wip

charts/operator-wandb/charts/weave-trace/templates/dangerzone_secret.yaml

@@ -0,0 +1,13 @@
+{{- $secretName := printf "%s-secrets" (include "weaveTrace.name" .) }}
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "weaveTrace.name" . }}-dangerzone-secrets
+type: Opaque
+data:
+  WEAVE_TRACE_GORILLA_JWT_SECRET: {{ if $existingSecret }}
+    {{ $existingSecret.data.WEAVE_TRACE_GORILLA_JWT_SECRET }}
+  {{ else }}
+    {{ randAlphaNum 32 | b64enc }}
+  {{ end }}

charts/operator-wandb/charts/weave-trace/templates/deployment.yaml

@@ -44,6 +44,7 @@ spec:
       initContainers:
         - name: {{ include "weaveTraceMigrate.fullname" . }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           command:
             - "python"
             - "migrator.py"
@@ -67,6 +68,10 @@ spec:
       containers:
         - name: {{ include "weaveTrace.fullname" .  }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - name: weave-trace-dangerzone-secrets
+              mountPath: /tmp/weave-trace/dangerzone
           ports:
             - name: http
               containerPort: 8080
@@ -79,7 +84,7 @@ spec:
             - name: WANDB_PUBLIC_BASE_URL
               value: {{ .Values.global.host }}
             - name: WANDB_BASE_URL
-              value: http://{{ .Release.Name }}-app:8080/
+              value: http://{{ .Release.Name }}:8080/
             - name: WF_TRACE_SERVER_URL
               value: "{{ .Values.global.host }}/traces"
             - name: WF_ENFORCE_PASSWORD_LENGTH
@@ -128,9 +133,18 @@ spec:
             failureThreshold: 12
             periodSeconds: 10
 
+
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       serviceAccountName: {{ include "weaveTrace.serviceAccountName" . }}
+      volumes:
+        - name: weave-trace-dangerzone-secrets
+          projected:
+            sources:
+              - serviceAccountToken:
+                  audience: dangerzone
+                  path: token
+                  expirationSeconds: 600
 ---
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler

charts/operator-wandb/charts/weave-trace/templates/rbac.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "weaveTrace.serviceAccountName" . }}-svc-act-role
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: ["", "apps", "batch"]
+    resources: ["pods", "services", "secrets"]
+    verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "weaveTrace.serviceAccountName" . }}-svc-act-role-binding
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "weaveTrace.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "weaveTrace.serviceAccountName" . }}-svc-act-role
+  apiGroup: rbac.authorization.k8s.io

charts/wandb/templates/deployment.yaml

@@ -151,6 +151,10 @@ spec:
             - name: LOCAL_LDAP_GROUP_ALLOW_LIST
               value: {{ .Values.ldap.groupAllowList }}
             {{- end }}
+            {{- if .Values.weaveTrace.enabled }}
+            - name: WEAVE_TRACES_ENABLED
+              value: "true"
+            {{- end }}
             {{- if .Values.extraEnv }}
             {{- toYaml .Values.extraEnv | nindent 12 }}
             {{- end }}
@@ -233,21 +237,3 @@ spec:
               - key: {{ .Values.ldap.tlsCert.configMap.key }}
                 path: ca.crt
       {{- end }}
----
-{{- if and (not .Values.bucket) .Values.existingClaim }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: {{ include "wandb.volumeClaim" . }}
-  annotations:
-    "helm.sh/resource-policy": keep
-  labels:
-    {{- include "wandb.labels" . | nindent 4 }}
-    app.kubernetes.io/component: local
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 64Gi
-{{- end }}

charts/wandb/templates/ingress.yaml

@@ -45,21 +45,23 @@ spec:
     - host: {{ .host | quote }}
       http:
         paths:
+          {{- if index $.Values "weaveTrace" "enabled" }}
+          - pathType: Prefix
+            path: /traces
+            backend:
+              service:
+                name: {{ $.Release.Name }}-weave-trace
+                port:
+                  number: 8722
+          {{- end }}
           {{- range .paths }}
           - path: {{ .path }}
-            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
             pathType: {{ .pathType }}
-            {{- end }}
             backend:
-              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
               service:
                 name: {{ $fullName }}
                 port:
                   number: {{ $svcPort }}
-              {{- else }}
-              serviceName: {{ $fullName }}
-              servicePort: {{ $svcPort }}
-              {{- end }}
           {{- end }}
     {{- end }}
 {{- end }}

charts/wandb/values.yaml

@@ -128,6 +128,8 @@ nodeSelector: {}
 tolerations: []
 
 affinity: {}
+weaveTrace:
+  enabled: false 
 
 mysql:
   # Set this to false if you want to bring your own mysql