statefulset.yaml

{{- $fullName := include "library-chart.fullname" . -}}
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ include "library-chart.fullname" . }}
  labels:
    {{- include "library-chart.labels" . | nindent 4 }}
spec:
{{- if not (.Values.autoscaling).enabled }}
  {{- if (.Values.global).suspend }}
  replicas: 0
  {{- else }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
{{- end }}
  serviceName: {{ include "library-chart.fullname" . }}
  selector:
    matchLabels:
      {{- include "library-chart.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        {{- if (.Values.git).enabled }}
        checksum/git: {{ include (print $.Template.BasePath "/secret-git.yaml") . | sha256sum }}
        {{- end }}
        {{- if (.Values.s3).enabled }}
        checksum/s3: {{ include (print $.Template.BasePath "/secret-s3.yaml") . | sha256sum }}
        {{- end }}
        {{- if (.Values.vault).enabled }}
        checksum/vault: {{ include (print $.Template.BasePath "/secret-vault.yaml") . | sha256sum }}
        {{- end }}
        {{- if not (empty (trim (include "library-chart.secretHive" .))) }}
        checksum/hive: {{ include (print $.Template.BasePath "/secret-hive.yaml") . | sha256sum }}
        {{- end }}
        {{- if not (empty (trim (include "library-chart.secretMetaflow" .))) }}
        checksum/metaflow: {{ include (print $.Template.BasePath "/secret-metaflow.yaml") . | sha256sum }}
        {{- end }}
        {{- if not (empty (trim (include "library-chart.secretMLFlow" .))) }}
        checksum/mlflow: {{ include (print $.Template.BasePath "/secret-mlflow.yaml") . | sha256sum }}
        {{- end }}
        {{- if not (empty (trim (include "library-chart.secretChromaDB" .))) }}
        checksum/chromadb: {{ include (print $.Template.BasePath "/secret-chromadb.yaml") . | sha256sum }}
        {{- end }}
        {{- if not (empty (trim (include "library-chart.secretMilvus" .))) }}
        checksum/milvus: {{ include (print $.Template.BasePath "/secret-milvus.yaml") . | sha256sum }}
        {{- end }}
        {{- if (include "library-chart.repository.enabled"  .) }}
        checksum/repository: {{ include (print $.Template.BasePath "/configmap-repository.yaml") . | sha256sum }}
        {{- end }}
        {{- if and .Values.certificates .Values.certificates.cacerts }}
        checksum/cacerts: {{ .Values.certificates.cacerts | sha256sum }}
        {{- end }}
        {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "library-chart.selectorLabels" . | nindent 8 }}
    spec:
      volumes:
        - name: config-files
          emptyDir: {}
        - name: home
        {{- if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (include "library-chart.fullname" .) }}
        {{- else }}
          emptyDir: {}
        {{- end }}
        - name: dshm
          emptyDir:
            medium: Memory
            sizeLimit: 10Gi
        {{- if (.Values.proxy).enabled }}
        - name: secret-proxy
          secret:
            secretName: {{ include "library-chart.secretNameProxy" . }}
        {{- end }}
        {{- if .Values.discovery.hive }}
        - name: secret-hive
          secret:
            secretName: {{ include "library-chart.secretNameHive" . }}
        {{- end }}
        {{- if .Values.discovery.metaflow }}
        - name: secret-metaflow
          secret:
            secretName: {{ include "library-chart.secretNameMetaflow" . }}
        {{- end }}
        {{- if and .Values.certificates .Values.certificates.cacerts }}
        - name: cacerts
          secret:
            secretName: {{ include "library-chart.secretNameCacerts" . }}
        {{- end }}
        {{- if (.Values.userPreferences.aiAssistant).enabled }}
        - name: secret-assistant
          secret:
            secretName: {{ include "library-chart.secretNameAssistant" . }}
        {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "library-chart.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      initContainers:
        - name: make-secrets-writable
          image: inseefrlab/onyxia-base:latest
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - -c
            - |
              echo 'initContainer make-secrets-writable is started';
              {{ if (.Values.userPreferences.aiAssistant).enabled }}
              mkdir /dest/continue
              cp /src/continue/config.yaml /dest/continue/config.yaml
              {{- end }}
              {{- if .Values.discovery.hive }}
              mkdir /dest/hive;
              cp /src/hive/hive-site.xml /dest/hive/hive-site.xml;
              {{- end }}
              {{- if .Values.discovery.metaflow }}
              mkdir /dest/metaflow;
              cp /src/metaflow/config.json /dest/metaflow/config.json;
              {{- end }}
              {{- if and .Values.certificates .Values.certificates.cacerts }}
              mkdir /dest/cacerts;
              {{- if regexMatch "^https?://" .Values.certificates.cacerts }}
              curl -s $(cat /cacerts/ca-certs.url) -o /tmp/ca.pem
              {{- else }}
              cp /cacerts/ca.pem /tmp/ca.pem
              {{- end }}
              awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "/dest/cacerts/cert." c ".crt"}' < /tmp/ca.pem;
              {{- end }}
          volumeMounts:
            {{- if (.Values.userPreferences.aiAssistant).enabled }}
            - name: secret-assistant
              mountPath: /src/continue
            {{- end }}
            - name: config-files
              mountPath: /dest
            {{- if and .Values.certificates .Values.certificates.cacerts }}
            - name: cacerts
              mountPath: /cacerts
            {{- end }}
            {{- if .Values.discovery.hive }}
            - name: secret-hive
              mountPath: /src/hive
            {{- end }}
            {{- if .Values.discovery.metaflow }}
            - name : secret-metaflow
              mountPath: /src/metaflow
            {{- end }}
          resources:
            limits:
              cpu: 50m
              memory: 50Mi
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          {{- if .Values.service.image.custom.enabled }}
          image: "{{ .Values.service.image.custom.version }}"
          {{- else }}
          image: "{{ .Values.service.image.version }}"
          {{- end }}
          command: ["/bin/sh","-c"]
          args: ["{{ .Values.init.standardInitPath }} /usr/bin/code-server --host 0.0.0.0 /home/{{ .Values.environment.user }}/work"]
          imagePullPolicy: {{ .Values.service.image.pullPolicy }}
          env:
            {{- if .Values.init.regionInit }}
            - name: REGION_INIT_SCRIPT
              value: {{ .Values.init.regionInit }}
            {{- end }}
            {{- if .Values.init.regionInitCheckSum }}
            - name: REGION_INIT_SCRIPT_CHECKSUM
              value: {{ .Values.init.regionInitCheckSum }}
            {{- end }}
            {{- if .Values.init.personalInit }}
            - name: PERSONAL_INIT_SCRIPT
              value: {{ .Values.init.personalInit }}
            {{- end }}
            {{- if .Values.init.personalInitArgs }}
            - name: PERSONAL_INIT_ARGS
              value: {{ .Values.init.personalInitArgs }}
            {{- end }}
            - name: PROJECT_USER
              value: {{ .Values.environment.user }}
            - name: PROJECT_GROUP
              value: {{ .Values.environment.group }}
            - name: ROOT_PROJECT_DIRECTORY
              value: /home/{{ .Values.environment.user }}/work
            {{- if .Values.userPreferences.darkMode }}
            - name: DARK_MODE
              value: "true"
            {{- end }}
            {{- if .Values.service.customPythonEnv }}
            - name: CUSTOM_PYTHON_ENV
              value: "true"
            {{- end }}
          envFrom:
            - secretRef:
                name : {{ include "library-chart.secretNameToken" . }}
            {{- if (.Values.git).enabled }}
            - secretRef:
                name: {{ include "library-chart.secretNameGit" . }}
            {{- end }}
            {{- if (.Values.s3).enabled }}
            - secretRef:
                name: {{ include "library-chart.secretNameS3" . }}
            {{- end }}
            {{- if (.Values.vault).enabled }}
            - secretRef:
                name: {{ include "library-chart.secretNameVault" . }}
            {{- end }}
            {{- if (.Values.proxy).enabled }}
            - secretRef:
                name: {{ include "library-chart.secretNameProxy" . }}
            {{- end }}
            {{- if (include "library-chart.repository.enabled" .) }}
            - configMapRef:
                name: {{ include "library-chart.configMapNameRepository" . }}
            {{- end }}
            {{- if not (empty (trim (include "library-chart.secretMLFlow" .))) }}
            - secretRef:
                name: {{ include "library-chart.secretNameMLFlow" . }}
            {{- end }}
            {{- if not (empty (trim (include "library-chart.secretChromaDB" .))) }}
            - secretRef:
                name: {{ include "library-chart.secretNameChromaDB" . }}
            {{- end }}
            {{- if not (empty (trim (include "library-chart.secretMilvus" .))) }}
            - secretRef:
                name: {{ include "library-chart.secretNameMilvus" . }}
            {{- end }}
            {{- if .Values.extraEnvVars }}
            - secretRef:
                name: {{ include "library-chart.secretNameExtraEnv" . }}
            {{- end }}
          livenessProbe:
            httpGet:
              path: /
              port: {{ .Values.networking.service.port }}
            timeoutSeconds: 2
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /
              port: {{ .Values.networking.service.port }}
          {{- if hasKey .Values "startupProbe" }}
          startupProbe:
            httpGet:
              path: /
              port: {{ .Values.networking.service.port }}
            {{- toYaml .Values.startupProbe | nindent 12 }}
          {{- end }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - mountPath: /home/{{ .Values.environment.user }}/work
              subPath: work
              name: home
            - mountPath: /dev/shm
              name: dshm
            {{ if (.Values.userPreferences.aiAssistant).enabled }}
            - mountPath: /home/{{ .Values.environment.user }}/.continue
              subPath: continue
              name: config-files
            {{- end }}
            {{- if (.Values.discovery).hive }}
            - name: config-files
              mountPath: /usr/local/lib/hive/conf/hive-site.xml
              subPath: hive/hive-site.xml
            {{- end }}
            {{- if (.Values.discovery).metaflow }}
            - name: config-files
              mountPath: /home/{{ .Values.environment.user }}/.metaflowconfig
              subPath: metaflow
            {{- end }}
            {{- if (.Values.certificates).pathToCaBundle }}
            - name: config-files
              mountPath: {{ .Values.certificates.pathToCaBundle }}
              subPath: cacerts
            {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}