rest-server.yaml.template

# Copyright (c) Microsoft Corporation
# All rights reserved.
#
# MIT License
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
# documentation files (the "Software"), to deal in the Software without restriction, including without limitation
# the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and
# to permit persons to whom the Software is furnished to do so, subject to the following conditions:
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
# BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: rest-server-ds
spec:
  selector:
    matchLabels:
      app: rest-server
  template:
    metadata:
      name: rest-server
      labels:
        app: rest-server
    spec:
      hostNetwork: false
      hostPID: false
      containers:
      - name: rest-server
        image: {{ cluster_cfg['cluster']['docker-registry']['prefix'] }}rest-server:{{ cluster_cfg['cluster']['docker-registry']['tag'] }}
        imagePullPolicy: Always
        volumeMounts:
        - mountPath: /pai-cluster-config
          name: pai-configuration-rest-server
{% if cluster_cfg['authentication']['OIDC'] %}
        - mountPath: /auth-configuration
          name: auth-configuration-rest-server
{% endif %}
        - mountPath: /group-configuration
          name: group-configuration-rest-server
{%- if cluster_cfg["cluster"]["common"]["cluster-type"] == "k8s" %}
{%- if cluster_cfg['hivedscheduler']['config']|length > 1 %}
        - mountPath: /hived-spec
          name: hived-spec-rest-server
{%- endif %}
        - mountPath: /k8s-job-exit-spec-configuration
          name: k8s-exit-spec-rest-server
{%- endif %}
        env:
        - name: LAUNCHER_TYPE
          value: {{ cluster_cfg["cluster"]["common"]["cluster-type"] }}
{%- if cluster_cfg["cluster"]["common"]["cluster-type"] == "k8s" %}
        - name: LAUNCHER_PRIORITY_CLASS
          value: "{{ cluster_cfg['rest-server']['enable-priority-class'] }}"
        - name: LAUNCHER_RUNTIME_IMAGE
          value: {{ cluster_cfg['cluster']['docker-registry']['prefix'] }}openpai-runtime:{{ cluster_cfg['cluster']['docker-registry']['tag'] }}
        - name: LAUNCHER_RUNTIME_IMAGE_PULL_SECRETS
          value: {{ cluster_cfg["cluster"]["docker-registry"]["secret-name"] }}
        - name: LAUNCHER_SCHEDULER
{% if cluster_cfg['hivedscheduler']['config']|length > 1 %}
          value: hivedscheduler
{% else %}
          value: defaultscheduler
{% endif %}
        - name: HIVED_WEBSERVICE_URI
          value: {{ cluster_cfg['hivedscheduler']['webservice'] }}
        - name: LOG_MANAGER_PORT
          value: "{{ cluster_cfg['log-manager']['port'] }}"
        - name: LOG_MANAGER_ADMIN_NAME
          value: "{{ cluster_cfg['log-manager']['admin_name'] }}"
        - name: LOG_MANAGER_ADMIN_PASSWORD
          value: "{{ cluster_cfg['log-manager']['admin_password'] }}"
{%- endif %}
        - name: RATE_LIMIT_API_PER_MIN
          value: "{{ cluster_cfg['rest-server']['rate-limit-api-per-min'] }}"
        - name: RATE_LIMIT_LIST_JOB_PER_MIN
          value: "{{ cluster_cfg['rest-server']['rate-limit-list-job-per-min'] }}"
        - name: RATE_LIMIT_SUBMIT_JOB_PER_HOUR
          value: "{{ cluster_cfg['rest-server']['rate-limit-submit-job-per-hour'] }}"
        - name: SCHEDULE_PORT_START
          value: "{{ cluster_cfg['rest-server']['schedule-port-start'] }}"
        - name: SCHEDULE_PORT_END
          value: "{{ cluster_cfg['rest-server']['schedule-port-end'] }}"
        - name: JWT_SECRET
          value: {{ cluster_cfg['rest-server']['jwt-secret'] }}
        - name: JWT_TOKEN_EXPIRE_TIME
          value: {{ cluster_cfg['rest-server']['jwt-expire-time'] }}
        - name: WEBPORTAL_URL
{%- if "ssl" in cluster_cfg["pylon"] and cluster_cfg["pylon"]["ssl"] %}
          value: "{{ cluster_cfg['pylon']['uri-https']}}"
{%- else %}
          value: "{{ cluster_cfg['pylon']['uri']}}"
{%- endif %}
{% if not cluster_cfg['authentication']['OIDC'] %}
        - name: AUTHN_METHOD
          value: basic
        - name: DEFAULT_PAI_ADMIN_USERNAME
          value: {{ cluster_cfg['rest-server']['default-pai-admin-username'] }}
        - name: DEFAULT_PAI_ADMIN_PASSWORD
          value: {{ cluster_cfg['rest-server']['default-pai-admin-password'] }}
{% else %}
        - name: AUTHN_METHOD
          value: OIDC
{% endif %}
        - name: K8S_APISERVER_URI
          value: {{ cluster_cfg['layout']['kubernetes']['api-servers-url'] }}
        - name: AZ_RDMA
          value: "{{ cluster_cfg['cluster']['common']['az-rdma']}}"
        - name: DEBUGGING_RESERVATION_SECONDS
          value: "{{ cluster_cfg['rest-server']['debugging-reservation-seconds']}}"
{% if cluster_cfg['cluster']['common']['k8s-rbac'] != 'false' %}
        - name: RBAC_IN_CLUSTER
          value: "true"
{% else %}
        - name: RBAC_IN_CLUSTER
          value: "false"
{% endif %}
        - name: SQL_CONNECTION_STR
          value: {{ cluster_cfg['postgresql']['connection-str'] }}
        - name: SQL_MAX_CONNECTION
          value: "{{ cluster_cfg['rest-server']['sql-max-connection'] }}"
{% if cluster_cfg['cluster']['common']['job-history'] != 'false' %}
        - name: JOB_HISTORY
          value: "true"
{% else %}
        - name: JOB_HISTORY
          value: "false"
{% endif %}
        - name: WRITE_MERGER_URL
          value: {{ cluster_cfg['database-controller']['write-merger-url'] }}
        - name: DEFAULT_COMPUTING_DEVICE_TYPE
          value: {{ cluster_cfg['rest-server']['default-computing-device-type'] }}
        - name: HIVED_COMPUTING_DEVICE_ENVS
          value: {{ cluster_cfg['rest-server']['hived-computing-device-envs'] }}
        ports:
        - name: rest-server
          containerPort: 8080
          hostPort: {{ cluster_cfg['rest-server']['server-port'] }}
        {%- if cluster_cfg['cluster']['common']['qos-switch'] == "true" %}
        resources:
          limits:
            memory: "4Gi"
        {%- endif %}
      imagePullSecrets:
      - name: {{ cluster_cfg["cluster"]["docker-registry"]["secret-name"] }}
      volumes:
      - name: pai-configuration-rest-server
        configMap:
          name: pai-configuration
{% if cluster_cfg['authentication']['OIDC'] %}
      - name: auth-configuration-rest-server
        configMap:
          name: auth-configuration
{% endif %}
{%- if cluster_cfg["cluster"]["common"]["cluster-type"] == "k8s" %}
{%- if cluster_cfg['hivedscheduler']['config']|length > 1 %}
      - name: hived-spec-rest-server
        configMap:
          name: hivedscheduler-config
{%- endif %}
      - name: k8s-exit-spec-rest-server
        configMap:
          name: k8s-job-exit-spec-configuration
{%- endif %}
      - name: group-configuration-rest-server
        configMap:
          name: group-configuration
{% if cluster_cfg['cluster']['common']['k8s-rbac'] == 'true' %}
      serviceAccountName: rest-server-account
{% endif %}