update tensorboards

Signed-off-by: David van der Spek <[email protected]>
pluralsh · Sep 15, 2023 · 90d8690 · 90d8690
1 parent 9e7f324
commit 90d8690
Show file tree

Hide file tree

Showing 14 changed files with 135 additions and 108 deletions.
diff --git a/kubeflow/helm/notebooks/Chart.yaml b/kubeflow/helm/notebooks/Chart.yaml
@@ -3,4 +3,4 @@ name: notebooks
 description: A Helm chart for Kubernetes
 type: application
 version: 0.1.27
-appVersion: "1.5.0"
+appVersion: "v1.8.0-rc.0"
diff --git a/kubeflow/helm/notebooks/templates/controller/deployment.yaml b/kubeflow/helm/notebooks/templates/controller/deployment.yaml
@@ -39,16 +39,19 @@ spec:
             - name: metrics
               containerPort: 8080
               protocol: TCP
+            - name: probe
+              containerPort: 8081
+              protocol: TCP
           livenessProbe:
             httpGet:
-              path: /metrics
-              port: metrics
+              path: /healthz
+              port: probe
             initialDelaySeconds: 30
             periodSeconds: 30
           readinessProbe:
             httpGet:
-              path: /metrics
-              port: metrics
+              path: /readyz
+              port: probe
           resources:
             {{- toYaml .Values.controller.resources | nindent 12 }}
           envFrom:

diff --git a/kubeflow/helm/tensorboards/Chart.yaml b/kubeflow/helm/tensorboards/Chart.yaml
@@ -3,4 +3,4 @@ name: tensorboards
 description: A Helm chart for Kubernetes
 type: application
 version: 0.1.11
-appVersion: "1.3.0"
+appVersion: "v1.8.0-rc.0"
diff --git a/...rds/templates/controller/clusterrole.yaml → ...ds/templates/controller/cluster-role.yaml b/...rds/templates/controller/clusterrole.yaml → ...ds/templates/controller/cluster-role.yaml
@@ -65,27 +65,14 @@ rules:
   - apiGroups:
       - tensorboard.kubeflow.org
     resources:
-      - tensorboards/status
+      - tensorboards/finalizers
     verbs:
-      - get
-      - patch
       - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels: {{- include "tensorboards.labels" . | nindent 4 }}
-  name: {{ include "tensorboards.fullname" . }}-controller-proxy-cluster-role
-rules:
-  - apiGroups:
-      - authentication.k8s.io
-    resources:
-      - tokenreviews
-    verbs:
-      - create
   - apiGroups:
-      - authorization.k8s.io
+      - tensorboard.kubeflow.org
     resources:
-      - subjectaccessreviews
+      - tensorboards/status
     verbs:
-      - create
+      - get
+      - patch
+      - update
diff --git a/kubeflow/helm/tensorboards/templates/controller/clusterrolebinding.yaml b/kubeflow/helm/tensorboards/templates/controller/clusterrolebinding.yaml
@@ -11,17 +11,3 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "tensorboards.serviceAccountName" . }}-controller
     namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels: {{- include "tensorboards.labels" . | nindent 4 }}
-  name: {{ include "tensorboards.fullname" . }}-controller-proxy-cluster-role-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "tensorboards.fullname" . }}-controller-proxy-cluster-role
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "tensorboards.serviceAccountName" . }}-controller
-    namespace: {{ .Release.Namespace }}
diff --git a/kubeflow/helm/tensorboards/templates/controller/configmap.yaml b/kubeflow/helm/tensorboards/templates/controller/configmap.yaml
@@ -1,10 +1,12 @@
 apiVersion: v1
 data:
-  {{ if eq .Values.controller.rwoScheduling.enabled false }}
+  {{ if eq .Values.controller.config.rwoScheduling.enabled false }}
   RWO_PVC_SCHEDULING: "False"
   {{ else }}
   RWO_PVC_SCHEDULING: "True"
   {{ end }}
+  ISTIO_GATEWAY: {{ .Values.controller.config.istioGateway }}
+  TENSORBOARD_IMAGE: {{ .Values.controller.config.tensorboardImage }}
 kind: ConfigMap
 metadata:
   name: {{ include "tensorboards.fullname" . }}-controller-config

diff --git a/kubeflow/helm/tensorboards/templates/controller/deployment.yaml b/kubeflow/helm/tensorboards/templates/controller/deployment.yaml
@@ -34,23 +34,23 @@ spec:
             {{- toYaml .Values.controller.securityContext | nindent 12 }}
           image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
-          args:
-            - --metrics-addr=0.0.0.0:8080
-            - --enable-leader-election
           command:
             - /manager
           ports:
             - name: metrics
               containerPort: 8080
               protocol: TCP
+            - name: probe
+              containerPort: 8081
+              protocol: TCP
           livenessProbe:
             httpGet:
-              path: /metrics
-              port: metrics
+              path: /healthz
+              port: probe
           readinessProbe:
             httpGet:
-              path: /metrics
-              port: metrics
+              path: /readyz
+              port: probe
           resources:
             {{- toYaml .Values.controller.resources | nindent 12 }}
           envFrom:

diff --git a/kubeflow/helm/tensorboards/templates/controller/role.yaml b/kubeflow/helm/tensorboards/templates/controller/role.yaml
@@ -17,16 +17,21 @@ rules:
       - patch
       - delete
   - apiGroups:
-      - ""
+      - coordination.k8s.io
     resources:
-      - configmaps/status
+      - leases
     verbs:
       - get
+      - list
+      - watch
+      - create
       - update
       - patch
+      - delete
   - apiGroups:
       - ""
     resources:
       - events
     verbs:
       - create
+      - patch
diff --git a/kubeflow/helm/tensorboards/templates/web-app/authorizationpolicy.yaml b/kubeflow/helm/tensorboards/templates/web-app/authorizationpolicy.yaml
@@ -1,8 +1,8 @@
 apiVersion: security.istio.io/v1beta1
 kind: AuthorizationPolicy
 metadata:
-  labels: {{- include "tensorboards.labels" . | nindent 4 }}
   name: {{ include "tensorboards.fullname" . }}-web-app
+  labels: {{- include "tensorboards.labels" . | nindent 4 }}
 spec:
   action: ALLOW
   rules:

diff --git a/kubeflow/helm/tensorboards/templates/web-app/cluster-role.yaml b/kubeflow/helm/tensorboards/templates/web-app/cluster-role.yaml
@@ -0,0 +1,54 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels: {{- include "tensorboards.labels" . | nindent 4 }}
+  name: {{ include "tensorboards.fullname" . }}-web-app-cluster-role
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - tensorboard.kubeflow.org
+    resources:
+      - tensorboards
+      - tensorboards/finalizers
+    verbs:
+      - get
+      - list
+      - create
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - kubeflow.org
+    resources:
+      - poddefaults
+    verbs:
+      - get
+      - list
+      - watch
diff --git a/kubeflow/helm/tensorboards/templates/web-app/configmap.yaml b/kubeflow/helm/tensorboards/templates/web-app/configmap.yaml
@@ -3,6 +3,7 @@ data:
   APP_PREFIX: {{ .Values.webApp.virtualService.prefix }}
   USERID_HEADER: {{ .Values.global.userIDHeader }}
   USERID_PREFIX: {{ .Values.global.userIDPrefix | quote }}
+  APP_SECURE_COOKIES: "true" # TODO: don't hardcode this
 kind: ConfigMap
 metadata:
   labels: {{- include "tensorboards.labels" . | nindent 4 }}

diff --git a/kubeflow/helm/tensorboards/templates/web-app/destination-rule.yaml b/kubeflow/helm/tensorboards/templates/web-app/destination-rule.yaml
@@ -0,0 +1,14 @@
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: {{ include "tensorboards.fullname" . }}-web-app
+  labels: {{- include "tensorboards.labels" . | nindent 4 }}
+  {{- with .Values.webApp.virtualService.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  host: {{ include "tensorboards.fullname" . }}-web-app.{{ .Release.Namespace }}.svc.{{ .Values.global.clusterDomain }}
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
diff --git a/...boards/templates/web-app/clusterrole.yaml → ...lates/web-app/kubeflow-cluster-roles.yaml b/...boards/templates/web-app/clusterrole.yaml → ...lates/web-app/kubeflow-cluster-roles.yaml
@@ -1,64 +1,17 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
-metadata:
-  labels: {{- include "tensorboards.labels" . | nindent 4 }}
-  name: {{ include "tensorboards.fullname" . }}-web-app-cluster-role
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - authorization.k8s.io
-    resources:
-      - subjectaccessreviews
-    verbs:
-      - create
-  - apiGroups:
-      - tensorboard.kubeflow.org
-    resources:
-      - tensorboards
-      - tensorboards/finalizers
-    verbs:
-      - get
-      - list
-      - create
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - persistentvolumeclaims
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-  - apiGroups:
-      - storage.k8s.io
-    resources:
-      - storageclasses
-    verbs:
-      - get
-      - list
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
 metadata:
   labels: {{- include "tensorboards.labels" . | nindent 4 }}
     rbac.authorization.kubeflow.org/aggregate-to-kubeflow-admin: "true"
-  name: tensorboards-web-app-kubeflow-tensorboard-ui-admin
+  name: {{ include "tensorboards.fullname" . }}-web-app-kubeflow-tensorboard-ui-admin
 rules: []
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels: {{- include "tensorboards.labels" . | nindent 4 }}
     rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
-  name: tensorboards-web-app-kubeflow-tensorboard-ui-edit
+  name: {{ include "tensorboards.fullname" . }}-web-app-kubeflow-tensorboard-ui-edit
 rules:
   - apiGroups:
       - tensorboard.kubeflow.org
@@ -70,13 +23,21 @@ rules:
       - list
       - create
       - delete
+  - apiGroups:
+      - kubeflow.org
+    resources:
+      - poddefaults
+    verbs:
+      - get
+      - list
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels: {{- include "tensorboards.labels" . | nindent 4 }}
     rbac.authorization.kubeflow.org/aggregate-to-kubeflow-view: "true"
-  name: tensorboards-web-app-kubeflow-tensorboard-ui-view
+  name: {{ include "tensorboards.fullname" . }}-web-app-kubeflow-tensorboard-ui-view
 rules:
   - apiGroups:
       - tensorboard.kubeflow.org
@@ -94,3 +55,11 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - kubeflow.org
+    resources:
+      - poddefaults
+    verbs:
+      - get
+      - list
+      - watch