Skip to content

Commit 043a440

Browse files
ChenYi015ChenYi015
committed
Add Helm hook to upgrade CRDs
Signed-off-by: Yi Chen <[email protected]>
1 parent 92deff0 commit 043a440

File tree

14 files changed

+604
-1
lines changed

14 files changed

+604
-1
lines changed

‎.dockerignore

-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
.idea/
33
.vscode/
44
bin/
5-
charts/
65
docs/
76
config/
87
examples/

‎Dockerfile

+2
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ USER ${SPARK_UID}:${SPARK_GID}
5555

5656
COPY --from=builder /workspace/bin/spark-operator /usr/bin/spark-operator
5757

58+
COPY --from=builder /workspace/charts/spark-operator-chart/crds /etc/spark-operator/crds
59+
5860
COPY entrypoint.sh /usr/bin/
5961

6062
ENTRYPOINT ["/usr/bin/entrypoint.sh"]

‎charts/spark-operator-chart/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@ See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall) for command docum
8383
| image.tag | string | If not set, the chart appVersion will be used. | Image tag. |
8484
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
8585
| image.pullSecrets | list | `[]` | Image pull secrets for private image registry. |
86+
| hook.upgradeCrd | bool | `true` | Specifies whether to update CRDs with a Helm hook job. |
87+
| hook.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security context for hook containers. |
8688
| controller.replicas | int | `1` | Number of replicas of controller. |
8789
| controller.workers | int | `10` | Reconcile concurrency, higher values might increase memory usage. |
8890
| controller.logLevel | string | `"info"` | Configure the verbosity of logging, can be one of `debug`, `info`, `error`. |

‎charts/spark-operator-chart/templates/hook/_helpers.tpl

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{{/*
2+
Copyright 2024 The Kubeflow authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
https://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/}}
16+
17+
{{/*
18+
Create the name of Helm hook
19+
*/}}
20+
{{- define "spark-operator.hook.name" -}}
21+
{{- include "spark-operator.fullname" . }}-hook
22+
{{- end -}}
23+
24+
{{/*
25+
Common labels for the Helm hook
26+
*/}}
27+
{{- define "spark-operator.hook.labels" -}}
28+
{{ include "spark-operator.labels" . }}
29+
app.kubernetes.io/component: hook
30+
{{- end -}}
31+
32+
{{/*
33+
Selector labels for the Helm hook
34+
*/}}
35+
{{- define "spark-operator.hook.selectorLabels" -}}
36+
{{ include "spark-operator.hook.labels" . }}
37+
{{- end -}}
38+
39+
{{/*
40+
Create the name of the service account to be used by the Helm hooks.
41+
*/}}
42+
{{- define "spark-operator.hook.serviceAccountName" -}}
43+
{{ include "spark-operator.hook.name" . }}
44+
{{- end -}}
45+
46+
{{/*
47+
Create the name of the cluster role to be used by the Helm hooks.
48+
*/}}
49+
{{- define "spark-operator.hook.clusterRoleName" -}}
50+
{{ include "spark-operator.hook.name" . }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the cluster role binding to be used by the Helm hooks.
55+
*/}}
56+
{{- define "spark-operator.hook.clusterRoleBindingName" -}}
57+
{{ include "spark-operator.hook.clusterRoleName" . }}
58+
{{- end }}
59+
60+
{{/*
61+
Create the name of the Helm hook job.
62+
*/}}
63+
{{- define "spark-operator.hook.jobName" -}}
64+
{{ include "spark-operator.hook.name" . }}-job
65+
{{- end }}

‎charts/spark-operator-chart/templates/hook/job.yaml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{{/*
2+
Copyright 2024 The Kubeflow authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
https://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/}}
16+
17+
{{- if .Values.hook.upgradeCrd }}
18+
apiVersion: batch/v1
19+
kind: Job
20+
metadata:
21+
name: {{ include "spark-operator.hook.jobName" . }}
22+
namespace: {{ .Release.Namespace }}
23+
labels:
24+
{{- include "spark-operator.hook.labels" . | nindent 4 }}
25+
annotations:
26+
helm.sh/hook: pre-install,pre-upgrade
27+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
28+
helm.sh/hook-weight: "3"
29+
spec:
30+
template:
31+
spec:
32+
containers:
33+
- name: spark-operator-hook
34+
image: {{ include "spark-operator.image" . }}
35+
{{- with .Values.image.pullPolicy }}
36+
imagePullPolicy: {{ . }}
37+
{{- end }}
38+
args:
39+
- hook
40+
- start
41+
- --upgrade-crds
42+
- --crds-path
43+
- /etc/spark-operator/crds
44+
{{- with .Values.image.pullSecrets }}
45+
imagePullSecrets:
46+
{{- toYaml . | nindent 8 }}
47+
{{- end }}
48+
serviceAccountName: {{ include "spark-operator.hook.serviceAccountName" . }}
49+
{{- end }}

‎charts/spark-operator-chart/templates/hook/rbac.yaml

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{{/*
2+
Copyright 2024 The Kubeflow authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
https://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/}}
16+
17+
{{- if .Values.hook.upgradeCrd }}
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
kind: ClusterRole
20+
metadata:
21+
name: {{ include "spark-operator.hook.clusterRoleName" . }}
22+
namespace: {{ .Release.Namespace }}
23+
labels:
24+
{{- include "spark-operator.hook.labels" . | nindent 4 }}
25+
annotations:
26+
helm.sh/hook: pre-install,pre-upgrade
27+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
28+
helm.sh/hook-weight: "2"
29+
rules:
30+
- apiGroups:
31+
- apiextensions.k8s.io
32+
resources:
33+
- customresourcedefinitions
34+
resourceNames:
35+
- sparkapplications.sparkoperator.k8s.io
36+
- scheduledsparkapplications.sparkoperator.k8s.io
37+
verbs:
38+
- get
39+
- update
40+
---
41+
42+
apiVersion: rbac.authorization.k8s.io/v1
43+
kind: ClusterRoleBinding
44+
metadata:
45+
name: {{ include "spark-operator.hook.clusterRoleBindingName" . }}
46+
namespace: {{ .Release.Namespace }}
47+
labels:
48+
{{- include "spark-operator.hook.labels" . | nindent 4 }}
49+
annotations:
50+
helm.sh/hook: pre-install,pre-upgrade
51+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
52+
helm.sh/hook-weight: "2"
53+
subjects:
54+
- kind: ServiceAccount
55+
name: {{ include "spark-operator.hook.serviceAccountName" . }}
56+
namespace: {{ .Release.Namespace }}
57+
roleRef:
58+
apiGroup: rbac.authorization.k8s.io
59+
kind: ClusterRole
60+
name: {{ include "spark-operator.hook.clusterRoleName" . }}
61+
{{- end }}

‎charts/spark-operator-chart/templates/hook/serviceaccount.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{/*
2+
Copyright 2024 The Kubeflow authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
https://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/}}
16+
17+
{{- if .Values.hook.upgradeCrd }}
18+
apiVersion: v1
19+
kind: ServiceAccount
20+
metadata:
21+
name: {{ include "spark-operator.hook.serviceAccountName" . }}
22+
namespace: {{ .Release.Namespace }}
23+
labels:
24+
{{- include "spark-operator.hook.labels" . | nindent 4 }}
25+
annotations:
26+
helm.sh/hook: pre-install,pre-upgrade
27+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
28+
helm.sh/hook-weight: "1"
29+
{{- end }}

‎charts/spark-operator-chart/tests/hook/job_test.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#
2+
# Copyright 2024 The Kubeflow authors.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
suite: Test hook job
18+
19+
templates:
20+
- hook/job.yaml
21+
22+
release:
23+
name: spark-operator
24+
namespace: spark-operator
25+
26+
tests:
27+
- it: Should not create hook job if `hook.upgradeCrd` is false
28+
set:
29+
hook:
30+
upgradeCrd: false
31+
asserts:
32+
- hasDocuments:
33+
count: 0
34+
35+
- it: Should create hook job by default
36+
asserts:
37+
- containsDocument:
38+
apiVersion: batch/v1
39+
kind: Job
40+
name: spark-operator-hook-job

‎charts/spark-operator-chart/tests/hook/rbac_test.yaml

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#
2+
# Copyright 2024 The Kubeflow authors.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
suite: Test hook rbac
18+
19+
templates:
20+
- hook/rbac.yaml
21+
22+
release:
23+
name: spark-operator
24+
namespace: spark-operator
25+
26+
tests:
27+
- it: Should not create hook RBAC resources if `hook.upgradeCrd` is false
28+
set:
29+
hook:
30+
upgradeCrd: false
31+
asserts:
32+
- hasDocuments:
33+
count: 0
34+
35+
- it: Should create hook ClusterRole by default
36+
documentIndex: 0
37+
asserts:
38+
- containsDocument:
39+
apiVersion: rbac.authorization.k8s.io/v1
40+
kind: ClusterRole
41+
name: spark-operator-hook
42+
- contains:
43+
path: rules
44+
content:
45+
apiGroups:
46+
- apiextensions.k8s.io
47+
resources:
48+
- customresourcedefinitions
49+
resourceNames:
50+
- sparkapplications.sparkoperator.k8s.io
51+
- scheduledsparkapplications.sparkoperator.k8s.io
52+
verbs:
53+
- get
54+
- update
55+
56+
- it: Should create hook ClusterRoleBinding by default
57+
documentIndex: 1
58+
asserts:
59+
- containsDocument:
60+
apiVersion: rbac.authorization.k8s.io/v1
61+
kind: ClusterRoleBinding
62+
name: spark-operator-hook
63+
- contains:
64+
path: subjects
65+
content:
66+
kind: ServiceAccount
67+
name: spark-operator-hook
68+
namespace: spark-operator
69+
count: 1
70+
- equal:
71+
path: roleRef
72+
value:
73+
apiGroup: rbac.authorization.k8s.io
74+
kind: ClusterRole
75+
name: spark-operator-hook

‎charts/spark-operator-chart/tests/hook/serviceaccount_test.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#
2+
# Copyright 2024 The Kubeflow authors.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
suite: Test hook service account
18+
19+
templates:
20+
- hook/serviceaccount.yaml
21+
22+
release:
23+
name: spark-operator
24+
namespace: spark-operator
25+
26+
tests:
27+
- it: Should not create hook service account if `hook.upgradeCrd` is false
28+
set:
29+
hook:
30+
upgradeCrd: false
31+
asserts:
32+
- hasDocuments:
33+
count: 0
34+
35+
- it: Should create hook service account by default
36+
asserts:
37+
- containsDocument:
38+
apiVersion: v1
39+
kind: ServiceAccount
40+
name: spark-operator-hook

0 commit comments

Comments
 (0)