp.name" . -}} +{{- $minReplicas := include "kubeflow.notebooks.volumesWebApp.autoscaling.minReplicas" . -}} +{{- $maxReplicas := include "kubeflow.notebooks.volumesWebApp.autoscaling.maxReplicas" . -}} +{{- $targetCPUUtilizationPercentage := include "kubeflow.notebooks.volumesWebApp.autoscaling.targetCPUUtilizationPercentage" . -}} +{{- $targetMemoryUtilizationPercentage := include "kubeflow.notebooks.volumesWebApp.autoscaling.targetMemoryUtilizationPercentage" . -}} + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ $componentName }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ $componentName }} + minReplicas: {{ $minReplicas }} + maxReplicas: {{ $maxReplicas }} + metrics: + {{- if $targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ $targetCPUUtilizationPercentage }} + {{- end }} + {{- if $targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ $targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/poddisruptionbudget.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/poddisruptionbudget.yaml new file mode 100644 index 00000000..d9ba40b4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.pdb.create" . | eq "true") -}} + +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.notebooks.volumesWebApp.selectorLabels" . | nindent 6 }} + {{- with (include "kubeflow.notebooks.volumesWebApp.pdb.values" .) }} + {{- . | nindent 2 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service-account.yaml new file mode 100644 index 00000000..23c72629 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service-account.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.notebooks.volumesWebApp.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service.yaml new file mode 100644 index 00000000..e8881467 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.notebooks.volumesWebApp.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 5000 + selector: + {{- include "kubeflow.notebooks.volumesWebApp.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.notebooks.volumesWebApp.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/virtual-service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/virtual-service.yaml new file mode 100644 index 00000000..7939994e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/notebooks/volumes-web-app/virtual-service.yaml @@ -0,0 +1,31 @@ +{{- if (include "kubeflow.notebooks.volumesWebApp.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.notebooks.volumesWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.notebooks.volumesWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.notebooks.volumesWebApp.config.urlPrefix }}/ + rewrite: + uri: / + route: + - destination: + host: {{ include "kubeflow.notebooks.volumesWebApp.svc.fqdn" . }} + port: + number: 80 + headers: + request: + add: + x-forwarded-prefix: {{ .Values.notebooks.volumesWebApp.config.urlPrefix }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/oauth2-proxy-integration/virtualservice.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/oauth2-proxy-integration/virtualservice.yaml new file mode 100644 index 00000000..bd34ef7f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/oauth2-proxy-integration/virtualservice.yaml @@ -0,0 +1,23 @@ +{{- if (include "kubeflow.oauth2ProxyIntegration.istio.enabled" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: {{ .Values.oauth2ProxyIntegration.svc.name }} + namespace: {{ .Values.oauth2ProxyIntegration.svc.namespace }} +spec: + gateways: + - {{ include "kubeflow.namespace" . }}/{{ .Values.istioIntegration.gateway.name }} + hosts: + - "{{ default "*" .Values.oauth2ProxyIntegration.host }}" + http: + - match: + - uri: + prefix: {{ .Values.oauth2ProxyIntegration.urlPrefix }}/ + route: + - destination: + host: {{ .Values.oauth2ProxyIntegration.svc.name }}.{{ .Values.oauth2ProxyIntegration.svc.namespace }}.svc.cluster.local + port: + number: {{ .Values.oauth2ProxyIntegration.svc.port }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/_notes.txt b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/_notes.txt new file mode 100644 index 00000000..cd988a3f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/_notes.txt @@ -0,0 +1,5 @@ +CRDs: +from cluster-scoped-resources all copied to helm charts crds directory +requiring argo wf as subchart + +investigate if it makes sense to add crd/applications.app.k8s.io diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/authorizationpolicy.yaml new file mode 100644 index 00000000..3c52cdc0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/authorizationpolicy.yaml @@ -0,0 +1,17 @@ +{{- if (include "kubeflow.pipelines.cache.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.pipelines.cache.selectorLabels" . | nindent 6 }} + rules: + - {} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.certificate.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.certificate.yaml new file mode 100644 index 00000000..ccaff1f1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.certificate.yaml @@ -0,0 +1,23 @@ +{{- if (include "kubeflow.pipelines.cache.enabledWithCertManager" . )}} + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.certName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + commonName: {{ include "kubeflow.pipelines.cache.certName" . }} + isCA: true + dnsNames: + - {{ include "kubeflow.pipelines.cache.svc.name" . }} + - {{ include "kubeflow.pipelines.cache.svc.addressWithNs" . }} + - {{ include "kubeflow.pipelines.cache.svc.addressWithSvc" . }} + - {{ include "kubeflow.pipelines.cache.svc.fqdn" . }} + issuerRef: + kind: Issuer + name: {{ include "kubeflow.pipelines.cache.certIssuerName" . }} + secretName: {{ include "kubeflow.pipelines.cache.tlsCertSecretName" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.issuer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.issuer.yaml new file mode 100644 index 00000000..2ffdc030 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/certmanager.issuer.yaml @@ -0,0 +1,13 @@ +{{- if (include "kubeflow.pipelines.cache.enabledWithCertManager" . )}} + +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.certIssuerName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selfSigned: {} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/deployment.yaml new file mode 100644 index 00000000..40cd5f0c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/deployment.yaml @@ -0,0 +1,127 @@ +{{- if (include "kubeflow.pipelines.cache.enabled" .) -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.cache.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.cache.autoscaling.minReplicas" . -}} + +# TODO: Add cache-deployer if cert-manager integration is disabled. +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.cache.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.pipelines.cache.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: server + image: {{ include "kubeflow.pipelines.cache.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.cache.imagePullPolicy" . }} + + args: + - --db_user=$({{ include "kubeflow.pipelines.cache.config.db.user.env.name" . }}) + - --db_password=$({{ include "kubeflow.pipelines.cache.config.db.password.env.name" . }}) + - --db_host=$({{ include "kubeflow.pipelines.cache.config.db.host.env.name" . }}) + - --db_port=$({{ include "kubeflow.pipelines.cache.config.db.port.env.name" . }}) + - --db_driver=$({{ include "kubeflow.pipelines.cache.config.db.driver.env.name" . }}) + - --db_name=$({{ include "kubeflow.pipelines.cache.config.db.cacheDatabaseName.env.name" . }}) + - --namespace_to_watch=$(NAMESPACE_TO_WATCH) + - --listen_port=$(WEBHOOK_PORT) + {{- if (include "kubeflow.certManagerIntegration.enabled" . )}} + - --tls_cert_filename=tls.crt + - --tls_key_filename=tls.key + {{- end }} + + env: + {{- include "kubeflow.pipelines.cache.config.db.user.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.cache.config.db.password.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.cache.config.db.host.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.cache.config.db.port.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.cache.config.db.driver.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.cache.config.db.cacheDatabaseName.env.spec" . | nindent 8 }} + + - name: DEFAULT_CACHE_STALENESS + value: {{ .Values.pipelines.cache.config.defaultCacheStaleness | quote }} + - name: MAXIMUM_CACHE_STALENESS + value: {{ .Values.pipelines.cache.config.maximumCacheStaleness | quote }} + - name: CACHE_IMAGE + value: {{ .Values.pipelines.cache.config.cacheImage }} + - name: CACHE_NODE_RESTRICTIONS + value: {{ .Values.pipelines.cache.config.cacheNodeRestrictions | quote }} + - name: WEBHOOK_PORT + value: {{ .Values.pipelines.cache.service.targetPort | quote }} + + - name: NAMESPACE_TO_WATCH + {{- if (include "kubeflow.deploymentMode.namespace" .) }} + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- else }} + value: "" + {{- end }} + + ports: + - containerPort: {{ .Values.pipelines.cache.service.targetPort }} + name: webhook-api + + {{- with .Values.pipelines.cache.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.cache.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + volumeMounts: + - name: webhook-tls-certs + mountPath: /etc/webhook/certs + readOnly: true + + volumes: + - name: webhook-tls-certs + secret: + secretName: {{ include "kubeflow.pipelines.cache.tlsCertSecretName" . }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.cache.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.cache.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.cache.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.cache.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.cache.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/mutatingwebhook.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/mutatingwebhook.yaml new file mode 100644 index 00000000..6c191e51 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/mutatingwebhook.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.pipelines.cache.enabled" .) -}} + +{{- $ca := printf "%s/%s" + (include "kubeflow.namespace" .) + (include "kubeflow.pipelines.cache.certName" .) +-}} + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ $ca }} + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.webhookName" . }} +webhooks: + - name: {{ include "kubeflow.pipelines.cache.svc.addressWithSvc" . }} + clientConfig: + service: + name: {{ include "kubeflow.pipelines.cache.svc.name" .}} + namespace: {{ include "kubeflow.namespace" . }} + path: "/mutate" + rules: + - operations: [ "CREATE" ] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods"] + failurePolicy: Ignore + sideEffects: None + timeoutSeconds: 5 + objectSelector: + matchLabels: + {{- include "kubeflow.pipelines.cache.cacheEnabledLabel" . | nindent 8}} + admissionReviewVersions: ["v1beta1"] + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/role-or-clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/role-or-clusterrole.yaml new file mode 100644 index 00000000..5125f5c5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/role-or-clusterrole.yaml @@ -0,0 +1,57 @@ +{{- if (include "kubeflow.pipelines.cache.enabled" .) -}} + +{{- $kind := ternary "ClusterRole" "Role" (include "kubeflow.deploymentMode.cluster" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ $kind }} +metadata: + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.roleName" .}} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - update + - patch +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - update + - patch +- apiGroups: + - tekton.dev + resources: + - pipelineruns + - customruns + - taskruns + - conditions + - runs + - tasks + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/rolebinding-or-clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/rolebinding-or-clusterrolebinding.yaml new file mode 100644 index 00000000..e7c0a262 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/rolebinding-or-clusterrolebinding.yaml @@ -0,0 +1,22 @@ +{{- if (include "kubeflow.pipelines.cache.enabled" .) -}} + +{{- $kind := ternary "ClusterRoleBinding" "RoleBinding" (include "kubeflow.deploymentMode.cluster" . | eq "true") -}} +{{- $roleRefKind := ternary "ClusterRole" "Role" (include "kubeflow.deploymentMode.cluster" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ $kind }} +metadata: + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.roleBindingName" .}} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: {{ $roleRefKind }} + name: {{ include "kubeflow.pipelines.cache.roleName" .}} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.cache.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/sa.yaml new file mode 100644 index 00000000..577b15ea --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.cache.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.cache.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/service.yaml new file mode 100644 index 00000000..fa5093c5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/cache/service.yaml @@ -0,0 +1,47 @@ +{{- if (include "kubeflow.pipelines.cache.enabled" .) -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.pipelines.cache.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.cache.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: {{ .Values.pipelines.cache.service.port }} + targetPort: webhook-api + selector: + {{- include "kubeflow.pipelines.cache.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.cache.service.type }} + +--- + +# TODO: having this SVC is a workaround... cache-server service might be hardcoded... + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.pipelines.cache.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.cache.labels" . | nindent 4 }} + name: cache-server + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: {{ .Values.pipelines.cache.service.port }} + targetPort: webhook-api + selector: + {{- include "kubeflow.pipelines.cache.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.cache.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/authorizationpolicy.yaml new file mode 100644 index 00000000..7d149086 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/authorizationpolicy.yaml @@ -0,0 +1,41 @@ +{{- if (include "kubeflow.pipelines.mlPipeline.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.pipelines.mlPipeline.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.pipelines.mlPipeline.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + principals: + - {{ include "kubeflow.pipelines.mlPipeline.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.ui.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.persistenceAgent.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.scheduledWorkflow.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.viewerCrd.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.cache.serviceAccountPrincipal" . }} + + # NOTE(kromanow94): with m2m tokens through istio/oauth2-proxy and + # ml-pipeline-ui, the following is probably not needed anymore. + # NOTE(kromanow94) UPDATE!!!: It's needed, otherwise the KF Pipeline Steps + # cannot reach ml-pipeline and appareantly it's needed to process the step... + # For user workloads, which cannot use http headers for authentication + # Allow all requests that dont have a `kubeflow-userid` header. + - when: + - key: request.headers[{{ .Values.auth.userHeaderName }}] + notValues: ['*'] + + # allow access by any trusted principal + # Please see the following for reference: + # https://github.com/kubeflow/manifests/issues/2747 + - from: + - source: + requestPrincipals: ["*"] +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/deployment.yaml new file mode 100644 index 00000000..f67303ad --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/deployment.yaml @@ -0,0 +1,162 @@ +{{- if (include "kubeflow.pipelines.mlPipeline.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.mlPipeline.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.mlPipeline.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.mlPipeline.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.mlPipeline.selectorLabels" . | nindent 6 }} + + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + labels: + {{- include "kubeflow.pipelines.mlPipeline.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: ml-pipeline-api-server + image: {{ include "kubeflow.pipelines.mlPipeline.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.mlPipeline.imagePullPolicy" . }} + + env: + {{- include "kubeflow.pipelines.mlPipeline.config.db.user.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.db.password.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.db.host.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.db.port.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.db.pipelineDatabaseName.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.db.conMaxLifetime.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.db.driver.env.spec" . | nindent 8 }} + + {{- include "kubeflow.pipelines.mlPipeline.config.objectStore.accessKey.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.objectStore.secretAccessKey.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.objectStore.host.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.objectStore.port.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.objectStore.region.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.objectStore.bucketName.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.mlPipeline.config.objectStore.secure.env.spec" . | nindent 8 }} + + # --- + # variables from pipeline-api-server-config-dc9hkg52h6 + # TODO: parameterize DEFAULTPIPELINERUNNERSERVICEACCOUNT + - name: DEFAULTPIPELINERUNNERSERVICEACCOUNT + value: default-editor + - name: MULTIUSER + value: {{ (include "kubeflow.isMultiuser" .) | quote }} + - name: VISUALIZATIONSERVICE_NAME + value: ml-pipeline-visualizationserver + - name: VISUALIZATIONSERVICE_PORT + value: "8888" + - name: LOG_LEVEL + value: "info" + # --- + + - name: KUBEFLOW_USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: KUBEFLOW_USERID_PREFIX + value: {{ .Values.auth.userIdPrefix | quote }} + - name: AUTO_UPDATE_PIPELINE_DEFAULT_VERSION + value: {{ .Values.pipelines.mlPipeline.config.autoUpdatePipelineDefaultVersion | quote }} + + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + + ports: + - name: http + containerPort: 8888 + - name: grpc + containerPort: 8887 + + # readinessProbe: + # exec: + # command: + # - wget + # - -q # quiet + # - -S # show server response + # - -O + # - "-" # Redirect output to stdout + # - http://localhost:8888/apis/v1beta1/healthz + # initialDelaySeconds: 3 + # periodSeconds: 5 + # timeoutSeconds: 2 + # livenessProbe: + # exec: + # command: + # - wget + # - -q # quiet + # - -S # show server response + # - -O + # - "-" # Redirect output to stdout + # - http://localhost:8888/apis/v1beta1/healthz + # initialDelaySeconds: 3 + # periodSeconds: 5 + # timeoutSeconds: 2 + # # This startup probe provides up to a 60 second grace window before the + # # liveness probe takes over to accomodate the occasional database + # # migration. + # startupProbe: + # exec: + # command: + # - wget + # - -q # quiet + # - -S # show server response + # - -O + # - "-" # Redirect output to stdout + # - http://localhost:8888/apis/v1beta1/healthz + # failureThreshold: 12 + # periodSeconds: 5 + # timeoutSeconds: 2 + + {{- with .Values.pipelines.mlPipeline.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.mlPipeline.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.mlPipeline.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.mlPipeline.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.mlPipeline.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.mlPipeline.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.mlPipeline.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/destinationrule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/destinationrule.yaml new file mode 100644 index 00000000..43419ead --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/destinationrule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.pipelines.mlPipeline.createIstioIntegrationObjects" .) -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.pipelines.mlPipeline.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.pipelines.mlPipeline.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/role-or-clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/role-or-clusterrole.yaml new file mode 100644 index 00000000..1aa0a28b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/role-or-clusterrole.yaml @@ -0,0 +1,85 @@ +{{- if (include "kubeflow.pipelines.mlPipeline.rbac.createRoles" .) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.mlPipeline.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.roleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - get + - list + - delete +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + verbs: + - create + - get + - list + - update + - patch + - delete +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + - conditions + - runs + - tasks + - customruns + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - custom.tekton.dev + resources: + - pipelineloops + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/rolebinding-or-clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/rolebinding-or-clusterrolebinding.yaml new file mode 100644 index 00000000..aa9961c8 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/rolebinding-or-clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.pipelines.mlPipeline.rbac.createRoles" .) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleBindingKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.mlPipeline.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.roleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} + name: {{ include "kubeflow.pipelines.mlPipeline.roleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.mlPipeline.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/sa.yaml new file mode 100644 index 00000000..0a57ee60 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.mlPipeline.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.mlPipeline.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.mlPipeline.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/service.yaml new file mode 100644 index 00000000..a2da4146 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/service.yaml @@ -0,0 +1,32 @@ +{{- if (include "kubeflow.pipelines.mlPipeline.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + annotations: + {{- with .Values.pipelines.mlPipeline.service.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + prometheus.io/port: "8888" + prometheus.io/scheme: http + prometheus.io/scrape: "true" + labels: + {{- include "kubeflow.pipelines.mlPipeline.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.mlPipeline.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: 8888 + protocol: TCP + targetPort: 8888 + - name: grpc + port: 8887 + protocol: TCP + targetPort: 8887 + selector: + {{- include "kubeflow.pipelines.mlPipeline.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.mlPipeline.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/deployment.yaml new file mode 100644 index 00000000..8ba88c2e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/deployment.yaml @@ -0,0 +1,76 @@ +{{- if (include "kubeflow.pipelines.metadataEnvoy.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.metadataEnvoy.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.metadataEnvoy.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.metadataEnvoy.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataEnvoy.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.metadataEnvoy.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.pipelines.metadataEnvoy.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: metadata-envoy + image: {{ include "kubeflow.pipelines.metadataEnvoy.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.metadataEnvoy.imagePullPolicy" . }} + + ports: + - name: md-envoy + containerPort: 9090 + - name: envoy-admin + containerPort: 9901 + + {{- with .Values.pipelines.metadataEnvoy.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataEnvoy.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.metadataEnvoy.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.metadataEnvoy.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataEnvoy.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataEnvoy.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataEnvoy.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/sa.yaml new file mode 100644 index 00000000..94ce2414 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.metadataEnvoy.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.metadataEnvoy.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.metadataEnvoy.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataEnvoy.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/service.yaml new file mode 100644 index 00000000..e73db2f7 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-envoy/service.yaml @@ -0,0 +1,41 @@ +{{- if (include "kubeflow.pipelines.metadataEnvoy.enabled" . | eq "true") -}} + +kind: Service +apiVersion: v1 +metadata: + labels: + {{- include "kubeflow.pipelines.metadataEnvoy.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataEnvoy.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: 9090 + protocol: TCP + name: md-envoy + selector: + {{- include "kubeflow.pipelines.metadataEnvoy.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.metadataEnvoy.service.type }} + +--- + +# TODO: having this SVC is a workaround... metadata-envoy service might be hardcoded... + +kind: Service +apiVersion: v1 +metadata: + labels: + {{- include "kubeflow.pipelines.metadataEnvoy.labels" . | nindent 4 }} + name: metadata-envoy-service + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: 9090 + protocol: TCP + name: md-envoy + selector: + {{- include "kubeflow.pipelines.metadataEnvoy.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.metadataEnvoy.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/authorizationpolicy.yaml new file mode 100644 index 00000000..bb40e261 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/authorizationpolicy.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.pipelines.metadataGrpcServer.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataGrpcServer.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: ALLOW + selector: + matchLabels: + {{- include "kubeflow.pipelines.metadataGrpcServer.selectorLabels" . | nindent 6 }} + rules: + - {} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/deployment.yaml new file mode 100644 index 00000000..2c61f12b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/deployment.yaml @@ -0,0 +1,103 @@ +{{- if (include "kubeflow.pipelines.metadataGrpcServer.enabled" .) -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.metadataGrpcServer.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.metadataGrpcServer.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataGrpcServer.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.metadataGrpcServer.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.selectorLabels" . | nindent 8 }} + spec: + containers: + - name: metadata-grpc-server + image: {{ include "kubeflow.pipelines.metadataGrpcServer.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.metadataGrpcServer.imagePullPolicy" . }} + + env: + {{- include "kubeflow.pipelines.metadataGrpcServer.config.db.user.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.metadataGrpcServer.config.db.password.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.metadataGrpcServer.config.db.host.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.metadataGrpcServer.config.db.port.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.metadataGrpcServer.config.db.mlmdDatabaseName.env.spec" . | nindent 8 }} + + command: ["/bin/metadata_store_server"] + args: + - --grpc_port={{ .Values.pipelines.metadataGrpcServer.service.port }} + - --mysql_config_user=$({{ include "kubeflow.pipelines.metadataGrpcServer.config.db.user.env.name" . }}) + - --mysql_config_password=$({{ include "kubeflow.pipelines.metadataGrpcServer.config.db.password.env.name" . }}) + - --mysql_config_host=$({{ include "kubeflow.pipelines.metadataGrpcServer.config.db.host.env.name" . }}) + - --mysql_config_port=$({{ include "kubeflow.pipelines.metadataGrpcServer.config.db.port.env.name" . }}) + - --mysql_config_database=$({{ include "kubeflow.pipelines.metadataGrpcServer.config.db.mlmdDatabaseName.env.name" .}}) + - --enable_database_upgrade=true + + ports: + - name: grpc-api + containerPort: {{ .Values.pipelines.metadataGrpcServer.service.port }} + + livenessProbe: + tcpSocket: + port: grpc-api + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + readinessProbe: + tcpSocket: + port: grpc-api + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + + {{- with .Values.pipelines.metadataGrpcServer.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataGrpcServer.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.metadataGrpcServer.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.metadataGrpcServer.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataGrpcServer.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataGrpcServer.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataGrpcServer.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/destinationrule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/destinationrule.yaml new file mode 100644 index 00000000..81691043 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/destinationrule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.pipelines.metadataGrpcServer.createIstioIntegrationObjects" .) -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataGrpcServer.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.pipelines.metadataGrpcServer.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/sa.yaml new file mode 100644 index 00000000..da5c3ed2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.metadataGrpcServer.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.metadataGrpcServer.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataGrpcServer.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/service.yaml new file mode 100644 index 00000000..aef9c67a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/service.yaml @@ -0,0 +1,55 @@ +{{- if (include "kubeflow.pipelines.metadataGrpcServer.enabled" . | eq "true") -}} + +kind: Service +apiVersion: v1 +metadata: + {{- with .Values.pipelines.metadataGrpcServer.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataGrpcServer.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: {{ .Values.pipelines.metadataGrpcServer.service.port }} + protocol: TCP + name: grpc-api + selector: + {{- include "kubeflow.pipelines.metadataGrpcServer.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.metadataGrpcServer.service.type }} + +--- + +# TODO: having this SVC is a workaround... metadata-grpc service might be hardcoded... +# Consider adding following snipper: +# env: +# - name: METADATA_GRPC_SERVICE_SERVICE_HOST +# value: {{ include "kubeflow.pipelines.metadataGrpcServer.svc.name" . }} +# - name: METADATA_GRPC_SERVICE_SERVICE_PORT +# value: "8080" + +kind: Service +apiVersion: v1 +metadata: + {{- with .Values.pipelines.metadataGrpcServer.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.labels" . | nindent 4 }} + name: metadata-grpc-service + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: {{ .Values.pipelines.metadataGrpcServer.service.port }} + protocol: TCP + name: grpc-api + selector: + {{- include "kubeflow.pipelines.metadataGrpcServer.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.metadataGrpcServer.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/virtualservice.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/virtualservice.yaml new file mode 100644 index 00000000..8d74abb9 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-grpc-server/virtualservice.yaml @@ -0,0 +1,28 @@ +{{- if (include "kubeflow.pipelines.metadataGrpcServer.createIstioIntegrationObjects" . ) -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.pipelines.metadataGrpcServer.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataGrpcServer.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + # TODO: parameterize all VS Hosts. + - '*' + http: + - match: + - uri: + prefix: {{ .Values.pipelines.metadataGrpcServer.config.urlPrefix }} + rewrite: + uri: {{ .Values.pipelines.metadataGrpcServer.config.urlPrefix }} + route: + - destination: + host: {{ include "kubeflow.pipelines.metadataEnvoy.svc.fqdn" . }} + port: + number: 9090 + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/deployment.yaml new file mode 100644 index 00000000..d25d2037 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/deployment.yaml @@ -0,0 +1,84 @@ +{{- if (include "kubeflow.pipelines.metadataWriter.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.metadataWriter.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.metadataWriter.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.metadataWriter.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataWriter.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.metadataWriter.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.pipelines.metadataWriter.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: main + image: {{ include "kubeflow.pipelines.metadataWriter.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.metadataWriter.imagePullPolicy" . }} + + env: + - name: METADATA_GRPC_SERVICE_SERVICE_HOST + value: {{ include "kubeflow.pipelines.metadataGrpcServer.svc.name" . }} + - name: METADATA_GRPC_SERVICE_SERVICE_PORT + value: "8080" + - name: NAMESPACE_TO_WATCH + {{- if (include "kubeflow.deploymentMode.namespace" .) }} + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- else }} + value: "" + {{- end }} + + {{- with .Values.pipelines.metadataWriter.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataWriter.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.metadataWriter.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.metadataWriter.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataWriter.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataWriter.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.metadataWriter.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/role-or-clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/role-or-clusterrole.yaml new file mode 100644 index 00000000..f3020959 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/role-or-clusterrole.yaml @@ -0,0 +1,38 @@ +{{- if (include "kubeflow.pipelines.metadataWriter.rbac.createRoles" .) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.metadataWriter.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataWriter.roleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - update + - patch +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - update + - patch + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/rolebinding-or-clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/rolebinding-or-clusterrolebinding.yaml new file mode 100644 index 00000000..b4dee83c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/rolebinding-or-clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.pipelines.metadataWriter.rbac.createRoles" .) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleBindingKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.metadataWriter.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataWriter.roleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} + name: {{ include "kubeflow.pipelines.metadataWriter.roleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.metadataWriter.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/sa.yaml new file mode 100644 index 00000000..0aff38a1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/metadata-writer/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.metadataWriter.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.metadataWriter.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.metadataWriter.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.metadataWriter.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/deployment.yaml new file mode 100644 index 00000000..65245f20 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/deployment.yaml @@ -0,0 +1,100 @@ +{{- if (include "kubeflow.pipelines.persistenceAgent.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.persistenceAgent.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.persistenceAgent.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.persistenceAgent.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.persistenceAgent.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.persistenceAgent.selectorLabels" . | nindent 6 }} + + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + labels: + {{- include "kubeflow.pipelines.persistenceAgent.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: ml-pipeline-persistenceagent + image: {{ include "kubeflow.pipelines.persistenceAgent.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.persistenceAgent.imagePullPolicy" . }} + + env: + - name: TTL_SECONDS_AFTER_WORKFLOW_FINISH + value: {{ .Values.pipelines.persistenceAgent.config.ttlSecondsAfterWorkflowFinish | quote }} + - name: NUM_WORKERS + value: {{ .Values.pipelines.persistenceAgent.config.numWorkers | quote }} + - name: NAMESPACE + {{- if (include "kubeflow.deploymentMode.namespace" .) }} + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- else }} + value: "" + {{- end }} + + {{- with .Values.pipelines.persistenceAgent.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.persistenceAgent.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + volumeMounts: + - mountPath: /var/run/secrets/kubeflow/tokens + name: persistenceagent-sa-token + + volumes: + - name: persistenceagent-sa-token + projected: + sources: + - serviceAccountToken: + path: persistenceagent-sa-token + expirationSeconds: 3600 + audience: pipelines.kubeflow.org + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.persistenceAgent.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.persistenceAgent.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.persistenceAgent.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.persistenceAgent.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.persistenceAgent.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/role-or-clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/role-or-clusterrole.yaml new file mode 100644 index 00000000..cc91248e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/role-or-clusterrole.yaml @@ -0,0 +1,42 @@ +{{- if (include "kubeflow.pipelines.persistenceAgent.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.persistenceAgent.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.persistenceAgent.roleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + verbs: + - get + - list + - watch +- apiGroups: + - pipelines.kubeflow.org + resources: + - scheduledworkflows + - workflows + verbs: + - report +- apiGroups: + - pipelines.kubeflow.org + resources: + - runs + verbs: + - reportMetrics + - readArtifact + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/rolebinding-or-clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/rolebinding-or-clusterrolebinding.yaml new file mode 100644 index 00000000..7b95e0b3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/rolebinding-or-clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.pipelines.persistenceAgent.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleBindingKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.persistenceAgent.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.persistenceAgent.roleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} + name: {{ include "kubeflow.pipelines.persistenceAgent.roleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.persistenceAgent.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/sa.yaml new file mode 100644 index 00000000..879d6b9f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/persistenceagent/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.persistenceAgent.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.persistenceAgent.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.persistenceAgent.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.persistenceAgent.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/deployment.yaml new file mode 100644 index 00000000..71b3418e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/deployment.yaml @@ -0,0 +1,87 @@ +{{- if (include "kubeflow.pipelines.scheduledWorkflow.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.scheduledWorkflow.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.scheduledWorkflow.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.scheduledWorkflow.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.scheduledWorkflow.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.scheduledWorkflow.selectorLabels" . | nindent 6 }} + + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + labels: + {{- include "kubeflow.pipelines.scheduledWorkflow.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: ml-pipeline-scheduledworkflow + image: {{ include "kubeflow.pipelines.scheduledWorkflow.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.scheduledWorkflow.imagePullPolicy" . }} + + env: + - name: LOG_LEVEL + value: "info" + - name: CRON_SCHEDULE_TIMEZONE + value: {{ .Values.pipelines.scheduledWorkflow.config.cronScheduleTimezone | quote }} + + - name: NAMESPACE + {{- if (include "kubeflow.deploymentMode.namespace" .) }} + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- else }} + value: "" + {{- end }} + + {{- with .Values.pipelines.scheduledWorkflow.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.scheduledWorkflow.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: ml-pipeline-scheduledworkflow + + {{- with include "kubeflow.pipelines.scheduledWorkflow.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.scheduledWorkflow.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.scheduledWorkflow.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.scheduledWorkflow.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/role-or-clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/role-or-clusterrole.yaml new file mode 100644 index 00000000..3d4603a2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/role-or-clusterrole.yaml @@ -0,0 +1,44 @@ +{{- if (include "kubeflow.pipelines.scheduledWorkflow.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.scheduledWorkflow.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.scheduledWorkflow.roleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - kubeflow.org + resources: + - scheduledworkflows + - scheduledworkflows/finalizers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - '' + resources: + - events + verbs: + - create + - patch + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/rolebinding-or-clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/rolebinding-or-clusterrolebinding.yaml new file mode 100644 index 00000000..bb0353e4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/rolebinding-or-clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.pipelines.scheduledWorkflow.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleBindingKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.scheduledWorkflow.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.scheduledWorkflow.roleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} + name: {{ include "kubeflow.pipelines.scheduledWorkflow.roleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.scheduledWorkflow.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/sa.yaml new file mode 100644 index 00000000..0ced5506 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/scheduledworkflow/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.scheduledWorkflow.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.scheduledWorkflow.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.scheduledWorkflow.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.scheduledWorkflow.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/secret.mlpipeline-minio-artifact.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/secret.mlpipeline-minio-artifact.yaml new file mode 100644 index 00000000..0f9ed5f2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/secret.mlpipeline-minio-artifact.yaml @@ -0,0 +1,27 @@ +{{- if and + (include "kubeflow.pipelines.enabled" .) + (eq .Values.pipelines.config.objectStore.existingSecretName nil) + (eq .Values.pipelines.config.objectStore.accessKey.secretKeyRef.name nil) + (eq .Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name nil) +-}} + +{{/* +NOTE/TODO: this secret name is hardcoded: +* <=2.1.0: + https://github.com/kubeflow/pipelines/blob/2.1.0/backend/src/v2/objectstore/object_store.go#L292 +* >=2.2.0 (state as of 2nd May 2024) + https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L39 +*/}} + +kind: Secret +apiVersion: v1 +metadata: + labels: + {{- include "kubeflow.pipelines.labels" . | nindent 4 }} + name: mlpipeline-minio-artifact + namespace: {{ include "kubeflow.namespace" . }} +stringData: + accesskey: {{ .Values.pipelines.config.objectStore.accessKey.value | quote }} + secretkey: {{ .Values.pipelines.config.objectStore.secretAccessKey.value | quote }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.extAuth.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.extAuth.yaml new file mode 100644 index 00000000..bcc63bb0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.extAuth.yaml @@ -0,0 +1,27 @@ +{{- if and + (include "kubeflow.pipelines.ui.createIstioIntegrationObjects" . | eq "true") + (include "kubeflow.istioIntegration.authorizationMode.granular" . | eq "true") +-}} + +# NOTE: this AuthorizationPolicy forces traffic through ext authz http extension +# so we don't have to provide configuration to allow traffic only from +# istio-ingressgateway. + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.authorizationPolicyExtAuthName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: CUSTOM + provider: + name: {{ .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} + rules: + - {} + selector: + matchLabels: + {{- include "kubeflow.pipelines.ui.selectorLabels" . | nindent 6 }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.yaml new file mode 100644 index 00000000..657bd8f6 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/authorizationpolicy.yaml @@ -0,0 +1,30 @@ +{{- if (include "kubeflow.pipelines.ui.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.pipelines.ui.selectorLabels" . | nindent 6 }} + rules: + # Allow all requests from the ingress gateway + - from: + - source: + principals: + - {{ include "kubeflow.istioIntegration.istioIngressGateway.serviceAccountPrincipal" . }} + # Allow all requests with an `authorization` header but NOT a `kubeflow-userid` header. + # This is needed to allow Kubernetes JWTs to be passed to the KFP API. + - when: + - key: request.headers[authorization] + values: + - "*" + - key: request.headers[kubeflow-userid] + notValues: + - "*" + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/configmap.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/configmap.yaml new file mode 100644 index 00000000..89045e5d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/configmap.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.pipelines.ui.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + viewer-pod-template.json: |- + { + "spec": { + "serviceAccountName": "{{ .Values.pipelines.ui.config.viewerPodServiceAccountName }}" + } + } + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/deployment.yaml new file mode 100644 index 00000000..e5c180d7 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/deployment.yaml @@ -0,0 +1,147 @@ +{{- if (include "kubeflow.pipelines.ui.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.ui.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.ui.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.ui.selectorLabels" . | nindent 6 }} + + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + labels: + {{- include "kubeflow.pipelines.ui.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: ml-pipeline-ui + image: {{ include "kubeflow.pipelines.ui.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.ui.imagePullPolicy" . }} + + env: + {{- include "kubeflow.pipelines.ui.config.objectStore.host.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.ui.config.objectStore.accessKey.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.ui.config.objectStore.secretAccessKey.env.spec" . | nindent 8 }} + + - name: VIEWER_TENSORBOARD_POD_TEMPLATE_SPEC_PATH + value: /etc/config/viewer-pod-template.json + - name: MINIO_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ALLOW_CUSTOM_VISUALIZATIONS + value: {{ .Values.pipelines.ui.config.allowCustomVisualizations | quote }} + + {{- if (include "kubeflow.deploymentMode.cluster" .) }} + - name: DEPLOYMENT + value: KUBEFLOW + - name: ARTIFACTS_SERVICE_PROXY_NAME + value: ml-pipeline-ui-artifact + - name: ARTIFACTS_SERVICE_PROXY_PORT + value: '80' + - name: ARTIFACTS_SERVICE_PROXY_ENABLED + value: 'true' + - name: ENABLE_AUTHZ + value: 'true' + - name: KUBEFLOW_USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: KUBEFLOW_USERID_PREFIX + value: {{ .Values.auth.userIdPrefix | quote }} + - name: DISABLE_GKE_METADATA # https://github.com/kubeflow/pipelines/issues/11247 + value: 'true' + - name: FRONTEND_SERVER_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- end }} + + ports: + - containerPort: 3000 + + readinessProbe: + exec: + command: + - wget + - -q # quiet + - -S # show server response + - -O + - "-" # Redirect output to stdout + - http://localhost:3000/apis/v1beta1/healthz + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + livenessProbe: + exec: + command: + - wget + - -q # quiet + - -S # show server response + - -O + - "-" # Redirect output to stdout + - http://localhost:3000/apis/v1beta1/healthz + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + + {{- with .Values.pipelines.ui.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.ui.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + volumeMounts: + - name: config-volume + mountPath: /etc/config + readOnly: true + + volumes: + - name: config-volume + configMap: + name: {{ include "kubeflow.pipelines.ui.configMapName" . }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: ml-pipeline-ui + + {{- with include "kubeflow.pipelines.ui.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.ui.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.ui.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.ui.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/destinationrule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/destinationrule.yaml new file mode 100644 index 00000000..7b327f63 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/destinationrule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.pipelines.ui.createIstioIntegrationObjects" .) -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.pipelines.ui.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/role-or-clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/role-or-clusterrole.yaml new file mode 100644 index 00000000..785a8414 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/role-or-clusterrole.yaml @@ -0,0 +1,49 @@ +{{- if (include "kubeflow.pipelines.ui.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.roleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - get +- apiGroups: + - "" + resources: + - events + verbs: + - list +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +- apiGroups: + - "kubeflow.org" + resources: + - viewers + verbs: + - create + - get + - list + - watch + - delete +- apiGroups: + - "argoproj.io" + resources: + - workflows + verbs: + - get + - list + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/rolebinding-or-clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/rolebinding-or-clusterrolebinding.yaml new file mode 100644 index 00000000..3c9e282a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/rolebinding-or-clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.pipelines.ui.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleBindingKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.roleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} + name: {{ include "kubeflow.pipelines.ui.roleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.ui.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/sa.yaml new file mode 100644 index 00000000..6d161b5e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.ui.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.ui.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/service.yaml new file mode 100644 index 00000000..52246914 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.pipelines.ui.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.pipelines.ui.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + protocol: TCP + port: 80 + targetPort: 3000 + selector: + {{- include "kubeflow.pipelines.ui.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.ui.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/virtualservice.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/virtualservice.yaml new file mode 100644 index 00000000..c6d68a63 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/ui/virtualservice.yaml @@ -0,0 +1,28 @@ +{{- if (include "kubeflow.pipelines.ui.createIstioIntegrationObjects" .) -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.pipelines.ui.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.ui.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.pipelines.ui.config.urlPrefix }} + rewrite: + uri: {{ .Values.pipelines.ui.config.urlPrefix }} + route: + - destination: + host: {{ include "kubeflow.pipelines.ui.svc.fqdn" . }} + port: + number: 80 + timeout: 300s + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/deployment.yaml new file mode 100644 index 00000000..733b6186 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/deployment.yaml @@ -0,0 +1,85 @@ +{{- if (include "kubeflow.pipelines.viewerCrd.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.viewerCrd.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.viewerCrd.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.viewerCrd.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.viewerCrd.name" . }} + namespace: {{ include "kubeflow.namespace" . }} + +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.viewerCrd.selectorLabels" . | nindent 6 }} + + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + labels: + {{- include "kubeflow.pipelines.viewerCrd.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: ml-pipeline-viewer-crd + image: {{ include "kubeflow.pipelines.viewerCrd.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.viewerCrd.imagePullPolicy" . }} + + env: + - name: MAX_NUM_VIEWERS + value: {{ .Values.pipelines.viewerCrd.config.maxNumViewers | quote }} + - name: NAMESPACE + {{- if (include "kubeflow.deploymentMode.namespace" .) }} + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- else }} + value: "" + {{- end }} + + {{- with .Values.pipelines.viewerCrd.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.viewerCrd.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.viewerCrd.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.viewerCrd.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.viewerCrd.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.viewerCrd.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.viewerCrd.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end -}} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/role-or-clusterrole.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/role-or-clusterrole.yaml new file mode 100644 index 00000000..a2c46c56 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/role-or-clusterrole.yaml @@ -0,0 +1,38 @@ +{{- if (include "kubeflow.pipelines.viewerCrd.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.viewerCrd.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.viewerCrd.roleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - '*' + resources: + - deployments + - services + verbs: + - create + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - kubeflow.org + resources: + - viewers + - viewers/finalizers + verbs: + - create + - get + - list + - watch + - update + - patch + - delete + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/rolebinding-or-clusterrolebinding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/rolebinding-or-clusterrolebinding.yaml new file mode 100644 index 00000000..4874a4d0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/rolebinding-or-clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.pipelines.viewerCrd.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: {{ include "kubeflow.deploymentMode.scopedRoleBindingKind" . }} +metadata: + labels: + {{- include "kubeflow.pipelines.viewerCrd.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.viewerCrd.roleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: {{ include "kubeflow.deploymentMode.scopedRoleKind" . }} + name: {{ include "kubeflow.pipelines.viewerCrd.roleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.viewerCrd.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/sa.yaml new file mode 100644 index 00000000..5d69675c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/viewer-crd/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.viewerCrd.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.viewerCrd.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.viewerCrd.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.viewerCrd.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/authorizationpolicy.yaml new file mode 100644 index 00000000..c7ee24c0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/authorizationpolicy.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.pipelines.visualization.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.pipelines.visualization.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.visualization.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.pipelines.visualization.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + principals: + - {{ include "kubeflow.pipelines.mlPipeline.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.ui.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.persistenceAgent.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.scheduledWorkflow.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.viewerCrd.serviceAccountPrincipal" . }} + - {{ include "kubeflow.pipelines.cache.serviceAccountPrincipal" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/deployment.yaml new file mode 100644 index 00000000..f06c7c38 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/deployment.yaml @@ -0,0 +1,101 @@ +{{- if (include "kubeflow.pipelines.visualization.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.visualization.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.visualization.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.visualization.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.visualization.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.visualization.selectorLabels" . | nindent 6 }} + + template: + metadata: + annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict: "true" + labels: + {{- include "kubeflow.pipelines.visualization.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: ml-pipeline-visualizationserver + image: {{ include "kubeflow.pipelines.visualization.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.visualization.imagePullPolicy" . }} + + ports: + - name: http + containerPort: 8888 + + readinessProbe: + exec: + command: + - wget + - -q # quiet + - -S # show server response + - -O + - "-" # Redirect output to stdout + - http://localhost:8888/ + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + livenessProbe: + exec: + command: + - wget + - -q # quiet + - -S # show server response + - -O + - "-" # Redirect output to stdout + - http://localhost:8888/ + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 2 + + {{- with .Values.pipelines.visualization.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.visualization.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.visualization.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.visualization.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.visualization.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.visualization.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.visualization.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/destinationrule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/destinationrule.yaml new file mode 100644 index 00000000..8f441820 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/destinationrule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.pipelines.visualization.createIstioIntegrationObjects" .) -}} + +apiVersion: "networking.istio.io/v1alpha3" +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.pipelines.visualization.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.visualization.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.pipelines.visualization.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/sa.yaml new file mode 100644 index 00000000..31d59b68 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/sa.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.pipelines.visualization.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.pipelines.visualization.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.visualization.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.visualization.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/service.yaml new file mode 100644 index 00000000..ec491e8d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/ml-pipeline/visualization/service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.pipelines.visualization.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.pipelines.visualization.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.pipelines.visualization.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.visualization.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: 8888 + protocol: TCP + targetPort: 8888 + selector: + {{- include "kubeflow.pipelines.visualization.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.visualization.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/configmap.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/configmap.yaml new file mode 100644 index 00000000..a7d27570 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/configmap.yaml @@ -0,0 +1,14 @@ +{{- if (include "kubeflow.pipelines.profileController.enabled" .) -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.pipelines.profileController.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.profileController.configMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + sync.py: | + {{- .Files.Get "files/pipelines-profile-controller/sync.py" | nindent 4 }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/decorator-controller.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/decorator-controller.yaml new file mode 100644 index 00000000..921aa8ef --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/decorator-controller.yaml @@ -0,0 +1,50 @@ +{{- if (include "kubeflow.pipelines.profileController.enabled" . | eq "true") -}} + +# Change resyncPeriodSeconds to 1 hour from insane 20 seconds +# Only sync namespaces with pipelines.kubeflow.org/enabled = "true" +apiVersion: metacontroller.k8s.io/v1alpha1 +kind: DecoratorController +metadata: + labels: + {{- include "kubeflow.pipelines.profileController.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.profileController.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + resyncPeriodSeconds: 3600 + resources: + - apiVersion: v1 + resource: namespaces + labelSelector: + matchLabels: + pipelines.kubeflow.org/enabled: "true" + attachments: + - apiVersion: v1 + resource: secrets + updateStrategy: + method: OnDelete + - apiVersion: v1 + resource: configmaps + updateStrategy: + method: OnDelete + - apiVersion: apps/v1 + resource: deployments + updateStrategy: + method: InPlace + - apiVersion: v1 + resource: services + updateStrategy: + method: InPlace + - apiVersion: networking.istio.io/v1alpha3 + resource: destinationrules + updateStrategy: + method: InPlace + - apiVersion: security.istio.io/v1beta1 + resource: authorizationpolicies + updateStrategy: + method: InPlace + hooks: + sync: + webhook: + url: {{ printf "http://%s/sync" (include "kubeflow.pipelines.profileController.svc.fqdn" .) }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/deployment.yaml new file mode 100644 index 00000000..bd0bc517 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/deployment.yaml @@ -0,0 +1,119 @@ +{{- if (include "kubeflow.pipelines.profileController.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.pipelines.profileController.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.pipelines.profileController.autoscaling.minReplicas" . -}} + +{{- $visualizationImageSplit := include "kubeflow.pipelines.visualization.image" . | split ":" -}} +{{- $visualizationImageName := $visualizationImageSplit._0 }} +{{- $visualizationImageTag := $visualizationImageSplit._1 }} + +{{- $frontendImageSplit := include "kubeflow.pipelines.ui.image" . | split ":" -}} +{{- $frontendImageName := $frontendImageSplit._0 }} +{{- $frontendImageTag := $frontendImageSplit._1 }} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.pipelines.profileController.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.profileController.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.pipelines.profileController.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.pipelines.profileController.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: profile-controller + image: {{ include "kubeflow.pipelines.profileController.image" . }} + imagePullPolicy: {{ include "kubeflow.pipelines.profileController.imagePullPolicy" . }} + + command: ["python", "/hooks/sync.py"] + + env: + {{- include "kubeflow.pipelines.profileController.config.objectStore.host.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.profileController.config.objectStore.accessKey.env.spec" . | nindent 8 }} + {{- include "kubeflow.pipelines.profileController.config.objectStore.secretAccessKey.env.spec" . | nindent 8 }} + + - name: DISABLE_ISTIO_SIDECAR + value: {{ .Values.pipelines.profileController.config.disableIstioSidecar | quote }} + - name: KFP_VERSION + value: {{ .Values.pipelines.defaults.image.tag | quote }} + - name: KFP_DEFAULT_PIPELINE_ROOT + value: {{ .Values.pipelines.config.defaultPipelineRoot | quote }} + - name: CONTROLLER_PORT + value: "8080" + - name: VISUALIZATION_SERVER_IMAGE + value: {{ $visualizationImageName }} + - name: VISUALIZATION_SERVER_TAG + value: {{ $visualizationImageTag | quote }} + - name: FRONTEND_IMAGE + value: {{ $frontendImageName }} + - name: FRONTEND_TAG + value: {{ $frontendImageTag | quote }} + - name: METADATA_GRPC_SERVICE_HOST + value: {{ include "kubeflow.pipelines.metadataGrpcServer.svc.addressWithNs" . }} + - name: METADATA_GRPC_SERVICE_PORT + value: {{ .Values.pipelines.metadataGrpcServer.service.port | quote }} + - name: ML_PIPELINE_SA_PRINCIPAL + value: {{ include "kubeflow.pipelines.mlPipeline.serviceAccountPrincipal" . }} + + {{- with .Values.pipelines.profileController.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.pipelines.profileController.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + volumeMounts: + - name: hooks + mountPath: /hooks + ports: + - containerPort: 8080 + + volumes: + - name: hooks + configMap: + name: {{ include "kubeflow.pipelines.profileController.configMapName" . }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.pipelines.profileController.serviceAccountName" . }} + + {{- with include "kubeflow.pipelines.profileController.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.profileController.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.profileController.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.pipelines.profileController.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/service.yaml new file mode 100644 index 00000000..15661b6a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/profile-controller/service.yaml @@ -0,0 +1,21 @@ +{{- if (include "kubeflow.pipelines.profileController.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + labels: + {{- include "kubeflow.pipelines.profileController.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.profileController.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 8080 + selector: + {{- include "kubeflow.pipelines.profileController.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.pipelines.profileController.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrole.cache-deployer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrole.cache-deployer.yaml new file mode 100644 index 00000000..1a9cb96c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrole.cache-deployer.yaml @@ -0,0 +1,45 @@ +{{/* +Cache Deployer is currently not supported +*/}} + +{{/* +{{- if (include "kubeflow.pipelines.cache.enabled" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: kubeflow-pipelines-cache-deployer-clusterrole + name: {{ include "kubeflow.pipelines.rbac.cacheDeployer.clusterRoleName" . }} +rules: +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + - certificatesigningrequests/approval + verbs: + - create + - delete + - get + - update +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch +- apiGroups: + - certificates.k8s.io + resources: + - signers + resourceNames: + - kubernetes.io/* + verbs: + - approve + +{{- end }} +*/}} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrolebinding.cache-deployer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrolebinding.cache-deployer.yaml new file mode 100644 index 00000000..9e901a19 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/clusterrolebinding.cache-deployer.yaml @@ -0,0 +1,24 @@ +{{/* +Cache Deployer is currently not supported +*/}} + +{{/* +{{- if (include "kubeflow.pipelines.cache.enabled" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.pipelines.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.rbac.cacheDeployer.clusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.pipelines.rbac.cacheDeployer.clusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.pipelines.rbac.cacheDeployer.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} +*/}} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.cache-deployer.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.cache-deployer.yaml new file mode 100644 index 00000000..946fa49e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.cache-deployer.yaml @@ -0,0 +1,17 @@ +{{/* +Cache Deployer is currently not supported +*/}} + +{{/* +{{- if (include "kubeflow.pipelines.cache.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + {{- include "kubeflow.pipelines.labels" . | nindent 4 }} + name: {{ include "kubeflow.pipelines.rbac.cacheDeployer.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} +*/}} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.yaml new file mode 100644 index 00000000..f8cdfe4e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/pipelines/rbac/sa.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: default-editor + namespace: {{ include "kubeflow.namespace" . }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/authorizationpolicy.yaml new file mode 100644 index 00000000..be47b75d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/authorizationpolicy.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.profilesController.createIstioIntegrationObjects" . | eq "true") -}} + +{{ $namespace := include "kubeflow.namespace" . }} +{{ $centraldashboardSaName := include "kubeflow.centraldashboard.serviceAccountName" . }} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.profilesController.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.kfam.name" . }} + namespace: {{ $namespace }} +spec: + action: ALLOW + rules: + - from: + - source: + principals: + # TODO: change me + - cluster.local/ns/{{ $namespace }}/sa/{{ $centraldashboardSaName }} + selector: + matchLabels: + {{- include "kubeflow.profilesController.selectorLabels" . | nindent 6 }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/configmap.namespace-labels.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/configmap.namespace-labels.yaml new file mode 100644 index 00000000..bfdae81e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/configmap.namespace-labels.yaml @@ -0,0 +1,20 @@ +{{- if (include "kubeflow.profilesController.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "kubeflow.profilesController.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.namespaceLabelsConfigMapName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: + namespace-labels.yaml: | + {{- with .Values.profilesController.config.defaultNamespaceLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.profilesController.config.extraNamespaceLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/deployment.yaml new file mode 100644 index 00000000..7d9938f5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/deployment.yaml @@ -0,0 +1,134 @@ +{{- if (include "kubeflow.profilesController.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.profilesController.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.profilesController.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.profilesController.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.profilesController.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.profilesController.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: manager + image: {{ include "kubeflow.profilesController.manager.image" . }} + imagePullPolicy: {{ include "kubeflow.profilesController.manager.imagePullPolicy" . }} + + command: + - /manager + - "-userid-header" + - {{ .Values.auth.userHeaderName | quote }} + - "-userid-prefix" + - {{ default "" .Values.auth.userIdPrefix | quote }} + - "-workload-identity" + - {{ default "" .Values.profilesController.config.workloadIdentity | quote }} + + env: + - name: ADMIN + value: {{ default "" .Values.profilesController.config.admin | quote }} + - name: WORKLOAD_IDENTITY + value: {{ default "" .Values.profilesController.config.workloadIdentity | quote }} + - name: USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: USERID_PREFIX + value: {{ default "" .Values.auth.userIdPrefix | quote }} + - name: NOTEBOOK_CONTROLLER_PRINCIPAL + value: {{ include "kubeflow.notebooks.controller.serviceAccountPrincipal" . }} + - name: KFP_UI_PRINCIPAL + value: {{ include "kubeflow.pipelines.ui.serviceAccountPrincipal" . }} + {{- if (include "kubeflow.istioIntegration.enabled" . ) }} + - name: ISTIO_INGRESS_GATEWAY_PRINCIPAL + value: {{ include "kubeflow.istioIntegration.istioIngressGateway.serviceAccountPrincipal" . }} + {{- end }} + + livenessProbe: + httpGet: + path: /healthz + port: 9876 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 9876 + initialDelaySeconds: 5 + periodSeconds: 10 + ports: + - containerPort: 9876 + + volumeMounts: + - mountPath: /etc/profile-controller + name: namespace-labels + readOnly: true + + - name: kfam + image: {{ include "kubeflow.profilesController.kfam.image" . }} + imagePullPolicy: {{ include "kubeflow.profilesController.kfam.imagePullPolicy" . }} + + command: + - /access-management + - "-cluster-admin" + - {{ default "" .Values.profilesController.config.admin | quote }} + - "-userid-header" + - {{ .Values.auth.userHeaderName | quote }} + - "-userid-prefix" + - {{ default "" .Values.auth.userIdPrefix | quote }} + + env: + - name: ADMIN + value: {{ default "" .Values.profilesController.config.admin | quote }} + - name: WORKLOAD_IDENTITY + value: {{ default "" .Values.profilesController.config.workloadIdentity | quote }} + - name: USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: USERID_PREFIX + value: {{ default "" .Values.auth.userIdPrefix | quote }} + - name: NOTEBOOK_CONTROLLER_PRINCIPAL + value: {{ include "kubeflow.notebooks.controller.serviceAccountPrincipal" . }} + - name: KFP_UI_PRINCIPAL + value: {{ include "kubeflow.pipelines.ui.serviceAccountPrincipal" . }} + {{- if (include "kubeflow.istioIntegration.enabled" . ) }} + - name: ISTIO_INGRESS_GATEWAY_PRINCIPAL + value: {{ include "kubeflow.istioIntegration.istioIngressGateway.serviceAccountPrincipal" . }} + {{- end }} + + livenessProbe: + httpGet: + path: /metrics + port: 8081 + initialDelaySeconds: 30 + periodSeconds: 30 + ports: + - containerPort: 8081 + name: kfam-http + protocol: TCP + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.profilesController.serviceAccountName" . }} + + volumes: + - name: namespace-labels + configMap: + name: {{ include "kubeflow.profilesController.namespaceLabelsConfigMapName" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/clusterrolebinding.main.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/clusterrolebinding.main.yaml new file mode 100644 index 00000000..3d6cf5b3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/clusterrolebinding.main.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.profilesController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.profilesController.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.profilesController.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_editor_role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_editor_role.yaml new file mode 100644 index 00000000..212436ab --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_editor_role.yaml @@ -0,0 +1,29 @@ +{{/* +# Permissions for end users to edit profiles. +# Currently not used anywhere. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: profile-editor-role +rules: +- apiGroups: + - kubeflow.org + resources: + - profiles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - profiles/status + verbs: + - get + +*/}} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_viewer_role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_viewer_role.yaml new file mode 100644 index 00000000..b17525f1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/profile_viewer_role.yaml @@ -0,0 +1,25 @@ +{{/* +# Permissions for end users to view profiles. +# Currently not used anywhere. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: profile-viewer-role +rules: +- apiGroups: + - kubeflow.org + resources: + - profiles + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - profiles/status + verbs: + - get + +*/}} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.leader-election.yaml new file mode 100644 index 00000000..414708b7 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.leader-election.yaml @@ -0,0 +1,37 @@ +{{- if (include "kubeflow.profilesController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.leaderElectionRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.yaml new file mode 100644 index 00000000..4486c8eb --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/role.yaml @@ -0,0 +1,44 @@ +{{/* +# This role is defined in kubeflow/manifests but it seems it's not used anywhere. +# https://github.com/kubeflow/manifests/blob/6cb9ff2fa2b25755eca5ce41c03d125aa8c8653b/apps/profiles/upstream/rbac/role.yaml + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: manager-role +rules: +- apiGroups: + - "" + resources: + - namespaces + verbs: + - '*' +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - '*' +- apiGroups: + - kubeflow.org + resources: + - profiles + - profiles/finalizers + - profiles/status + verbs: + - '*' +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - '*' +- apiGroups: + - security.istio.io + resources: + - authorizationpolicies + verbs: + - '*' + +*/}} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/rolebinding.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/rolebinding.leader-election.yaml new file mode 100644 index 00000000..99e2d3a0 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/rolebinding.leader-election.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.profilesController.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "kubeflow.notebooks.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.leaderElectionRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "kubeflow.profilesController.leaderElectionRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.profilesController.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/serviceaccount.yaml new file mode 100644 index 00000000..9dac3682 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/rbac/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.profilesController.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.profilesController.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.profilesController.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/service.yaml new file mode 100644 index 00000000..077cf38d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/service.yaml @@ -0,0 +1,22 @@ +{{- if (include "kubeflow.profilesController.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.profilesController.kfam.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.profilesController.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.kfam.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - port: 8081 + selector: + {{- include "kubeflow.profilesController.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.profilesController.kfam.service.type }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/virtualservice.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/virtualservice.yaml new file mode 100644 index 00000000..efaa7f77 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/profiles-controller/virtualservice.yaml @@ -0,0 +1,31 @@ +{{- if (include "kubeflow.profilesController.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.profilesController.labels" . | nindent 4 }} + name: {{ include "kubeflow.profilesController.kfam.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.profilesController.kfam.config.urlPrefix }}/ + rewrite: + uri: {{ .Values.profilesController.kfam.config.urlPrefix }}/ + route: + - destination: + host: {{ include "kubeflow.profilesController.kfam.svc.fqdn" . }} + port: + number: 8081 + headers: + request: + add: + x-forwarded-prefix: {{ .Values.profilesController.kfam.config.urlPrefix }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/deployment.yaml new file mode 100644 index 00000000..f8ec3f27 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/deployment.yaml @@ -0,0 +1,139 @@ +{{- if (include "kubeflow.tensorboard.controller.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.tensorboard.controller.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.tensorboard.controller.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + control-plane: controller-manager + name: {{ include "kubeflow.tensorboard.controller.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.tensorboard.controller.selectorLabels" . | nindent 6 }} + control-plane: controller-manager + + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + labels: + {{- include "kubeflow.tensorboard.controller.selectorLabels" . | nindent 8 }} + control-plane: controller-manager + + spec: + containers: + - name: manager + image: {{ include "kubeflow.tensorboard.controller.manager.image" . }} + imagePullPolicy: {{ include "kubeflow.tensorboard.controller.manager.imagePullPolicy" . }} + + args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + command: + - /manager + + env: + - name: ISTIO_GATEWAY + value: {{ include "kubeflow.namespace" . }}/{{ .Values.istioIntegration.gateway.name }} + - name: ISTIO_HOST + value: "*" + - name: RWO_PVC_SCHEDULING + value: {{ .Values.tensorboard.controller.manager.config.rwoPvcScheduling | quote }} + - name: TENSORBOARD_IMAGE + value: {{ include "kubeflow.tensorboard.controller.manager.tensorboardImage" . }} + + {{- with .Values.tensorboard.controller.manager.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + + {{- with include "kubeflow.tensorboard.controller.manager.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + - name: kube-rbac-proxy + image: {{ include "kubeflow.tensorboard.controller.kubeRbacProxy.image" . }} + imagePullPolicy: {{ include "kubeflow.tensorboard.controller.kubeRbacProxy.imagePullPolicy" . }} + + args: + - --secure-listen-address=0.0.0.0:{{ .Values.tensorboard.controller.kubeRbacProxy.service.targetPort }} + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + + ports: + - containerPort: {{ .Values.tensorboard.controller.kubeRbacProxy.service.targetPort }} + name: https + protocol: TCP + + {{- with .Values.tensorboard.controller.kubeRbacProxy.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.controller.kubeRbacProxy.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.tensorboard.controller.serviceAccountName" . }} + + {{- with include "kubeflow.tensorboard.controller.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.controller.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.controller.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.controller.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.controller.terminationGracePeriodSeconds" . }} + terminationGracePeriodSeconds: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.controller.securityContext" . }} + securityContext: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.manager.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.manager.yaml new file mode 100644 index 00000000..dc50e605 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.manager.yaml @@ -0,0 +1,83 @@ +{{- if (include "kubeflow.tensorboard.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.mainClusterRoleName" . }} +rules: +- apiGroups: + - apps + resources: + - deployments + verbs: + - create + - get + - list + - update + - watch +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - services + verbs: + - create + - get + - list + - update + - watch +- apiGroups: + - networking.istio.io + resources: + - virtualservices + verbs: + - create + - get + - list + - update + - watch +- apiGroups: + - tensorboard.kubeflow.org + resources: + - tensorboards + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - tensorboard.kubeflow.org + resources: + - tensorboards/finalizers + verbs: + - update +- apiGroups: + - tensorboard.kubeflow.org + resources: + - tensorboards/status + verbs: + - get + - patch + - update + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.metrics-reader.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.metrics-reader.yaml new file mode 100644 index 00000000..17c6f0e2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.metrics-reader.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.tensorboard.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.metricsReaderClusterRoleName" . }} +rules: +- nonResourceURLs: + - /metrics + verbs: + - get + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.proxy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.proxy.yaml new file mode 100644 index 00000000..5f7c8129 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrole.proxy.yaml @@ -0,0 +1,23 @@ +{{- if (include "kubeflow.tensorboard.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.proxyClusterRoleName" . }} +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.manager.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.manager.yaml new file mode 100644 index 00000000..beecb8ff --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.manager.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.tensorboard.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.tensorboard.controller.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.tensorboard.controller.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.proxy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.proxy.yaml new file mode 100644 index 00000000..936c02c4 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/clusterrolebinding.proxy.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.tensorboard.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.proxyClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.tensorboard.controller.proxyClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.tensorboard.controller.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/role.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/role.leader-election.yaml new file mode 100644 index 00000000..006a90da --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/role.leader-election.yaml @@ -0,0 +1,43 @@ +{{- if (include "kubeflow.tensorboard.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.leaderElectionRoleName" . }} + namespace: {{ include "kubeflow.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/rolebinding.leader-election.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/rolebinding.leader-election.yaml new file mode 100644 index 00000000..bfeb64ab --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/rbac/rolebinding.leader-election.yaml @@ -0,0 +1,19 @@ +{{- if (include "kubeflow.tensorboard.controller.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.leaderElectionRoleBindingName" . }} + namespace: {{ include "kubeflow.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "kubeflow.tensorboard.controller.leaderElectionRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.tensorboard.controller.serviceAccountName" .}} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/service.controller-manager-metrics-service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/service.controller-manager-metrics-service.yaml new file mode 100644 index 00000000..561d85d8 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/service.controller-manager-metrics-service.yaml @@ -0,0 +1,28 @@ +{{- if (include "kubeflow.tensorboard.controller.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.tensorboard.controller.kubeRbacProxy.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + control-plane: controller-manager + name: {{ include "kubeflow.tensorboard.controller.metricsService.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: https + # port: 8443 + port: {{ .Values.tensorboard.controller.kubeRbacProxy.service.port }} + protocol: TCP + targetPort: https + selector: + {{- include "kubeflow.tensorboard.controller.selectorLabels" . | nindent 4 }} + control-plane: controller-manager + sessionAffinity: None + type: {{ .Values.tensorboard.controller.kubeRbacProxy.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/serviceaccount.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/serviceaccount.yaml new file mode 100644 index 00000000..26d97cb5 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/controller/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.tensorboard.controller.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.tensorboard.controller.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.tensorboard.controller.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.controller.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.extAuth.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.extAuth.yaml new file mode 100644 index 00000000..47846b5d --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.extAuth.yaml @@ -0,0 +1,29 @@ +{{- if and + (include "kubeflow.tensorboard.tensorboardsWebApp.createIstioIntegrationObjects" . | eq "true") + (include "kubeflow.istioIntegration.authorizationMode.granular" . | eq "true") +-}} + +# NOTE: this AuthorizationPolicy forces traffic through ext authz http extension +# so we don't have to provide configuration to allow traffic only from +# istio-ingressgateway. The .spec.rules.to.operations.notPaths is configured for +# CloudFlare integration and allows only static, non-secret assets to be +# accessible without the Istio Auth. + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.authorizationPolicyExtAuthName" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + action: CUSTOM + provider: + name: {{ .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} + rules: + - {} + selector: + matchLabels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.selectorLabels" . | nindent 6 }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.yaml new file mode 100644 index 00000000..4df42532 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/authorizationpolicy.yaml @@ -0,0 +1,20 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.createIstioIntegrationObjects" .) -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.selectorLabels" . | nindent 6 }} + rules: + - from: + - source: + namespaces: + - {{ .Values.istioIntegration.ingressGatewayNamespace }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role-binding.yaml new file mode 100644 index 00000000..8d27d69b --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role-binding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role.yaml new file mode 100644 index 00000000..54ab26fc --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/cluster-role.yaml @@ -0,0 +1,134 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.mainClusterRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - tensorboard.kubeflow.org + resources: + - tensorboards + - tensorboards/finalizers + verbs: + - get + - list + - create + - delete +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete + - get + - list +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - poddefaults + verbs: + - get + - list + - watch + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.kfTenUiAdminClusterRoleName" . }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.kfTenUiEditClusterRoleName" . }} +rules: +- apiGroups: + - tensorboard.kubeflow.org + resources: + - tensorboards + - tensorboards/finalizers + verbs: + - get + - list + - create + - delete +- apiGroups: + - kubeflow.org + resources: + - poddefaults + verbs: + - get + - list + - watch + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.kfTenUiViewClusterRoleName" . }} +rules: +- apiGroups: + - tensorboard.kubeflow.org + resources: + - tensorboards + - tensorboards/finalizers + verbs: + - get + - list +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - poddefaults + verbs: + - get + - list + - watch + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/deployment.yaml new file mode 100644 index 00000000..690b5a3a --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/deployment.yaml @@ -0,0 +1,84 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.selectorLabels" . | nindent 8 }} + + spec: + containers: + - name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.baseName" . }} + image: {{ include "kubeflow.tensorboard.tensorboardsWebApp.image" . }} + imagePullPolicy: {{ include "kubeflow.tensorboard.tensorboardsWebApp.imagePullPolicy" . }} + + ports: + - containerPort: {{ .Values.tensorboard.tensorboardsWebApp.service.targetPort }} + protocol: TCP + + {{- with .Values.tensorboard.tensorboardsWebApp.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + env: + - name: APP_PREFIX + value: {{ .Values.tensorboard.tensorboardsWebApp.config.urlPrefix }} + - name: USERID_HEADER + value: {{ .Values.auth.userHeaderName | quote }} + - name: USERID_PREFIX + value: {{ .Values.auth.userIdPrefix | quote }} + - name: APP_SECURE_COOKIES + value: {{ .Values.tensorboard.tensorboardsWebApp.config.secureCookies | quote }} + + {{- with include "kubeflow.tensorboard.tensorboardsWebApp.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.tensorboard.tensorboardsWebApp.serviceAccountName" . }} + + {{- with include "kubeflow.tensorboard.tensorboardsWebApp.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.tensorboardsWebApp.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.tensorboardsWebApp.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.tensorboard.tensorboardsWebApp.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/destination-rule.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/destination-rule.yaml new file mode 100644 index 00000000..774da109 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/destination-rule.yaml @@ -0,0 +1,16 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + host: {{ include "kubeflow.tensorboard.tensorboardsWebApp.svc.fqdn" . }} + trafficPolicy: + tls: + mode: ISTIO_MUTUAL + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/hpa.yaml new file mode 100644 index 00000000..49676b27 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/hpa.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.enabled" . | eq "true") -}} + +{{- $componentName := include "kubeflow.tensorboard.tensorboardsWebApp.name" . -}} +{{- $minReplicas := include "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.minReplicas" . -}} +{{- $maxReplicas := include "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.maxReplicas" . -}} +{{- $targetCPUUtilizationPercentage := include "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.targetCPUUtilizationPercentage" . -}} +{{- $targetMemoryUtilizationPercentage := include "kubeflow.tensorboard.tensorboardsWebApp.autoscaling.targetMemoryUtilizationPercentage" . -}} + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ $componentName }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ $componentName }} + minReplicas: {{ $minReplicas }} + maxReplicas: {{ $maxReplicas }} + metrics: + {{- if $targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ $targetCPUUtilizationPercentage }} + {{- end }} + {{- if $targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ $targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/poddisruptionbudget.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/poddisruptionbudget.yaml new file mode 100644 index 00000000..34df185f --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.pdb.create" . | eq "true") -}} + +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.selectorLabels" . | nindent 6 }} + {{- with (include "kubeflow.tensorboard.tensorboardsWebApp.pdb.values" .) }} + {{- . | nindent 2 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service-account.yaml new file mode 100644 index 00000000..b1fa20e1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service-account.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.tensorboard.tensorboardsWebApp.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4}} + {{- end }} + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service.yaml new file mode 100644 index 00000000..a1ef5864 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/service.yaml @@ -0,0 +1,25 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.tensorboard.tensorboardsWebApp.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: http + port: {{ .Values.tensorboard.tensorboardsWebApp.service.port }} + protocol: TCP + targetPort: {{ .Values.tensorboard.tensorboardsWebApp.service.targetPort }} + selector: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.tensorboard.tensorboardsWebApp.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/virtual-service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/virtual-service.yaml new file mode 100644 index 00000000..1360f74c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tensorboard/tensorboards-web-app/virtual-service.yaml @@ -0,0 +1,31 @@ +{{- if (include "kubeflow.tensorboard.tensorboardsWebApp.createIstioIntegrationObjects" . | eq "true") -}} + +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + labels: + {{- include "kubeflow.tensorboard.tensorboardsWebApp.labels" . | nindent 4 }} + name: {{ include "kubeflow.tensorboard.tensorboardsWebApp.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + gateways: + - {{ .Values.istioIntegration.gateway.name }} + hosts: + - '*' + http: + - match: + - uri: + prefix: {{ .Values.tensorboard.tensorboardsWebApp.config.urlPrefix }}/ + rewrite: + uri: / + route: + - destination: + host: {{ include "kubeflow.tensorboard.tensorboardsWebApp.svc.fqdn" . }} + port: + number: {{ .Values.tensorboard.tensorboardsWebApp.service.port }} + headers: + request: + add: + x-forwarded-prefix: {{ .Values.tensorboard.tensorboardsWebApp.config.urlPrefix }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/tests/_test-connection.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tests/_test-connection.yaml new file mode 100644 index 00000000..789ac15e --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/tests/_test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "kubeflow.fullname" . }}-test-connection" + labels: + {{- include "kubeflow.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "kubeflow.fullname" . }}:{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/cluster-role-binding.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/cluster-role-binding.yaml new file mode 100644 index 00000000..19f7b523 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/cluster-role-binding.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.trainingOperator.rbac.createRoles" . | eq "true" ) -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.mainClusterRoleBindingName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubeflow.trainingOperator.mainClusterRoleName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "kubeflow.trainingOperator.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterrole.main.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterrole.main.yaml new file mode 100644 index 00000000..6947a7b1 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterrole.main.yaml @@ -0,0 +1,297 @@ +{{- if (include "kubeflow.trainingOperator.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.mainClusterRoleName" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - list + - update + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - pods/exec + verbs: + - create +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - update + - watch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - create + - get + - list + - watch +- apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - list + - update + - watch +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - mpijobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - mpijobs/finalizers + verbs: + - update +- apiGroups: + - kubeflow.org + resources: + - mpijobs/status + verbs: + - get + - patch + - update +- apiGroups: + - kubeflow.org + resources: + - mxjobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - mxjobs/finalizers + verbs: + - update +- apiGroups: + - kubeflow.org + resources: + - mxjobs/status + verbs: + - get + - patch + - update +- apiGroups: + - kubeflow.org + resources: + - paddlejobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - paddlejobs/finalizers + verbs: + - update +- apiGroups: + - kubeflow.org + resources: + - paddlejobs/status + verbs: + - get + - patch + - update +- apiGroups: + - kubeflow.org + resources: + - pytorchjobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - pytorchjobs/finalizers + verbs: + - update +- apiGroups: + - kubeflow.org + resources: + - pytorchjobs/status + verbs: + - get + - patch + - update +- apiGroups: + - kubeflow.org + resources: + - tfjobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - tfjobs/finalizers + verbs: + - update +- apiGroups: + - kubeflow.org + resources: + - tfjobs/status + verbs: + - get + - patch + - update +- apiGroups: + - kubeflow.org + resources: + - xgboostjobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - xgboostjobs/finalizers + verbs: + - update +- apiGroups: + - kubeflow.org + resources: + - xgboostjobs/status + verbs: + - get + - patch + - update +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - list + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + verbs: + - create + - list + - update + - watch +- apiGroups: + - scheduling.volcano.sh + resources: + - podgroups + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - scheduling.x-k8s.io + resources: + - podgroups + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterroles.user.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterroles.user.yaml new file mode 100644 index 00000000..317121f3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/clusterroles.user.yaml @@ -0,0 +1,109 @@ +{{- if (include "kubeflow.trainingOperator.rbac.createRoles" . | eq "true") -}} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowAdminRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.kfTrAdminClusterRoleName" . }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + {{- include "kubeflow.trainingOperator.kfTrAdminClusterRoleLabel" . | nindent 6 }} +rules: [] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowEditRoleLabel" . | nindent 4 }} + {{- include "kubeflow.trainingOperator.kfTrAdminClusterRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.kfTrEditClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - mpijobs + - tfjobs + - pytorchjobs + - mxjobs + - xgboostjobs + - paddlejobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - kubeflow.org + resources: + - mpijobs/status + - tfjobs/status + - pytorchjobs/status + - mxjobs/status + - xgboostjobs/status + - paddlejobs/status + verbs: + - get +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - create + - delete + - get + - list + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - get + - list + - watch + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + {{- include "kubeflow.kubeflowRoles.kubeflowViewRoleLabel" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.kfTrViewClusterRoleName" . }} +rules: +- apiGroups: + - kubeflow.org + resources: + - mpijobs + - tfjobs + - pytorchjobs + - mxjobs + - xgboostjobs + - paddlejobs + verbs: + - get + - list + - watch +- apiGroups: + - kubeflow.org + resources: + - mpijobs/status + - tfjobs/status + - pytorchjobs/status + - mxjobs/status + - xgboostjobs/status + - paddlejobs/status + verbs: + - get + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/deployment.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/deployment.yaml new file mode 100644 index 00000000..ebb73047 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/deployment.yaml @@ -0,0 +1,122 @@ +{{- if (include "kubeflow.trainingOperator.enabled" . | eq "true") -}} + +{{- $autoscalingEnabled := include "kubeflow.trainingOperator.autoscaling.enabled" . -}} +{{- $replicas := include "kubeflow.trainingOperator.autoscaling.minReplicas" . -}} + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + {{- if (eq $autoscalingEnabled "false") }} + replicas: {{ $replicas }} + {{- end }} + + selector: + matchLabels: + {{- include "kubeflow.trainingOperator.selectorLabels" . | nindent 6 }} + + template: + metadata: + labels: + {{- include "kubeflow.trainingOperator.selectorLabels" . | nindent 8 }} + annotations: + sidecar.istio.io/inject: "false" + + spec: + containers: + - name: {{ include "kubeflow.trainingOperator.baseName" . }} + image: {{ include "kubeflow.trainingOperator.image" . }} + imagePullPolicy: {{ include "kubeflow.trainingOperator.imagePullPolicy" . }} + + command: + - /manager + + ports: + - containerPort: {{ .Values.trainingOperator.service.monitoring.targetPort }} + - containerPort: {{ .Values.trainingOperator.service.webhookServer.targetPort }} + name: webhook-server + protocol: TCP + + {{- with .Values.trainingOperator.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + timeoutSeconds: 3 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 3 + + env: + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + + {{- with include "kubeflow.trainingOperator.containerSecurityContext" . }} + securityContext: + {{- . | nindent 10 }} + {{- end }} + + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + + serviceAccountName: {{ include "kubeflow.trainingOperator.serviceAccountName" . }} + + {{- with include "kubeflow.trainingOperator.nodeSelector" . }} + nodeSelector: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.trainingOperator.tolerations" . }} + tolerations: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.trainingOperator.affinity" . }} + affinity: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.trainingOperator.topologySpreadConstraints" . }} + topologySpreadConstraints: + {{- . | nindent 8 }} + {{- end }} + + {{- with include "kubeflow.trainingOperator.terminationGracePeriodSeconds" . }} + terminationGracePeriodSeconds: + {{- . | nindent 8 }} + {{- end }} + + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: {{ include "kubeflow.trainingOperator.tlsCertSecretName" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/hpa.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/hpa.yaml new file mode 100644 index 00000000..290fd3b3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/hpa.yaml @@ -0,0 +1,36 @@ +{{- if (include "kubeflow.trainingOperator.autoscaling.enabled" . | eq "true") -}} + +{{- $componentName := include "kubeflow.trainingOperator.name" . -}} +{{- $minReplicas := include "kubeflow.trainingOperator.autoscaling.minReplicas" . -}} +{{- $maxReplicas := include "kubeflow.trainingOperator.autoscaling.maxReplicas" . -}} +{{- $targetCPUUtilizationPercentage := include "kubeflow.trainingOperator.autoscaling.targetCPUUtilizationPercentage" . -}} +{{- $targetMemoryUtilizationPercentage := include "kubeflow.trainingOperator.autoscaling.targetMemoryUtilizationPercentage" . -}} + +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ $componentName }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ $componentName }} + minReplicas: {{ $minReplicas }} + maxReplicas: {{ $maxReplicas }} + metrics: + {{- if $targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ $targetCPUUtilizationPercentage }} + {{- end }} + {{- if $targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ $targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/poddisruptionbudget.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/poddisruptionbudget.yaml new file mode 100644 index 00000000..c0dc2e2c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if (include "kubeflow.trainingOperator.pdb.create" . | eq "true") -}} + +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + selector: + matchLabels: + {{- include "kubeflow.trainingOperator.selectorLabels" . | nindent 6 }} + {{- with (include "kubeflow.trainingOperator.pdb.values" .) }} + {{- . | nindent 2 }} + {{- end }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/secret.webhook-cert.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/secret.webhook-cert.yaml new file mode 100644 index 00000000..4232f1b2 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/secret.webhook-cert.yaml @@ -0,0 +1,13 @@ +{{- if (include "kubeflow.trainingOperator.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Secret +metadata: + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.tlsCertSecretName" . }} + namespace: {{ include "kubeflow.namespace" . }} +data: {} +type: Opaque + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service-account.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service-account.yaml new file mode 100644 index 00000000..1330d850 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service-account.yaml @@ -0,0 +1,15 @@ +{{- if (include "kubeflow.trainingOperator.createServiceAccount" . | eq "true") -}} + +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- with .Values.trainingOperator.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.serviceAccountName" . }} + namespace: {{ include "kubeflow.namespace" . }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service.yaml new file mode 100644 index 00000000..670f47aa --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/service.yaml @@ -0,0 +1,28 @@ +{{- if (include "kubeflow.trainingOperator.enabled" . | eq "true") -}} + +apiVersion: v1 +kind: Service +metadata: + {{- with .Values.trainingOperator.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kubeflow.trainingOperator.labels" . | nindent 4 }} + name: {{ include "kubeflow.trainingOperator.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} +spec: + ports: + - name: monitoring-port + port: {{ .Values.trainingOperator.service.monitoring.port }} + targetPort: {{ .Values.trainingOperator.service.monitoring.targetPort }} + - name: webhook-server + port: {{ .Values.trainingOperator.service.webhookServer.port }} + protocol: TCP + targetPort: {{ .Values.trainingOperator.service.webhookServer.targetPort }} + selector: + {{- include "kubeflow.trainingOperator.selectorLabels" . | nindent 4 }} + sessionAffinity: None + type: {{ .Values.trainingOperator.service.type }} + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/validatingwebhookconfiguration.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/validatingwebhookconfiguration.yaml new file mode 100644 index 00000000..16dba1bd --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/templates/training-operator/validatingwebhookconfiguration.yaml @@ -0,0 +1,110 @@ +{{- if (include "kubeflow.trainingOperator.enabled" . | eq "true") -}} + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validator.training-operator.kubeflow.org +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "kubeflow.trainingOperator.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} + path: /validate-kubeflow-org-v1-mxjob + failurePolicy: Fail + name: validator.mxjob.training-operator.kubeflow.org + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - mxjobs + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "kubeflow.trainingOperator.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} + path: /validate-kubeflow-org-v1-paddlejob + failurePolicy: Fail + name: validator.paddlejob.training-operator.kubeflow.org + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - paddlejobs + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "kubeflow.trainingOperator.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} + path: /validate-kubeflow-org-v1-pytorchjob + failurePolicy: Fail + name: validator.pytorchjob.training-operator.kubeflow.org + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - pytorchjobs + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "kubeflow.trainingOperator.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} + path: /validate-kubeflow-org-v1-tfjob + failurePolicy: Fail + name: validator.tfjob.training-operator.kubeflow.org + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - tfjobs + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "kubeflow.trainingOperator.svc.name" . }} + namespace: {{ include "kubeflow.namespace" . }} + path: /validate-kubeflow-org-v1-xgboostjob + failurePolicy: Fail + name: validator.xgboostjob.training-operator.kubeflow.org + rules: + - apiGroups: + - kubeflow.org + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - xgboostjobs + sideEffects: None + +{{- end }} diff --git a/packs/kubeflow-1.9.1/charts/kubeflow/values_lint.yaml b/packs/kubeflow-1.9.1/charts/kubeflow/values_lint.yaml new file mode 100644 index 00000000..a4b2aeb6 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/kubeflow/values_lint.yaml @@ -0,0 +1,2057 @@ +# NOTE: try disabling cache in the ml-pipeline +# or, try using newer version + +# This namespace allows you to define where the services will be installed into +# if not set then they will use the namespace of the release +# This is helpful when installing Kubeflow as a chart dependency (sub chart). +namespace: "" + +# one of ['cluster', 'namespace'] +# 'namespace' is not yet fully supported. +# Maybe rename to 'deploymentScope'? +deploymentMode: cluster + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +auth: + userHeaderName: kubeflow-userid + groupsHeaderName: kubeflow-groups + authHeader: + name: Authorization + prefix: "Bearer " + userIdPrefix: "" + +clusterDomain: cluster.local + +defaults: + image: + registry: docker.io + pullPolicy: IfNotPresent + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: false + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + podDisruptionBudget: {} + nodeSelector: {} + tolerations: [] + affinity: {} + topologySpreadConstraints: + terminationGracePeriodSeconds: + containerSecurityContext: + +admissionWebhook: + enabled: true + image: + repository: kubeflownotebookswg/poddefaults-webhook + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + service: + create: true + annotations: + type: ClusterIP + port: 443 + targetPort: 4443 + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + +centraldashboard: + enabled: true + image: + repository: kubeflownotebookswg/centraldashboard + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + # This enables the automatic profile creation. + enableRegistrationFlow: false + logoutURL: "/oauth2/sign_out" + forceIFrame: true + links: + externalLinks: + menuLinks: + - type: item + link: /jupyter/ + text: Notebooks + icon: book + + - type: item + link: /tensorboards/ + text: Tensorboards + icon: assessment + + - type: item + link: /volumes/ + text: Volumes + icon: device:storage + + - type: item + link: /katib/ + text: Katib Experiments + icon: kubeflow:katib + + - type: item + link: /kserve-endpoints/ + text: KServe Endpoints + icon: kubeflow:models + + - icon: kubeflow:pipeline-centered + items: + - type: item + text: Pipelines + link: /pipeline/#/pipelines + + - type: item + text: Experiments + link: /pipeline/#/experiments + + - type: item + text: Runs + link: /pipeline/#/runs + + - type: item + text: Recurring Runs + link: /pipeline/#/recurringruns + + - type: item + text: Artifacts + link: /pipeline/#/artifacts + + - type: item + text: Executions + link: /pipeline/#/executions + text: Pipelines + type: section + quickLinks: + - text: Create a new Notebook + desc: Kubeflow Notebooks + link: /jupyter/new + - text: Upload a Pipeline + desc: Kubeflow Pipelines + link: /pipeline/#/pipelines + - text: View Pipeline Runs + desc: Notebook Servers + link: /pipeline/#/runs + documentationItems: + - text: Kubeflow Website + desc: The Kubeflow website + link: https://www.kubeflow.org/ + - text: Kubeflow Pipelines Documentation + desc: Documentation for Kubeflow Pipelines + link: https://www.kubeflow.org/docs/components/pipelines/ + - text: Kubeflow Notebooks Documentation + desc: Documentation for Kubeflow Notebooks + link: https://www.kubeflow.org/docs/components/notebooks/ + - text: Kubeflow Training Operator Documentation + desc: Documentation for Kubeflow Training Operator + link: https://www.kubeflow.org/docs/components/training/" + - text: Katib Documentation + desc: Documentation for Katib + link: https://www.kubeflow.org/docs/components/katib/ + +notebooks: + enabled: true + jupyterWebApp: + enabled: true + image: + repository: kubeflownotebookswg/jupyter-web-app + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + # TODO: embed into config + urlPrefix: /jupyter + uiFlavor: default + secureCookies: true + logos: + # if this is defined, the configmap with logos will not be created but + # the one provided with customConfigMap will be used. + customConfigMap: + # if below values are defined, those will be used for the icons + # instead of defaults + icons: + jupyterIconSvg: + jupyterLabLogoSvg: + groupOneIconSvg: + groupOneLogoSvg: + groupTwoIconSvg: + groupTwoLogoSvg: + spawnerFormDefaults: + # -------------------------------------------------------------- + # Configuration file for the Kubeflow Notebooks UI. + # + # About the `readOnly` configs: + # - when `readOnly` is set to "true", the respective option + # will be disabled for users and only set by the admin + # - when 'readOnly' is missing, it defaults to 'false' + # -------------------------------------------------------------- + + ################################################################ + # Container Images + ################################################################ + # if users can input custom images, or only select from dropdowns + allowCustomImage: true + + # if the registry of the container image is hidden from display + hideRegistry: true + + # if the tag of the container image is hidden from display + hideTag: false + + # configs for the ImagePullPolicy + imagePullPolicy: + readOnly: false + + # the default ImagePullPolicy + # (possible values: "Always", "IfNotPresent", "Never") + value: IfNotPresent + + ################################################################ + # Jupyter-like Container Images + # + # NOTES: + # - the `image` section is used for "Jupyter-like" apps whose + # HTTP path is configured by the "NB_PREFIX" environment variable + ################################################################ + image: + # the default container image + value: kubeflownotebookswg/jupyter-scipy:v1.9.2 + + # the list of available container images in the dropdown + options: + - kubeflownotebookswg/jupyter-scipy:v1.9.2 + - kubeflownotebookswg/jupyter-pytorch-full:v1.9.2 + - kubeflownotebookswg/jupyter-pytorch-cuda-full:v1.9.2 + - kubeflownotebookswg/jupyter-tensorflow-full:v1.9.2 + - kubeflownotebookswg/jupyter-tensorflow-cuda-full:v1.9.2 + + ################################################################ + # VSCode-like Container Images (Group 1) + # + # NOTES: + # - the `imageGroupOne` section is used for "VSCode-like" apps that + # expose themselves under the HTTP root path "/" and support path + # rewriting without breaking + # - the annotation `notebooks.kubeflow.org/http-rewrite-uri: "/"` is + # set on Notebooks spawned by this group, to make Istio rewrite + # the path of HTTP requests to the HTTP root + ################################################################ + imageGroupOne: + # the default container image + value: kubeflownotebookswg/codeserver-python:v1.9.2 + + # the list of available container images in the dropdown + options: + - kubeflownotebookswg/codeserver-python:v1.9.2 + + ################################################################ + # RStudio-like Container Images (Group 2) + # + # NOTES: + # - the `imageGroupTwo` section is used for "RStudio-like" apps whose + # HTTP path is configured by the "X-RStudio-Root-Path" header + # - the annotation `notebooks.kubeflow.org/http-rewrite-uri: "/"` is + # set on Notebooks spawned by this group, to make Istio rewrite + # the path of HTTP requests to the HTTP root + # - the annotation `notebooks.kubeflow.org/http-headers-request-set` is + # set on Notebooks spawned by this group, such that Istio injects the + # "X-RStudio-Root-Path" header to all request + ################################################################ + imageGroupTwo: + # the default container image + value: kubeflownotebookswg/rstudio-tidyverse:v1.9.2 + + # the list of available container images in the dropdown + options: + - kubeflownotebookswg/rstudio-tidyverse:v1.9.2 + + ################################################################ + # CPU Resources + ################################################################ + cpu: + readOnly: false + + # the default cpu request for the container + value: "0.5" + + # a factor by which to multiply the CPU request calculate the cpu limit + # (to disable cpu limits, set as "none") + limitFactor: "1.2" + + ################################################################ + # Memory Resources + ################################################################ + memory: + readOnly: false + + # the default memory request for the container + value: "1.0Gi" + + # a factor by which to multiply the memory request calculate the memory limit + # (to disable memory limits, set as "none") + limitFactor: "1.2" + + ################################################################ + # GPU/Device-Plugin Resources + ################################################################ + gpus: + readOnly: false + + # configs for gpu/device-plugin limits of the container + # https://kubernetes.io/docs/tasks/manage-gpus/scheduling-gpus/#using-device-plugins + value: + # the `limitKey` of the default vendor + # (to have no default, set as "") + vendor: "" + + # the list of available vendors in the dropdown + # `limitsKey` - what will be set as the actual limit + # `uiName` - what will be displayed in the dropdown UI + vendors: + - limitsKey: "nvidia.com/gpu" + uiName: "NVIDIA" + - limitsKey: "amd.com/gpu" + uiName: "AMD" + + # the default value of the limit + # (possible values: "none", "1", "2", "4", "8") + num: "none" + + ################################################################ + # Workspace Volumes + ################################################################ + workspaceVolume: + readOnly: false + + # the default workspace volume to be created and mounted + # (to have no default, set `value: null`) + value: + mount: /home/jovyan + + # pvc configs for creating new workspace volumes + # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#persistentvolumeclaim-v1-core + newPvc: + metadata: + # "{notebook-name}" is replaced with the Notebook name + name: "{notebook-name}-workspace" + spec: + # storageClassName: my-storage-class + resources: + requests: + storage: 5Gi + accessModes: + - ReadWriteOnce + + ################################################################ + # Data Volumes + ################################################################ + dataVolumes: + readOnly: false + + # a list of additional data volumes to be created and/or mounted + value: [] + # value: + # - mount: /home/jovyan/datavol-1 + # newPvc: + # metadata: + # name: "{notebook-name}-datavol-1" + # spec: + # resources: + # requests: + # storage: 5Gi + # accessModes: + # - ReadWriteOnce + # + # - mount: /home/jovyan/datavol-1 + # existingSource: + # persistentVolumeClaim: + # claimName: "test-pvc" + + ################################################################ + # Affinity + ################################################################ + affinityConfig: + readOnly: false + + # the `configKey` of the default affinity config + # (to have no default, set as "") + # (if `readOnly`, the default `value` will be the only accessible option) + value: "" + + # the list of available affinity configs in the dropdown + options: [] + # options: + # - configKey: "dedicated_node_per_notebook" + # displayName: "Dedicated Node Per Notebook" + # affinity: + # # Require a Node with label `lifecycle=kubeflow-notebook` + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: "lifecycle" + # operator: "In" + # values: + # - "kubeflow-notebook" + # + # # Require a Node WITHOUT an existing Pod having `notebook-name` label + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchExpressions: + # - key: "notebook-name" + # operator: "Exists" + # topologyKey: "kubernetes.io/hostname" + # # WARNING: `namespaceSelector` is Beta in 1.22 and Stable in 1.24, + # # setting to {} is required for affinity to work across Namespaces + # namespaceSelector: {} + + ################################################################ + # Tolerations + ################################################################ + tolerationGroup: + readOnly: false + + # the `groupKey` of the default toleration group + # (to have no default, set as "") + # (if `readOnly`, the default `value` will be the only accessible option) + value: "" + + # the list of available toleration groups in the dropdown + options: [] + # options: + # - groupKey: "group_1" + # displayName: "4 CPU 8Gb Mem at ~$X.XXX USD per day" + # tolerations: + # - key: "dedicated" + # operator: "Equal" + # value: "kubeflow-c5.xlarge" + # effect: "NoSchedule" + # + # - groupKey: "group_2" + # displayName: "8 CPU 16Gb Mem at ~$X.XXX USD per day" + # tolerations: + # - key: "dedicated" + # operator: "Equal" + # value: "kubeflow-c5.2xlarge" + # effect: "NoSchedule" + # + # - groupKey: "group_3" + # displayName: "16 CPU 32Gb Mem at ~$X.XXX USD per day" + # tolerations: + # - key: "dedicated" + # operator: "Equal" + # value: "kubeflow-c5.4xlarge" + # effect: "NoSchedule" + # + # - groupKey: "group_4" + # displayName: "32 CPU 256Gb Mem at ~$X.XXX USD per day" + # tolerations: + # - key: "dedicated" + # operator: "Equal" + # value: "kubeflow-r5.8xlarge" + # effect: "NoSchedule" + + ################################################################ + # Shared Memory + ################################################################ + shm: + readOnly: false + + # the default state of the "Enable Shared Memory" toggle + value: true + + ################################################################ + # PodDefaults + ################################################################ + configurations: + readOnly: false + + # the list of PodDefault names that are selected by default + # (take care to ensure these PodDefaults exist in Profile Namespaces) + value: [] + # value: + # - my-pod-default + + ################################################################ + # Environment + # + # NOTE: + # - these configs are only used by the ROK "flavor" of the UI + ################################################################ + environment: + readOnly: false + value: {} + controller: + enabled: true + image: + repository: kubeflownotebookswg/notebook-controller + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + culling: + enabled: false + idleTimeMinutes: 1440 + idleCheckPeriodMinutes: 1 + volumesWebApp: + enabled: true + image: + repository: kubeflownotebookswg/volumes-web-app + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + urlPrefix: /volumes + secureCookies: true + viewer: + image: + repository: filebrowser/filebrowser + tag: v2.25.0 + registryOverwrite: + pullPolicyOverwrite: + serviceAccountName: default-editor + pvcviewerController: + enabled: true + manager: + image: + repository: kubeflownotebookswg/pvcviewer-controller + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + service: + create: true + annotations: + type: ClusterIP + webhook: + port: 9443 + resources: + {} + # limits: + # cpu: 500m + # memory: 128Mi + # requests: + # cpu: 10m + # memory: 64Mi + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + kubeRbacProxy: + image: + repository: kubebuilder/kube-rbac-proxy + tag: v0.13.1 + registryOverwrite: gcr.io + pullPolicyOverwrite: + service: + create: true + annotations: + type: ClusterIP + resources: + {} + # limits: + # cpu: 500m + # memory: 128Mi + # requests: + # cpu: 5m + # memory: 64Mi + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + - arm64 + - ppc64le + - s390x + - key: kubernetes.io/os + operator: In + values: + - linux + topologySpreadConstraints: + terminationGracePeriodSeconds: 10 + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + +kserveModelsWebApp: + enabled: true + image: + repository: kserve/models-web-app + tag: v0.13.0 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + serviceAccount: + create: true + name: + annotations: + service: + create: true + annotations: + type: ClusterIP + rbac: + create: true + config: + urlPrefix: /kserve-endpoints + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + +profilesController: + enabled: true + kfam: + image: + repository: kubeflownotebookswg/kfam + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + service: + create: true + annotations: + type: ClusterIP + config: + urlPrefix: /kfam + manager: + image: + repository: kubeflownotebookswg/profile-controller + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + admin: + workloadIdentity: + defaultNamespaceLabels: + # Below is a list of labels to be set by default. + # + # To add a namespace label, use `key: 'value'`, for example: + # istio.io/rev: 'asm-191-1' + # + # To remove a namespace label, use `key: ''`. For example: + # istio-injection: '' + # + # Profile controller will not replace a namespace label if its key already + # exists. If you want to override the value of a previously applied label, you + # need to: + # 1. Remove the label by using `key: ''` and deploy. + # 2. Add the label by using `key: 'value'` and deploy. + # + katib.kubeflow.org/metrics-collector-injection: "enabled" + serving.kubeflow.org/inferenceservice: "enabled" + pipelines.kubeflow.org/enabled: "true" + app.kubernetes.io/part-of: "kubeflow-profile" + extraNamespaceLabels: + +katib: + urlPrefix: /katib + enabled: true + controller: + enabled: true + name: katib-controller + image: + repository: kubeflowkatib/katib-controller + tag: v0.17.0 + registryOverwrite: + pullPolicyOverwrite: + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + service: + create: true + annotations: + prometheus.io/port: "8080" + prometheus.io/scheme: http + prometheus.io/scrape: "true" + + webhook: + port: 443 + targetPort: 8443 + metrics: + port: 8080 + targetPort: 8080 + healthz: + port: 18080 + targetPort: 18080 + + serviceAccount: + create: true + name: + annotations: + dbmanager: + enabled: true + name: katib-db-manager + image: + repository: kubeflowkatib/katib-db-manager + tag: v0.17.0 + registryOverwrite: + pullPolicyOverwrite: + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + annotations: + sidecar.istio.io/inject: "false" + service: + create: true + annotations: + type: ClusterIP + config: + db: + existingSecretName: + driver: + value: mysql + secretKeyRef: + name: + key: driver + host: + value: mysql.kubeflow.svc.cluster.local + secretKeyRef: + name: + key: host + port: + value: 3306 + secretKeyRef: + name: + key: port + databaseName: + value: katib + secretKeyRef: + name: + key: databaseName + user: + value: katib + secretKeyRef: + name: + key: username + password: + value: katib1234 + secretKeyRef: + name: + key: password + ui: + enabled: true + name: katib-ui + urlPrefix: /katib + image: + repository: kubeflowkatib/katib-ui + tag: v0.17.0 + registryOverwrite: + pullPolicyOverwrite: + serviceAccount: + create: true + name: + annotations: + service: + create: true + annotations: + istioIntegration: + create: true + enabled: true + authorizationMode: ingressgateway + gateway: + name: kubeflow-gateway + config: + init: + trialResources: + - Job.v1.batch + - TFJob.v1.kubeflow.org + - PyTorchJob.v1.kubeflow.org + - MPIJob.v1.kubeflow.org + - XGBoostJob.v1.kubeflow.org + - MXJob.v1.kubeflow.org + runtime: + metricsCollectors: + - kind: StdOut + image: docker.io/kubeflowkatib/file-metrics-collector:v0.17.0 + - kind: File + image: docker.io/kubeflowkatib/file-metrics-collector:v0.17.0 + - kind: TensorFlowEvent + image: docker.io/kubeflowkatib/tfevent-metrics-collector:v0.17.0 + resources: + limits: + memory: 1Gi + suggestions: + - algorithmName: random + image: docker.io/kubeflowkatib/suggestion-hyperopt:v0.17.0 + - algorithmName: tpe + image: docker.io/kubeflowkatib/suggestion-hyperopt:v0.17.0 + - algorithmName: grid + image: docker.io/kubeflowkatib/suggestion-optuna:v0.17.0 + - algorithmName: hyperband + image: docker.io/kubeflowkatib/suggestion-hyperband:v0.17.0 + - algorithmName: bayesianoptimization + image: docker.io/kubeflowkatib/suggestion-skopt:v0.17.0 + - algorithmName: cmaes + image: docker.io/kubeflowkatib/suggestion-goptuna:v0.17.0 + - algorithmName: sobol + image: docker.io/kubeflowkatib/suggestion-goptuna:v0.17.0 + - algorithmName: multivariate-tpe + image: docker.io/kubeflowkatib/suggestion-optuna:v0.17.0 + - algorithmName: enas + image: docker.io/kubeflowkatib/suggestion-enas:v0.17.0 + resources: + limits: + memory: 200Mi + - algorithmName: darts + image: docker.io/kubeflowkatib/suggestion-darts:v0.17.0 + - algorithmName: pbt + image: docker.io/kubeflowkatib/suggestion-pbt:v0.17.0 + persistentVolumeClaimSpec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + earlyStoppings: + - algorithmName: medianstop + image: docker.io/kubeflowkatib/earlystopping-medianstop:v0.17.0 + +# TODO: verify patches in apps/pipeline/upstream/base/installs/multi-user +pipelines: + enabled: true + # NOTE: The Kubeflow Pipelines subcomponents contains special handling. It + # will first apply the global .Values.defaults.image, then look for + # .Values.pipelines.defaults.image and lastly for .Values.pipelines..image. + # This is primarily useful for setting global registry or Pipelines Container Tag. + defaults: + image: + registry: gcr.io + tag: 2.3.0 + pullPolicy: IfNotPresent + config: + # If this is empty, the kfp backend will automatically configure that with: + # "minio://mlpipeline/v2/artifacts" + # Please see the following links for referece: + # * <=2.1.0: https://github.com/kubeflow/pipelines/blob/2.1.0/backend/src/v2/config/env.go#L33 + # * >=2.2.0: https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L36 + # + # If we want to use s3, we should configure this with something similar to: + # s3://mlpipeline/v2/artifacts + # + # In 2.2.0 it's also possible to define bucket 'providers', which can be minio, s3 or gcs: + # * https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L45 + # * https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L151 + # * https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/s3.go#L24 + defaultPipelineRoot: "" + + objectStore: + # The Secret Name 'mlpipeline-minio-artifact' is currently hardcoded: + # * <=2.1.0: + # https://github.com/kubeflow/pipelines/blob/2.1.0/backend/src/v2/objectstore/object_store.go#L292 + # * >=2.2.0 (state as of 2nd May 2024) + # https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L39 + # + # It's only possible to use either nil or 'mlpipeline-minio-artifact' for + # * .Values.pipelines.config.objectStore.existingSecretName + # * .Values.pipelines.config.objectStore.accessKey.secretKeyRef.name + # * .Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name + # + # If the Secret Name is not provided in neither of the following, it will + # be created with plaintext values for compatibility: + # * .Values.pipelines.config.objectStore.existingSecretName + # * .Values.pipelines.config.objectStore.accessKey.secretKeyRef.name + # * .Values.pipelines.config.objectStore.secretAccessKey.secretKeyRef.name + existingSecretName: + accessKey: + value: minio + secretKeyRef: + name: + # The Secret Key 'accesskey' is currently hardcoded: + # https://github.com/kubeflow/pipelines/blob/2.1.0/backend/src/v2/objectstore/object_store.go#L324 + # https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L42 + key: accesskey + secretAccessKey: + value: minio123 + secretKeyRef: + name: + # The Secret Key 'secretkey' is currently hardcoded: + # https://github.com/kubeflow/pipelines/blob/2.1.0/backend/src/v2/objectstore/object_store.go#L325 + # https://github.com/kubeflow/pipelines/blob/2.2.0/backend/src/v2/config/env.go#L41 + key: secretkey + host: + value: minio + secretKeyRef: + name: + key: host + port: + value: 9000 + secretKeyRef: + name: + key: port + region: + value: + secretKeyRef: + name: + key: region + secure: + value: false + secretKeyRef: + name: + key: secure + bucketName: + value: mlpipeline + secretKeyRef: + name: + key: bucketName + + db: + existingSecretName: + user: + value: root + secretKeyRef: + name: + key: username + password: + value: mysql1234 + secretKeyRef: + name: + key: password + host: + value: mysql + secretKeyRef: + name: + key: host + port: + value: 3306 + secretKeyRef: + name: + key: port + mlmdDatabaseName: + value: metadb + secretKeyRef: + name: + key: mlmdDatabaseName + pipelineDatabaseName: + value: mlpipeline + secretKeyRef: + name: + key: pipelineDatabaseName + cacheDatabaseName: + value: cachedb + secretKeyRef: + name: + key: cacheDatabaseName + driver: + value: mysql + secretKeyRef: + name: + key: driver + conMaxLifetime: + value: 120s + secretKeyRef: + name: + key: conMaxLifetime + + cache: + enabled: true + image: + repository: ml-pipeline/cache-server + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + # requests: + # cpu: + # memory: + # limits: + # cpu: + # memory: + service: + create: true + annotations: + type: ClusterIP + port: 443 + targetPort: 8443 + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + ## defaultCacheStaleness and maximumCacheStaleness configures caching according to + ## https://www.kubeflow.org/docs/components/pipelines/overview/caching/ and + ## https://www.kubeflow.org/docs/components/pipelines/overview/caching-v2/. + ## This value is used if the user did not set a value in the pipeline. + ## defaultCacheStaleness: "P7D" + ## maximumCacheStaleness: "P30D" + defaultCacheStaleness: "" + maximumCacheStaleness: "" + ## ConMaxLifeTime will set the connection max lifetime for MySQL + ## this is very important to setup when using external databases. + ## See this issue for more details: https://github.com/kubeflow/pipelines/issues/5329 + ## Note: this value should be a string that can be parsed by `time.ParseDuration`. + ## If this value doesn't include a unit abbreviation, the units will be assumed + ## to be nanoseconds. + conMaxLifeTime: "120s" + ## cacheImage is the image that the mutating webhook will use to patch + ## cached steps with. Will be used to echo a message announcing that + ## the cached step result will be used. If not set it will default to + ## 'gcr.io/google-containers/busybox' + cacheImage: gcr.io/google-containers/busybox + ## cacheNodeRestrictions the dummy container running if output is cached + ## will run with the same affinity and node selector as the default pipeline + ## step. This is defaulted to 'false' to allow the pod to be scheduled on + ## any node and avoid defaulting to specific nodes. Allowed values are: + ## 'false' and 'true'. + cacheNodeRestrictions: "false" + + # --- + + mlPipeline: + # aka api-server + enabled: true + image: + repository: ml-pipeline/api-server + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + requests: + cpu: 250m + memory: 500Mi + # limits: + # cpu: 500m + # memory: 1024Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + # always use KF Pipeline latest version? + autoUpdatePipelineDefaultVersion: true + + persistenceAgent: + enabled: true + image: + repository: ml-pipeline/persistenceagent + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + requests: + cpu: 120m + memory: 500Mi + # limits: + # cpu: 500m + # memory: 1024Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + ttlSecondsAfterWorkflowFinish: 86400 + numWorkers: 2 + + scheduledWorkflow: + enabled: true + image: + repository: ml-pipeline/scheduledworkflow + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + # requests: + # cpu: 250m + # memory: 500Mi + # limits: + # cpu: 500m + # memory: 1024Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + cronScheduleTimezone: "UTC" + + ui: + enabled: true + image: + repository: ml-pipeline/frontend + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + requests: + cpu: 10m + memory: 70Mi + # limits: + # cpu: 500m + # memory: 1024Mi + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + # Note from apps/pipeline/upstream/base/installs/multi-user/pipelines-ui/configmap-patch.yaml + # Temporary workarounds: + # 1. Using default-editor because default-viewer isn't bound to workload identity + viewerPodServiceAccountName: default-editor + allowCustomVisualizations: true + urlPrefix: /pipeline + + viewerCrd: + enabled: true + image: + repository: ml-pipeline/viewer-crd-controller + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + # requests: + # cpu: + # memory: + # limits: + # cpu: + # memory: + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + maxNumViewers: 50 + + metadataWriter: + enabled: true + image: + repository: ml-pipeline/metadata-writer + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + # requests: + # cpu: + # memory: + # limits: + # cpu: + # memory: + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + + # NOTE: defines istio sidecar injection but it doesn't work + # because it's in an annotation, not pod label. + metadataEnvoy: + enabled: true + image: + repository: ml-pipeline/metadata-envoy + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + # requests: + # cpu: + # memory: + # limits: + # cpu: + # memory: + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + serviceAccount: + create: false + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + + metadataGrpcServer: + enabled: true + image: + repository: tfx-oss-public/ml_metadata_store_server + registryOverwrite: + tagOverwrite: 1.14.0 + pullPolicyOverwrite: + resources: + # requests: + # cpu: + # memory: + # limits: + # cpu: + # memory: + service: + create: true + annotations: + type: ClusterIP + # TODO: investigate if exposing port config to all services makes sense. + port: 8080 + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + urlPrefix: /ml_metadata + + visualization: + enabled: true + image: + repository: ml-pipeline/visualization-server + registryOverwrite: + tagOverwrite: + pullPolicyOverwrite: + resources: + requests: + cpu: 30m + memory: 500Mi + # limits: + # cpu: + # memory: + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + + # This is metacontroller based implementation that creates instances of + # * Secret/mlpipeline-minio-artifact + # * Deployment/ml-pipeline-ui-artifact + # * Service/ml-pipeline-ui-artifact + # * Deployment/ml-pipeline-visualizationserver + # * Service/ml-pipeline-visualizationserver + # * ConfigMap/kfp-launcher + # * ConfigMap/metadata-grpc-configmap + # * AuthorizationPolicy/ml-pipeline-visualizationserver + # * DestinationRule/ml-pipeline-visualizationserver + profileController: + enabled: true + image: + repository: python + registryOverwrite: docker.io + tagOverwrite: "3.7" + pullPolicyOverwrite: + resources: + # requests: + # cpu: + # memory: + # limits: + # cpu: + # memory: + service: + create: true + annotations: + type: ClusterIP + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: false + serviceAccount: + create: false + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + disableIstioSidecar: false + + +tensorboard: + enabled: true + controller: + enabled: true + manager: + image: + repository: kubeflownotebookswg/tensorboard-controller + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + # limits: + # cpu: 500m + # memory: 128Mi + # requests: + # cpu: 10m + # memory: 64Mi + containerSecurityContext: + allowPrivilegeEscalation: false + config: + rwoPvcScheduling: "True" + tensorboard: + image: + repository: tensorflow/tensorflow + registryOverwrite: + tag: "2.5.1" + kubeRbacProxy: + image: + repository: kubebuilder/kube-rbac-proxy + tag: v0.8.0 + registryOverwrite: gcr.io + pullPolicyOverwrite: + service: + create: true + annotations: + type: ClusterIP + port: 8443 + targetPort: 8443 + resources: + {} + # limits: + # cpu: 500m + # memory: 128Mi + # requests: + # cpu: 5m + # memory: 64Mi + containerSecurityContext: + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + terminationGracePeriodSeconds: 10 + securityContext: + runAsNonRoot: true + runAsUser: 999 + tensorboardsWebApp: + enabled: true + image: + repository: kubeflownotebookswg/tensorboards-web-app + tag: v1.9.2 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + service: + create: true + annotations: + type: ClusterIP + port: 80 + targetPort: 5000 + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + containerSecurityContext: + config: + urlPrefix: /tensorboards + secureCookies: true + +trainingOperator: + enabled: true + image: + repository: kubeflow/training-operator + tag: v1-04f9f13 + registryOverwrite: + pullPolicyOverwrite: + resources: + {} + service: + create: true + annotations: + type: ClusterIP + webhookServer: + port: 443 + targetPort: 9443 + monitoring: + port: 8080 + targetPort: 8080 + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + rbac: + create: true + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + terminationGracePeriodSeconds: 10 + containerSecurityContext: + allowPrivilegeEscalation: false + +modelRegistry: + enabled: true + rest: + image: + repository: kubeflow/model-registry + tag: v0.2.9 + pullPolicy: IfNotPresent + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + containerSecurityContext: + grpc: + image: + registry: gcr.io + repository: tfx-oss-public/ml_metadata_store_server + tag: 1.14.0 + pullPolicy: IfNotPresent + resources: + {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + containerSecurityContext: + service: + annotations: + type: ClusterIP + restPort: 8080 + grpcPort: 9090 + autoscaling: + # If autoscaling is disabled, replica count for a component is equal to minReplicas. + enabled: + minReplicas: + maxReplicas: + targetCPUUtilizationPercentage: + targetMemoryUtilizationPercentage: + podDisruptionBudget: {} + podAnnotations: + # If Database in use is MySQL running incluster and MySQL has Istio Sidecar + # Disabled, the connection to MySQL Server must also run without sidecar. + # Related resources: + # https://istio.io/latest/about/faq/#mysql-with-mtls + # https://github.com/istio/istio/issues/10062 + traffic.sidecar.istio.io/excludeOutboundPorts: "3306" + serviceAccount: + create: true + name: + annotations: + nodeSelector: + tolerations: + affinity: + topologySpreadConstraints: + config: + rest: + urlPrefix: /api/model_registry/ + grpc: + urlPrefix: /ml_metadata.MetadataStoreService/ + db: + existingSecretName: + user: + value: root + secretKeyRef: + name: + key: username + password: + value: mysql1234 + secretKeyRef: + name: + key: password + host: + value: mysql + secretKeyRef: + name: + key: host + port: + value: 3306 + secretKeyRef: + name: + key: port + dbName: + value: metadb_model_registry + secretKeyRef: + name: + key: dbName + +networkPolicies: + enabled: true + +# if cert manager is not enabled, we have to use cache-deployer. +# We currently don't support deployments without cert-manager. +certManagerIntegration: + enabled: true + +istioIntegration: + enabled: true + envoyExtAuthzHttpExtensionProviderName: oauth2-proxy + rootNamespace: istio-system + ingressGatewayNamespace: istio-ingress + # Required for KF Profiles Controller to configure + # correct AuthorizationPolicy principal. + ingressGatewayServiceAccountName: istio-ingressgateway + # one of ['ingressgateway', 'granular'] + # * 'ingressgateway' will deploy one AuthorizationPolicy in the namespace where + # istio ingress gateway Pod is being deployed. + # * 'granular' will deploy multiple AuthorizationPolicies with CUSTOM action using auth provider, + # each for component that requires user id. This is an alternative way of setting authentication + # with istio. 'granular' is more secure but more complex. + # NOTE: this is ultimately not supported and should be cleaned up. + authorizationMode: ingressgateway + m2m: + enabled: true + userClaim: sub + groupsClaim: groups + issuer: https://kubernetes.default.svc.cluster.local + userAuth: + userClaim: email + issuer: http://dex.dex.svc.cluster.local:5556/dex + gateway: + name: kubeflow-gateway + selector: + istio: ingressgateway + # TODO: check if this is used + servers: + - hosts: + - "*" + port: + number: 80 + name: http + protocol: HTTP + kubeflowJwksProxy: + enabled: true + +# Both .Values.dexIntegration.enabled and .Values.istioIntegration.enabled has +# to be set to a boolean 'true' in order to create required dex integration +# resources. + +# Automatically creates Istio VirtualService or Ingress objects. +dexIntegration: + enabled: true + svc: + name: dex + port: 5556 + namespace: dex + + # one of: 'internal', 'external' + # * internal - the in-kubernetes svc address will be used as the dex IdP + # Issuer address. + # example: dex.dex.svc.cluster.local + # * external - the .Values.dexIntegration.host will be used as the dex IdP + # Issuer address. + # example: dex.example.com + # Currently only 'internal' is supported. + integrationType: internal + + # One of: 'istio', 'ingress'. + # Currently only 'istio' is supported. + integrationMode: istio + + # 'host' must be set if .Values.dexIntegration.integrationType: external + host: + + # If .Values.dexIntegration.integrationType: internal, dex IdP will be + # available under this relative URL Prefix. + urlPrefix: /dex + + integrationModeConfig: + istio: + ingress: + class: + annotations: + +# Automatically creates Istio VirtualService. +oauth2ProxyIntegration: + enabled: true + urlPrefix: /oauth2 + host: "*" + svc: + name: oauth2-proxy + port: 80 + namespace: oauth2-proxy + +knativeIntegration: + enabled: true + knativeServing: + enabled: true + name: knative-serving + namespace: knative-serving + # Whatever is under .knativeIntegration.knativeServing.operatorSpec will be + # put directly to the KnativeServing CRD under .spec. + operatorSpec: + version: 1.12.4 + ingress: + istio: + enabled: true + knative-ingress-gateway: + selector: + istio: ingressgateway + servers: + - port: + number: 80 + name: http + protocol: HTTP + hosts: + - "*" + knative-local-gateway: + selector: + istio: cluster-local-gateway + servers: + - port: + number: 80 + name: http + protocol: HTTP + hosts: + - "*" + config: + # Note: The configuration options may be copied out of + # the example blocks, found in each of the supported KNative ConfigMaps. + # For more information, visit official knative operator documentation: + # https://knative.dev/docs/install/operator/configuring-with-operator/ + istio: + gateway.knative-serving.knative-ingress-gateway: "istio-ingressgateway.istio-ingress.svc.cluster.local" + local-gateway.knative-serving.knative-local-gateway: "cluster-local-gateway.istio-ingress.svc.cluster.local" + external-gateways: | + - name: knative-ingress-gateway + namespace: knative-serving + service: istio-ingressgateway.istio-ingress.svc.cluster.local + + local-gateways: | + - name: knative-local-gateway + namespace: knative-serving + service: cluster-local-gateway.istio-ingress.svc.cluster.local + domain: {} + # example.com: "" + + # Eventing config + knativeEventing: + enabled: false + name: knative-eventing + namespace: knative-eventing + # Whatever is under .knativeIntegration.knativeEventing.operatorSpec will be + # put directly to the KnativeEventing CRD under .spec. + operatorSpec: + version: 1.10.2 diff --git a/packs/kubeflow-1.9.1/charts/metacontroller-4.11.22.tgz b/packs/kubeflow-1.9.1/charts/metacontroller-4.11.22.tgz new file mode 100644 index 0000000000000000000000000000000000000000..a6f6632d81d4080c437f2e7cfb40e648579aeb3b GIT binary patch literal 4115 zcmV+u5bWDc zVQyr3R8em|NM&qo0PI~)bKAI*_nDsps~o&LWm1%4J5#E92d|Tzm)c3jWoNR7saLNc zvL#{+0(<}{N12-a>{|dRiKO^XwwymZ=tFFi%?8luM*je^J1Hm}ai#>P6vX&C!9oRV zoYIryQ5c5d<@ve!8HQo~XE>dNCzFft;^J}=PAAioaB@DKOioaE#6GlAE)^Ch;gj2{ z5AHi5oRNWzGDJ^WRv=Kl)PjA8|H9MN1V5Q0;9>Uz-Q|I_KkwC4Y> zE~d`^zX+B6U(9h7;9MnKkk7_XgZm$4K=^ny@$LzWXXx5m#Vx1cY14_Z!ZQyc>-P8g z92S&6_%;6*IR!cMe1tRdli+zKXXv-l=pP;0%p2b7??J5+VUg>SrR(7G#;?Y+!4VfTFc} zyJu(=1BIrs;;ax~=|v0~S->rzJ8J9%Cj(20X#h(IJM6V6fwia=L z6&Gdp{y_||8d&Wc>TckL>wWE&^8Y6diT`uLV(o5^g#mr||01l#|LG*W2wnXD67=}^ z|DV<>8eo9F;_r;gFHFhTw&WMaj zB2@N&y_MXB`n$pa?x4B?P&@}J^=~?IXM2Zzv1LyBiZ3 z@fC=*PnZI+!t`%1FT+rJWreJOfs{9b&!IY?M5*j2Q1ww}T&NlPG5m2-zkyXUL*oQ6 zRmo?stS=ms<2Is2uFGv~jsdPYQ}C%KPePsp;+*&e$7W$KmS~_7##n?==zp(^xR$IyoA*8N{{{LVF7C15Ig8EP4s9)RHXbjDO7eLS@pPy^Y7+DvK;Gw zHh;<$8}9_oade+&NUzM&`yr4InfF65$M@b3flBr7T#%*r!~c3O&_^r?&n0^M`i=C0 zOmK}1ynw`j$Ch32-@RZZBOb%}dw8i?^Z!W1a$Gv!J<6v5o&G-wr0HUGanzdU#T z|0T%xeXqI)An-{6GpGLh$A2ca-4@XHH7p1t=6!w{aAU@}GETnTB@iEHncypkgI%}` z2%n*xZSI_HU@c-?p*1KZ^La{?g4jqY1?VL(BgZUJU{JvJgMw8UOkM`zb{o?4k|St* zL9*SVEbU=rGgEOUXh&9PWz)oU6|Ybt)ql5f{7j?;c^SNK0+b+dI@9ZA|6S0_@!0DS;I%*KK0@MuM#V6CStUM+jJ+cHQ^UFYL8>CEv+( z3-;Z1C(~PYLvhq2h*L_~a*(`&w_j|p#x>b*Xs#28?mIL(Oz+6X_L!6qLp!w^>*E@> zBmm2HBd*dQ{p`qU>RCh^_TvlIizpG$=?Rv6Be<8XWeIC%#X{h9uZeaF>|yB|qhDIr z8gFmbtcIJN&9)D22@LcCc2_wK-+y+_IR#wrRl<3b7k0Zqv^k|}p5}i4S#_`c8bFwX zO!Hc?ji-A>^}8PR(Q4XybAZ7=z+5Y?z4c*B2q?Vl_LSjEQG}xeuJsJ(*`3Dk@qmS6 z!9|MIOheF@?F!kDRg8wK%gUi@Yj-}76nL(_f$jjqb2?;M>hhH)&fb;D9Qh9r)Vsh6 zkQrwZer4~lkO`*r9glm~@CpvU17){9ze~^q>H~`(o*sQqAkIuju@l;EG3_9&u2^ zaE?728Ngz6evH*d*%i0DTN_QsxoA4$Xll4uCAsKP?;tt7qwHZ=5QeG4B@UN#cgNup zhf5qTDUrh^?c{Jtf6p8)>1N2dRKJ?T=Ieyemf3Oe#K98>PYQDI#KDs-Ie5}e4xaS) z%)yf$cp|`|6NgS5I&tX4p_3gsbkac%o%FFdbW&z|JUWqU7CB7PLJpHSOk&Al5{F5) zuGlxm~KgMmmnPCA;-L_^Xbo*RiQbf<#Or?tU?|@N#p}w+DYzt}FBprM0 zUpa_1;wumcBMC|`+1s?Bw&n0c0-7nOhP_mgqeyB}QS#F|!n3y?+gHfUeq% z1JX>b>-{v6Kq4Jf>@>&#T_KiJT4QaIx)H$m_W4I5%=)0Zpk_(+d%CcyC(>wc&=}Be zc}Q(ClvV%kN=d=3GJ10&x-F*ET#@3{-)V$Yg4L$-r)}5WGQ(0u|b0!m#^@lvZTSzu(j2|&2@wN$TuW#8Ide7BccGfHM z%_kz2U0Ysrkng!NSB|DI+s%X2WgjuFz-+pP9&b7CQ3mMkqF-AH>{L&rhP_-Ada?Pd zwjtX@n(t+m?$aC)NPh? zGg+fp!IDHM1+g?09-^dgk_YB`9e^%}TX|(OWjMp>NNdwsDd(+GRB( z^VH~ZFyN_&bO?R&OT~;*ocV?ADV~z3;fe0--5v|t)Rz7`k&26!0No$q&3xTpm2_Bh z??Q6GhNImPJJs91rgY{Tc4QlNG$%l=S#$$}@VNCrt$PpMzGrS8iC^0`c>}uIlpEW~ zy5FR~O_wiSk{Rr*bWe~3v4Xf%(@dM4DJ8bMlF#?b_7$B(fBfnF1!|@26@EW@sgw=V zZP9|cS+0~)XJ{ytve!#Hd!-sEb&g#Llx^we`1z`!G>#FuA}HT@5foD>LqKg78iPky zT-ug1Z-^3|fo8u5%YcVUE>@e4_Mq1j?%D%gTNK;<4-b1c^q}@GnofI7tv1B7=I*$P zHQ!go8Ve6@H1ZzAUqhot`C|=3X1(umy z`Kd;7xTJ*~F4^aFxWwTShfBIy9WLo(ak!++aNgO8WW_6gP zkHukM&Vlw8$6rfH@_GbaYm;vg#s-HC$(QwN7*l-}O= z3Od4fNCV0mJgu-ns|I!j4-PDC&?>P~^5Br-2CWhsiXIFuZ*TzK8HggDqsYNA${aX+ zf;CR*QQ8Q@ zFuXiJH$THLtp7B>PcFiXi_1wkolH-{$;J7r=?Myt(s~c&QekltKDn*>;2b$}Dc zVQyr3R8em|NM&qo0PI?AZ`(NX?`wXF`8!#l&3{G9j*}b=9I(D@?poYKd+~08!(tK8 z(%9mLBDExC$4z>l{XkOkgY3lFHk)2?o)->9k;561^P2~y&}z&Dw$C%BEuFJmym)eo z<2XL;_59yBj+=ku&RO?G=OjKkIqk&V&e@B&(>*;tegW~*i?T_ju}r^+KYOjFa$gCt zg1<*?xRQOCb_pwr#bbwdPH9Y1G>PVg^?d_)jUtD{-4+-t4Sy|1s3lr7M6w+FP+cfu z=LPnG6@}mlbCb!mW*pNFjmekRd{2&Q`?r`Ef>|`}s|-bf+E80O5f<#Q|8B2$(y;%N z?%w{Nhi-4%N95wBU@`@pAvhxjHTG?9<&+$?KYk>)w-KZ`<`SV*-5Kh}wjf%*Wu>q{ zgDd%mV?^IGQKIo9-%e3$o+8|V)ul|}^w>9fJ}k#$egmzj1r;xpscRB1-ML0)D`|p! zPS^@ffEg$arZAc>Wd^}UC?1g9k6MaeXfEv-THl!H8`E0XAhat`ggek!2$mqU{=WsS ztJZJVM&-GZK|*uCgyDSR#eNQbDWJZa8f z+p=1RoqN|*Hrgsla97(lE8J_kT>&nQWir8a@%>%dCi^8CRq6!6jW7>fNmklSY5u|c z%0daA%o_&QxTP(;v5}kAT9_F(ma8|?;zWBk6y;RSFK+ChwAqK())p5x7Nt9|cUnz( ziuzu`-!W~_nU)638Gp!{3ODpegZjb^Tnc>XCqn;^%jTBScBN7&*2JEz^Vb^qV(c2Cdt{{K0s_5t@J2pb7Zy-kzVWWiuk zYHsIYigys55n9$E*IcH37_45Scm5iY94$+kWqkq_h`Sbm7ov&6V&SUpKysNnOYS+l z1PIW*aw$#KX$p29GMfSux0)^m`eh@SWhjFH5nSWE4;p_h(O8-xOHrGj9G_}qoK;YV z7_a@iitEpQHo(*m>Q_%r9nItf;gEj|hg0Su>t)SqRc^Rj#7%-5`zq)cC~|uE*^AB< zl&(A4M^*E@)EcD~Ar9KI{UA-GW)gM8k_3&3{K-M$!z&*^RabsAEhnWIDnj+oY^F+CG{R~c@i^jv*ob{X3O(Td17CA7rt?*bn`@`;CP?i<2(-k z>rms<3Pii=KWDw;2L5+?C*3{%KL=I#A1r2<7kFq$fRQTJbfM-p2k>9$MYbgX_s8ON zIrR~~h9#kDcK+k=hqr$x-~iS~-9g}m08bFVuQ|5c$79K+{nwlDbhY4J_J7*6|9$=E z*=W@mU7|Y{YDSfww5PQRzN-qlPi}Vin$5zuuDe!0+c%dBTlFuNi}hvvxYc}i3rAh0 z<^L>|Wy1oK%7&WVpTANe$_bYy@UI>o+u!y4H|<|5fg>(cE+?Ov_tms3|LdIf z8vZ}-_2Rw#KL@!KW8uwwsb;gJ1&8iV_?ir++_vi8M3ly&zElGJU^k$~kZ3WIG}57! zJLT8gmK8O_1U+KOx>u&xe+X5{8m62Se+t+3)1c~b6RMb$%KGIh25uibc7+|OqIj1L zh2B-&cElLXqS^Mj%OGRrlsf6=Ne9@r%U5H{(2d19-=ZJeY7<8t&1 zCf4*x^qZD&Dy{Qg*Xw_ytoGGVjsG-5k@JaE8lQZPUGd+^ar67%aopR-f6qb(@Gex& zeVrs+0ACn`QOSivQz%$+%_e9lISBO_Qx=8N)_}=S2$%>p0$(TLa`G)`6wLA|Lcwgd z((h8t1CTiJumLX%jbna;X$Y78?-hl&Qp`a~KhqcU3)CREL`vxQ!>gfH8p#1vpM&0? z4sxsX7 zEdb`nUHTx2Y1wBp)8{Pj_p73B#M8cuT-xS1(!P#P$ReRTSPvi$su04Wv5||gzFSRC z3E7&ek!A(ObymfzK3HA4u;($As>R^PRbcv{Tu{`F3axJDgt!N{^!f*bWrpn);wf<; zv?$w4v5S08|^~t6<+Sq_fI*_R{Gr|A**q9I8(owc*F8SAWc;MrLW+g Z_Oz!x?dc29e*ypi|Np4q?$`h>0039;2XX)a literal 0 HcmV?d00001 diff --git a/packs/kubeflow-1.9.1/charts/profile/.helmignore b/packs/kubeflow-1.9.1/charts/profile/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/kubeflow-1.9.1/charts/profile/Chart.yaml b/packs/kubeflow-1.9.1/charts/profile/Chart.yaml new file mode 100644 index 00000000..633fac13 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: profile +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" diff --git a/packs/kubeflow-1.9.1/charts/profile/templates/_helpers.tpl b/packs/kubeflow-1.9.1/charts/profile/templates/_helpers.tpl new file mode 100644 index 00000000..c6f57c0c --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "profile.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "profile.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "profile.labels" -}} +helm.sh/chart: {{ include "profile.chart" . }} +{{ include "profile.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Common selector labels +*/}} +{{- define "profile.selectorLabels" -}} +app.kubernetes.io/name: {{ include "profile.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Resource Names. +*/}} +{{- define "profile.authorizationpolicy.name" -}} +{{- printf "%s-%s" "ext-auth" .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} +{{- end }} + +{{/* +Parse user email. +*/}} +{{- define "profile.parseUserEmail" -}} +{{- $email := . }} +{{- $pattern := "[.@_]" }} +{{- $replacement := "-" }} +{{- $modifiedEmail := regexReplaceAll $pattern $email $replacement }} +{{- printf "%s-%s" "user" (lower $modifiedEmail) }} +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.contributor.yaml b/packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.contributor.yaml new file mode 100644 index 00000000..26f90356 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.contributor.yaml @@ -0,0 +1,28 @@ +{{- if .Values.istioIntegration.enabled -}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "profile.labels" . | nindent 4 }} + name: contributors + namespace: {{ .Release.Name }} +spec: + rules: + - when: + - key: request.headers[{{ .Values.auth.userHeaderName }}] + values: + {{- range $i, $val := (.Values.contributors | default list) }} + - {{ $val }} + {{- end }} + {{/* + Currently the AuthorizationPolicy ns-owner-access-istio created by profiles-controller + specifies that user can only route through a istio-ingressgateway-service-account SA. + This SA name is deprecated. This AuthorizationPolicy defines more granular access and + has to specify access for the owner as well because of the SA mismatch. + */}} + {{- with (.Values.owner | default dict).name }} + - {{ . }} + {{- end -}} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.ext-auth.yaml b/packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.ext-auth.yaml new file mode 100644 index 00000000..e3b688cf --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/templates/authorizationpolicy.ext-auth.yaml @@ -0,0 +1,20 @@ +{{- if and + .Values.istioIntegration.enabled + .Values.istioIntegration.createExtAuthHttpAuthorizationPolicy +-}} + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + labels: + {{- include "profile.labels" . | nindent 4 }} + name: {{ include "profile.authorizationpolicy.name" . }} + namespace: {{ .Release.Name }} +spec: + action: CUSTOM + provider: + name: {{ .Values.istioIntegration.envoyExtAuthzHttpExtensionProviderName }} + rules: + - {} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/profile/templates/profile.yaml b/packs/kubeflow-1.9.1/charts/profile/templates/profile.yaml new file mode 100644 index 00000000..19540213 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/templates/profile.yaml @@ -0,0 +1,21 @@ +apiVersion: kubeflow.org/v1 +kind: Profile +metadata: + labels: + {{- include "profile.labels" . | nindent 4 }} + name: {{ .Release.Name }} +spec: + {{- with .Values.owner }} + owner: + {{- toYaml . | nindent 4}} + {{- end }} + + {{- with .Values.resourceQuotaSpec }} + resourceQuotaSpec: + {{- toYaml . | nindent 4}} + {{- end }} + + {{- with .Values.plugins }} + plugins: + {{- toYaml . | nindent 2 }} + {{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/profile/templates/rolebinding.contributor.yaml b/packs/kubeflow-1.9.1/charts/profile/templates/rolebinding.contributor.yaml new file mode 100644 index 00000000..892fe532 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/templates/rolebinding.contributor.yaml @@ -0,0 +1,26 @@ +{{ $namespace := .Release.Name }} +{{ $role := "edit" }} +{{ $clusterRoleName := "kubeflow-edit" }} + +{{- range $i, $contributor := .Values.contributors }} + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "profile.labels" $ | nindent 4 }} + annotations: + role: {{ $role }} + user: {{ $contributor }} + name: {{ include "profile.parseUserEmail" $contributor }} + namespace: {{ $namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ $clusterRoleName }} +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: User + name: {{ $contributor }} + +{{- end }} \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/charts/profile/values_lint.yaml b/packs/kubeflow-1.9.1/charts/profile/values_lint.yaml new file mode 100644 index 00000000..426cb137 --- /dev/null +++ b/packs/kubeflow-1.9.1/charts/profile/values_lint.yaml @@ -0,0 +1,28 @@ +nameOverride: "" + +plugins: +# - kind: AwsIamForServiceAccount +# spec: +# awsIamRole: arn:aws:iam::account-id:role/s3-reader + +owner: + # kind: User + # name: test-user@kubeflow.org + +resourceQuotaSpec: + +istioIntegration: + enabled: true + createExtAuthHttpAuthorizationPolicy: true + envoyExtAuthzHttpExtensionProviderName: oauth2-proxy + +auth: + userHeaderName: kubeflow-userid + +# Currently not used +# kubeflowClusterRoleNames: +# edit: kubeflow-edit +# view: kubeflow-view + +contributors: +# - user@example.com \ No newline at end of file diff --git a/packs/kubeflow-1.9.1/logo.png b/packs/kubeflow-1.9.1/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..f29aa94be98bf28c23b6fd4d91416b6723daaf1b GIT binary patch literal 54864 zcmd?R_dnJD|3CgfW+5w)?N|v}3E>EF>=Cld-t!~KQ1-D!!#-xo zD8lD{cs^gR*Zcb~eCyILob$Nf@3-6acD>!Mx7+mK+e4doi zOUh22Qtc;Xc?R}l?-q)L>@o4^#+zgngv6}T`o#2hX3VC9@;~tAR_D+w99-EMw8ote zzj?|X2OQ@F3=;m`718UDy`1ZqlAzl8RNY6Pq%EI*_6PejkI1xxOkVEqMi%>{2ygmD zqc1_h2018EhHo?xc4@BnID%iZyJs;- z$LyQx*J!8jxmp>B-JRo`i^z9O+8S&ubN@0|mQq^gr*+(+t!ZMkBvt+Z_Bw(q;v!o? z6!oXq7YofeKPW~G%(EP`cMGA^xD834Go614f4cDd-O0Co=l;J7Pcmqu2(pCgkA(5h z`G(%yyvFn^+@i8qG$cxJjGJr z7a~hFWku)&_cyn-I1&7W)Lq5M3xWhWasTih7Rvd69}*)G8cM{==SlG?gbp*L8^Mnl zkV^NE3T`egHm*oW!PDje(#D$2*8yqIri{?gHVmbphaffxp(ua%;q>~fU*O%{spFq( zvWal~MypvzIuuD*`T5-I=iI5w+OO{Uv83LzJWnEctFFR@u+F%^K%my!!AZb{4&Rc_ zNg{bXN)ZLud8}qa%k^!1+}M;#g-vw%_z185DjtDkV&Ask$;d?MGwUTOyMaunfy^xd zJg~w4AO7iq#L2T?=q(>6oP(fYVGdvdX-l70)_F|6z%tc7k+7MxpsNOq0D=gaAqa_T zNj;D)FLzAZ!BQT5Ek|vVS~WkgoH2-}h9Fub1jXMGWo&)@(kM=au`Y&{l&fE2M0~!t zJfRbUCWY~+ASh&SM+s@oQdn-Fh!^+^|Y;cWYXVbjJ!56j_kjYwz4M@Lsvi&&FJvm&2xA+G%M zh-c~k?MfIW2U!|FqY9G_w5_`Oz4Ijm5HH{*h*hNYUAuKfi`3dy)6O%5L<8+wcp~v< zqIz(wFbW9T{*vi0cPlAHWp$V^_*etc@DwpCBK%;hTKpg5q&{lv++R<@Bns|s%!O~a zAwkf=0WOC|wf54I z{by6VkEjpHA-2yyx(K13n{~adsZq$37D0DIeVa5HrK`iQO7>3@kioGz=WnfHG-S*t zW?o%Ys~W>Q_58HMvFg{ln?r`TMrqUb#2lRSM>pBi?EB3Z!u@j#Q9k{N#cyT`vBX^7 zz8nt_d%#x!tsyQiO|StCsutoSN+_SN+eEvqiX~>MQp4#cTLCaLt)9E-;dU}Yz20gs zMxRHLIz4cMAnhSMXfl6~>#KzNs->tITS<5L@kqg5`Z24abb%74g~;G12;nj(}~4+kr08=pPDRwE9hE1&Xy^f*J1CoLei_T zoCAOw7&5-j(a_KDvg50?uG(KYV(SMLSBWU=4KUG~bpb=g^6kmft;|1kaDY>vh~sad z|7R_0Lf?j`8jMzGU{n|2yod^lrjjjomWcaWICX-`8bSFO)v zbJpK?0*k6Z-JK4#*nJ;H~_4i`q*-+yQbxYU)ThOgDPU*xPC{oqmgLgXPh9 zfX`ZC&8&9`nn3FJTFRRyoyb?A^^w*E^P4y9sy4kQ_|U`HY;SB4OQn;mesbYI_E4;N z@N^4f{PI^l?XOmj-^rCciHv{$9QUQg8f&x~sx_y>nnyiPDQOl^(mw}7-rG3;Mfw7= zElm(r8=% zXatH3vt#?KSp16jwdf9|-dPu)$D7GWMhEMdI+UwhjKjf{M?l8SQ$`B8RJJ!rnAgUR zy@03^J1za5JoaPP{Ya1cD6Y4mit8v&F>+FH3A0 zMq1XeD#XWqFGuUT*2&`?XNEEA0JV9zG zm1KRq6fvHn^!*ryy^iTYI4c z|9X1O!m0i2s#+>!z0fkMv}fOG^y_Uk+1ivc!|0<_TYlu#`oA1b4!_52!euPJD{G8l z?aX)gGaJ=NzfoaInVtqX14nEO3*YTp?HbIbKAWYgO68Wa#$^nYUaR^%B{H0Dv_?!! z2r{P|CIoF~+WcqHb5`Hw67|^^&0d}%7qQu_j%j1qe!X-zY5HNkX6=%|&pC2F@fS#1 zhi_KLs~BHO)zwYK4%9zJ=Xn+ME+9N~Kw{)6YOg1$dl578VOIRsqg?Tt3X6Li18(!PgkQiNSUUbvK&rtnWR*G=C6zSf)1s41OJM` zDwhi%eOqsA)nGeyzED`?e*Ws5ybG+wi$yJ0)ts431dM;BJoNBV-9-^45OGuk z==Ses0fcy;A>@9*hrmKs2BPK}vtrv1RZ}~C2bSb=4#A(_jz^D|5#=~kh$8SEUJs+w ztzWunG1^p8otd9ix8+msdu_dbG45!VJ(DW*v*)XBLREwX`g&Uyi910kc)AM;S&4Sj zy8J-s%w=p}qyN}9Rd_qxOOe^J<_&s;EE%h&;}l#b&yHVHoO)u5N~-WH(zn5ikGQ*rBDEycYUaiCj4{a zKVRFmd=#ZV@d9aoDW~JBnU1Z6W%L~<+j9C3man{e2Pj?Qy)K!&bc0+XA@UYGoCUAW6%a>aq|{NJ&{t-Xh4UZt1w6yjK=mG?R(K;PMg1&oa zt$KKi~b@(f=obvL^Ut}&7Z^?a+EE=TAuzvRy~h}Cc1;Yq16qe z?iFM=qY{vHwpzl=py4=eb;HKB(LhP_X6*JS>O%?>Ib%_$ps%^`Uf6~fV-L+0jaQ_o z=FMKx!z*W0>QnKea(nyw=v~p6kHyOy7`LmcND+`8obD9RUlMo9LwjQ2EYmQoIpS;f z^$v5`nfqFzn_4Oo?k4zZeW}Y=l3IEqV$z#^u{_=Xq~wMWFUdj;fbgZ&)t?3HerEyZ zJgYYA@*uJ6Tv4ehBdS>VjTL4%QrF2cE}}70;qBmdxi$H&&6*Xf z9TcGz9?}dYN9wj@%WxX|3hf3No7Aae@X&aH`5(CdMR8^Z9-QSxJEny`ja#Kz7ZVEO zKpeQ_E1ta1cOOn4UU{k{V9Yk5f`NQi%61&QW^V!*FEpOR$qLDrK27_&2?L%JcM*pP zJ?*XWBFtW!)x~;b^hP^L+MxYZ;vW z1u|4U0M(=XhPC-wtYFP@1jn4G`PRI~D|S*gRO0AZo|ubOm8~X=b2$tjx1`b1|3FxR zdMc_H>8KQW6vdk_UOW&-ra_L1LJ&lZ@}pb@W3k2h9!}g8r|Y@Lm2D4pnp#XO`Hj$` zU6^+?#v-X(p270#Y;+p$Aac0L*<5e{zL)2Eu&r&P#&inA2me;h4%L_Kb`gtzLzRMd zzmD0mJ1E+n;$w{pQJ_MwLhGj5Tn=yERpVS|p2N{_h@ipeh43aZCCohpA#6L+TslUtvBfHqLgN)adG&S-^@OSTZXTM z(g9-NNkXNA~~rbUHiMB;FZ!+ZQ<^loNUeyc}#Ujtoc2?g=_5mKJ?+OF&W~ zAS0Vl{2-?e_d^;T96P@C5xe34eR@{h07Hj5NKgqc7j?LoKYFYR&NcSULS(`WhG$*= zUkC&1{f_^`-x`qM5QgUGVpicuaBtGANIgIi#p@lfWA+11;afI= zvmaYrp9Qw%67fM)csj>OHjMfw-t2Bqx^7UY()WCEx9slp{SgIJEDt%GUAd>jfjnY1 zP30cy)Q}5h&B<-Pr91kfW-td|YD9FZKp}hNqdjgNMJI#S;6Zd{;<+w;3TA;NQNxx)Pe|lX5^15HiD;F8vyN)Ob6{ z48wr3gkc<5f@&1IYj{m-fozf`_t(bIs}Q{HE|b7g#5o*1X*>e74UlF1U)kq*3yZA0 zr~254R?xp@H7FgSr-J|1#~FomyEsxeKR2#;8kEiI8&`!W6*R<0E@M`x`%!m*%S3Po zYCVZVANmEK8`Au5gW)1E&dZwLH|t*`tga17EJ{67Y~FbrWSc+gsKQ}fL;oj_#l8e> zh9G!LLH3`P(CNm|N~i40la6&nJXS$FHSHXI(mfBh?tQj#oR-o2J?qW|HcI*w&r&gzcUHv%65g{VK?a!tQ$ zWGRZ^F!o}6W3l3Y`x+T>uGc@H{V1S@V?h|APUzv*^`Squ%_^8p7%Fekw7IT&RFFH; zes=g<3vDAyDv}qNBERNG>S8mOx?@-8le&wz@QM!yGAig=p;{j@6wLxd4PR<+(xKBQ zaG}vrES{EG8Oi;s%Ba8yHK(h&y+C@YRXw`t_u7Sx3KwFOqiqYs0jjAgQii%zk=Ab} zj0@j&r%t!yjN<*MT-`9?T*!rAMd;5RXxFqCuYDs4a8V*3S8-M}BXsd1t)He0iFqO; zWpI25ctdQWl8X?H$EJXTZrJTv_b%;#$2V~RVS0VPE?AIcmmFcI5|yBGiTQ<@9nYtA z3RJ{+CehY1W`1)zMhvnJ-Q}MBF07Grv7w!Y7#CkpSzNXoO;aK0N)SSs^RxZhgunw`QEu+Cr*Ir9HXb&9l+*tvHK?Ad zGM%jGdHnV;I8rx5p88Ca3X6ZLrFVedj+^?wM`xHs?Y{r`*o7bxXBO7&6-T+A+d&!_ zNl=f#g!(FY>qt8vjfI;_*%SEvR1|zjKpEg)=01TZGT;f0KxjwYGDV027X6~50))*yXqDYJD za}J}9*<^pU6phc9^?t9?J33P`Er^NE@~q|i!PgV=vt zY~WjI=6zZTSjI#OE-L4r2G>g13l2W3fyAFK)qb}K3&VrVEUVC~q@2!pILNYD{mZt3 zW)8Xxk>3$Sio4m`_-08w}LNf#_K>y{mv)$aWB2J$Ds6y&largo@v zkoB8X*eoNrxRqsx@u>k5{)1S0wdoke*Jc$BR(#~3@Dxk>CDq=kE&)a<*2(|rt@RO4 z0N+j`;wttYUmKl(WpS3gP#mJ*Ytk&^tqG3=baCa)jM;fEIuzJsp*ZT%3?@H=ht+P2 z3WwNfoBvUFi6qngySq^$^JH#2i+@EoL5HGPg#fDlVvJ~L=n^}^H7IaEve$D-WL?70 zo)RsI&yWx>;sr}UF~&ksAMP#}v4hxARks0?Ao$N$7wo3QOjj^~niO z8ar6NMkjadZlZOHS!tLC2PxEJ1f(6}*})!KXOGbXIC{ZJ*y5kQngZjbLq&s`RC9Ho z0o5IxWPQp#t4a;U(;IWm(!8i(HFOoaNDQ3JLg(dc##s_3HYA^?W_49jtQD-K#zxNlH+`kG9lg}Kf6MuuTw5$ffMk}-qftX z5XUb6X|Ca-!~Tos)_6;cX6lXxB0QcXe*t5GS`&W`YEHwEZ*qxi&L{|~)&Hlpwv8tV zws-0O2)i(`hu!D`n!<5KTB_7v{&HFv7Z4u5&kZ&rfAualmrh@UQ2>Itp!aW4{HoE7 z4omY1sjC#(&l45V`^S>CNINc4={p2%>>H-G1!(K~@=&LoeoOF1aN(9Q(+WR}V-%2d zB$!X$N=j+7Di?8Vc}PU)m;}-V1o?ERp&y}1=1m!+9Pe$tfQxxOAh@Rps{VOUwF~M~PT*OA8QZ%xU)TTb= zIxacN&2IY>L2Ot5Pjd|zlFFpE;}A`TtU`Nn(It>b4Ifr%cR!cv%;t##o$Fs-Gdp^~ zlIQ|-OYL==g9D?*J<2%%-3a(U(6!>CizksXvM)MOO`3cR5CW!zV(v2BCDP!0QfxLD zenA-?hcrYl3bT#ibQT|G%g_moH~R2bNv?w+sJ~DML8fxf44v-D(t0+tJm6Ynf?hu! zS3QVE^qTn(sQ0Ev?~E?Is}HpYaKY&Goy|BhG-Zjqa zCxGg=yb-;%h0l9yojcrRx-HAWF|+RW&FXJds1~FYtN~>nQ+eY&2pKL7=?@EuSH-FHU0k-t4f)2a(ZS&ykCy|yo(6#WYVx@Wl z=ElSh5d4n){!LNHEUvQAs`#HF2~30jGS7Su2e+Apykwkd|9o5O4Xk037qlYsT$BJj zS|ZxuVb0x9L4%iGHdleQ^(B2}s*CQ9!Klh{6J_tj&BW1gz+4+B!PcIeq9I|ix9Z&s zDU%!=RT+ER9$(w_yjoJF-Zuqa;0h!o&-kQJ2s3wqEn+!ZyH|sOigg z1}{cM?O^K~`9K0Iw}8non0#1nTs3nkl81#c{i-emMHTan^5-KW{;ec%Q#w_Sp6`!8Pb!wo zDo}$;>et}MT18zg3>0q#u$J5VlWzak&mT2kYD|Q(Hb7^S8P3t;@fBd&4W}lP9w|u@ z$1hGZ+1;oz6-rB^p#)&Y6#Zwk(PwsuBH4Zmro9zx&+Nf4=Oa;nGERk8_Z*_k?@D*2 zX>jm^oQGCB8_6AWk0^O=Xma$>fH`khtU6ABjup#Gs2t!Upq~3+`|-Pt#4;06f7IIC zUSMpvvp8*OINQa#P2VdgPmO>m2c1k-#Qv{rpq6TzYf&DykSCSlke7z8UO$pbp6%-k zB+KG0f6>&3!G&Vco)o#!*9R^Djx?IpeMW=7?cUxlsbg6~0%YY{P@J_cWlt@?1Ef+@ z-j!B}^7pjtI7Wy8q0*y@8_cJ~NM*v}?HGN6l=VRCWo%Qv+T8c!r?ezMxK ztFHZu1OU02!m8Qu?3Ni1z>u>>QgUI~9d|%t> z;StEgjwTe=Kf_6-Xk)pbo!r7)AXsjVE;fe{u26Fz;;q@*|hm_?|6;<@d& zC<%#GUCRiAx&ZB=+!iioRYth^!OBfh2fsL(-BjEh)*iIQW0`5UcYPMZClV1^U8Gh! z6y{~6Trr^CxqS9S6$yGmW=XdK;)AWh{f6L+Al7ixWp6G7BpD9;06?93-N0Qrc5ANU z7yrRD4TyBG`N6^|K_G6e>nP(yO<2;iGp?Hs;vQICKF+=-@bJq%8Cl)4jYuY0-J{0* z&NkJH!_5Wnd?TAu(#1l=Ldu3W!J|Xg-_z}wt_TuF=?x^b%$f!pkL0VVa2Rj8dR=lV z(i;d>?*jako6Gt6oNne;CA;#GsCpHzsZ^iqPy;OMHZ}atq+_Phr`>gQLjAMTvtFAI zoy*VTB-Xn39(H8OL5W+2#X~S zA+He`lqDJuO$UM#qTLCs@iAoPDj`O&b@#ozR+mEs)Wn#7(|k z&%Tl4zke+0Ie@t|q11U%z_($Fyjc$e$3Rlnr5?8P40fQL$W@pQJdrFu*Te4iP_;OF zXz&K$wI#6?GDLC0xgpmL7CRqqBRqhWc$gPCC*eYb0j0kFR2(R`gq9zft~5V`g}7K| zGT>YqTN3n55C`rMu?+g#K`hIXd)KEl3@8TWgi{*>45Ja6Ns@+Yk62J&{Mhv2&a0 z>eN)r&3-zK(lF*bj6EJ8LPQPc8x!`VhQam2l@)bbq;-n~{sjFzu}BoJBkpG z@XyfAnnghwyCNH0fGms#FjH9q)XY93Vu;+XO8NKA!-e*Mw z4yN2uO>?HV;o~V@BWB55dz>H(zu_`}!(M2SHku(8p9hE$=YHbz6#F@xCTZDI+I{)% z*w^fZ(i&1xuz0+GelG_o+_=z61>b0;{9dW1Y)R*hv!IaZ^Oi#7p2uwvg#7W}# zItCVRgUUl1D+LEcg7g}Y0Omn=Q1E7p_qc-tU&RSexa-2}Jw^%()XGxM1^@v!vpF&Q z47j+*<`z{4zKgb8pufgyaHALT-KFBciZcn)YNp+@L4Z65;Zvw znHUE@v6k7**^(Ml%gZvsDn;9{4`%JZW{BJ#EWgS0MN08 zGfCJS9hclD*ZoA?Bc_dELmY7t=KRny*<1bM)o}RAg@(^oq9WIh!S};*ZBt2_?e|y-r#j7Co9CWmEu_ZVv^^xB;q)nKE6}{ z6W}rm>X`u-@ZO86LstI zO4a>%H*;y*A(JZ;`!#PZJwM8=%rl#&i(Y!>K_*4WoMnHkx+REJLBXFLdae1#*b%O* z5E3@`7qY_=q;W`TnxAwOdcEX*)F%cHCHmwNf1}-Pi^jP7{6pz4cjr*9mTJIdh$sSb z4?|xRoG75%jE6P2u^iO=;K~mniaSBk0B7(8b%tQO{jjCU2Q24_5VCJ&F29UfBj$U} zQ9|?S;gy-zOo7Cs#w^L`YtGwzsG@{(B6n9XFF<1$*G?MXhzk#ODSNGnIq%pF z_zi9=y&)FYs#pCp_j(E=FD0={+tp11SZ_~>YAAiuwcnbopJC)e`N4!Mgsw)-J5Ph+t%xro8gB zg)=T$y;s3!Fd8VdVEt@30(!bQF{v=(hMRnvxdPrJ+xh+b`<_rfUdVdQhKDUn;A?l2 z)IhD)_gU}eP@9(L^@b8`<0=e{-hS%u>G8!cw@(>Zkey!Hs4sm4n;3=-V{vwtn*|+7D{dI;CjGihV7=XzrMWp6up(~CYh1I0kO~o-wnOFO;m;g6d&G2=WJtTUo-rgndRKif!|6&73D)^qy<7a@4g&)c8GLQ4~d z`CZ53Oc~{=PZPpI1lT;{k)mq0IIvXO$7d`i8-#KCCMYr96%}Q9-w%?v*cHIQQ&YBL z^xi|5r8v3lJF{ifIb4*cF09_Hx!^|GTI+E10F}*t9?(Bq{2Wt#JgIU(+5nT8;~=h4 zb>p{olkLKHJv$s?BjlI;zgGm5NyCD>(roG{mpq(kkz`W&1}1BSppQn1l+^Ra%}Cku zz4vv$7T4+TBUZEDYk2`gARPXnsp`{ZAgEgF^L*dc1s?!}x zAj%o0^4#ShK~{Yo+Z}5FB^pkZ*D3u1_Z`Bs$BhxeKqf)fa$s$7ZaDA<#pavFp+zwA z?5eqJxD#c9EN!`C`%@3p22AL=&*AnRLQX^Y`(D&&bs zR)qGDyu7ljyO)M)(v&9{2laEvVUnw&J6yyE{uQUrl2DJ}bJ1Qe+fzoN^4}qpgM)c@ zXhq3#GiU*}!y@cmz;!5JR8-6FJX~7wB$@9UA`;xu8KNp=E23h$Gt8wP99W|`L9JNp z=+ydc%wV>3z=9SRTiK)AxQm*l0IR?pK5r9v^aJ9EUm3kj4vST36njoPM0hy+iEZe_ zfWg8ccDnRwGonJr;V;c8r(yuQ@h}I2s^c*pw)Wv2-d85b6KW%Pc~>I3+&SPpCiE&i zJO`64xWZiOq}r5T@i#xNhLH^OuvN+E|24$7LW@L>z9010LWC!tllpa0aKZ@O)Zz!E zv}7rF`$71nr~i-}K#Wuz!+xIK>ms2rbps zkyzHRj+tryv<6_L(9|+;0_}zPLpUPblOk4gXP{?OCcx0pM1^)Llz)Zc({F!iDX(BJ zoc#O>VsUKT|6OSY^6QOHk~m~5*Scjgq;?H+?b%PhuE;?zM}~#PQjnl;hI=4Usd|VQ zFo<6{)u31R1^8b^<8tWkWxHq2G(_**aT$R5+or*1wAJrz8q7egEO$`VoOau7<~oKL z^OZI4`UC=$pz6`%_dUc3+>I&fjiyKUJ6A;&{PCgr2+l1S83%Y$I+pE0$I zxmwqLQE8_>$+Ma;3A=5V|^9n<+}$S z5c;A=_){=gFk6Fq=v-n%&&yr5TcR#~$+>mqVCnGGdFwBy>EAS{6~aQr98!>~`8ll! zS}4T%{Y}yPJRYpz^wNK(NySXd6vD)WvHX#`CU>Zz5Ot7X*mM;%OZQy&^*?jx=jK{< zGt%a`vJ03VJW?td16rOfG4Nq#8iHVfkr#Uz1Yg2c)$pP(V#a#5s^0cCY&8ZP=$RHMePKz1g8b5 z#JVo%j>R~}_nmK)0SzG`^9G;ZOmHko+FDAKZUzFJkNE>QpYq|I_~)R|(Hk1pd>;W( z8NIPhETSfWz9oVP?I{S`yp)Qh2jTyd^wOJ^Ag&E%>WH^a<(QB91ZiHR&~Hj`==i{! z4AwU&J}}G;C(90~*C6njN2$~A#0pmNMB+o+hJg8yFVLH4f`z*4BoZ4<_ouVBsFZ9$ zQhr8qkBx%r`oy0CHNIsiUTB)p&KAR#x(9+Oq~1~4el|8?M;T{#Y4AB_!DUPwwT%xk z0)o39+y_d?k^ui#sNj{+@tdMjk|7(0$T&UV?aA0b{6U5Y0a(8+QXk#Yv{$@f$A4losviYY28IwbHrjm0DchB(yKCnst2He4hN!o(*Rfjt7%tE$%z6xh z+4BMons;UL&dA)_#-z^41wE;aCy(kAcp)}_fTnn23R#~|&$Q%jw03`u0L(xM${`=#m|-DPNpx_0h?Erdmfi z{#<=HXsIt$x;(1d#+h|YTBJQyOX`EJPvLs_!Z@zX#P*n>qsFaPD;VQWCd4i zn-V>EkRtfnJy{F&i;u2e55Hj$()x#D|0R7P)Hd#Cz{o2^en7`t0D!;`TsQNUH zg|4tTy2VKZ0jY%JSV=@|_dc%Dk>S_Au8!FP_{h$&>7!dNJ^wpCm`>${PHreY5+ANy zCq8g(Mr5FG;o1xlG})Y&(G3#g&YQa@QCq{)uO7id1yD-|Uv+Hu7{H4g^$656mxAVH)VWV zDyMHyDNO*5;PKj&>kjsL)hHi$Ay?IQdb*E3*C z?CiLHYU^a&9czAa_Q+ey{?aL%p3lmWAu(BC_jsM(<2c>mf6U1_d0oTR& z?hjFgmJ%Zt>XOi+cXk_6Bk+4z8gZ$j&JWm7Vwy~Hfk$@L$A?v3~ zBzDSf$3`HCKCswcTt|E8*KM{BlKQ=Co{xONoJRfPY2gB~xoH|cwl<|E%nHlqk$&TJ znQy`6Ux^F1b#ls_!U?p7xA;wsS1F*LpKX>N2;YQrgfh!A;F75BORYpj^ORo=3KJiB zHU{(E;YB#dK`z;io@%c2R>|p_IIYS)VT$UJ&O`8k%Se=pc*vOg?lkOm#4G~5K@ykU zLiD{zhF<;iFPZ!mMgR%e5@Q!(+8ZRpBGU>J04kLGK5VF&nG+ialGva_o>*oj|3a1p zm+Fp;C6vGabhW|9#YONh6R0|%i01r&OrVek9Vq42WHb)0Ar>f8k5Q(TKW)3jrE?#H zII8z3pwNGdYejL$#d*)m?g(}kKGg(>HT+Z;0^9DA=4Q^~t>eyzrnlzj`))ggAe2?7 zqrppGE45LLg6m(b;<{f6ATDLa@vme(*2>#f<{e3;;Y#wlA5bqmP?ke@=@6J8hm8Ol zqI;8iqg+lMBWexyJsf1}al0o`!{xx%229sT?~8(%f#QQKGrG%l0ADqM8!|&znKh{W zvzl<9i(VqbsW_wYWieKm2kf)aXI$-FW#QmC= zY5Sc+vEOYNeaFBt8?}s)r&6X8Kg6^Ya zKD@aORH6IPpc915`eS^G4ANhQ{=VRDqN1zth&Z?unghF72LxPe;ciBE+EKvwddd?a z2wYYe3~KtOB0os3RP+uNrNU86p-p*hwRBAdpLur+9GaDF1dcc*5=dm|$EqXct5N|N z*g*aKNYTu;r7okP3sdIMqnw)q&!fTol&xlC`1J!bIm93+ePl|TXqRWC?aIK-=I=D8 z4Xp+1%1A<-PLWwl6HB7?oPS|m5g93BqDdQ%BP(co!+CNZwaG?8=0E<*Wm`9Ok1I0s z$A)6s5$f{xNYzPBYXD`<3ANL#P_!tXvHXvO0GNFq>)91eS)%W;pdfp#iw%> z!hLpzD&JS+3|uJ6T1OXU-h#ml_7tyrT_23c2&Q(aq4Ek^e&G_AF5kd;8{aR}3R zwvp4;{#tYPnt#Q?hxMZ=r}CiSz2>a|8;hwDYmHSn3vPo^^*L$d4LIp&pbIiWvNn#x{g4PFqwd zc>MzxnISHvD_mr;@jLt=fAP=}%1jv$Vis0|*4q^moHP6~r|`&V&puf0yt1UM3*sko z^l#?Yf@EtPjJkL6K+!w-D4Q4cxEsV6wBY@ukGw~=s3Z~~UnV)Sv>Dr&zvn&wPK&q^a0R47tg z&BG-;0RWzxQ`qrC1vD@T6)$G}+2linCn(O9c}(z)9eyUukBBogpK8hiFNQ&u9nZZ% zI;|_Y!DC0s)Wd!S;R2+}!T$j2D{;PX-aqMgEQb z+>z)^Lv;__NA!X(l&`y=exmC57HN7IJ(58fR+3kP0Pl~%-!P)RtWaSrphNPFfQwm? zx@s>lvWCxe?x0Bryhj9CipzSZ*IoH71PZGyZp1PiA@Qs-172>YATiM)l5|zLHzD2Ja$QCG)=} zE?c_)N$d&Ca`~yI!?wd#gSTSBx9H%v%piq?T*e8TdA<+t7?hb=Rz~N;KLMMwRI9an~OC!$Vp5OYV0R8rfoecXX)UqNvyA*`V$LJ&SLIky0&U}{53qbYo zCtO)o1Qqd=zNK00sm6D*b*5kO;HEfqQHxmX(*YaKAH}zRlbs9x%n9tBtnZ;^vQ70#?Sp0;f{>q5tftKCnm0HsG z8?1^tljHU(0c=v>eK@&!Qp8F8PBq%ldawGaEU#EH@n+hPvqa(-0Y0U>Z-^zB#ZKeFXs)aoY@- z-v5Z$f<-(rbCh#iZxc*>+~#=pp5f0r)WA*vEU4m8 z98&5I!{a;9QG7AiCUZN+c2hoQHEC^U_3ELt4(&Ww4uIAqM=H{*QSfhI@a(&mWk(YM zY>SoP;Z~+6|Hoz|)x0z9gwaX?*R0Y-+8x>bwCo1BsPt=}qB zenwx0?k8qbbo>bWAj;1g@!@9GgJMINnQ73}YLo4wQuNX92yLc$@$o$6r+k~AUlynr zbk5&6z`OxFVHc(qt`UC%Ue8zL{H=7c;tE}==NCOMg@Z_OW-MjePLM1QZDfL8^*~V@ z)i;WRdY`9EBcBh~oeYhoUYq7{MCQv;8`R`*LAl|AqCr(v6>|X|j}j<@yT?_UAO2k| z%|>E*P((k5^FqiUmU#8EqgdFZnBOz+xKKXFUJ0_YL8NL*Zkx@>Jgp)Eu6`%wdtz^8 zwiJNydl$2tCK>uU0d?Hf9ez87Ou?U;u+`0GmOz5}4z=HeO@&^Z> zqL-dUNu%~U=q1pp&(=DqQ0c!f0}8)U0J!CFe0UH`0ImTmehJEJ{$w11hgz^LMc_eE z=EbJ04i&vKS)&p|o*Ii$hK5C2*K1gRdgNaxcEM?r{axYioxQ)|WhPzZ5;yL?%jj!* zOaWcEDCp|gGn2UE`?GU*eCl3mwrx=y!jgfN%=vPq47cfcl@RF098wd?R4S?W8Wf8s zvkkT6)POTa1qNQPDQTPQe!7#wxF#ae66T0F`9^R@K6xiMx=m4jt9OeyhWlw?R=>aG zSjor4J@oSj^9qlpS0L?9#&Frh2CbXa`)w<<%VwU+ahyym!CpcF^Pf3BxxFi&!h0^pD*!_zX=R3W;G~ zl;xYc;%~PNSec1beA?tDagHMFdj*AXj8YN#sP>8{^OGIL)LWOAmI!*KWeg;bzEh5S zBJJK$C{$B&gRoWWx*4aO>lH(ruiQk=1}p1x6p&Jv^@vG@x)5K{{)}mAS}7Zo8z!0w zPsOwSpR~5jD&4rOV6yCJ2EQ;lS3-XdkY7kXqvs#*m|g6Z=%1|;W=4Os<7=pvj!Bg9 zQJ=5-%`g(m46^vYBUY7q0^>N^3z{-ZjFXG7Go9ZM)MW=e5!G!)U|=ICxCCvsUOgJD z9!skdIpGT@pqA|OwZhSE`?R$9ZCwV0A~$kmYQA)RP%*SY?w&5rL=-~d*-}Bnb@la= zkMAMN%UxcTHol#e<#J#SCqi{v|C=cN5-t4$Mg_0P&0L})sDEY>Yjg?H{(V~_YYKDy zN2TJ=qNQg$yA|%4=->n*YBB#_``J~3kD&N#S9l)AQuuW2JyKlwzEkp(LfmP?Se>!G z{oV}OE7c_^bBjN@VfUY)l|e%+VGfKgcK#-NNg$Nt6=}b=`oHq38xR)dA$KmXFa`G_ zAhH)}C)FkFL39Xb^O5Ao$2x6SgPu3Ja*)Fc6c{9K@~!+C{!Oosm`;ZIO!9|L(o%eO zz3(r8`{D$ckor}0#_hY=;Z9q{{ws2K4I_;>C#;O?d4wa>2PZx9)a?u@8|)(SKVPj0 zB#~Q%;16P}4g6LT=?9s%uNpbG;*KeQIW}>}4FiAv-}Edqo}--b-LQ+i=Ih0C_1$5F zDT%cyFevx+9b(t-Jn41@*Lb2_8Xnp%5enK%kmmpUotzMgWM%U{9mny;=MX&Cn1k3tZ>MI>B0p#bb4ML}4JJP}C+Qurg7tHf@ATdjq`Te^ z&PYmuE|kFyOK=0b7OmmLO<#*aQmkWyrlh;HLlGO67sf7M? zghAaihjzgYXy1g+&!Qt{`;-$B2z&cl)F_x=AQJ2O$r$d*}F_8!Nc*_4@` ztdNlslF>0v2q!aTWUq{jWFJS4O_}GI;Rwh2-KY2G{rP@=e}LEVx?lHwjmP!8uKVrc zYKltI&1g?5egY+jlR<`@%KOiJizQ!XuHOj~7?UtYZbOK|#FMADKlIzrr?K;)rw23U zS|#rFN;HPB9gEono?FK))|MCuT*l}t>KtlmNbi&i5 z$+cTF>^YEk?8}G@2DrBt1eKpB@uB4_FnAO7c3dvP3AU@8%Nyt9{!vGSLSD+4zMAum z2xqZV%WJU1r=QygN!kzPQjTK=MqlgM=iR$kzO5tE)Dr<5nI%H#K9vkX*La)X1NXkD z(lX9hOYUx0PdqK=6tt_Nfyn3TZ{yWWRs7<}KQlx~d8IY#Xa2Tx9EHUWzTI5?j>RO% z9{*VXlIq`7D7Qon9%TaSH}Gk6N6g3N5om`TG+|9FVToT}uXZHos4LG)Zh3D372OG7VHQ8F{Ngzq43&PsP##)w^<-dbCe!FnTZ%aCv)R9q1V}0BiHTe4 z+pP3mKl9sQ`$*8!(8S4w2>^DlFLi)o9l^q4fLQJqK3S|p9^X?MyV~`2y?_i8@LqgR z5bE>bf9@nyRo-?>Xx1;8o4*H?Lq)?o)!cd!(~Gyk!ol-BsK7%U?%3QpI!f5Tq8loF zYZgrT2?V)8FVS=up)cw^SR3O#wlJoYmnmH@MeM_#K25{7lr=p}kI+H}Snr$h6+%j< zbA~rnz{YvY6vRz8h&QUh$Bd?a8dTCp zR}K;E2o?^*_`!3W+ z9adH;yhn#BbPUD0K6I8tWk$7{@u89Pg2hSq%&nO~rFeNBE0prF9 z=Ep}(Y79?I4x0Rl|2%+rUXAs-x+K#QAJyvI7W}QBo5gDBw!fAq1&n5N6_??S+o(I+ zRzblJRu(ML1PDcSPYp*^obTiIB5~V{Rsqu|4F$yzB5Mhd#e={ktiP{7m5YjRt-=n| z;oG@Mo(QyXZ&yis13Ck<-|70!AF?ll&5vyf)&sFoETJ{h*#5}hE!exJAXJOUN3o#V z$g$c^1ymsh*|>^E)Wg%CHUpZlq7{o;4PR58sSh`4NND6kUuXFMUI;z<>sfjkMl0eK z*Jp{XA?om8bTx)K!zGZ$F>)~Rv6xjoPU$fm?!*5g&zAIoakYGfjxLrm)6=nc-xM%$I{YI}H*PIL4S$ zB%L}Am21$b?`i^y+xfO)vjH8{tguq$?QAl8ECE7F#V}aRVnXCC6bwla(q&H9N5>*wg1P+X{3odh> zxlVGG$A~)dJ|OtcBo!9os~W-&Vb8T%yVH-V(DC7-ip5j31S)jST+S_M{q(PA3Qw_f ze>h^oYKjJTk{WjJ2t1QT%ZuFmCcH(E%scN@-ao)if{p%$>q~nOjJt>`R7HMGsTz6$ zi<;9JIdOL^$1EPy_S^-7e!|k(?jt?bKl9%JTl*a#Ny$l{);j@0gh7dL#yY5`%(XkP zMvP#kaLe2OGLz666bC=Li0z*FWWtTDk*42_^On!Hpr#qcipt8{(l0LIaTCX%3RB^` z0m|uxK4`YVfDCJ*dLV()VD6S_|9g;H{({3R;ZozB0y2Ro88c|1tbO*hQ8`HG-l40- z^SM2TW&D{oEasQnocn}4=c2$CcT-^se>FXNQNV-bQ*gm&QWf>n)j0TW(5jfQ-Npv8 z1klQsE1~OIkH=Pyh98l(kk;e*813YTi8h3VeXyc3JGE7Li47fyP+e_9jF>^{rgVwH zKRUYY?8~TbF-uV7PXCiGu&gQ0xW{ZKB~_l)u;fEr)YeUWu*F<2F=l3?b1BvgV&5h_ ztIL+sm16y>XNabzVk#H-*xd^vXkooitS&TA|5fFCd8+a zf_IwmHAwR>5@9FlG6VUuOGd&QtQ=_H5YZvl^(%(!+({6gsV~ZX&E_rj=!xb!^m+>i zY*eL@I|A-7`rImk`xyb|(-vXcC ztJ&tq$P?rKuv#wS1Y-i1n5aEOMm#g-#_J=}qgs`R{`xdoY}&$V?GJMWJqE3)<8=YM z-Cb;Dsg6igdAP}-AzKbhL1KGfrfnjSbC&@#WIpm;AKdq#?HeJu|^ z0O8J_K<2stBlIHFsk6x+vZ}Sl{zj!m$*nD4I3mnEif>_TVm5TKnb>-RckQ3$xVZ&iKg?N42P#S~D%)IEm=DMKVR>0qXf2p7xw)ousSnU~? zM=2Zj(LWig8-s(gUr{5IhjIj(n2m2VhGN5OkVSDIyyMr6G97O$h2QKX41BSDE8uL| zvuX`>eTX8xM*hvNV=qMi#P3Ey>+EX+d$~}J_gDNYjch6zv5C|yJSC;~=aMla)Z?bq z%ipsq%Y;Yt!dm!etnD$sl<3dGA&D4TRXRrO1*?cT{&CEh*`FZlMc|?~dotEND(~85EVPb1`TLMx zmAm6&a*wY>+k>=$&6M_aGM3Mc%l_7-j1@ai;@R0jUE)erc%y<8zzmDDi6~c>;Iu4n zSn8`DWgX@1u%8|hHwoGq%Pz?W;PN~&Y-1J>{>$)))Cz4d?=qp_4c0fu2oYZfuRk$6 z)|o0KnCtsXuwr~_gfq7@L=h?w+3sbDN|LaAxdD7^l?6*#A4q@sEP|VYAw_+BYH9^H zz&l={v(5G9MdBU^(o`z-e7B7k>bHa3Fp-bLUa3m$3Pcs6&>9fZZ)+EqsY66o0J4u9 zwB;-mk&%|#t2c9Gqh{5&+aX+ z8}OhhS?N7U);bZ&u{=_GOR1q1@>-mJVmzumFBdFfRu}gX(e|D3lAas)hke&HJf`Fn zQH4I=_HL;wZ(oTK12$6fmqGfvocSHzS7c)~*&8nQR_9?)KU=!Txx>sZ>z>rwNT9cY z0lx~V*5dSal&1)({4&xV@%#Oq&D`wys9Wd27he^@i~Ib$G?*qYvJ^KJhP(|+x-4mxo3%~UtQ+*?ixl;eG`eMocneOXH2f*g z`Y>)K<4S)Vhl)wM>wxF`g0ESJK03N{v_I+wM^j@+=SV=#9-;+EXcT$QZ!DE-5xr}0Hde6Tcp!qM{S$JyV+~o`9Uu? zUj!l}e-=YP+`?OKHIs zmT~UIj~m|lBcM-J=q#rlD+b{v5AJ2a<}eAOzycRX|8hGRFSO@+MaI(RM6>s!Y+72u zqD?q#G9a_+%WKia3OoVnPfEkGA!FH65}330p$=i^>P845SOaFWKH*c9k6(z!y5C+H zJfIsNSyn=9Xof(L&_HkZ1CQmr7Er@aRgmD_w-?wi?zGU2_fFES$m=km3O z;LXBCx2`Q2*hteDsWF1G5l$+@p)68g=2t8Hv+K3pD)XrY@;z9h8RhNZ#y~KIfTNW} zyIy?E{Nybc2kWJ6JDfbkk%Kva)s4GQ$KPR{51P;xT7CnoVv)nj>Bj2TrSmbCt^OVZ z@vQt!;@SPGW*)YPm{|8;? zYdMS`)FsMtxqcq5huekVY#N144pOb zzgC9v10r2!dfaY*@xTE??!wD>3E7e&XUWY{SU;*pZ|x>z1m4&>SQ>WVDeAd zDrGJ5@nzLm|6-}YzS^XUEQf@%eYzm|YMTAZOAtt?cRS5L1nKNcE{@dw_9ZDDW|U@x zZ;j^BRx$JjG_m-k1yx(7A`_FjixCIe8v-nGtg8yhTX{xE6&(5@ml9Sytq)o zeVk~fxBpz&;mc8RM!9HcA*h*e}m%{;nP!!JVxCv7~DJE)j?{6YT{ti_yRB zv~@swZSr z>+3G1{P7d6t4FMNgpy4~Ws5?zl;?lud>Wezb0<8r9m zm!rsX!?xraP2~iDV-`XRenC;mM3EO-hfd)o!eUuBI9Pwz(cs<`s5<Xv+g7`lECeTjT-nOxE78vHGcZK*h7S7_rv@MO0#%1xLqa6nP zWDJo%-?o&Fo0RwBqiQ$5uuNUzMzLES2r23pQPgnu(`l0ulfO~}HFOush^JZR%-&0K zEKtPj2gG3WTMT2w;67%)z__uK>y*uHX%_8?dhQU?Nqp=g6h1nwD)tYf9jXTA?}lQB z&AjkW6>a711n_8tf8z!xBn_eGB-RxLoBvD}vozyLwrt79z= z6~`={Qh_hFNZHGO`VOi@53}8;h89&{w~E-Gdp++k?@F(=eN->?j0^|OIUQ{q9_+b+ zNpc{|rEo!%D5k^8WPMIA-=a;6>(>vOT!ltFnJ}Gh@vltu2qR^4KaoHcM|e@tq{JAgXW$jKpjjf0&@9m)$3)hREz&4(_L6{i2)q5MB&&kphg9CoCg7kfalTjew z^&Sm3<7vW`ulvN<#Kby!A)`SP&cjD3hDd>P(|<`0htt$Qgf%K>iSVf$Dz{meE!WU_ zW9w?=wd$v-HtJ$52s}oiX9o3iuJ8{IyL(LbW?!@G__DDey=pbw?YkhryM2dpd%O$f zcbL5BV-$$?NC?PC`YbFzRSg#>)40-~MMZ(t+YeO^8kg#!s+PT*n-?%5I6vDQ!WORQ_)#EVxqWo7C_*mh#>nqvF7wG~m2>x?4;AWf&WO|+~ zKDUalb1I;sesq3xJ0@TYKf$MBwpKaUg)pqhiJN$MTY7cw;Z1$t?O}WKf1&oOVU5ec zA3rCYzb~UPMTp3Q&o5~SxDZqAo2mE|j^h=Xp4FMR-z*QmnbY>uw;75BQ+50|F75;c z1^(_=&D9(KE^ab*{Z0PAS^#t=nHlR0PqdwF+Nn1I`+5Sq~juE_2&E zp_MuPW(vZXZ_XF=PIFDYxj!e3&_Co(@(aht*I@$tp>>Q(*QhvkUneuKxUcgRSYgRO_(DcXfg;nYh z15lJ?4_=XwD2UL$L`UObvZ+Wjd10!4Lt zx~z%7XUz%_TA#aL85D}9P(*PYgxoE{ql|nv_%U|KiI6RYmr*&Q?+-e0exrVk!r8u= zmA`a;`~!7wl2e3i@4W+~zi$7F)+&QEQr*+Tzt6O3()wIWrIx}x7^}%qVI=3n?57FD zC}b)4o;LY=X8*&AiRG1TWb%^Emu~rGi~nk=gYI!#jjkR}LW@#faG~Hn;%E24mQf=c z3_!`7UvgshNKLd?=n}N}uwaL)LzE zskvM)vJG$kOV`_0P2*7N)hDV@Fa}yG)gWWr^Q`Ju-ttZR`veP$vHoF&ptxuajWt9O z31FJckP0s<)d5q6)tp+f*)?7E?Xq{Y?H*PceF*ZG!P+rCG-L!w)wnP%VL=#^&W2lA z!*29tZhlW6(ms6u7B$X=!xary$(PXaQW*T)N`px+p2Hb$b)s40u!G14p}G25;?K!azdpZw4{t3?fYVW

XM<>y`%b>+-OB<64b}WJ)2xd#$`PHm zmf+5bDSZN8W+4S}ezw+jYW^uEpimVw0566 zlOHNAMc%`EjzVvrk4|6TBo50My=i5#68f>)w7#!a#O=%A?VLRLL4#m(fy5FJ@|~qo zJm;sZs!QbKFg^b9X62jy;gQLM_aaWVAu8H9km$MKt~#f;B z1oVFIE{%j}HoLs)DfFC;TLYx@v(b&nyJ+#~;@MC$T&^13dwe9&K@8O<=d6&F6FG%t zetscwMvkz6HCnnja>?6oSQbzm`g#x>A@usjNq^kLq~?Fx;1(ty$-F(zn}ylqs!Rhx zE8v!qcYkDwh@;Hs3~1?O{2?Wl<4+->^cuMdw|S-_k(y@5KSId?X;?!V1omk*{4o9z zQ)d0un*nwhHFu~PQCtwTTykiC*SkUfYazQ8)6fo0(_TZW7u_qp1xXocK9nq`pvsEz|*f|{Q(LknO!{f-B}e z&K@dyG-BPDw8oXKML!)KHCGLn1#|Y!ZNitn9tlxB&*cV4q;Au*Fe9@?AY}4cRpj_3!U%3rmYo&hmJ9mRjueb`7-TrcMe{zWDYAoVv z4VG2vDtLNC&EC0}`&EBlh#KGeGss@oM$=uHb`|-Lab+p79B2O{MRB8R@uCQsDL~5T z8Yx6|ihFg4hQ2eAvl?|hBIFrl%x01Imh@u7TkHSTso2teS$@vz-176=_g-Q2$eH`@sc+{7kN)OE+b8kc zrAk2%2bR%9s!O1_u=@yr7PL;pUcj$wl#CYmv$6N1(gk-*xhvwk*X~Pr(WWHJcppz2 zIRdX3xB_Gz6&E5t{U_&0GIxvn2v@9eC~NJ)+$aOlx2gUf7Zq;;i^2pyTK+9SP)fO& zNA)InBCgB;5E1XZBjX$ozxq}3Yp>qw*VD^`xFHO}34CJft}^jgGDs5R;WNueqcfMS z5wo*P%vZiD?mL*nir)PRx9%yqQTCU--}Vw>K5>|Bevf}XTY{9Q6;P;=Lt_yWt0Zp= zLB5nK3jK5Xi6-;JcT6ro@IjaTe|0fBQj8ln-SXf)>WkGO6}qZ{zjHCamDm)v2#$G+ zAK|MV0L$NjsQrol&Vse`z38DusB|VGd6u&BQoMgYkM${a$i5~Ns5QHo9T|luv zf0w>|_~~OHz!vTloZour>ph z)#5odoJQ{6S;$It7j5MfDt=~T@#32&z$4uyfu1ubOx_o*a~d@Nx(m;PdGfVe1~ZJRuLUYD1y60*M0Zt(!vgXeW4gkJ%jsKs%sb=a)eAv?rA<3r=2#^A zRWrU^2nXd@;MULZ*~4FfM8yyOe!zi%Vw>j>&bGib5~xbOXc{1Xk$jqrpX9K;@l~q! zobhDYh^DsaOwOD&?8xY}Mag?@E$(+*D04 z?jxiasy5H}AiqH>m6#jsK3Z}=+u0w6m62R|OD>zX)m*EjPgDIXbnFAGi{!d=+b=%! z*0SH;b>u$feIOFHlv)ZiLL4t=`DcZ*U@j45ONK`rlNMX!bC1OV&`p5u{G|^LBGuyu zpw)m-?GEE0l~zQ?RgQb3Ati@|Z1O##Rn?w)IOQ?9BUYqVdvs;%LMs&Lg%sbwVe)@# z6+m~ncrl2ja_qdmXjpe*d}~!a{@+SNSCMmA=!OYm+++I#m<~5_^M64rZ(X8T^*J}0 zXI>$jXS!A1l=B$gJK9L2qd&{ZYaqWAd|5HQ%Gf1?<(gBTpZd9)$mXK>3;PPCz9)Z~ z#EQ?27l~es*MAk&`n7Z3D5fBpi@>vZ$nY1)pO7MWY81X^%ZPS`YLgLVRmS&jJ+KYA zQ{z;YU!vfbn4uuR&vc&ikOA9TcWBUBQ6OKpaE|RIT*iqPn{~|y)oMs-%Os29IKwGI zk_0~MSgBHjd3RCn;8Kc;r^)Ob{tIHuC`=F-(JJ~|5?|rX>H&`UVQK%+uL1BtW$W6&>0b4 zHlPW;Sa)WMtuB*4jpPxEkaFv?2SKHGVUvb7F6_1a%0Jx{QFFz-yVHzVeK2#pysFKQ zS^Yo738-3I4gmnU2?1z=Ix~+DC7cPcewof}ewYhU?SXf@I?A~-8~g=9aQ#2hsh+@w z8~)tknW0D&ob5=G_-qegZ3X?@hhc%~+g|UzFK2b^?-9oUI79lG$d3Gr6OgMdPSLqZ z+v9GEH7BxvCJL0G*)r2xcLiS9s%qO}%v2FA4p8o;1ER-L6e0FUgJO34(4$K$zDYWaPID#$l!sjUJo6mtg=aN+IY>*WU*;c&Dxt zy`X!p1Ns4^zS)WrSRV(ZdjVk;M;w{6{AXynHP@!<)z}T2G`-qCLoRqg4@~!e$s%h$ zEa2x09eY+?>Pc6(-%O6n+n*EJ<@PBs!bRVHDA*I&y6N&X2Vnb+~_Ho2}M_>kRH#4W`LAXdDu zBjXgP4N@%ayx6LDB4u~RZ6F#~zgIsNn{5ZR9<&{7s|o@=o6fE1nx$`{mZu{Q8+XML zLR!Y@8@x+cUFH{^faYc8SZN)}BD|@>T-nKt&4ER>1I6}zN=Nm7A*;U)*qRpLxOOPz zhRydES%sRXxTkOH0}BrHhkCctWOb3}`}5258VQ3Tq;feNQFXImbA0cb%n*78J_+yQSU%t4x=UT^W8wOn@6z#GAJ}q6o0a<=xRNP?Dj^i!}swiNVuV=tKeK&b7Yaz#QvIY$Hh8Nh?r`SpGO(d0|DqtVe}p>G^5cav7$=R zPxP;p;UNS}cqf)GnE^Xkse)AcKN3H1IO@aNb){%8(n|<~Q_=bsj}iR;C5J7d1P5840>g?)LN6k)Fe3DNgnS>x;esvWUL1+EFlo|eAglOw*r`z1@b&A9-aC7O#J>ID}zm{Qu-;yI5YlD!Oa-C&gXySN*}&PnABZ1!;wlx^X3L-lF1q z>CJE8OUlBx5-42Z;KX#p3s49!xxi(5O(_Qh3{7RtcVAyjTNMaN?-O_)%HZFH za9ufiBfN9t=tX~;F+z%u?ME+*Km4$iYDT{i-?WL}T*=C?$n3d;^F|@+WzpL9D$|sHeS9PohjmGfaH6z z%@jB`3+MJ=fxca!U@(wvdtY+%)Z}sO6ZW^^r!mlm>R1QS|AE^7C4DujQqFQ$xZFYS zV@rD)6@tc=S(Tpnj$8nUuU$O86Yxce*;>^Var)hcsCh0_88n|fjZ!j7D0DIrl3yDC z=rx@ozEDwFzTo=atwv{fvz;I_D)Gr%g>gk8%mpal2cIhdZ7NOhQS&_&DK;+YrHP1P zTjDSq4QXf$gRvVHBuX7E;(0ZQ19WU%Eb-F4Z=2T@Jj97vPQAYgvT-xne~G@Q3G|~H zOg5Q^38f=}ziwP1t?g$P zcUCaC9ov{*8Xz&|EbKRGIaPNXo<{N&^e5uFfj(JWbP$HsNAk(t1kGZv!EW`IKR5GJ zZF&aEZHHx(ZFVa?Z!Z3J3HF;TM71ieBQNJQ3j2Bdl+-}l*N4+)zr!o>E|>u2bU&~* z4CwY(vgnqWZF&#Hvktk&T=I?~KQ6zHSVI77ws0KE1X=!3{7-dj%Sh?fPlUX+M5xB2 zIk_dgme09vuY zv#_7ttqg9)|ChCe3yc>gy@T%G0k1bu(-_{6Rn8k1B~qa43-p@AEPQfIbwA8ba;|cS zI|qLgY%tl??jV@E_f3})lu4-iWNi7jxWfRE77Nowrsw>*eZPB3f)vcH;T3Kj3lako zP>!z*2dwWv7b=?!49|N#GcXa-U64z_px_Rk-jM>|17JNENwT{G(?9T6rsGWY%FY~7m&MD$Du=9K{ zfCa)}dDA(i!4BURz|bCdas*VD$K)I;F~a<{P$V&QTluPzf9GdFc@0jrFQ;GPNj&uU zI6NRmyr>(plTh&vF7Rh`h96BX?v+RrfT51l^u98GHy!M%UD_bTvlq>^CGQu&(EgpD z-Un44X>ixG3*^_sepm%#96yGwwSc%V0rZzqKbBP4jcM*dYA9>gR1MlW6y@qn#fZP6 z1)JQTkP>)dt@2{zGKMntrbBK2P~cH9*@f?)PIZ6fXa4x}04!2yh4y*%Q?nwg-RoRQ zr%5pI;VgH)l&5%iclQ@u8PD-(hN{)C>6qtwK0A-%id6Frexz;E z36}-(p;|B5tfz4WVdO;UJ;JGqmi#?WA=aH+5AJL3co-P>9my$v*Beh!t4wkSQrU50 zK~TtHf3|rN!M{q^A98=C-f-wyc=Kny8p6UPcTmcFK}ZoocQ|7Z7Te7D3Nx5Y;*_DW zzjE+C8hCl=@*LhjrCjA;9T0LmeQCoBy@;sb4vV1N|KL8Q&vVHTK{=6nl(Qx{R`xjj zN(@);z0Llu)9Wwr-N#yqZPDu;VoZXcZy2e4aG6vKI=-V!Q27v(<`V8|*j%doIGz4^ zlwIuHNO=ahPl?>~b6tD}!}S8W0yt4G;+J=E4QPvv0(_h48&oarK+S0t5x5c23opk-&YQDr&F%# zga9cuxeE>+9bzM4z@l>%^ny>Q`<=G%45oKYF?bq%pSyV77ob&N=Fm*gou?2+1%!R~ zuZu5%E5A}M8q&VZjE-*_FC=2XPBa2_v-G1=ZTeyDuIbzw5Pmk`uN-K2bXr;JIV%l1 zLDW9f?dN+pfvGi7$QI$2x_wDKtBwh3&=+pe#y>L%eVIa1=YFE2JP#OjEU~roN(vJQ zOf?wkGJga{LdGv&G=wk8VDbT*`rhPkh;Upe48yiT-L)=EKSF`b!jVdbHs*Fw%&HX1 z{DkfA+6V|@qoKFRi1;3|RT(CEIIKSb-?4>FFKdxE%U>FDKTG2)NaDNS$)c6c>;1w$ zmArQ#gs5eHwDjKegluzD!uc*qj01KDzM*2{lbmfIq)jFNjk^5;pm=2MAOX7uXITv^ zK99l2aDSX3DdZRUZgKPYknz;bbu@uVjW`6iREWCpk8B5%yPoDZ!JqYYPIj}P>-P*o z-WQB2PC;vhk+Fy_)D92mSc-IDnMUjGAxZJO9`YOvbnpKMU^?_M*F~s-3^|xi47?^n zQKs(KJ@LmI%nfXpvz-4$y5f{<41*9J18j9|zc&i6UnC`Fq05l$IWU1YIwg{kd;?^7 zV3La(?O28(#2C=2cDYZ3l%G6`;4|h|ZnpC#hSYR#DO3x*Ba44;g5861*=1&3=7}8* zAZ!V{vPdn1i1`ly3BMZuBd(uX@+gS>Li_aHF2VfE72BfusYy0{8?U;WL5_fY*Y7Wad+9M*0{mQ{YjvneocZ`$o2r7+|Ioda-3RPs(t zL2w`aI*@J_GQClKQN?Nj883tWxp|3T`hMpga z2MdQEX$veF>>vBX{gLJ8Yq2*MlqVL;0`NACV7k+mt@;m^D6{5dwg61!n?4*6te_vh zt*#&p7Rb(6&V}lGeOqS7UX>-dz(GaAi??}$9xTyw>dMa^aXi8-It&c{p5OkGI56Z| zAKzWZ7sUC}+ndm2=Glqm2ZUJn{!CUnJ9@S z2=bVmDA>WI!d2`&Rfi~OJ4>#JPw@Y>@Dghb>J6#O*Tk&(cAS_9-rN#93Q*pxS_fg! zHD53YaSj`dt195O2+S-2LrX9uQlj8)?%Fac{T@RNJ%0HxIQ)(^0Q&obR zn=D;~Z74G{VDqHBa@YjMfja$&F}<2P?D;#GG2$6I<_QfAzd=OY4g85AhUIF|672RT z)E>qZn@%dXj7_o4O9Z!W#&OVE1$Fo3m07PNo6NpO3njlh zIy;Lz)G=mChdf>xINl#VU7Qn;&dm_pdpaaGEH?cl!uy9tS=LXa6xju(#3xA^XQgjE z^lyUcMrUbzpH7LMVPwE}2#Eyg6Q^VT-TT{K6jgS<$FGUNh_n|P6(SM`!56{RVOYsY zw&!m=R@M+>8}VQS7R`Lgek z(@1&Rw2_)*L`sRrHO`%5%(W}{1?@punjao;nL#gx`0ENu#;w25oOvc+@6ev#-Nybh zmh|31`FS+naqrFijAcw$Hgs)-RgdBDO*A zG{SuA9B%ofY(kDvNq5r<)(SKc4A^&4M|ZYU0)(L8z8rSV-?5=RvJ~K!COsZmKXpBv z9XN?^k`5|OKZ7e-I|yj~aw|O>ta@f5u7Z(ne)oLgI-n#;zGQgQnWQD`#y1aC%`EL8_nv%1W3^p1f2oYV?edgWoQM!9UNC_qaNyUugGW^i@r zVIf%~DD+SHvig$F4H#q=U76RtL?=^K(r(pB44qTGNVU(8njJ8l^1mHjXV1Dfp6xR? zdMhHqPnP)DVRHTB2JJvA{d59H_azy`8?V5F#dL%1a|%l}w15X`Cg~nf#1LpTh-97E zC0IzMf+1(N3)AMf<_^Pam6Mcw=p6wx2q9#`c?IQa-9mbwbJ4vYp-HpQ9@m*m5+zWA zV(G-%RP#}+2Eevy>1D4+Pa4)j=k%Ck^^}8LNs2dBRtDfi6={B$dc9F?cL)d4bg*L+ z24U7^BtR%vHoAio>23j3;Yqp`3Ym+@V#tNt4koK5BDZS_zcTyZcTK{|+RY{_#DLV& zeOCH$0@&kEPT#!kAF3-Og5lj>>+sN*j&lR#xbziTS#G(NIiBk-8Oo#ut00y9(;AFY z`MVuf2lhRp2qNpTS4^HHX_TMh_v=BQCG3dqvF&%a$h&LP+R8pAR~f;*JpMvOk7k6# zki)dBtw*OA+{=EaWN5wgJP z&6_@818o)&(kHQE2DhKjxr}F8qh>kcP=%qzlbYP_oG4xY@o};X1ba9(}uV<|{S0`1yHMPQ>e|L?`lD&xJm}`7;2S5iqt5A4b9SCkfmHYNcH>jFsS{ zoMrmhE^dpun%rF)fq_oNXZ?Ub^*%UTFLJ|#{I!nv5Fxb%G;|~c{v)$GfpxRZ;c=~> zab8_-enu$-lrytA$94)mL-QBe4GVCt>sf2Z&&Q zoRVhxM{{vrB0%5cX2dxFiPr~sZa^cA7?W%zhax3Eaf=DNCwJy_YY;EO85b*( z-{N0VkOV$E7OSM6Uuy7cR>ozP{pDfshmXCK12u*lU9Xb z__mtokId~R4}hwahElQ57}vZLEDp>lLUMw4__IaE-@IG?z9%9=+~TP2N+q*964BxL z=;@;1v_1nJb0d&l+|#2aNcIzI$<455du?OF8O(7&(%T#rj(VEQj^ZmFVl#peY zzIvdNBdT0vg2!IxMSz;ThTNgP$=f$S;zbGAc{gof3Xf;0WN_u-Kzsz-6KEOG+q+x* zCRTuHTY39!%#ozAQh4^LOlWt_f;CWX$CL|;dz7VNy*mgZ-$_kHwbr{WHPM(L9MQ57 zzt6U;1X+*ORX&rnn6Sz%B%a9R`&ir-I<*E+6|pxIHLs1chZ00iTy@_K4H(E2F+w;x zd6pGhQ3NE|u&vzCh%!XT+6+ADVmU$%?mya|lfA_afF2??V9_>^2dvTtwjRMO{&;p0 z0_p-x#HZQQ;;KlPbkLj6%5ucOfq8?A{0OH#SFR+O5!rFalO@>MyRWqIg5yz^+UpTT zw_ZL5L#^!J8J=Lmf`bJS-oahtsz|Pa*c8jX)109@9<^Z2smg0w@&Vx>IJwQvs_E^7 zO5v{~3_f3&eeZ}`*<7!2v_-V}Ho}_X?7QA*fl3R;VTDi(9eWH5`PP>Sy`-!rn_8Xz zBbO`eg&>%Zx&1T%96>`e=ylON6$Spf&|GeiHtt^AQa{I<~s#vpKF9lzQpb z!-bE0FM_+$Tq7+f8vHWF(?|O-Yk_%$Tq7b-qMd% z_mH5>QE{G^5f0+s`l&vX7Yz`A8a0w?W znS~GP6b4PTO-sc165{zjk;^X$e7;9;G+209NbrliJ*u#$9G>gj$i_QLbN33NTaP5G zpU-8+x;xJk52D<}x)3&(^)Uw#xUfCp8dvW*)I_+MUS zXLqh1fYW)fRubB+H$RSi@M-r~byqpu+|1JAv+89h z9B(lPeZ=isaCrS>(b)i;Q`nB;3p}s9@2+dUxWi_T9!>~sqN=wi?m|M%eD(?kg1IBP zM-tNyizpzMypuPg05g?r4s4%OrvL8yet<`?0@Il^V1z?Xo!=f+fwYhl5ztF8+g&Fq zGugvj?hd3oEsd+YS5)C=%+U)*E45q>uTf2`wl95`?#&fLmQbc=`QDxz(*hPXu4?3p z=?Cv8b_wSWE&a0_kiZ08F=?qcrhtTl>jHRn6i1sMGT&B{OP-W@)Z}CjhMsGsmiG62 zY8Btk(TYEn#10>f&~VKTNWW5})&&NSlj(Z*P0dNi2ixg!X2GAEJ@utsW-En3fq;PB zO;thBdVe{1lF-o}A+{)JJ(0HqWnDE@-(?0n%8}H8ghkrT`X_V!NB1@u2%qdNWf3a2 z!gehb1mxGZFjiwQ`{cIHV>!`1kGk8JCdH|HJ9&K1)5yjNmKKy2uJ?N&4^q@#d{eOS zrNl~RpCu(lNZuz}VwOh9D)fJ zSX+yvoZPP>h*XaI2H3YFXfEi$o{t9!_a06V- z5^d$1^$0%96A%)pk;~VljNQeu9Vvbp79;&)FrVUfWmS}ZWH>{4`^7c?rPr%h3ck5~ z^dvP>vm6?~;k@eyCXhqB2g3`#A=SPViEmScj2WTU$`@@zqD-y@M^xs)gGyJ26d1mf zmr;bx^zFUM;dw19_<%quPvgnB2L>_EwLD64bohS7bn2zj$K;xX%gn)H zjSKQIeA%{cklh3`!&o-Pb7>EzC1m9Kl)Xt)H;24gdG1=ZjET) zoCeT7V&#S=ko(rVZY(6SR`Y+yH8`(U4{#Xgv+{`n;VL0P??O?oyPKOTy<+Gb6E?Wm zQs<)~uNF?KSZ238X&0mv@r`@2vLWanDF${5`AgthuJ#NP0`5=(U z%!2R}cJlvM-CO@f88&aAt8`09gD6XhfYKd;z>+H64bsxm0wMxZOE*YKcP%L*olAp& zL8rnB0xq0;dEfW@Ip=FZWF-zV*vv8fH&0?fW%XhMJ)OA);q zrT1IQd}XTTHE8LMNw#$7{gMmGC~+asA^C&RWY{7VZvu`9d_%3SZS)Jh@R}ZvIc|p) zGf>rKmoKmTqsjpY@@cSRH;8R+5{kJ`gSWMz&RQ+K)Sj>mp@piKk&R9R41M&du~fm? zs}B-Vw-4|&N30(Jq91+Z32kbS0%~U7|+HZ_Wj2b?k6NPDd{7s+% zt=jJ_N+z_xJ`JM8?AD!jlmmuqDRFK%Z^*s9e|_^6B9gO}hzWSM;GTn2{$r1YW8{MZ zA~?qNTrKAZd4^dJw$9yMq+KyN7g&V-#Yy$t$DM=~7yzWY4%x*?3aqRy{vn0&1e^UV zRhw$Ds|O*=0rG}KYcm%6v!fdXXA*^wdEXjXK$R|({ob!v5ZTGZh(NC!q&u0cnXOl7z_&n zk!PpV;v{_N+j1aQo(QMhUtpQghe;@7xg`qC0(1UH+Cey2p>X71U$T%r^QTxp$Wc|# zFtZy|S@bRVu>|4egxc&3Z9D1k7+PSK)|4V;5eF)arTaVz zoZF+X%bGfY3s~SQ%RCpyh;qsckLD3}f+3XuM;Z+*P%LK6v0a{CVYVFP(oilx|`&U%&D~@qzDk zW`6O0=WUlV$dX+il^}z5tInVy#+JZUjC^iNxaqC6RhOujb8!MTF20GqxPW*Vv6PAc zS7F(rTJo`KuNsKsP`4w>69Lvw+!TAG{zF{Q({`e^O`hOFN6QNl0y*lTXzwn?=O~{9ylKSZwpegZil3Gib0mFKInsRL(Z2 z6_ZFQk4eqgI1wtzjWgAA|6za;Dc_V@0_19@A2ndk%PWDB>Z}x7tW3_Bz?%67EvCpN zjPn!RaKCuFqq>k89hxIQ(q2P?#n#4th`6 za{1ImIu>)cGkPi+#@KNQ{l*Y4qonR`Lt##$ZgmwK-bWuzqk(2g~EwOSPfyP`9uEG5(8cp_eii|IMO0 z+s{pkzd68gFh+iIPwrJaJ((|N=zQ(NlIKF~GjMD~M+hoEuX*sT0in356>?$NQAIaF z;SH&Y$qSrty1~^aw2*j4mmtK>+htW?A!uW;N9zN<$_nxDv6j!Dcne24PJKnhgvK`I z_mXgzO$iL%{jobLLCBYa;sQw&_6+0P6GOu>#d0dt-&X4^=M?(}=t^z03*}o7Is2ae zywIAs+sb^f?5_mOA1z23H>^d_cR&FA;VW}7QIIk*D6nNn4Kj<&y{ffmM3hJW;ziAY z!gBJo8U@TYbF}?KtwVRYH9)M$lG2@cF%KS;j{7+d>)X8DV*$Zk#b}1p@QBV6imjAT z5MTK8Jn#$cA}xM76tx5I!a%uIOXDC$XrCpAzzY|6By~l|f>VHi&YmH;y>bePVPMhi zJJ5OJTwMK;*Fc$=yzHoZq&fv<0WQSa%WX9to~{URAI?6HeC`x~f(&~TQYAGr4+S(Q z829HDds82}KeFFf{^+=awFi*+kMsgce{6!GpfPX-BM$G<$H?Krkg6Vf)Ky(LKE(-B z{N>C&88@BeM!4b|#R|Ihqg;&b+o|$Xns5Hq28MT!8+qK{Cl^qMQ^9c&Ytf)K)|)1$ znL^DaxjnlBr+EiL<<_e(TjAW=n-Hi2@t=y4$HL(Sd7E7Zi4_{iYS>MaPgsP0B?_QN zPkhnEPFUx(EgO1I@Fcb~g^(IXFAL6_mWTPx&xW;lJ78*a@as9YQ~7!B5h$!a<=o1? z`JMc9t);G%T?+8^m>Hea&F*jC!klzW&dAtPlQU;17!6ML&dUDyb~ZlBV!x|)wVKiSaPf;Dj@*`X_! zJ+^y4a!NSPtt@g=U^+T|M|qqv#{M5vE2OYrLzkbK=zYu&;03m2a`3&DbK+wiWxr&> znmI81>JjN|-e!Swh~w9?GPEhk1(@nx;$iK@q!9S}!9+AzCxyf0YJNiHuN-opP0ZdL zz!*z3sMjW6j}Ou^E?s@q&x1e^xD}!D0QCjKVTVxs^d1V zAP1K{8-U8`u!;C+Z}|K6b$0aqWEe`qP6SbY5Bf2&g;LO&;KIz4TwH0%Bu~py%tzn+ z4BWvEc@3^qaO_4l)_GyDGATIpgZ^u%Re6GGW?!O=8!Z4{tTwZ(?7;~2mNhIc0r#W= z^g&Ckynbvuas2tX6d*~(L*Br7DORG}VO(@1Jgjc#N#qYj(^mQ{`oU`_A?6ww~SazlY#ftPztf_x#k+I}rt; zDtQPxcOnid1jqJP3aL-@&or&99LejSI}c4k%|&8>13+og2CBXGa_+RjbN)UY>?OXZ zqeD&I1jKX2Leif6aG2OHlj+M6fY2Mbv_)MO&iW{CJrnmEeVAyb43Y;%_AWyb8_5{J z@|m^`8WpxJ0-%BZ?_$6%X%>5q=XBd&wD*9@`)o~T2F(nbzyr@dT~g2Ag8^C%gu+Ul zwn2jp7eto>MafNL#*#;oB05iH0fen%lV4~Hf2SiOQ(cO%ek7)F_T*PLp<#6b>Mk&Y zz4Kck_q9c`N(i{Nwp8lbml_Wcuc5yb>nut9IKHO+u=-za#PF}fu>=O%vmmnWZ^L-+ zjAPWzGx3UQ+X*I;h;2#(a_VoGY5DiRlINuTAGDf^jt4$d&g#zbowClXDzMJhXYhT! zlSOpjFiI2I9UPbrZW6#`rEoJoclT8w@>Zik@<;AS%D+tr80V1qc(*vu%9NC=6kw>g zYz4Y(8Ai45+Tu+{;!&YAeC`YDj{NbM-G8sMS)})0%)mC9ts@2#IQmRCS`c06Je!!b zvQ=+r+_1D$^h5}2O-S@w^u_6m1tQMB0<0)k`QDGrb4*YGc2k0D5mS}-cz7r+4J;#5 zQa!hBGekathRo4s_Ikbh3?@6Y9cizG)lhVG~uT&l<^@y=hN z&pXx1m2bkW?;eUBOi!G#iHSJlOL;xM23A4Q`%kW*fe>(Z?k&5FLP^UC6aZ6vS5{Cl zW74nsLx(V)0Z6jl{`Wh7Qo?omuCn4oN{mFvI;Yl%*ltsRgtpI8C@Du1%(Yuf6H9LT zRQSkpN)$v{Igv_VJr2{hl(-$EQvVwU%w{C~Gr7J4D@KAaeh$Ltg1h~Y|LzDN6nCGf zP-!zm+CvjwRmi!<(V@QH-`o(X`lx{!I@1~1RsZWTESDW4l~hTcZp?|VAr_LolM5H1 z2`@(Se73+er}4XS`b|Y}vvXEqclB`95=```IBW6~0}=p3twg-{V%CQZoergl657iC zf!~zySc5Tgl-cjg(Kg!bZuGmx`B8Qo4CMA{Id};39lZnXQx$AFAHjs=OhNdo$>Kbp z2cYIO9yx{V(aJ1Nl~krOF*jI9sp&*vr)INqsj`5*K0eb7(@%x7!Gz#<>Ct^l$IM&h z@H8nkIAU@VJn}{9ChX;(5&z+b`l#A-?DEnVPv;(A#0TWGXQM+{Z4N%G&Ghr6QBd} zyFSo_!d(%Z4tY6HY8}sx@@txL`d4<}kuAoh0Z77B`xgO>2;9`8$6G_O03+zakU@OS z`@I9TkY>vFxMGq*SAPHKV?B^6{L=ICYvmMjoZ<=D0P(`!pQ4}MfZ|So4Y8DL@VE%y ziI_xR6>3Nwi2XOCctfu zN{IPL1Q=@88{UGu#EJS08RL3?bP4@3Q)-gy=B2<$>-M9s%~xTZ?hAlQY}^0NYa0?@ zuy5R@Ex&LNV{`9rWZUvAJhftzlBYi_)x)3)%|&UUD?A1NON=Zn?d`*iUbR?{j6q~I zKyq2~Sv6Sw7Fgsn!ltz+mI|a3CU~UD&G4necHwOCe&nbQVwMN%@|h>^qu$CwGXH6< zj@bA;KVUtxe!V+@CLjoK|a;DhbkutV-GD~ z4Cbku%6Jm*B5&mNJD+qfPyrfQVWx?FY8na;KEQ`bX~hw*Mmih?hn+^Ec7hn*-J3Ow z2a;Xxx*r*G7lP`Z7**HO)*IV>C?^+DsOMQ+=#PIdx9W%r6${2Tw-wKAGjNv_U8&si z{g59}+IEL``w(3IWnYO#kH!Y4yRg?F{6SW@E}n$S_N(}%2p$#2;Q}+txiv|~VOyQ0 zE1Ao9R8=VR<9ib;bXl1eGQkukY(z~hg;EWLfJLOnqLVo!H-%${Gk1DH4emEDigTRr zv<(-ii%-!vA#fkpX{{L0uQDs>nv?An3#VD{{z5A0=}`EGUM87)p;f-MV?u zOBmK$qX{Osl}Nr1?K~Au_kChD0}&?ttU zz^M6*azv&D=7V{+A!7A`{{8Af|H+PU#P#_-vzw_I*_&;^ldgd>UdI4l0y}ttgaVts z{2_szCMZ-G-gcZ=A_{YUQ?oguUH<`LeHZr4Ygy8|pyUp{#nHBehdxb3AQEl&DoL9v;+(Agra?p*`& z;yY)L9)T}a9!)pbMC?KVoRV+>W@3q3(ws{DxGpl;^7pX|&r7Ke)3g*xvu(S9t2HON z4FCiuLOc-C6c=hX-DdwyWG;!RFQ9Q^=}=O&QZE@i9K8rMN6g7o&--Wns!cH?zi1(O z&b(F_!A>^X>MXjhA!4EKjNn(^0^^-e7Yw)^kf(60lc7IhBCjStn=Lf*f~obAR8u0_ zW<$&xz~}GYrrxG%oe$@428VG$#8_>xWTID9p>dT%Tcf!+Th!L4`lAhx#Z3(%`^P3V z5va`;wLt%ZFrRifOtLPqEe+V>5@Lg}%h|9{{?Bv-|PX%tKEhU_4@(nU^!|E_Sqm8&q_$C*j(vwwYXfeD~Gzihapoc!2?h7dvbEmfu(5Jkh` z6olu&smDrKtB;=Xa}ax$_Z?kGy`bZr0<8@3crIkogaB#*91JbqEKAK--NkNVGhKvf zAgt9Za)xt$xLQql_$z9C>Z0p0)mA#+`Y)Qm<32txn_0FU&*(h0`QzjCyAt?VAa2PL zqui%X50ay3y}L$!>OI0%EAPAXs>k!Z%%1Ims@%APQ7Uilz$v9Hv5^0L#sV9gtGk5Y zd+TjArv+hj@PTk@MNs{T`QeSI!Q@iCud|++1tsI1Hx!ltN>{*J192^{&j)M-;F+Zn z$-QzdsFX6TQ~+l$JxW7Ag15^<_E2zlE#7};=yJ!xyT!U3JarIP8_={fe5p(U92Ye& zon2$dgGO!tJ*!d++5wpdJ&^4h}RR0XRMPfHz)B`r3b` z+<|4Tb^lG}uU$;}rPxjCv}l9;G#34p68+9Unv2nA_&rJ>i(tUMx`S_-1LnYf3nC_* z@oHA>;LfjRi zBNl26-SK6-0smDr)f25!`~*6Qg()+Q`9d4>%-Y-y2Oo?ngyKI&N1_b{pHy{`EBe@J${o^1u+`>O^SyutXBWiH8@dk&FjF(xAP)(^ z^wF5Ro~86dm$Dei@QsMh2p2ssi{HMD+>*w4NlMrvJxV>l$8C5_#FQ`Mm80ZKe|c9wEV6IGCUwn|Nc$x?eFPv02b6|Em)E{3rO8ny%HiSu|ehjd> zPN$9?KeRRxe|><;%8b+b8L||46DUkJ24H9%V~ccgcmdFi5MOs@H<4oxy;&-g@n=da z_KeV*5%?t^J^KK8y>O3}fCHlS+EN?Zd*!^(Qd^h#U!nQlU5kl`sga zL9FP};+WSqnAar!nwL&MIkg-EFo1ihkcL5DaKtr`<%N?);2fdmB!2a6|EV;IEh@i1 zNBT1V-DHzeqJ`XZ*z^gvn6$?RCql9QA@Za~H4!Ri55kA-*vz@M^tL5Bb)oGG(J|#L z#L?2%fEEyAV0BCTt<(d68)&y0fUp!(%U~bM&p91IF7@44GR)<&4US{}{Qiz)D2wMbaXqLNcV=uRK^^A}{3kuxSLWH&90Z7Ii9#Ur^=_e^m2Z(<@xZDm zHk{|%vPChsj+r+BCN@&Wpb~{o``@Ymyw|z(bYe->=5v5iSWdFzzp{)@ z&6l36s9MKWjwvtr^Xy9zrLw0!4o~-=K8})y@wLs!lcX+nyt(m>r%&}XBCr{tyqsII z{`DpE^1SNQnSD?C4Z>DT(^S@Hh!L4V4Ryt@=#+#X-*MimoSnW0!)yQKv%?BMnCKqS z?}-ZOs|&uEg^#BNNLxT&g}Gne(Zn&+*+>L6m~)1Do0P)OD?hHv^f!nEA8N7A6yx*sSDruh&^MC~2gbuxshnF< zPJ|Rq1EK-a_7HF${cw8NJ^CjdX-{0IxH$&^JM>O1rmiLFOi}cyk&^A|+~v|Nb7Xv$ zg=c1>{FJqw_9I{Rri)qpw#=IwvT)-|6CS3fC=emwttbF3Ubv|qk0L|P`&8cDomjH| zJS&+d*ZjYv@B2H&7s}49#vZ3Xu8z4KxZ0J%sxN5o_Q}d`n@Qd#PHo6|_}W@vL8pu_ z_X#inSZ&{t1SijRK}9@V@I-w+I&{U>(F69C2+82k2<-n7q!b1UwtI%^iV2qU1w%$e~Ev$U)E$hSBjICcU!s#aulGvc7ipN zeC+oekYNK8=!eU<^s7G5?oYW$_s3N*Mtl)P0tc_+@h zK|;l&SE~*(bZ7BN-m(x4-rXGF4GA} zdDT#<+9h|VqwEge!%ea|;9{?V1=*?qzG^-B1y4+fHE@F_rg>AHp2wcS-VT@0Ch9i+AsOM1-{?zU639$k*IhaV2zwC@SO{H_Vr>HSMd{QTBR zm0UWX+rytvkr7fmrKU>C-clA2sUK{bw;2mS%FPDC)DT7iJGhB`u`29?2?3zFJ=kik zkG?q0QDMq0tz%+L#%IbpYab~;`j&`FZI=t9$>M2sGxzukm&yrVhPNZp$JpT z*4lwpyd9eY#%M#9`TNdVuaPRC8l;&%8I6U6LK;r=b8mrGmkV8Tt`ndXZ8+(7tBZAZrWkKpmJWW>abNU%nTpqsW^(xp=Eg{DOpGIsfxRTQh z5FTgE09sJwC}oV0Lf|eJ;iykV*||gS%}PiaA%96;z9}NCJ9T)uPa`(}XyWPRyAr=( z;{%afxD#wvnGu2hs%+N>(K}GV<(&#@3B8W9;>x}bj%3Wy5f`Wx>Ewc2wQ}iG*5X1p zavQpgV?aX0y2(S=Fvu`;A3z)mE{S&aw+*GUilD$lxe1gYc~k98d#pIK0F7IW!F!0> z+P^H%mGH4lRjmW0ZA5W9Z}Br*7pGkAE8t4xh^l7tz5e}8IbK{zt+M)p@MIx8I2v@2 ze51zzYE->5vCiUJRYsJ|SXgH!gdKStgow6_q;&xm{Y3hryN&4EFG31e2p$A+I1D#Q z2-cj)XW@f*t75GFyrnP#A8S4$v$S31&w4Zrgj+0q7)UJNF{`lmAk9QuK`yv*ma56~ zg5FbLMsOzS!96sm4$jaHJ?xI!OMDytHNo!w`*utbuj_P#g8sTw|}?KU;|@OfyA z4P;^=k}okNqoP_k#o5?4hURYDcJ6gbd>(ZfR~)Q(M9v^;ol(d~`384jpB)%%g`ecr zeu3MyZL>x7t+#6~n1Ao{Bx>92Z9;&e@d2h=_QAO~;DvEZw07C*BnznydG~j%U!wvx z{3&c_oWs5w<@{H7<=SoM5U3F$;7!7Snk{Q4HH1sPZf+RFx`t6g+8=Bu?mthw1WTt( zZt;h$*uQSCWVlS&4_QhxDpxgSIm9PH9I&LD@ebk_2*|)Po0qHP=7QoMSmx!o&uV?* zU_&Q9d@a&h)4EMHlPsf51rGIW=XN&Nc8OnMKUuKD8-%ovh>R`UViO-6gLTs{Gi4!sC40keB?+BM4Mli|>GCk%I*6VFG!K5_TQ=X`^D{fw z!MNfd18(VV3pJhp7)4}Y6{>j9?f+qO-$Bk1Per5IAOQ`OA-|IXGC2g$S+%0)w|&O; zQiKj*_cwEs+A~;A-l{*Xb(#D20AU=M>f8 zp^G5Ue(;@MRJK0YyU20k%*bFNMVYdtU4Q);%po5f=RxqA+Bo$$5Z zPpZ!B14MhSSbVd3&~@{RiIUCgbe)rAL@j<{8+-D$8AQh53xGi!RyApX-T6P{=V+dC zrTi2I!WD3d=0@MtkEJ|AQ*ihYDTC zryI&2-pRx6H1+xaq35;7v0x!{c59wQ1pUIr2ucn# z7nkI+RgD$@gOZw#t~!1DJEr5GdHE=MGV~NY2h0$fKdRYE$i0P;{0j0(;vQGJM$&W! zjhPE57Vph1me8Rv4L!nIHWJGGkHZ|hI2SYtJ}3n~&oQa|G{+=I^=Lvrs0)whvyCB) z_FX=Q)C&tOQSiI=Iu{b1ii~B3;=nk1*Kx`DrO*{i!v1A`Rx~k}qQMwVplp>RTM>Ri ze}@rs1@ha-+`D_YfT*>VDH4?Kwf!#L`8wh^gJNX1X8_A}+EhhIl1UTdbcA&TjAmT; z=xLv}CI7pJ`ZRn#P#?`k!ty?A(&(TIETmEcs+9^1SBz}@v5)yS0|t)8D5-fh)ya$q zbeZNj?h`$VRLZ}47QiWW#n!^xPbxGg*+7TfyDUK+gUadnMIUg2)2U|bA<{hCTs^W? z{M!LDsU{i}n3Tcs8i<^rP5kkXlNxlD@p+d@nTBKs()WQ+h z(#7c4WVvwG6ut(cusNo?%|!V3s80}aWu&Jl0r4uX{SkY*?$n0&E6t&SAU1DZ!#1FLoeKipFzHsFYIYWodi4sX! zcDei}HHA{F|9;@MH0-%RNM3|c8=lqls{tZ~8{q!DP(6o^#y7CM4fd-pW9R#Ze~@(a zvY8Mu9NbY?yyZs`Jpqt|`%We-fE-V*s@3S*b^Cl?=#V9f_627b(gy6Ijr$+03FOb> zXS>qxS*Eu8^Q6S}RfYj*40ZZsMD3ZHa(JcxyIPssavWWvh)lpH-`vf+)T_iP_nPpE zAXfwjv9ejZ#{pf2(QaK1hx1M&kA{^ouWPdL57tz~Qa%Y6?%h7r5CddddlK*V8NZ|d zVL8aCiElXlDkmnP14M^9xBfi|bKszSLi|8%jgBljmVf*7O^A!9(O=_Xvd9~l4?O7M zI(dU94tumH$eRh8Db)v4nmZPV{}1JX-G7Ybh&QzF4yxw91#yMLU?&Y_3_wtKhl>$= zf-nhuY?Glse6EwU%OdUJ4}tfc;Mq`XFj71Bbvj7akPCLs5+82bB?&TiYZk}=D0#wj zjFTH~(0?w|GXO+r)3ts+@Z;)k)OF%-@mFjxhmF`X!B#Wes-a>}=K5G%gdE{z>SZxc zeQnN8Ta8nl!<60>quOd; zhYXBeyOTZ&Hs3-E*1UP;pelC;Hyoet8#68RmNR)Q{}*Yyhp1j5r!MN$Bn8)E%Z)~} zR%z5L)ZKRqusu0ubtmfG)s2M;wpOhv^5aY{q|ZAr3!$M76h z;=OgLKL$Wp$#gwrQsAQoNC4Y{Uu1pHzdr1B=*plj%zY|Ocb1BeH5Q*qy!mNmsUsVc zEN$e8!R>~s*}O&hNMMJCTs@Az!w>Ef@8$2idSN-vYg3^nIkvT5ZsC$(i}yW?-fqBzl6r9d{w+FX76PGMg(=8s59-Um zm!dPvDlJ<7SAzv^m@(t~j1nWSDC6Ma4mW4bCH0ta$_FbKy)0$?I9AMKipgix(R;Q zSCJAV^CSBYg%9;E*%Qy*tuMPSHs}Q8pV9mM2_g*r@*{$!y_K)L@s}w{=Yf?1c?8_l zyF7xPS7gOLW-Q0U1AyMZX9kR9SbM>PvblrF1h%%sbwUh@FucIJZWrVC()Y*?rn?t^ z60qXZ4`1#ZsY+WNoxKS$F*K$xDO%U0!~q`3(&hvTHZuQUJ3Y!fsk*7#tnrGxrg>;^as zy>F+3v=8*$uezn(m?~3x{5^m5+tR}U?Stf8Wy=1RmW)D?wZoe1B0E#zuk;mz(tIq)v zcx_01OUj0NLMt>DKKO8yHHxx8q{b9|xZuLXA-@hE{APQJu^;{`tJcxTi# zoXd4BELRiJFQ&R5t)Lx%nNtz4m*Jy4q`dQlb_*BpetDZ<%ZVs3K_KvxaW3X2U^QE8 zJs`Vq`A?Xz*0rFu2R2r9+JmLO{)Yp_Hyf#^Rs6^-@)(i_8bP%4sCGww^g9x%@*f6D z?Mb_xkYT!}3o9lrfEE;LHZVZd5Bq}Q>OX48bp#?U@>vgre~6eO`{|9SSr~oeD@yISJFL1{Lz2l9?+9J)X);{!TA96k0o<+}g5W zol!mA>fXf#{$e_Hb z@G}1ECONkI`g`sBEkOoR<7sUnCpVPR~ zZ)(W(yX5k)FG-v6GIJ>Mf)wHV5ZeDm8&`^3+1}UAFEroaltR)SIfQp?V=Iban zFB^+_4#1|R<(C%*-tPSeqN2yX=|Qkt?;=A8d)kC*yak{2cEj(+`9AxEL7v`!{e~pd zHd|4^1W>XZ7{cD(1a|u6!tEV68FcvkabWKE?>Jwk>0O{ zr(in`(7e&u1c1w-u+9DhhXQZ)is%{-z1L;$2VOpND?5kBUQ~`{CHr%~y;81(=fnpx zpz#lQoL>@=rS7@DnXD8>+`Kkw5bwGFwEY$Qa|K&mekL0gjtz(8J3arj&Z*7wasYY{ zdy->I>wVMZ%;$`GgWDUCwNh}z@V@z~nfIG@-!zsXS;m+4kA zv7Bmc2E~03FM_0lZ4cUqJp@iW#{CaZS8g}X%BZ=wJ!~q-Fxq`Z%~nJRKvQ#ufHjo6 zN2!=q=G6d`+~y}-yH1HgRUEmvv_yEd-HWv^A6~pp_Bi|)C_t)SnM!EY*3vdR8+o>u z_2(MZCmjn?Z>>oQcwxj`peVO_1FN7~?MPT|!s(Z)1l9) z>iF+Rsh!Dp(ChmKLjK8^noLuDeJmFxOaD6D!F3r~`lT4M$AiHpKWVL)1iM%GzRb7Gq=mt?KDsw`-)sG zk6a@DQ}=07MzivB=&=bK_3r7x89Lg)d`|jr zM_4YElvAWIp4{7t@U^;%G_?663P?vWEg8(_u!**M<)V0cujWUzPOp~3C1 zQm#ZCo0GNnSgyNik12V4ZN*P9NU~jymgLt_CQXu|bk54flJhFz6a-ipv)7f#C{gX>^HY> zxH~umX6MRA(5YBIA6q)tIbx2p!OuL$d;ZByysJ9g3!;~i(~^4B zH75Jn)8px?uJ3H*eP)+uJNH6bQ7+!Tr0K`J+>D4sI?pW%*MHhl?a(=B`tRW2*}2?6 zj7(dT5Yyl0SK0nNkn1MZKHjbvPv1Z?{Ae*U)lrd7agiwhXzjc#8uUV1=1@eJ-;+aW zB40J&Z-cv)%F5AGnWcuwaF28Nqwp9W&6D&WLDH*1r-gY4NcG6V6AbjgxwXaLpYUbHrQ4!wMoWfn*46C^ykAFxur zgJ?5d{O+;cSlli=yt!f<4h)EAf|ro1Lu0)zg}TUM>Sg3O)HmZn9_y&`X#Yr&NblhW zQcF`E>2})0SJWxNZ5wCsY{EYZA3|^bat{qd6UoW4o>Wz7avysv{ThEW38`*b&qI#Y zLC3e=(`d`+`LzAi_t*qSG!gk$F;3FK;2(59D^22U7kDet69)g(*@nqN=8ik{9 zxsyD$oW1`-#AhldrTEjU+0(g*Uo;%oT`ao}soTXyf4C9bb~gQds1@d&-D6kTI2&#t z<}*$BdSwG&Tvn-!Z9m|#SVYxJ#aXG#oxR}6M1@HR_ht~Hm@#=xN$XEiQPS!CO<=Jm zO5djZvvJrUx`|L2e3qWpB!0motw2jsV|k+9=z8=EDx&eJKCrW6H=~PO{N+_Y4kX*g zd@U{MXaPF)=7x!#6HwGQ*nz^4*vpWKSyHEVFwjSRKw9 zenaZJDqXIy%&Nq1nh!4?!>(q@*}P!SbK9kutJtfDqQs(ch$PeKJYQ?nUb@+FZ%$}k za!#@9+L;eZ0wW!Tg47}z5$6`_C%pL=&7Qi+-uej3>NtE7qBnwuIUk;c!jB>&j0y{bSh($S z`5t_m6#c?vZb!@L@B5rDnolJ}scfgQozHPs0{$K5CfE()fKBLj@I;rXS+MYB&sV{5 zsYA?{91op+8CN;iJ*Y{(|+YhXV~7wNpJooYu7;nST;SQ{lp{>b5+q$(uc{o{bQOt z_Mwob9>jE3PUB})g&Pyu=L(RAHtYXJVQ5D=h>^XY%7$I_cN34z3O?wZZUV%UMrq>WSu1Z$lF)VTc8zgzXlbKtPdE5R>L|fdXTF%^jHoe;lQ0} zJ#Q>7>+=$vO)S44f<-7A=Z0Fs?S-N%DvxathC;}iR^gu-7R}U;^erG-Td}D1H(!PS zIX{C4#sOvAcm7t_UsxR&=}x+bePP3IHaIcx`vU~1ho3PIR~Opa;jQ(JJ!l+^C)L_~ zPioNMFskE8i_8EYP4=<`U zX%6^MukaFr*Uq~br4LjDZgp^_2O>TpRciBWcC1T{3X(nijQO?mpY~*d=fWoG)@BwE zCI>|o>J~F`Sv!yKw_ZEX_#BGCNXfA$zN@GN8sXZRW^4xbnXp5|-Q`KTXBilM1D}sk zVoyADM7m_hOK2FfUVq)0ZOquHHMk7r4`1UVI7&;bM?=>?K(>fA-0}x0s+NTbLzuezXw9RuXNJCw+=iL56XkJFzqjt|n_HiKvKxM*<`}3&O%ZOy zN>LV;Ns+aj@V>kJiP1Tu1!Qkz^bsV})f|<~)jEAbx%J$q$lAi?&Se%Sq&SCl3zF&h zVz85|RaOiSF`rXv;B{pz4$&IbVDH{Y3;cAj&@ikA-{T|B6Pf<95ZFAoUaa?(gXneX zcYN{gjlcW6SH)Ra9YqgD&Phb9%~1<=m=hBJJTZ`4w5BZwk$Rz_(wUQ=Kofn_yx#+; z0xKP(#Jy4wRqzt$MW`1~`>dVd9Nxz1julYHhQt+ixT;+0l0sl7M*L|QY2icu|M!=% b*>$7DOZ