Skip to content

Commit 44f8dc3

Browse files
alex-treebeardalex-treebeard
authored
Merge pull request #4 from treebeardtech/auto-sync
Auto sync app + docs
2 parents 059cd93 + 2618342 commit 44f8dc3

File tree

12 files changed

+399
-182
lines changed

12 files changed

+399
-182
lines changed

‎README.md

Lines changed: 32 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -99,11 +99,37 @@ The [eks-https-loadbalancer](examples/eks-https-loadbalancer) example also shows
9999

100100
Profiles are a Kubeflow abstraction that lets you securely isolate users from each other. See the [Kubeflow docs on profiles](https://www.kubeflow.org/docs/components/central-dash/profiles/)
101101

102+
### Manage your instance with GitOps
103+
104+
Lots of the config used to define your Kubeflow instance has has no dependency on
105+
Terraform resource outputs such as role ARNs.
106+
107+
These may best be stored in a git repo and referenced using Argo's [multiple sources feature](https://argo-cd.readthedocs.io/en/stable/user-guide/multiple_sources/)
108+
109+
Using this approach you can invoke this terraform module (or the underlying bootstrap helm chart) with config like the following that combines injected values with values from a git repo:
110+
111+
```yaml
112+
sources:
113+
# - repoURL: 'https://github.com/treebeardtech/gitops-bridge-argocd-control-plane-template'
114+
# targetRevision: dev
115+
# ref: values
116+
- repoURL: ghcr.io/treebeardtech
117+
targetRevision: 0.1-2024-03-08-T12-25-15
118+
chart: kubeflow-argo-apps
119+
helm:
120+
ignoreMissingValueFiles: true
121+
# valueFiles:
122+
# - $values/some-dir/my-values-file.yaml # use your own gitops values file
123+
values: |
124+
# pass in terraform outputs from cloud resources
125+
# e.g. ARNs, node labels, etc.
126+
```
127+
102128
### Teardown
103129
104130
1. Manually remove any manually created Kubeflow resources, e.g. Notebook Servers and Volumes
105131
2. Remove the terraform module, e.g. with `terraform destroy` if you have installed directly from CLI
106-
3. Clean up remaining resources, e.g. Istio leaves behind some secrets that can prevent successful re-installation.
132+
3. Clean up remaining resources, e.g. Istio leaves behind some secrets that can prevent successful re-installation. You may also want to clear out CRDs, persistent volumes and namespaces
107133

108134
## Troubleshooting
109135

@@ -133,7 +159,6 @@ This module is built on top of the official [Kubeflow Manifests repo](https://gi
133159
|------|---------|
134160
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.12 |
135161
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
136-
| <a name="provider_time"></a> [time](#provider\_time) | >= 0.9 |
137162

138163
## Modules
139164

@@ -143,47 +168,18 @@ No modules.
143168

144169
| Name | Type |
145170
|------|------|
146-
| [helm_release.admission_webhook](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
147171
| [helm_release.argo_cd](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
148-
| [helm_release.central_dashboard](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
149-
| [helm_release.cert_manager](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
150-
| [helm_release.cluster_issuer](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
151-
| [helm_release.dex](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
152-
| [helm_release.istio_base](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
153-
| [helm_release.istio_ingressgateway](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
154-
| [helm_release.istiod](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
155-
| [helm_release.jupyter_web_app](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
156-
| [helm_release.kubeflow_istio_resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
157-
| [helm_release.kubeflow_namespace](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
158-
| [helm_release.kubeflow_roles](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
159-
| [helm_release.notebook_controller](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
160-
| [helm_release.oidc_authservice](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
161-
| [helm_release.profile](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
162-
| [helm_release.profiles_kfam](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
163-
| [helm_release.pvc_viewer_controller](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
164-
| [helm_release.volumes_web_app](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
165-
| [null_resource.kf_apps_end](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
166-
| [null_resource.kf_apps_start](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
167-
| [null_resource.kf_core_end](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
168-
| [null_resource.kf_core_start](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
169-
| [null_resource.kf_dependencies_end](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
170-
| [null_resource.kf_dependencies_start](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
171-
| [time_sleep.wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
172+
| [helm_release.kubeflow_bootstrap](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
173+
| [null_resource.start](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
172174

173175
## Inputs
174176

175177
| Name | Description | Type | Default | Required |
176178
|------|-------------|------|---------|:--------:|
177179
| <a name="input_enable_argocd"></a> [enable\_argocd](#input\_enable\_argocd) | n/a | `bool` | `true` | no |
178-
| <a name="input_enable_cert_manager"></a> [enable\_cert\_manager](#input\_enable\_cert\_manager) | n/a | `bool` | `true` | no |
179-
| <a name="input_enable_example_profile"></a> [enable\_example\_profile](#input\_enable\_example\_profile) | n/a | `bool` | `true` | no |
180-
| <a name="input_enable_https"></a> [enable\_https](#input\_enable\_https) | n/a | `bool` | `false` | no |
181-
| <a name="input_enable_istio_base"></a> [enable\_istio\_base](#input\_enable\_istio\_base) | n/a | `bool` | `true` | no |
182-
| <a name="input_enable_istio_resources"></a> [enable\_istio\_resources](#input\_enable\_istio\_resources) | Enable istio resources for clusters with pre-existing istio | `bool` | `true` | no |
183-
| <a name="input_enable_istiod"></a> [enable\_istiod](#input\_enable\_istiod) | n/a | `bool` | `true` | no |
184-
| <a name="input_hostname"></a> [hostname](#input\_hostname) | n/a | `string` | `"*"` | no |
185-
| <a name="input_issuer_name"></a> [issuer\_name](#input\_issuer\_name) | Required if enable\_https is true | `string` | `"null"` | no |
186-
| <a name="input_user_password"></a> [user\_password](#input\_user\_password) | The password for the user | `string` | `"12341234"` | no |
180+
| <a name="input_kubeflow_set"></a> [kubeflow\_set](#input\_kubeflow\_set) | Value block with custom STRING values to be merged with the values yaml. | <pre>list(object({<br> name = string<br> value = string<br> }))</pre> | `null` | no |
181+
| <a name="input_kubeflow_set_sensitive"></a> [kubeflow\_set\_sensitive](#input\_kubeflow\_set\_sensitive) | Value block with custom sensitive values to be merged with the values yaml that won't be exposed in the plan's diff. | <pre>list(object({<br> path = string<br> value = string<br> }))</pre> | `null` | no |
182+
| <a name="input_kubeflow_values"></a> [kubeflow\_values](#input\_kubeflow\_values) | Extra values | `list(string)` | `[]` | no |
187183

188184
## Outputs
189185

‎examples/eks-https-loadbalancer/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
| <a name="input_enable_treebeardkf"></a> [enable\_treebeardkf](#input\_enable\_treebeardkf) | Enable Treebeard KF | `bool` | `false` | no |
5353
| <a name="input_host"></a> [host](#input\_host) | n/a | `any` | n/a | yes |
5454
| <a name="input_hosted_zone_id"></a> [hosted\_zone\_id](#input\_hosted\_zone\_id) | n/a | `any` | n/a | yes |
55+
| <a name="input_password"></a> [password](#input\_password) | password for [email protected] | `any` | n/a | yes |
5556

5657
## Outputs
5758

‎examples/eks-https-loadbalancer/kubeflow.tf

Lines changed: 69 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -3,69 +3,75 @@ module "treebeardkf" {
33
source = "../.."
44
kubeflow_values = [
55
<<EOF
6-
certManager:
7-
enabled: false
8-
istioBase:
9-
enabled: false
10-
istiod:
11-
enabled: false
12-
istioResources:
13-
spec:
14-
source:
15-
kustomize:
16-
patches:
17-
- target:
18-
kind: Gateway
19-
name: kubeflow-gateway
20-
patch: |-
21-
- op: replace
22-
path: /spec/servers/0
23-
value:
24-
hosts:
25-
- ${var.host}
26-
port:
27-
name: https
28-
number: 443
29-
protocol: HTTPS
30-
tls:
31-
credentialName: gateway-cert
32-
mode: SIMPLE
33-
gateway:
34-
spec:
35-
sources:
36-
- chart: 'gateway'
37-
repoURL: 'https://istio-release.storage.googleapis.com/charts'
38-
targetRevision: "1.18.7"
39-
helm:
40-
releaseName: "istio-ingressgateway"
41-
ignoreMissingValueFiles: true
42-
valueFiles: []
43-
values: |
44-
service:
45-
type: LoadBalancer
46-
serviceAccount:
47-
name: istio-ingressgateway-service-account
48-
resources:
49-
requests:
50-
cpu: 10m
51-
memory: 64Mi
52-
limits:
53-
cpu: 2000m
54-
memory: 1024Mi
55-
dex:
56-
spec:
57-
project: default
58-
source:
59-
kustomize:
60-
patches:
61-
- target:
62-
kind: Secret
63-
name: dex-passwords
64-
patch: |-
65-
- op: replace
66-
path: /stringData/DEX_USER_PASSWORD
67-
value: ${bcrypt(var.password)}
68-
6+
sources:
7+
- repoURL: ghcr.io/treebeardtech
8+
targetRevision: 0.1-2024-03-08-T12-25-15
9+
chart: kubeflow-argo-apps
10+
helm:
11+
ignoreMissingValueFiles: true
12+
values: |
13+
certManager:
14+
enabled: false
15+
istioBase:
16+
enabled: false
17+
istiod:
18+
enabled: false
19+
istioResources:
20+
spec:
21+
source:
22+
kustomize:
23+
patches:
24+
- target:
25+
kind: Gateway
26+
name: kubeflow-gateway
27+
patch: |-
28+
- op: replace
29+
path: /spec/servers/0
30+
value:
31+
hosts:
32+
- ${var.host}
33+
port:
34+
name: https
35+
number: 443
36+
protocol: HTTPS
37+
tls:
38+
credentialName: gateway-cert
39+
mode: SIMPLE
40+
gateway:
41+
spec:
42+
sources:
43+
- chart: 'gateway'
44+
repoURL: 'https://istio-release.storage.googleapis.com/charts'
45+
targetRevision: "1.18.7"
46+
helm:
47+
releaseName: "istio-ingressgateway"
48+
ignoreMissingValueFiles: true
49+
valueFiles: []
50+
values: |
51+
service:
52+
type: LoadBalancer
53+
serviceAccount:
54+
name: istio-ingressgateway-service-account
55+
resources:
56+
requests:
57+
cpu: 10m
58+
memory: 64Mi
59+
limits:
60+
cpu: 2000m
61+
memory: 1024Mi
62+
dex:
63+
spec:
64+
project: default
65+
source:
66+
kustomize:
67+
patches:
68+
- target:
69+
kind: Secret
70+
name: dex-passwords
71+
patch: |-
72+
- op: replace
73+
path: /stringData/DEX_USER_PASSWORD
74+
value: ${bcrypt(var.password)}
6975
EOF
7076
]
7177
depends_on = [

‎examples/k3s-existing-istio/main.tf

Lines changed: 13 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -104,33 +104,19 @@ module "treebeardkf" {
104104
source = "../.."
105105
kubeflow_values = [
106106
<<EOF
107-
certManager:
108-
enabled: false
109-
istioBase:
110-
enabled: false
111-
istiod:
112-
enabled: false
113-
# istioResources:
114-
# spec:
115-
# source:
116-
# kustomize:
117-
# patches:
118-
# - target:
119-
# kind: Gateway
120-
# name: kubeflow-gateway
121-
# patch: |-
122-
# - op: replace
123-
# path: /spec/servers/0
124-
# value:
125-
# hosts:
126-
# - kf.example.com
127-
# port:
128-
# name: https
129-
# number: 443
130-
# protocol: HTTPS
131-
# tls:
132-
# credentialName: gateway-cert
133-
# mode: SIMPLE
107+
sources:
108+
- repoURL: ghcr.io/treebeardtech
109+
targetRevision: 0.1-2024-03-08-T12-25-15
110+
chart: kubeflow-argo-apps
111+
helm:
112+
ignoreMissingValueFiles: true
113+
values: |
114+
certManager:
115+
enabled: false
116+
istioBase:
117+
enabled: false
118+
istiod:
119+
enabled: false
134120
EOF
135121
]
136122
depends_on = [

‎examples/k3s/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,6 @@ k3d cluster delete demo
114114
| Name | Version |
115115
|------|---------|
116116
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | ~> 2.12.1 |
117-
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | ~> 2.25.2 |
118117

119118
## Providers
120119

0 commit comments

Comments
 (0)