k8s-manifests/jupyter/base/charts/jupyterhub/templates/image-puller/_helpers-daemonset.tpl

280 lines
11 KiB
Smarty
Raw Normal View History

{{- /*
Returns an image-puller daemonset. Two daemonsets will be created like this.
- hook-image-puller: for pre helm upgrade image pulling (lives temporarily)
- continuous-image-puller: for newly added nodes image pulling
*/}}
{{- define "jupyterhub.imagePuller.daemonset" -}}
apiVersion: apps/v1
kind: DaemonSet
metadata:
{{- if .hook }}
name: {{ include "jupyterhub.hook-image-puller.fullname" . }}
{{- else }}
name: {{ include "jupyterhub.continuous-image-puller.fullname" . }}
{{- end }}
labels:
{{- include "jupyterhub.labels" . | nindent 4 }}
{{- if .hook }}
hub.jupyter.org/deletable: "true"
{{- end }}
{{- if .hook }}
annotations:
{{- /*
Allows the daemonset to be deleted when the image-awaiter job is completed.
*/}}
"helm.sh/hook": pre-install,pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
"helm.sh/hook-weight": "-10"
{{- end }}
spec:
selector:
matchLabels:
{{- include "jupyterhub.matchLabels" . | nindent 6 }}
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 100%
{{- if typeIs "int" .Values.prePuller.revisionHistoryLimit }}
revisionHistoryLimit: {{ .Values.prePuller.revisionHistoryLimit }}
{{- end }}
template:
metadata:
labels:
{{- include "jupyterhub.matchLabels" . | nindent 8 }}
{{- with .Values.prePuller.annotations }}
annotations:
{{- . | toYaml | nindent 8 }}
{{- end }}
spec:
{{- /*
image-puller pods are made evictable to save on the k8s pods
per node limit all k8s clusters have and have a higher priority
than user-placeholder pods that could block an entire node.
*/}}
{{- if .Values.scheduling.podPriority.enabled }}
priorityClassName: {{ include "jupyterhub.image-puller-priority.fullname" . }}
{{- end }}
{{- with .Values.singleuser.nodeSelector }}
nodeSelector:
{{- . | toYaml | nindent 8 }}
{{- end }}
{{- with concat .Values.scheduling.userPods.tolerations .Values.singleuser.extraTolerations .Values.prePuller.extraTolerations }}
tolerations:
{{- . | toYaml | nindent 8 }}
{{- end }}
{{- if include "jupyterhub.userNodeAffinityRequired" . }}
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
{{- include "jupyterhub.userNodeAffinityRequired" . | nindent 14 }}
{{- end }}
terminationGracePeriodSeconds: 0
automountServiceAccountToken: false
{{- with include "jupyterhub.imagePullSecrets" (dict "root" . "image" .Values.singleuser.image) }}
imagePullSecrets: {{ . }}
{{- end }}
initContainers:
{{- /* --- Conditionally pull an image all user pods will use in an initContainer --- */}}
{{- $blockWithIptables := hasKey .Values.singleuser.cloudMetadata "enabled" | ternary (not .Values.singleuser.cloudMetadata.enabled) .Values.singleuser.cloudMetadata.blockWithIptables }}
{{- if $blockWithIptables }}
- name: image-pull-metadata-block
image: {{ .Values.singleuser.networkTools.image.name }}:{{ .Values.singleuser.networkTools.image.tag }}
{{- with .Values.singleuser.networkTools.image.pullPolicy }}
imagePullPolicy: {{ . }}
{{- end }}
command:
- /bin/sh
- -c
- echo "Pulling complete"
{{- with .Values.prePuller.resources }}
resources:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- with .Values.prePuller.containerSecurityContext }}
securityContext:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- end }}
{{- /* --- Pull default image --- */}}
- name: image-pull-singleuser
image: {{ .Values.singleuser.image.name }}:{{ .Values.singleuser.image.tag }}
command:
- /bin/sh
- -c
- echo "Pulling complete"
{{- with .Values.prePuller.resources }}
resources:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- with .Values.prePuller.containerSecurityContext }}
securityContext:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- /* --- Pull extra containers' images --- */}}
{{- range $k, $container := concat .Values.singleuser.initContainers .Values.singleuser.extraContainers }}
- name: image-pull-singleuser-init-and-extra-containers-{{ $k }}
image: {{ $container.image }}
command:
- /bin/sh
- -c
- echo "Pulling complete"
{{- with $.Values.prePuller.resources }}
resources:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- with $.Values.prePuller.containerSecurityContext }}
securityContext:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- end }}
{{- /* --- Conditionally pull profileList images --- */}}
{{- if .Values.prePuller.pullProfileListImages }}
{{- range $k, $container := .Values.singleuser.profileList }}
{{- /* profile's kubespawner_override */}}
{{- if $container.kubespawner_override }}
{{- if $container.kubespawner_override.image }}
- name: image-pull-singleuser-profilelist-{{ $k }}
image: {{ $container.kubespawner_override.image }}
command:
- /bin/sh
- -c
- echo "Pulling complete"
{{- with $.Values.prePuller.resources }}
resources:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- with $.Values.prePuller.containerSecurityContext }}
securityContext:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- end }}
{{- end }}
{{- /* kubespawner_override in profile's profile_options */}}
{{- if $container.profile_options }}
{{- range $option, $option_spec := $container.profile_options }}
{{- if $option_spec.choices }}
{{- range $choice, $choice_spec := $option_spec.choices }}
{{- if $choice_spec.kubespawner_override }}
{{- if $choice_spec.kubespawner_override.image }}
- name: image-pull-profile-{{ $k }}-option-{{ $option }}-{{ $choice }}
image: {{ $choice_spec.kubespawner_override.image }}
command:
- /bin/sh
- -c
- echo "Pulling complete"
{{- with $.Values.prePuller.resources }}
resources:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- with $.Values.prePuller.containerSecurityContext }}
securityContext:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- /* --- Pull extra images --- */}}
{{- range $k, $v := .Values.prePuller.extraImages }}
- name: image-pull-{{ $k }}
image: {{ $v.name }}:{{ $v.tag }}
command:
- /bin/sh
- -c
- echo "Pulling complete"
{{- with $.Values.prePuller.resources }}
resources:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- with $.Values.prePuller.containerSecurityContext }}
securityContext:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- end }}
containers:
- name: pause
image: {{ .Values.prePuller.pause.image.name }}:{{ .Values.prePuller.pause.image.tag }}
{{- with .Values.prePuller.resources }}
resources:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- with .Values.prePuller.pause.containerSecurityContext }}
securityContext:
{{- . | toYaml | nindent 12 }}
{{- end }}
{{- end }}
{{- /*
Returns a rendered k8s DaemonSet resource: continuous-image-puller
*/}}
{{- define "jupyterhub.imagePuller.daemonset.continuous" -}}
{{- $_ := merge (dict "hook" false "componentPrefix" "continuous-") . }}
{{- include "jupyterhub.imagePuller.daemonset" $_ }}
{{- end }}
{{- /*
Returns a rendered k8s DaemonSet resource: hook-image-puller
*/}}
{{- define "jupyterhub.imagePuller.daemonset.hook" -}}
{{- $_ := merge (dict "hook" true "componentPrefix" "hook-") . }}
{{- include "jupyterhub.imagePuller.daemonset" $_ }}
{{- end }}
{{- /*
Returns a checksum of the rendered k8s DaemonSet resource: hook-image-puller
This checksum is used when prePuller.hook.pullOnlyOnChanges=true to decide if
it is worth creating the hook-image-puller associated resources.
*/}}
{{- define "jupyterhub.imagePuller.daemonset.hook.checksum" -}}
{{- /*
We pin componentLabel and Chart.Version as doing so can pin labels
of no importance if they would change. Chart.Name is also pinned as
a harmless technical workaround when we compute the checksum.
*/}}
{{- $_ := merge (dict "componentLabel" "pinned" "Chart" (dict "Name" "jupyterhub" "Version" "pinned")) . -}}
{{- $yaml := include "jupyterhub.imagePuller.daemonset.hook" $_ }}
{{- $yaml | sha256sum }}
{{- end }}
{{- /*
Returns a truthy string or a blank string depending on if the
hook-image-puller should be installed. The truthy strings are comments
that summarize the state that led to returning a truthy string.
- prePuller.hook.enabled must be true
- if prePuller.hook.pullOnlyOnChanges is true, the checksum of the
hook-image-puller daemonset must differ since last upgrade
*/}}
{{- define "jupyterhub.imagePuller.daemonset.hook.install" -}}
{{- if .Values.prePuller.hook.enabled }}
{{- if .Values.prePuller.hook.pullOnlyOnChanges }}
{{- $new_checksum := include "jupyterhub.imagePuller.daemonset.hook.checksum" . }}
{{- $k8s_state := lookup "v1" "ConfigMap" .Release.Namespace (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
{{- $old_checksum := index $k8s_state.data "checksum_hook-image-puller" | default "" }}
{{- if ne $new_checksum $old_checksum -}}
# prePuller.hook.enabled={{ .Values.prePuller.hook.enabled }}
# prePuller.hook.pullOnlyOnChanges={{ .Values.prePuller.hook.pullOnlyOnChanges }}
# post-upgrade checksum != pre-upgrade checksum (of the hook-image-puller DaemonSet)
# "{{ $new_checksum }}" != "{{ $old_checksum}}"
{{- end }}
{{- else -}}
# prePuller.hook.enabled={{ .Values.prePuller.hook.enabled }}
# prePuller.hook.pullOnlyOnChanges={{ .Values.prePuller.hook.pullOnlyOnChanges }}
{{- end }}
{{- end }}
{{- end }}