Skip to content

Commit fc3b3a2

Browse files
madmecodesdariofaccin
madmecodes
authored and
dariofaccin
committed
feat: Add ambient mode support to profile-controller
Signed-off-by: madmecodes <ayushguptadev1@gmail.com> Signed-off-by: Kimonas Sotirchos <kimonas.sotirchos@canonical.com>
1 parent 3ac737d commit fc3b3a2

22 files changed

Lines changed: 795 additions & 70 deletions

File tree

‎components/profile-controller/Dockerfile‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
1-
ARG GOLANG_VERSION=1.22
2-
FROM --platform=${BUILDPLATFORM} golang:${GOLANG_VERSION} AS builder
3-
ARG TARGETOS
4-
ARG TARGETARCH
1+
# Build the manager binary
2+
FROM golang:1.23 as builder
53

64
WORKDIR /workspace
75

@@ -50,7 +48,6 @@ FROM gcr.io/distroless/static:nonroot
5048
WORKDIR /
5149
COPY third_party third_party
5250
COPY --from=builder /workspace/manager .
53-
COPY --from=builder /go/pkg/mod/github.com/hashicorp third_party/library/
5451

5552
USER 65532:65532
5653

‎components/profile-controller/config/components/kfam/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
## KFAM Component
2+
3+
This kustomize component is aimed to provide the configuration for enabling KFAM in the Profile Controller.
4+
5+
Since the Profile Controller is expected to be deployed either standalone or alongside Kubeflow, we'll need to
6+
be able to include this functionality only in specific cases.
7+
8+
Also, since now we have more than one flavour of the Kubeflow integration (Istio sidecar vs ambient) we need
9+
to include this common functionality to both overlays.

‎components/profile-controller/config/components/kfam/authorizationpolicy.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: security.istio.io/v1beta1
2+
kind: AuthorizationPolicy
3+
metadata:
4+
name: profiles-kfam
5+
spec:
6+
action: ALLOW
7+
selector:
8+
matchLabels:
9+
app.kubernetes.io/component: controller-manager
10+
app.kubernetes.io/name: profile-controller
11+
app.kubernetes.io/part-of: kubeflow-dashboard
12+
app.kubernetes.io/managed-by: kustomize
13+
rules:
14+
- from:
15+
- source:
16+
principals:
17+
- cluster.local/ns/kubeflow/sa/dashboard

‎components/profile-controller/config/components/kfam/kustomization.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: kustomize.config.k8s.io/v1alpha1
2+
kind: Component
3+
4+
resources:
5+
- service.yaml
6+
- authorizationpolicy.yaml
7+
8+
patchesStrategicMerge:
9+
- patches/kfam.yaml
10+
11+
images:
12+
- name: ghcr.io/kubeflow/dashboard/access-management
13+
newName: ghcr.io/kubeflow/dashboard/access-management
14+
newTag: latest

‎components/profile-controller/config/components/kfam/patches/kfam.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: deployment
5+
spec:
6+
template:
7+
metadata:
8+
labels:
9+
sidecar.istio.io/inject: "true"
10+
spec:
11+
securityContext:
12+
seccompProfile:
13+
type: RuntimeDefault
14+
containers:
15+
- command:
16+
- /access-management
17+
- "-cluster-admin"
18+
- $(ADMIN)
19+
- "-userid-header"
20+
- $(USERID_HEADER)
21+
- "-userid-prefix"
22+
- $(USERID_PREFIX)
23+
envFrom:
24+
- configMapRef:
25+
name: config
26+
image: ghcr.io/kubeflow/dashboard/access-management
27+
imagePullPolicy: IfNotPresent
28+
name: access-management
29+
livenessProbe:
30+
httpGet:
31+
path: /metrics
32+
port: 8081
33+
initialDelaySeconds: 30
34+
periodSeconds: 30
35+
ports:
36+
- containerPort: 8081
37+
name: kfam-http
38+
protocol: TCP
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
runAsNonRoot: true
42+
capabilities:
43+
drop:
44+
- ALL
45+
serviceAccountName: controller-service-account

‎components/profile-controller/config/components/kfam/service.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: profiles-kfam
5+
spec:
6+
ports:
7+
- port: 8081

‎components/profile-controller/config/components/remove-system-namespace/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Remove System Namespace Component
2+
3+
This component is aimed to be consumed by the overlays targetted for the Kubeflow installation.
4+
5+
In this case, the manifests will need to install everything in the `kubeflow` namespace and not create
6+
the `profile-controller-system` namespace. Thus the two kubeflow overlays (Istio sidecar and ambient)
7+
will need to both include this common component.

‎components/profile-controller/config/components/remove-system-namespace/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kustomize.config.k8s.io/v1alpha1
2+
kind: Component
3+
4+
patchesStrategicMerge:
5+
- patches/remove-namespace.yaml

‎components/profile-controller/config/components/remove-system-namespace/patches/remove-namespace.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
$patch: delete
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
<<<<<<<< HEAD:components/profile-controller/manifests/kustomize/overlays/kubeflow/patches/remove-namespace.yaml
6+
name: profiles-system
7+
========
8+
name: system
9+
>>>>>>>> 9024371 (feat: Add ambient mode support to profile-controller):components/profile-controller/config/components/remove-system-namespace/patches/remove-namespace.yaml

‎components/profile-controller/config/manager/kustomization.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
resources:
2+
- manager.yaml
3+
- service-account.yaml
4+
5+
configMapGenerator:
6+
- literals:
7+
- ADMIN=
8+
- WORKLOAD_IDENTITY=
9+
- USERID_HEADER="kubeflow-userid"
10+
- USERID_PREFIX=
11+
- ISTIO_INGRESS_GATEWAY_PRINCIPAL="cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"
12+
- NOTEBOOK_CONTROLLER_PRINCIPAL="cluster.local/ns/kubeflow/sa/notebook-controller-service-account"
13+
- KFP_UI_PRINCIPAL="cluster.local/ns/kubeflow/sa/ml-pipeline-ui"
14+
- SERVICE_MESH_MODE="istio-sidecar"
15+
- WAYPOINT_NAME="waypoint"
16+
- WAYPOINT_NAMESPACE=""
17+
- CREATE_WAYPOINT="false"
18+
name: config

0 commit comments

Comments
 (0)