rucio-servers.yaml

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: servers-vre
  namespace: rucio-vre
  annotations:
    flux.weave.works/automated: "false" 
 
spec:
  releaseName: servers-vre
  interval: 5m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
        name: rucio-charts
        namespace: rucio-vre
      interval: 1m
      chart: rucio-server
      version: 1.30.0

  valuesFrom:
    - kind: Secret
      name: rucio-db
      valuesKey: dbconnectstring

  values:

    replicaCount: 2
    authReplicaCount: 2

    useSSL:
      server: true
      authServer: true 

    image:
      repository: rucio/rucio-server
      tag: release-1.30.0
      pullPolicy: Always

  # The API server listens on port 6443 (by default). 
  # Therefore, expose the API server on port 443 and listen to 6443. 

    service:
      type: ClusterIP
      port: 80
      targetPort: 80
      protocol: TCP
      name: http
      annotations: {}

    authService:
      type: ClusterIP
      port: 443
      targetPort: 443
      protocol: TCP
      name: https
      annotations: {}

    serverType:
      server: flask
      authServer: flask

    ingress:
      enabled: true
      path: /
      annotations:
        kubernetes.io/ingress.class: nginx
        nginx.ingress.kubernetes.io/frontend-entry-points: http, https
        nginx.ingress.kubernetes.io/ssl-redirect: "false"
      hosts:
        - "vre-rucio.cern.ch"
      tls:
        - secretName: vre-rucio-server.tls-secret

    authIngress:
      enabled: true
      annotations:
        kubernetes.io/ingress.class: nginx
        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
        nginx.ingress.kubernetes.io/ssl-redirect: "true"
      hosts:
        - "vre-rucio-auth.cern.ch"
      path: /

    monitoring:
      enabled: true

    automaticRestart:
      enabled: 1
      image:
        repository: bitnami/kubectl
        tag: latest
        pullPolicy: IfNotPresent
      schedule: "17 1 * * *"
      selectorLabel: "'app in (rucio-server,rucio-server-trace,rucio-server-auth)'"
      resources:
        limits:
        cpu: 500m
        memory: 256Mi
        requests:
        cpu: 100m
        memory: 128Mi

    additionalSecrets:
      - volumeName: rucio-db
        secretName: rucio-db
        mountPath: /opt/rucio/etc/rucio-db
        subPath: rucio-db
      - volumeName: idpsecrets
        secretName: idpsecrets
        mountPath: /opt/rucio/etc/idpsecrets.json
        subPath: idpsecrets.json
      - volumeName: rse-accounts
        secretName: rse-accounts
        mountPath: /opt/rucio/etc/rse-accounts.json
        subPath: rse-accounts.json
  
    wsgi:
      daemonProcesses: "4"
      daemonThreads: "4"

    httpd_config:
      mpm_mode: "event"
      timeout: "300"
      enable_status: "True"
      legacy_dn: "True"
      keep_alive: "On"
      keep_alive_timeout: "5"
      max_keep_alive_requests: "128"
      server_limit: "10"
      start_servers: "4"
      thread_limit: "128"
      threads_per_child: "128"
      min_spare_threads: "256"
      max_spare_threads: "512"
      max_request_workers: "1280"
      max_connections_per_child: "2048"

    ## values used to configure Rucio
    config:

      database:
        pool_size: 10
        max_overflow: 20
      
      oidc:
        idpsecrets: "/opt/rucio/etc/idpsecrets.json"
        admin_issuer: "escape"
        expected_audience: "rucio"
        expected_scope: "openid profile"

      policy:
        permission: "escape"
        schema: "escape"
      
    serverResources: 
      limits:
        cpu: "4000m"
        memory: "4000Mi"
      requests:
        cpu: "2000m"
        memory: "2000Mi"

    authServerResources:
      limits:
          cpu: "4000m"
          memory: "4000Mi"
      requests:
        cpu: "2000m"
        memory: "2000Mi"