Skip to content

Commit 5811c9b

Browse files
funkypenguinfunkypenguin
committed
first cut at runpod credentials
Signed-off-by: David Young <[email protected]>
1 parent c960d9b commit 5811c9b

File tree

7 files changed

+287
-51
lines changed

7 files changed

+287
-51
lines changed

‎charts/stable/skypilot/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: skypilot
33
description: A Helm chart for deploying SkyPilot API server on Kubernetes
44
type: application
5-
version: 0.0.1-pre-05
5+
version: 0.0.1-pre-06
66
appVersion: "0.0"
77
dependencies:
88
- name: ingress-nginx

‎charts/stable/skypilot/templates/NOTES.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{{- if not .Values.apiService.skipResourceCheck }}
2+
{{- include "skypilot.checkResources" . }}
3+
{{- end }}

‎charts/stable/skypilot/templates/_helpers.tpl‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{{- define "skypilot.checkResources" -}}
2+
{{- $cpu := .Values.apiService.resources.requests.cpu | default "0" -}}
3+
{{- $memory := .Values.apiService.resources.requests.memory | default "0" -}}
4+
5+
{{- /* Convert CPU to numeric value */ -}}
6+
{{- $cpuNum := 0.0 -}}
7+
{{- if kindIs "string" $cpu -}}
8+
{{- if hasSuffix "m" $cpu -}}
9+
{{- $cpuNum = float64 (divf (trimSuffix "m" $cpu | atoi) 1000) -}}
10+
{{- else -}}
11+
{{- $cpuNum = float64 ($cpu | atoi) -}}
12+
{{- end -}}
13+
{{- else -}}
14+
{{- $cpuNum = float64 $cpu -}}
15+
{{- end -}}
16+
17+
{{- /* Convert memory to Gi */ -}}
18+
{{- $memNum := 0.0 -}}
19+
{{- if hasSuffix "Gi" $memory -}}
20+
{{- $memNum = float64 (trimSuffix "Gi" $memory | atoi) -}}
21+
{{- else if hasSuffix "Mi" $memory -}}
22+
{{- $memNum = float64 (divf (trimSuffix "Mi" $memory | atoi) 1024) -}}
23+
{{- else if hasSuffix "G" $memory -}}
24+
{{- $memNum = float64 ($memory | trimSuffix "G" | atoi) -}}
25+
{{- else if hasSuffix "M" $memory -}}
26+
{{- $memNum = float64 (divf (trimSuffix "M" $memory | atoi) 1024) -}}
27+
{{- end -}}
28+
29+
{{- if or (lt $cpuNum 4.0) (lt $memNum 8.0) -}}
30+
{{/* TODO(aylei): add a reference to the tuning guide once complete */}}
31+
{{- fail "Error\nDeploying a SkyPilot API server requires at least 4 CPU cores and 8 GiB memory. You can either:\n1. Change `--set apiService.resources.requests.cpu` and `--set apiService.resources.requests.memory` to meet the requirements or unset them to use defaults\n2. add `--set apiService.skipResourceCheck=true` in command args to bypass this check (not recommended for production)\nto resolve this issue and then try again." -}}
32+
{{- end -}}
33+
34+
{{- end -}}
35+
36+
{{/*
37+
Create the name of the service account to use
38+
*/}}
39+
{{- define "skypilot.serviceAccountName" -}}
40+
{{- if .Values.rbac.serviceAccountName -}}
41+
{{ .Values.rbac.serviceAccountName }}
42+
{{- else -}}
43+
{{ .Release.Name }}-api-sa
44+
{{- end -}}
45+
{{- end -}}

‎charts/stable/skypilot/templates/api-deployment.yaml‎

Lines changed: 41 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ spec:
1717
app: {{ .Release.Name }}-api
1818
spec:
1919
automountServiceAccountToken: {{ .Values.kubernetesCredentials.useApiServerCluster }}
20-
serviceAccountName: {{ .Release.Name }}-api-sa
20+
serviceAccountName: {{ include "skypilot.serviceAccountName" . }}
2121
{{- with .Values.podSecurityContext }}
2222
securityContext:
2323
{{- toYaml . | nindent 8 }}
24-
{{- end }}
24+
{{- end }}
2525
runtimeClassName: {{ .Values.runtimeClassName }}
2626
containers:
2727
- name: skypilot-api
@@ -62,9 +62,8 @@ spec:
6262
{{- if .Values.apiService.config }}
6363
mkdir -p /root/.sky
6464
echo "Copying config.yaml from ConfigMap \`skypilot-config\` to /root/.sky/config.yaml"
65-
# The configmap serves as the ground truth for the config.yaml file.
66-
# Any local changes to the config.yaml file will be overwritten by the contents of the configmap.
67-
cp /tmp/config.yaml /root/.sky/config.yaml
65+
# The configmap serves as the ground truth for the config.yaml file, read-only
66+
ln -sf /var/skypilot/config/config.yaml /root/.sky/config.yaml
6867
{{- end }}
6968
7069
if sky api start -h | grep -q -- "--foreground"; then
@@ -101,8 +100,7 @@ spec:
101100
{{- end }}
102101
{{- if .Values.apiService.config }}
103102
- name: skypilot-config
104-
mountPath: /tmp/config.yaml
105-
subPath: config.yaml
103+
mountPath: /var/skypilot/config
106104
{{- end }}
107105
{{- if .Values.awsCredentials.enabled }}
108106
- name: aws-config
@@ -126,7 +124,7 @@ spec:
126124
{{- with .Values.securityContext }}
127125
securityContext:
128126
{{- toYaml . | nindent 10 }}
129-
{{- end }}
127+
{{- end }}
130128
image: {{ .Values.apiService.image }}
131129
command: ["/bin/sh", "-c"]
132130
args:
@@ -161,7 +159,7 @@ spec:
161159
{{- with .Values.securityContext }}
162160
securityContext:
163161
{{- toYaml . | nindent 10 }}
164-
{{- end }}
162+
{{- end }}
165163
image: google/cloud-sdk:latest
166164
command: ["/bin/sh", "-c"]
167165
env:
@@ -178,6 +176,36 @@ spec:
178176
- name: gcp-config
179177
mountPath: /root/.config/gcloud
180178
{{- end }}
179+
{{- if .Values.runpodCredentials.enabled }}
180+
- name: create-runpod-credentials
181+
{{- with .Values.securityContext }}
182+
securityContext:
183+
{{- toYaml . | nindent 10 }}
184+
{{- end }}
185+
image: {{ .Values.apiService.image }}
186+
command: ["/bin/sh", "-c"]
187+
args:
188+
- |
189+
echo "Setting up RunPod credentials..."
190+
if [ -n "$RUNPOD_API_KEY" ]; then
191+
echo "RunPod credentials found in environment variable."
192+
mkdir -p /root/.runpod
193+
echo "[default]" > /root/.runpod/config.toml
194+
echo "api_key = \"$RUNPOD_API_KEY\"" >> /root/.runpod/config.toml
195+
else
196+
echo "RunPod credentials not found in environment variables. Skipping credentials setup."
197+
sleep 600
198+
fi
199+
env:
200+
- name: RUNPOD_API_KEY
201+
valueFrom:
202+
secretKeyRef:
203+
name: runpod-credentials
204+
key: api_key
205+
volumeMounts:
206+
- name: runpod-config
207+
mountPath: /root/.runpod
208+
{{- end }}
181209
volumes:
182210
{{- if .Values.storage.enabled }}
183211
- name: state-volume
@@ -191,14 +219,17 @@ spec:
191219
- name: aws-config
192220
emptyDir: {}
193221
{{- end }}
194-
195222
{{- if .Values.gcpCredentials.enabled }}
196223
- name: gcp-credentials
197224
secret:
198225
secretName: gcp-credentials
199226
- name: gcp-config
200227
emptyDir: {}
201228
{{- end }}
229+
{{- if .Values.runpodCredentials.enabled }}
230+
- name: runpod-config
231+
emptyDir: {}
232+
{{- end }}
202233
{{- if .Values.kubernetesCredentials.useKubeconfig }}
203234
- name: kube-config
204235
secret:

‎charts/stable/skypilot/templates/ingress-nodeport.yaml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
1-
{{- if and .Values.ingress.nodePortEnabled (index .Values "ingress-nginx" "enabled") }}
1+
{{- /* TODO(aylei): remove this template in v0.9.0 release */ -}}
2+
{{- $createNodePort := false -}}
3+
{{- if eq .Values.ingress.nodePortEnabled nil -}}
4+
{{- /* Keep existing NodePort service if ingress.nodePortEnabled is not set */ -}}
5+
{{- $existingService := lookup "v1" "Service" .Release.Namespace (printf "%s-ingress-controller-np" .Release.Name) -}}
6+
{{- if $existingService -}}
7+
{{- /* If there is an existing legacy NodePort service, error out and ask user to set ingress.nodePortEnabled explicitly */ -}}
8+
{{- fail (printf "Service %s-ingress-controller-np is deprecated and will be removed in SkyPilot v0.9.0. Refer to https://docs.skypilot.co/en/latest/reference/api-server/api-server-admin-deploy.html#sky-migrate-legacy-service for migration steps." .Release.Name) -}}
9+
{{- end -}}
10+
{{- else -}}
11+
{{- /* Use explicitly set value */ -}}
12+
{{- $createNodePort = .Values.ingress.nodePortEnabled -}}
13+
{{- end -}}
14+
15+
{{- if and $createNodePort (index .Values "ingress-nginx" "enabled") }}
216
apiVersion: v1
317
kind: Service
418
metadata:
@@ -23,4 +37,4 @@ spec:
2337
app.kubernetes.io/component: controller
2438
app.kubernetes.io/instance: {{ .Release.Name }}
2539
app.kubernetes.io/name: ingress-nginx
26-
{{- end}}
40+
{{- end }}

‎charts/stable/skypilot/templates/rbac.yaml‎

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
{{- if .Values.rbac.create }}
2+
{{- if .Values.rbac.rules }}
3+
{{- fail "`.rbac.rules` is deprecated. Please use `.rbac.namespaceRules` and `.rbac.clusterRules` instead" }}
4+
{{- end }}
15
---
26
apiVersion: v1
37
kind: ServiceAccount
@@ -10,7 +14,7 @@ kind: ClusterRole
1014
metadata:
1115
name: {{ .Release.Name }}-api-role
1216
rules:
13-
{{ toYaml .Values.rbac.rules | indent 2 }}
17+
{{ toYaml .Values.rbac.clusterRules | indent 2 }}
1418
---
1519
apiVersion: rbac.authorization.k8s.io/v1
1620
kind: ClusterRoleBinding
@@ -24,3 +28,46 @@ roleRef:
2428
kind: ClusterRole
2529
name: {{ .Release.Name }}-api-role
2630
apiGroup: rbac.authorization.k8s.io
31+
---
32+
{{- $namespaces := list }}
33+
{{- range .Values.rbac.grantedNamespaces }}
34+
{{- $namespaces = append $namespaces .namespace }}
35+
{{- end }}
36+
{{- $namespaces = append $namespaces .Release.Namespace | uniq }}
37+
{{- range $namespaces }}
38+
{{/* Create namespaces in advance to enable RBAC rules, filter out the release namespace in case user accidentally added it to grantedNamespaces*/}}
39+
{{- if and (ne . $.Release.Namespace) (not (lookup "v1" "Namespace" "" .)) }}
40+
---
41+
apiVersion: v1
42+
kind: Namespace
43+
metadata:
44+
name: {{ . }}
45+
annotations:
46+
{{/* Keep the namespace when uninstalling the chart, so that the deployed sky resources (if any) can still work even if the API server get uninstalled */}}
47+
helm.sh/resource-policy: keep
48+
{{- end }}
49+
---
50+
apiVersion: rbac.authorization.k8s.io/v1
51+
kind: Role
52+
metadata:
53+
name: {{ $.Release.Name }}-api-role
54+
namespace: {{ . }}
55+
rules:
56+
{{ toYaml $.Values.rbac.namespaceRules | indent 2 }}
57+
---
58+
apiVersion: rbac.authorization.k8s.io/v1
59+
kind: RoleBinding
60+
metadata:
61+
name: {{ $.Release.Name }}-api-role-binding
62+
namespace: {{ . }}
63+
subjects:
64+
- kind: ServiceAccount
65+
name: {{ $.Release.Name }}-api-sa
66+
namespace: {{ $.Release.Namespace }}
67+
roleRef:
68+
kind: Role
69+
name: {{ $.Release.Name }}-api-role
70+
apiGroup: rbac.authorization.k8s.io
71+
---
72+
{{- end }}
73+
{{- end }}

0 commit comments

Comments
 (0)