Add catalog service

charts/catalog/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: catalog
+description: A Helm chart for CAVE Catalog service on Kubernetes
+version: 0.1.0
+appVersion: "0.1.0"

charts/catalog/templates/cloudsql_secret.yaml

@@ -0,0 +1,11 @@
+{{ $gs := .Values.cloudsql.googleSecret | required ".Values.cloudsql.googleSecret is required." }}
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: catalog-cloudsql-google-cloud-key
+type: Opaque
+stringData:
+  {{ $v := $gs }}
+  google-secret.json: {{ if kindIs "map" $v }}{{ $v | toJson | quote }}{{ else }}{{ $v | quote }}{{ end }}

charts/catalog/templates/configmap.yaml

@@ -0,0 +1,13 @@
+{{- $global_server := .Values.cluster.globalServer | required ".Values.cluster.globalServer is required." }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: catalog-config
+data:
+  AUTH_SERVICE_URL: "{{ .Values.cluster.globalServer }}/auth"
+  MAT_ENGINE_URL: "{{ .Values.cluster.globalServer }}/materialize"
+  CAVECLIENT_SERVER_ADDRESS: "{{ .Values.cluster.globalServer }}"
+  AUTH_ENABLED: "true"
+  DATASTACKS: {{ .Values.catalog.datastacks | toJson | quote }}
+  LOG_LEVEL: {{ .Values.catalog.logLevel | default "ERROR" | quote }}

charts/catalog/templates/db_secret.yaml

@@ -0,0 +1,9 @@
+{{- $cloudsql_pw := .Values.cloudsql.password | required ".Values.cloudsql.password is required." }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: catalog-db-secret
+type: Opaque
+stringData:
+  DATABASE_URL: "postgresql+asyncpg://{{ .Values.cloudsql.username }}:{{ .Values.cloudsql.password }}@127.0.0.1:{{ .Values.cloudsql.port | default "5432" }}/{{ .Values.cloudsql.database | default "cave_catalog" }}"

charts/catalog/templates/deployment.yaml

@@ -0,0 +1,92 @@
+{{- $global_server := .Values.cluster.globalServer | required ".Values.cluster.globalServer is required." }}
+{{- $raw := .Values.catalog.tag | default .Chart.AppVersion -}}
+{{- $tag := ternary $raw (printf "v%s" $raw) (hasPrefix "v" $raw) -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: catalog
+spec:
+  selector:
+    matchLabels:
+      app: catalog
+  template:
+    metadata:
+      labels:
+        app: catalog
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secrets: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        checksum/cloudsql: {{ include (print $.Template.BasePath "/cloudsql_secret.yaml") . | sha256sum }}
+        checksum/db-secret: {{ include (print $.Template.BasePath "/db_secret.yaml") . | sha256sum }}
+    spec:
+      tolerations:
+        - key: "pool"
+          operator: "Equal"
+          value: "{{ .Values.cluster.standardPool }}"
+          effect: "NoSchedule"
+      nodeSelector:
+        cloud.google.com/gke-nodepool: {{ .Values.cluster.standardPool }}
+      volumes:
+        - name: google-cloud-key
+          secret:
+            secretName: catalog-google-cloud-key
+        - name: cloudsql-instance-credentials-volume
+          secret:
+            secretName: catalog-cloudsql-google-cloud-key
+      containers:
+        - name: catalog
+          image: {{ .Values.cluster.dockerRegistry }}/cave-catalog:{{ $tag }}
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: google-cloud-key
+              mountPath: /home/nginx/.cloudvolume/secrets
+          envFrom:
+            - configMapRef:
+                name: catalog-config
+            - secretRef:
+                name: catalog-db-secret
+          env:
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /home/nginx/.cloudvolume/secrets/google-secret.json
+            - name: DAF_CREDENTIALS
+              value: /home/nginx/.cloudvolume/secrets/cave-secret.json
+          resources:
+            requests:
+              memory: {{ .Values.catalog.resources.requests.memory | default "256Mi" }}
+              cpu: {{ .Values.catalog.resources.requests.cpu | default "100m" }}
+          readinessProbe:
+            httpGet:
+              path: /catalog/health
+              port: 80
+            initialDelaySeconds: 5
+            timeoutSeconds: 1
+            periodSeconds: 60
+          livenessProbe:
+            httpGet:
+              path: /catalog/health
+              port: 80
+            initialDelaySeconds: 15
+            timeoutSeconds: 1
+            periodSeconds: 60
+        - name: cloudsql-proxy
+          image: gcr.io/cloudsql-docker/gce-proxy:1.33.6
+          command:
+            [
+              "/cloud_sql_proxy",
+              "-instances={{ .Values.cluster.googleProject}}:{{ .Values.cluster.googleRegion}}:{{ .Values.cloudsql.sqlInstanceName}}=tcp:{{ .Values.cloudsql.port | default "5432" }}",
+              "-credential_file=/secrets/cloudsql/google-secret.json",
+            ]
+          resources:
+            requests:
+              memory: 8Mi
+              cpu: 10m
+          securityContext:
+            runAsUser: 2
+            allowPrivilegeEscalation: false
+          volumeMounts:
+            - name: cloudsql-instance-credentials-volume
+              mountPath: /secrets/cloudsql
+              readOnly: true

charts/catalog/templates/hpa.yaml

@@ -0,0 +1,18 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: catalog-scaler
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: catalog
+  minReplicas: {{ .Values.catalog.minReplicas | default 1 }}
+  maxReplicas: {{ .Values.catalog.maxReplicas | default 3 }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 75

charts/catalog/templates/ingress.yaml

@@ -0,0 +1,28 @@
+{{- $domain := .Values.cluster.domainName | required ".Values.cluster.domainName is required." -}}
+{{- $prefix := .Values.cluster.cluster_prefix | required ".Values.cluster.cluster_prefix is required." -}}
+{{- $defaultHost := printf "%s.%s" $prefix $domain -}}
+{{- $dnsEntries := .Values.cluster.dns_entries | default (list) -}}
+{{- $raw := append (default (list) $dnsEntries) $defaultHost -}}
+{{- $hosts := uniq $raw -}}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: catalog-ingress
+  annotations:
+    kubernetes.io/ingress.class: nginx
+spec:
+  ingressClassName: nginx
+  rules:
+  {{- range $hosts }}
+  - host: {{ . }}
+    http:
+      paths:
+      - path: /catalog
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: catalog-service
+            port:
+              number: 80
+  {{- end }}

charts/catalog/templates/secret.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: catalog-google-cloud-key
+type: Opaque
+{{ $list := .Values.catalog.secretFiles | default (list) }}
+{{ if not (empty $list) }}
+stringData:
+  {{ range $list }}
+    {{ $v := .value }}
+    {{ .name }}: {{ if kindIs "map" $v }}{{ $v | toJson | quote }}{{ else }}{{ $v | quote }}{{ end }}
+  {{ end }}
+{{ else }}
+stringData: {}
+{{ end }}

charts/catalog/templates/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: catalog-service
+spec:
+  type: NodePort
+  selector:
+    app: catalog
+  ports:
+    - port: 80
+      targetPort: 80

charts/catalog/values.yaml

@@ -0,0 +1,37 @@
+catalog:
+  # image tag; if empty defaults to Chart.appVersion
+  tag: ""
+  datastacks:
+    - ""
+  secretFiles:
+    - name: google-secret.json
+      value: ""
+    - name: cave-secret.json
+      value: ""
+  logLevel: "ERROR"
+  resources:
+    requests:
+      memory: "256Mi"
+      cpu: "100m"
+  minReplicas: 1
+  maxReplicas: 3
+
+cloudsql:
+  sqlInstanceName: ""
+  googleSecret: ""
+  username: "postgres"
+  password: ""
+  database: "cave_catalog"
+  port: "5432"
+
+cluster:
+  globalServer: ""
+  environment: ""
+  domainName: ""
+  cluster_prefix: ""
+  dns_entries: []
+  googleProject: ""
+  googleRegion: "us-east1"
+  googleZone: "us-east1-b"
+  standardPool: "standard-pool"
+  dockerRegistry: "docker.io/caveconnectome"