SWAN.yaml

### SWAN ###
#
# SWAN service
# Deploys:
#  * JupyterHub to spawn, manage, and proxy multiple Jupyter sessions for single users
#  * EOS client for fuse-mounting user's home directory
#  * CVMFS client to fetch scientific libraries on-demand
#  * Cluster wise squid proxy for CVMFS (cvmfssquid)
#  * Image puller to pull single-user container image beforehand
###


###
# Deployment with KubeSpawner and a cluster-wise SQUID proxy for CVMFS
###


### SECRETS ###
#
### 1.SSL certificates ###
# Note: These certificates are self-signed and for testing purposes only. Please replace them with proper certificates.
#
# Note: All Kubernetes secrets must be base64 encoded. Please encode your certificates with
#       `cat /path/to/your/certificate.key | base64 -w 0` for Linux-based systems
#       More details available here: https://kubernetes.io/docs/concepts/configuration/secret/
###
apiVersion: v1
kind: Secret
metadata:
  name: swan-certs
  namespace: boxed
type: Opaque
data:
  boxed.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBem5HeDErQ2FyalBWOVM3bWFQK3pqWlZhaXZZdm5acllBQlNIUnoyNis5emE5a1dsCkVUeWxpMzdiVnd0OEdQQnZtZ3RqVU1yK25WTFlETU42K2o0Y1Vrem1RMnFHa0hXN1Q2T3BOM2FNTUVFZ2VnQWUKYzkvU2dQdE9EZUlXK3paaUJUNW80SmpKNDgzRVc1cURDUkQxenRiSnl3WVAvR1ZLTlFpS0RaR3hwU3MxMXYzTgowWGwvM1pGK1J6KzA1dW5uaEIrT2NaT0JKNHUrSlozK2tGbFR5YU5GdENHd2R1N09jWUl3dE1nMXpmWXZpTTFQCnJjYkpUYS9OM1EzR0FHSFBYQzVsZGNyYWFnK1Zib3FtNk83RGk4QzFVNUFMUmRxWE1TMW4yRVpLekprUHdTaUMKem83VElUYjh2SFdFNG1ySU1XVGIvVjRCMjhzeHgyQ2lScDJVTHdJREFRQUJBb0lCQUV0YnYxS1JQNFdGa0gyZQpzQ2IxNkNJdnVjeHVEM1dWbDNGNERPV1ppQTcyVU11RElyMUhDUnNCcEttQ25Mc3gwVnRHK3VyOEhyTnBFVXFmCmROMnlISDZDYWErRVREaWhjVTJoN1Z3OG52SGlaQ3VFclprWXcrdW5VSmZLeHg3T2ZEdHp5NjdvdHhHOEJBaDQKUDRyb3NRSGU3K3gzZXhCa0hSRjgyNEFXaGVWSFZ3WUtTQUVwZFpiczZUVTdwTWhnWEVSNHNJa1kyNFhFazVOVApZRERmU1NOeUt1SXh6RzlVM1hXNHNUSmgyZkFRVXNpa0o1STVmTWh4QURZTVN2TWk2VjZvSTJ5N0NsL1J2eTJtClhnQnZVK0hoazlvNWZFaVdRcksrdUZXWURBWlhhdW1NTFZ1YXUvNlBGNWw1RWRJczZVaHpZc3ZzamRFNy8yWlIKejY3UUg0RUNnWUVBL2U2eGVxbU5KZlVGRUZxTXFBMzVjd1hXWXVDRndEOFJNT0V2Z1dtMnB4SzgzQ3BDa3hpSwpLajZwLzBRbnpQd0R1UWFtZ3NSS3YxbU5mbnFaTldFN2tTcG5WelNLSGFXVjhrR2pYOUVZVzcxWEdMRXJ5RE9mClhwVEIxeUxTelpWNnJZcmZWMnQzS2kwaFJvYXpUWVpWMk1CdW1yME9UMGNyaWRJL2hCbnB1TzhDZ1lFQTBDQUQKMWZYUTh0Zkx6MXNNdVhHUTY1dWc0Q0I1bWk5cUlnQmxLYXQyTzdtNHlsWC9HcDMvSlFoSTlneHhmaXRrMjdWSQpGc2Jvc2wzaU5FSE5HdUo3UjBOSGFjMm4zSjE2dXBzNWtuWmQydmZkQU9wZnA3YWRQL3ZqMS9sZHhTb25zTmZtCjdMUDFlWDNMaDk1ZC9NL1pHZU5rS1lZV3VtMDVmS0x4aFJHWldNRUNnWUJTbzJ0K3o4N3ZtMTJhaE4xaGs2cXEKbEN2QTRmQ2xMK0VZVnpCdW5VaWo5cVVmd1dFSkhlTlkvQ3UydHlkOHZrYzMzOEl3ckZEbkZPM0hTMzZ3c0lRQwpLaHFYZHJHOEZEZElMN1JMYW5EUzZqdDkvYXFSN0xyZ3ZPaVlhdXpQbXVYaHRHQWF3dzUwMjFzSTZLMVJmWFpTCm84MWE3a3ZKNFE5Nk9zSVE2NTMwWVFLQmdRREpiK01taUZnbll0UUJxd2RpeVZkUm92eVBVUDlCUzFqMjlkanoKL3Q5ZHFVRUFuVUZldXNORFRZU0ltTHlVT0YzVEJOOTBKQ3IrMEQxckJMRUdyMlJRTWY4Qm1hbzVyalltUEt6NQpaQlV0SlMvRGZoVDlGNU9WWlRBK1RqNEM0ZTB1alprVlNveHhmVjZyNzM2YWZYV01SL2tlODRnMkFoZGMyYnpYClpaUTlRUUtCZ1FENStpTk5wb0NRT0d1OW1WenkzUlBIa0xjTVo4RW04SUdqQ0pRNTYrWitQT1hTWEEwR3dlQ3EKcG55Wkw2cXJNcWp2VFErWDlNWVdhMmR6R00wSFd4NWFMMVN0UVcyNmYyQTZGNTFZN09FdW9JSnB1YkZxOXJ0QgpsZ1FsUG5rN3MxZkR1Y3FPblZMNDBPd1J3SDc0bTMwLy8zcU1IQlprbXBvQTJtbEdHSCtqRkE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
  boxed.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURBRENDQWVnQ0NRQ1Y4bGJrL1BOYTREQU5CZ2txaGtpRzl3MEJBUXNGQURCQ01Rc3dDUVlEVlFRR0V3SlkKV0RFVk1CTUdBMVVFQnd3TVJHVm1ZWFZzZENCRGFYUjVNUnd3R2dZRFZRUUtEQk5FWldaaGRXeDBJRU52YlhCaApibmtnVEhSa01CNFhEVEUzTURNd056RXhORFF5TjFvWERURTRNRE13TnpFeE5EUXlOMW93UWpFTE1Ba0dBMVVFCkJoTUNXRmd4RlRBVEJnTlZCQWNNREVSbFptRjFiSFFnUTJsMGVURWNNQm9HQTFVRUNnd1RSR1ZtWVhWc2RDQkQKYjIxd1lXNTVJRXgwWkRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTTV4c2RmZwptcTR6MWZVdTVtai9zNDJWV29yMkw1MmEyQUFVaDBjOXV2dmMydlpGcFJFOHBZdCsyMWNMZkJqd2I1b0xZMURLCi9wMVMyQXpEZXZvK0hGSk01a05xaHBCMXUwK2pxVGQyakRCQklIb0FIblBmMG9EN1RnM2lGdnMyWWdVK2FPQ1kKeWVQTnhGdWFnd2tROWM3V3ljc0dEL3hsU2pVSWlnMlJzYVVyTmRiOXpkRjVmOTJSZmtjL3RPYnA1NFFmam5HVApnU2VMdmlXZC9wQlpVOG1qUmJRaHNIYnV6bkdDTUxUSU5jMzJMNGpOVDYzR3lVMnZ6ZDBOeGdCaHoxd3VaWFhLCjJtb1BsVzZLcHVqdXc0dkF0Vk9RQzBYYWx6RXRaOWhHU3N5WkQ4RW9nczZPMHlFMi9MeDFoT0pxeURGazIvMWUKQWR2TE1jZGdva2FkbEM4Q0F3RUFBVEFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBS056ZXJyMGpwTS92NFZoNQp1Yy8vU3B2eEszWjAyeU5TV2ZYU1RUL2RuL1kwRkI4dkJxdkszdjVDV1NXa0Rnejc3WEkvSmRSZDQzcEgzVDJUCnZGMDRoSnVkUTJESGhiZER0cjBZRXdvTlY1TE9QRHhiNnhNbkMvWFRnR09EZ2ZHdGkwWVVBbisycVVNU0J6UksKMGhMeFV6Q0ZnZHEyeFZaOGl0OFVBZm1BNUc4OUlHbDEvWXUxMlhON0h4OFBOMGdyVjBQQXJ5SDZCaVhROGNUYQpjcTAzS0N1ZExhOUluQ2ZyRm9DWjRnSC9TZE50ZXpzT3NFWXA2WHlkZ0xmVlY5V1pTUVNreVFkUUNiV2duYytLCkVmUGkrRzBHTXp6KzFLQkpzbnRTOTVqdUJBVE1ualA2OWZKaUZQcGRlY2VrZ0F2OW1rVmdvYklvdVVHMjJjRW8KbWZtWnhnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  boxed.csr: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2h6Q0NBVzhDQVFBd1FqRUxNQWtHQTFVRUJoTUNXRmd4RlRBVEJnTlZCQWNNREVSbFptRjFiSFFnUTJsMAplVEVjTUJvR0ExVUVDZ3dUUkdWbVlYVnNkQ0JEYjIxd1lXNTVJRXgwWkRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCCkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU01eHNkZmdtcTR6MWZVdTVtai9zNDJWV29yMkw1MmEyQUFVaDBjOXV2dmMKMnZaRnBSRThwWXQrMjFjTGZCandiNW9MWTFESy9wMVMyQXpEZXZvK0hGSk01a05xaHBCMXUwK2pxVGQyakRCQgpJSG9BSG5QZjBvRDdUZzNpRnZzMllnVSthT0NZeWVQTnhGdWFnd2tROWM3V3ljc0dEL3hsU2pVSWlnMlJzYVVyCk5kYjl6ZEY1ZjkyUmZrYy90T2JwNTRRZmpuR1RnU2VMdmlXZC9wQlpVOG1qUmJRaHNIYnV6bkdDTUxUSU5jMzIKTDRqTlQ2M0d5VTJ2emQwTnhnQmh6MXd1WlhYSzJtb1BsVzZLcHVqdXc0dkF0Vk9RQzBYYWx6RXRaOWhHU3N5WgpEOEVvZ3M2TzB5RTIvTHgxaE9KcXlERmsyLzFlQWR2TE1jZGdva2FkbEM4Q0F3RUFBYUFBTUEwR0NTcUdTSWIzCkRRRUJDd1VBQTRJQkFRQVBzSDB0TGd6TzRjMERDd296Uzl5Y2FmTVY5QWRDYkNIdTJHL3BPdGhnaStWNkY2aTcKMURLMWRuelpXWjhFQVEwaW4wWkFtdlVIVVRsWEdGQ3B5b2hKbGtnczdpd3FRT3A3UjNiQnZhS0hxQitCMWpTZApoSjlwaElzSkFnVXFqVXE2ei9oUDV5RU40OW43YWIreWEzREp5Zm1iR2YxSmNVOC9COE5Hc0JBLzBJc0NRa2NxCmFFTFVncDFCWlg3TFpwSlFwaUVHWnBCME1DUzMvdUV0Z2EyQTJQZHEyWnlDb1NOV3d5dEFvN2lOa3JZdG4rd1AKa1lZWldCZkFjZGZNOVNQaVBnRXRmNnJzRWFBR0J4KzVicDBma0Rtbm1RUE9OZ2ZhT211UEMzZk9XRGdTMmtSQQowZnVRWFU2MjlFOEdpUEQ2QXZCemptcTc1M0VVVzZNanlUQkQKLS0tLS1FTkQgQ0VSVElGSUNBVEUgUkVRVUVTVC0tLS0tCg==
#
---
###
# 2.EOS Keytab
# Note: This is specific to the EOS instance to connect to. Should be kept secret for production instances
#

# The EOS Keytab secret is currently commented out.
# If in the need of specifing a custom keytab, proceed as follows:
#       a. base64 encode it and copy the result in the 'eos.keytab' variable below
#       b. uncomment what follows, from ''apiVersion: v1' to '  eos.keytab: %%% THIS IS ONLY A PLACE HOLDER %%%'
#       c. uncomment the volumeMount and the volume definition for 'eos-keytab' in the eos-fuse resource specification
#       d. uncomment the env var EOS_GATEWAY_KEYTAB_FILE definition in the eos-fuse resource specification
#       e. redeploy the services for the changes to take effect
#
##apiVersion: v1
##kind: Secret
##metadata:
##  name: eos-keytab
##  namespace: boxed
##type: Opaque
##data:
##  eos.keytab: %%% THIS IS ONLY A PLACE HOLDER %%%
#


### CLUSTER ROLE BINDINGS ###
#
# NOTE: SWAN requires access to the Kubernetes cluster resources and the ability 
#       to list and start containers in the namespace where it is deployed.
#       In order to achieve this, please review your cluster configuration and, if needed, 
#       configure the default service account for the namespace as an admin of the cluster.
#      
#       Example with namespace "boxed":
#        `kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=boxed:default`
#
#       The binding between the default service account for namespace "boxed" and its role
#       of cluster administrator is automated in what follows:
###
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  name: add-on-cluster-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: default
  namespace: boxed
#
###


### PODS ###
---
# Jupyterhub -- Deployment
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: &name swan
  namespace: &namespace boxed
  labels:
    app: *name
spec:
  replicas: 1 
  template:
    metadata:
      labels:
        app: *name
        name: *name
    spec:
      terminationGracePeriodSeconds: 60
      nodeSelector:
        nodeApp: *name
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
      - name: jupyterhub
        image: gitlab-registry.cern.ch/swan/docker-images/jupyterhub:v1.9
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          protocol: TCP
          hostPort: &HTTP_PORT 80
          containerPort: *HTTP_PORT
        - name: https
          protocol: TCP
          hostPort: &HTTPS_PORT 443
          containerPort: *HTTPS_PORT
        volumeMounts:
        - name: &vm_swan-certs swan-certs
          mountPath: /etc/boxed/certs
        - name: &vm_JHconfig jupyterhub-data
          mountPath: /srv/jupyterhub/jupyterhub_data
        - name: &vm_logs-jupyterhub jupyterhub-logs
          mountPath: /var/log/jupyterhub 
        - name: &vm_logs-httpd httpd-logs
          mountPath: /var/log/httpd
        - name: &vm_logs-shibboleth shibboleth-logs
          mountPath: /var/log/shibboleth
        env:
        - name: PODINFO_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: PODINFO_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: PODINFO_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: PODINFO_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: PODINFO_NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: THIS_CONTAINER
          value: "JUPYTERHUB"
        - name: DEPLOYMENT_TYPE
          value: "kubespawner"
        #- name: HOSTNAME                 # Use this configuration only if the linux hostname matches the chosen domain name
        #  valueFrom:                     # at the DNS (e.g., no aliases are defined)
        #    fieldRef:                    # Otherwise, please specify manually the hostname below. 
        #      fieldPath: spec.nodeName
        - name: HOSTNAME                 # Assume JupyterHub is exposed via hostNetwork on the node where it runs
          value: "up2kube-swan.cern.ch"  # URL to reach SWAN will be: https://<HOSTNAME>
        - name: HTTP_PORT
          value: "80"
        - name: HTTPS_PORT
          value: "443"
        ### LDAP parameters
        - name: LDAP_URI
          value: "ldap://ldap.boxed.svc.cluster.local"
        - name: LDAP_PORT
          value: "389"
        - name: LDAP_BASE_DN
          value: "dc=example,dc=org"
        - name: LDAP_BIND_DN
          value: "cn=readuser,dc=example,dc=org"
        - name: LDAP_BIND_PASSWORD
          value: "readuser"
        ### JupyterHub configuration
        - name: AUTH_TYPE
          value: "local"
          #value: "shibboleth"
        - name: CONTAINER_IMAGE
          value: "gitlab-registry.cern.ch/swan/docker-images/systemuser:v5.2.0"
        ### KubeSpawner parameters
        - name: NAMESPACE
          value: *namespace
        - name: NODE_SELECTOR_KEY
          value: "nodeApp"
        - name: NODE_SELECTOR_VALUE
          value: "swan-users"
        ### Mounts for single-user containers
        - name: CVMFS_FOLDER
          value: "/cvmfs"
        - name: EOS_USER_PATH           # This must bring to the folder with the list of initials of users
          value: "/eos/docker/user"     # E.g., "/eos/docker/user" --(will be mapped to)--> "/eos/user" in the container
        - name: CERNBOXGATEWAY_HOSTNAME     # Hostname of CERNBox for Sharing API
          value: "up2kube-cernbox.cern.ch"
        # - name: SPAWNER_FORM
        #   value: "simple"
        #### Customization
        #- name: CUSTOMIZATION_REPO
        #  value: "https://<something>.git"
        #- name: CUSTOMIZATION_COMMIT
        #  value: ""
        #- name: CUSTOMIZATION_SCRIPT
        #  value: ""
        #- name: SSO_LOGOUT_URL
        #  value: "https://swan.web.cern.ch"
      volumes:
      - name: *vm_swan-certs
        secret:
          secretName: swan-certs
          defaultMode: 0644
      - name: *vm_JHconfig
        hostPath:
          path: /mnt/jupyterhub_data
          type: Directory
      - name: *vm_logs-jupyterhub
        hostPath:
          path: /var/kubeVolumes/jupyterhub_logs
          type: DirectoryOrCreate
      - name: *vm_logs-httpd
        hostPath:
          path: /var/kubeVolumes/httpd_logs
          type: DirectoryOrCreate
      - name: *vm_logs-shibboleth
        hostPath:
          path: /var/kubeVolumes/shibboleth_logs
          type: DirectoryOrCreate

---
# SQUID Proxy for CVMFS -- Deployment
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: &name cvmfssquid
  namespace: &namespace boxed
  labels:
    app: *name
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: *name
        name: *name
    spec:
      terminationGracePeriodSeconds: 60
      nodeSelector:
        nodeApp: swan
      containers:
      - name: cvmfssquid
        image: gitlab-registry.cern.ch/cernbox/boxedhub/cvmfssquid:v0
        imagePullPolicy: IfNotPresent
        env:
        ### PodInfo ###
        - name: PODINFO_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: PODINFO_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: PODINFO_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: PODINFO_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: PODINFO_NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: DEPLOYMENT_TYPE
          value: "kubernetes"

---
# CVMFS client, EOS fuse gateway, and Image puller -- DaemonSet
#
# Note: Deploy EOS Fuse and CVMFS daemons on all the nodes where
#       single-user sessions can land. Such nodes are identified
#       via NodeSelector key-value provided by Kubernetes.
#       Default is: "nodeApp: swan-users"
#
# Note: Image puller is used to download the single-user
#       container image before the first request from the user comes.
#       This image is usually 3GB+ in size and, if not already
#       available locally, would require several minutes to download.
#
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: &daemons swan-daemons
  namespace: &namespace boxed
  labels:
    app: *daemons
spec:
  template:
    metadata:
      labels:
        app: *daemons
        name: *daemons
    spec:
      hostPID: true
      terminationGracePeriodSeconds: 60
      nodeSelector:
        nodeApp: "swan-users"
      containers:
      ###
      # 1. EOS-FUSE
      - name: eos-fuse
        image: gitlab-registry.cern.ch/cernbox/boxedhub/eos-fuse:v0.8
        imagePullPolicy: IfNotPresent
        securityContext:
          privileged: true
          capabilities:
            add: ["SYS_ADMIN"]
        volumeMounts:
        - name: &vm_cgroup cgroup
          mountPath: /sys/fs/cgroup
        ##- name: &vm_eos-keytab eos-keytab
        ##  mountPath: /etc/boxed/eos_secrets
        - name: &vm_rdv-eos rdv-eos
          mountPath: /eos:shared
        - name: &vm_logs-eosfuse eosfuse-logs
          mountPath: /var/log/eos/fuse
        env:
        - name: PODINFO_NAMESPACE
          valueFrom:
             fieldRef:
              fieldPath: metadata.namespace
        - name: PODINFO_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: PODINFO_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: PODINFO_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: PODINFO_NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: THIS_CONTAINER
          value: "EOS-FUSE"
        - name: DEPLOYMENT_TYPE
          value: "kubernetes"
        ### LDAP parameters
        - name: LDAP_URI
          value: "ldap://ldap.boxed.svc.cluster.local"
        - name: LDAP_PORT
          value: "389"
        - name: LDAP_BASE_DN
          value: "dc=example,dc=org"
        - name: LDAP_BIND_DN
          value: "cn=readuser,dc=example,dc=org"
        - name: LDAP_BIND_PASSWORD
          value: "readuser"
        ### EOS parameters
        - name: EOS_MGM_ALIAS
          value: "eos-mgm.boxed.svc.cluster.local"
        - name: EOS_FOLDER
          value: "/eos"
        ##- name: EOS_GATEWAY_KEYTAB_FILE
        ##  value: "/etc/boxed/eos_secrets/eos.keytab"
        - name: EOS_GATEWAY_SELF_REGISTRATION
          value: "true"
        - name: EOS_GATEWAY_AUTH
          value: "unix"
        lifecycle:
          preStop:
            exec:
              command: ["bash", "/root/stop.sh"]
      ###
      # 2. CVMFS
      - name: cvmfs
        image: gitlab-registry.cern.ch/cernbox/boxedhub/cvmfs:v0.5
        imagePullPolicy: IfNotPresent
        securityContext:
          privileged: true
          capabilities:
            add: ["SYS_ADMIN"]
        volumeMounts:
        - name: &vm_devfuse devfuse
          mountPath: /dev/fuse
        - name: &vm_rdv-cvmfs rdv-cvmfs
          mountPath: /cvmfs:shared
        env:
        - name: PODINFO_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: PODINFO_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: PODINFO_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: PODINFO_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: PODINFO_NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: THIS_CONTAINER
          value: "CVMFS"
        - name: DEPLOYMENT_TYPE
          value: "kubernetes"
        - name: CVMFS_FOLDER
          value: "/cvmfs"
        - name: CVMFS_UPSTREAM_CONNECTION
          #value: "direct"
          #value" "cern"
          value: "squid"
        - name: CVMFS_SQUID_HOSTNAME
          value: "cvmfssquid.boxed.svc.cluster.local"
        - name: CVMFS_SQUID_PORT
          value: "3128"
        - name: SOFTWARE_STACK
          value: "LCG_96"
        - name: PLATFORM
          value: "x86_64-centos7-gcc8-opt"
        lifecycle:
          preStop:
            exec:
              command: ["bash", "/root/stop.sh"]
      ###
      # 3. Image puller
      - name: imagepuller
        image: gitlab-registry.cern.ch/cernbox/boxedhub/imagepuller:latest
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: &vm_docker-socket docker-socket
          mountPath: /var/run/docker.sock
        env:
        - name: PODINFO_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: PODINFO_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: PODINFO_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: PODINFO_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: PODINFO_NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: THIS_CONTAINER
          value: "ImagePuller"
        - name: DEPLOYMENT_TYPE
          value: "kubernetes"
        - name: DAEMON_SET
          value: "true"
        - name: DOCKER_IMAGES
          value: "gitlab-registry.cern.ch/swan/docker-images/systemuser:v5.2.0"

      volumes:
      # EOS-FUSE
      - name: *vm_cgroup
        emptyDir: {}            # Fooling systemd to init the eosd service
      ##- name: *vm_eos-keytab
      ##  secret:
      ##    secretName: eos-keytab
      ##    defaultMode: 0400
      - name: *vm_rdv-eos
        hostPath:
          path: /eos
      - name: *vm_logs-eosfuse
        hostPath:
          path: /var/kubeVolumes/eosfuse_logs
          type: DirectoryOrCreate
      # CVMFS
      - name: *vm_devfuse
        hostPath:
          path: /dev/fuse
      - name: *vm_rdv-cvmfs
        hostPath:
          path: /cvmfs
      # ImagePuller
      - name: *vm_docker-socket # To pull single-user container image
        hostPath:
          path: /var/run/docker.sock


---
### SERVICE ###
apiVersion: v1
kind: Service
metadata:
  name: &name cvmfssquid
  namespace: boxed
spec:
  selector:
    app: *name
  ports:
  - name: squid-http
    protocol: TCP
    port: 3128
    targetPort: 3128
  type: ClusterIP


# NOTE: A kubernetes service to access SWAN in only needed when 
#	hostNetwork connectivity is not enabled on the cluster node
#	where jupyterhub runs.
#	Otherwise, JupyterHub is directly accessible on {HTTP, HTTPS}_PORTS
#
# Below, an example of NodePort service that uses the Kubernetes master
# as a gateway for SWAN via ports 30080 and 30443.
#
#apiVersion: v1
#kind: Service
#metadata:
#  name: &name swan
#  namespace: &namespace boxed
#spec:
#  selector:
#    app: *name
#  ports:
#  - name: http
#    protocol: TCP
#    port: 80
#    targetPort: 80
#    nodePort: 30080
#  - name: https
#    protocol: TCP
#    port: 443
#    targetPort: 443
#    nodePort: 30443
#  type: NodePort