Skip to content

Commit bcd2fd3

Browse files
velotioaasthavelotioaastha
authored
Merge branch 'main' into aastha/restric-k8s-permissions
2 parents 7fa422f + b5aceec commit bcd2fd3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+1153
-50
lines changed

‎.github/CODEOWNERS

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
* @gls4 @jsbroks @nfoucha @vanpelt
2-
/charts/launch-agent/ @bcsherma @gtarpenning @KyleGoyette @nickpenaranda @TimH98 @wandb-zacharyblasczyk
2+
/charts/launch-agent/ @bcsherma @KyleGoyette @TimH98

‎charts/launch-agent/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: launch-agent
33
icon: https://em-content.zobj.net/thumbs/240/apple/354/rocket_1f680.png
44
description: A Helm chart for running the W&B Launch Agent in Kubernetes
55
type: application
6-
version: 0.13.5
6+
version: 0.13.10
77
maintainers:
88
- name: wandb
99
email: [email protected]

‎charts/launch-agent/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ The table below describes all the available variables in the chart:
5757
| `launchConfig` | mutiline string | **Yes** | `null` | This should be set to the literal contents of your launch agent config. See the agent setup docs for details: https://docs.wandb.ai/guides/launch/setup-agent-advanced |
5858
| `volcano` | bool | No | `true` | Controls whether the volcano scheduler should be installed in your cluster along with the agent. Set to `false` to disable volcano installation. |
5959
| `gitCreds` | mutiline string | No | `null` | Contents of a git credentials file. |
60+
| `sshAuthSecrets` | list(object) | No | `[]` | Name of secret containing an ssh-auth kubernetes secret and the associated host for the ssh key. |
6061
| `serviceAccount.annotations` | object | No | `null` | Annotations for the wandb service account. |
6162
| `azureStorageAccessKey` | string | No | "" | Azure storage access key required for kaniko to acces build contexts in azure blob storage. |
6263
| `additionalEnvVars` | map(string) | No | {} | Map with environment variables to be set in the Launch Agent pod. |

‎charts/launch-agent/templates/configmap.yaml

+18-1
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,21 @@ kind: ConfigMap
88
metadata:
99
name: wandb-launch-configmap-{{ .Release.Name }}
1010
namespace: {{ .Values.namespace }}
11-
...
11+
---
12+
{{- if .Values.sshAuthSecrets }}
13+
---
14+
apiVersion: v1
15+
kind: ConfigMap
16+
metadata:
17+
name: ssh-config-{{ .Release.Name }}
18+
namespace: {{ .Values.namespace }}
19+
data:
20+
config: |
21+
{{- range $index, $secret := .Values.sshAuthSecrets }}
22+
Host {{ .host }}
23+
IdentityFile /home/launch_agent/.ssh/id_repo{{ $index }}
24+
IdentitiesOnly yes
25+
StrictHostKeyChecking no
26+
UserKnownHostsFile /dev/null
27+
{{- end }}
28+
{{- end }}

‎charts/launch-agent/templates/deployment.yaml

+54-10
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,23 @@ spec:
1818
metadata:
1919
labels:
2020
app: launch-agent-{{ .Release.Name }}
21-
{{- if .Values.agent.labels }}
22-
{{- toYaml .Values.agent.labels | trim | nindent 8 }}
23-
{{- end }}
21+
{{- if .Values.agent.labels }}
22+
{{- toYaml .Values.agent.labels | trim | nindent 8 }}
23+
{{- end }}
2424
spec:
2525
serviceAccountName: wandb-launch-serviceaccount-{{ .Release.Name }}
26-
{{- if .Values.kanikoPvcName }}
26+
{{- if or .Values.sshAuthSecrets .Values.kanikoPvcName }}
2727
initContainers:
28+
{{- end}}
29+
{{- if .Values.sshAuthSecrets }}
30+
- name: init-create-ssh-dir
31+
image: {{ .Values.agent.image }}
32+
command: ["sh", "-c", "mkdir -p /home/launch_agent/.ssh"]
33+
volumeMounts:
34+
- name: ssh-dir
35+
mountPath: /home/launch_agent/.ssh
36+
{{- end }}
37+
{{- if .Values.kanikoPvcName }}
2838
- name: kaniko-volume-chown
2939
image: {{ .Values.agent.image }}
3040
command: ["sh", "-c"]
@@ -101,12 +111,31 @@ spec:
101111
value: {{ .Values.kanikoDockerConfigSecret }}
102112
{{- end }}
103113
volumeMounts:
114+
- name: ssh-dir
115+
mountPath: /home/launch_agent/.ssh
104116
- name: wandb-launch-config
105117
mountPath: /home/launch_agent/.config/wandb
106118
readOnly: true
107119
{{ if .Values.gitCreds}}
108120
- name: git-creds
109-
mountPath: /home/launch_agent/
121+
mountPath: /home/launch_agent/.gitconfig
122+
subPath: .gitconfig
123+
readOnly: true
124+
- name: git-creds
125+
mountPath: /home/launch_agent/.git-credentials
126+
subPath: .git-credentials
127+
readOnly: true
128+
{{ end }}
129+
{{ if .Values.sshAuthSecrets }}
130+
{{- range $index, $secret := .Values.sshAuthSecrets }}
131+
- name: git-ssh-key-secret-{{ $index }}
132+
mountPath: /home/launch_agent/.ssh/id_repo{{ $index }}
133+
subPath: id_repo{{ $index }}
134+
readOnly: true
135+
{{- end }}
136+
- name: ssh-config
137+
mountPath: /home/launch_agent/.ssh/config
138+
subPath: config
110139
readOnly: true
111140
{{ end }}
112141
{{- if and .Values.customCABundle.configMap.name .Values.customCABundle.configMap.key }}
@@ -120,30 +149,45 @@ spec:
120149
mountPath: /home/launch_agent/kaniko
121150
{{ end }}
122151
volumes:
152+
- name: ssh-dir
153+
emptyDir: {}
123154
- name: wandb-launch-config
124155
configMap:
125156
name: wandb-launch-configmap-{{ .Release.Name }}
126157
{{ if .Values.gitCreds}}
127158
- name: git-creds
128159
secret:
129160
secretName: git-creds
130-
- name: git-config
131-
secret:
132-
secretName: git-config
133161
{{ end}}
162+
{{ if .Values.sshAuthSecrets }}
163+
{{- range $index, $secret := .Values.sshAuthSecrets }}
164+
- name: git-ssh-key-secret-{{ $index }}
165+
secret:
166+
secretName: {{ $secret.name }}
167+
items:
168+
- key: ssh-privatekey
169+
path: id_repo{{ $index }}
170+
{{- end }}
171+
- name: ssh-config
172+
configMap:
173+
name: ssh-config-{{ .Release.Name }}
174+
items:
175+
- key: config
176+
path: config
177+
{{ end }}
134178
{{- if and .Values.customCABundle.configMap.name .Values.customCABundle.configMap.key }}
135179
- name: custom-cabundle
136180
configMap:
137181
name: {{ .Values.customCABundle.configMap.name }}
138182
items:
139183
- key: {{ .Values.customCABundle.configMap.key }}
140184
path: custom-ca.crt
141-
{{- end}}
185+
{{- end }}
142186
{{ if .Values.kanikoPvcName }}
143187
- name: kaniko-pvc
144188
persistentVolumeClaim:
145189
claimName: {{ .Values.kanikoPvcName }}
146-
{{- end}}
190+
{{- end }}
147191
nodeSelector:
148192
{{- toYaml .Values.agent.nodeSelector | nindent 8 }}
149193
tolerations:

‎charts/launch-agent/values.yaml

+9-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ agent:
55
# Providing API key can be done external to this chart
66
useExternalWandbSecret: false
77
# Container image to use for the agent.
8-
image: wandb/launch-agent:0.17.1
8+
image: wandb/launch-agent:0.17.3
99
# Image pull policy for agent image.
1010
imagePullPolicy: Always
1111
# Resources block for the agent spec.
@@ -63,6 +63,14 @@ additionalSecretEnvVars:
6363
# repos. Example: https://username:[email protected]
6464
gitCreds: |
6565
66+
# list of secrets for the agent to use for ssh auth
67+
# format is a list of secret names and hosts secrets
68+
# should be created ass ssh-auth secrets,
69+
# see: https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets
70+
sshAuthSecrets:
71+
# - name: secret-name
72+
# host: example.com
73+
6674
# Annotations for the wandb service account. Useful when setting up workload identity on gcp.
6775
serviceAccount:
6876
annotations:

‎charts/operator-wandb/Chart.lock

+8-2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ dependencies:
88
- name: weave
99
repository: file://charts/weave
1010
version: 0.1.0
11+
- name: weave-trace
12+
repository: file://charts/weave-trace
13+
version: 0.1.0
1114
- name: parquet
1215
repository: file://charts/parquet
1316
version: 0.1.0
@@ -35,5 +38,8 @@ dependencies:
3538
- name: stackdriver
3639
repository: file://charts/stackdriver
3740
version: 0.1.0
38-
digest: sha256:9a6c69506deb6969686d5b220a0692b53cfa29642e059bdf27c440c5d7086bdb
39-
generated: "2024-06-05T11:04:02.508473-07:00"
41+
- name: yace
42+
repository: file://charts/yace
43+
version: 0.1.0
44+
digest: sha256:bca2b6781737da6806e4485605cf9ce87b1428944b14cb88f082024cc3500bbd
45+
generated: "2024-07-18T01:17:04.532871-04:00"

‎charts/operator-wandb/Chart.yaml

+9-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: operator-wandb
33
description: A Helm chart for deploying W&B to Kubernetes
44
type: application
5-
version: 0.13.14
5+
version: 0.15.3
66
appVersion: 1.0.0
77
icon: https://wandb.ai/logo.svg
88

@@ -24,6 +24,10 @@ dependencies:
2424
version: "*.*.*"
2525
repository: file://charts/weave
2626
condition: weave.install
27+
- name: weave-trace
28+
version: "*.*.*"
29+
repository: file://charts/weave-trace
30+
condition: weave-trace.install
2731
- name: parquet
2832
version: "*.*.*"
2933
repository: file://charts/parquet
@@ -60,3 +64,7 @@ dependencies:
6064
version: "*.*.*"
6165
repository: file://charts/stackdriver
6266
condition: stackdriver.install
67+
- name: yace
68+
version: "*.*.*"
69+
repository: file://charts/yace
70+
condition: yace.install

‎charts/operator-wandb/charts/app/templates/_helpers.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ app deployments.
116116
{{- $bucket = printf "az://%s/%s" .Values.global.bucket.name .Values.global.bucket.path -}}
117117
{{- end -}}
118118
{{- if eq .Values.global.bucket.provider "gcs" -}}
119-
{{- $bucket = printf "gs://%s" .Values.global.bucket.name -}}
119+
{{- $bucket = printf "gs://%s/%s" .Values.global.bucket.name .Values.global.bucket.path -}}
120120
{{- end -}}
121121
{{- if eq .Values.global.bucket.provider "s3" -}}
122122
{{- if and .Values.global.bucket.accessKey .Values.global.bucket.secretKey -}}

‎charts/operator-wandb/charts/app/templates/deployment.yaml

+8-2
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ spec:
6363
secretKeyRef:
6464
name: {{ include "wandb.mysql.passwordSecret" . }}
6565
key: MYSQL_PASSWORD
66-
command: ['bash', '-c', "until mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASSWORD -D$MYSQL_DATABASE --execute=\"SELECT 1\"; do echo waiting for db; sleep 2; done"]
66+
command: ['bash', '-c', "until mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASSWORD -D$MYSQL_DATABASE -P$MYSQL_PORT --execute=\"SELECT 1\"; do echo waiting for db; sleep 2; done"]
6767
containers:
6868
- name: {{ .Chart.Name }}
6969
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -114,6 +114,10 @@ spec:
114114
value: "http://{{ .Release.Name }}-parquet:8087"
115115
- name: PARQUET_ENABLED
116116
value: "true"
117+
{{- if index .Values.global "weave-trace" "enabled" }}
118+
- name: WEAVE_TRACES_ENABLED
119+
value: "true"
120+
{{- end }}
117121

118122
{{- if ne (include "wandb.redis.password" .) "" }}
119123
- name: REDIS_PASSWORD
@@ -227,6 +231,8 @@ spec:
227231
key: KAFKA_CLIENT_PASSWORD
228232
- name: KAFKA_TOPIC_RUN_UPDATE_SHADOW_QUEUE
229233
value: {{ include "wandb.kafka.runUpdatesShadowTopic" .}}
234+
- name: KAFKA_RUN_UPDATE_SHADOW_QUEUE_NUM_PARTITIONS
235+
value: "{{ include "wandb.kafka.runUpdatesShadowNumPartitions" .}}"
230236
- name: OVERFLOW_BUCKET_ADDR
231237
value: "{{ include "app.bucket" .}}"
232238
- name: GORILLA_RUN_UPDATE_SHADOW_QUEUE
@@ -237,7 +243,7 @@ spec:
237243
"name": "wandb",
238244
"prefix": "wandb-overflow"
239245
},
240-
"addr": "kafka://$(KAFKA_CLIENT_USER):$(KAFKA_CLIENT_PASSWORD)@$(KAFKA_BROKER_HOST):$(KAFKA_BROKER_PORT)/$(KAFKA_TOPIC_RUN_UPDATE_SHADOW_QUEUE)?producer_batch_bytes=1048576"
246+
"addr": "kafka://$(KAFKA_CLIENT_USER):$(KAFKA_CLIENT_PASSWORD)@$(KAFKA_BROKER_HOST):$(KAFKA_BROKER_PORT)/$(KAFKA_TOPIC_RUN_UPDATE_SHADOW_QUEUE)?producer_batch_bytes=1048576&num_partitions=$(KAFKA_RUN_UPDATE_SHADOW_QUEUE_NUM_PARTITIONS)"
241247
}
242248
{{- include "app.extraEnv" (dict "global" $.Values.global "local" .Values) | nindent 12 }}
243249
{{- include "wandb.extraEnvFrom" (dict "root" $ "local" .) | nindent 12 }}

‎charts/operator-wandb/charts/app/templates/serviceaccount.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if .Values.serviceAccount.create -}}
12
apiVersion: v1
23
kind: ServiceAccount
34
metadata:
@@ -14,3 +15,4 @@ metadata:
1415
{{- if .Values.serviceAccount.annotations -}}
1516
{{- toYaml .Values.serviceAccount.annotations | nindent 4 }}
1617
{{- end }}
18+
{{- end }}

‎charts/operator-wandb/charts/app/values.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ resources:
5353

5454
serviceAccount:
5555
create: true
56+
annotations: {}
5657

5758
role: {}
5859
roleBinding: {}

‎charts/operator-wandb/charts/console/templates/deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ spec:
3434
{{- toYaml .Values.pod.annotations | nindent 4 }}
3535
{{- end }}
3636
spec:
37-
serviceAccountName: {{ include "console.fullname" . }}
37+
serviceAccountName: {{ include "console.serviceAccountName" . }}
3838
{{- if .tolerations }}
3939
tolerations:
4040
{{- toYaml .tolerations | nindent 8 }}

‎charts/operator-wandb/charts/console/templates/service.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,10 @@ metadata:
1111
{{- toYaml .Values.service.labels | nindent 4 }}
1212
{{- end }}
1313
annotations:
14-
{{- include "wandb.deploymentAnnotations" $ | nindent 4 }}
14+
{{- if eq .Values.global.cloudProvider "aws" }}
15+
alb.ingress.kubernetes.io/healthcheck-path: /console/api/ready
16+
{{- end }}
17+
{{- include "wandb.serviceAnnotations" $ | nindent 4 }}
1518
{{- if .Values.service.annotations -}}
1619
{{- toYaml .Values.service.annotations | nindent 4 }}
1720
{{- end }}

‎charts/operator-wandb/charts/console/templates/serviceaccount.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if .Values.serviceAccount.create -}}
12
apiVersion: v1
23
kind: ServiceAccount
34
metadata:
@@ -14,3 +15,4 @@ metadata:
1415
{{- if .Values.serviceAccount.annotations -}}
1516
{{- toYaml .Values.serviceAccount.annotations | nindent 4 }}
1617
{{- end }}
18+
{{- end }}

‎charts/operator-wandb/charts/console/values.yaml

+3-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ extraCors: []
2121
common:
2222
labels: {}
2323
deployment: {}
24-
serviceAccount: {}
24+
serviceAccount:
25+
create: true
26+
annotations: {}
2527
clusterRole: {}
2628

2729
pod:

‎charts/operator-wandb/charts/flat-run-fields-updater/templates/_helpers.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ Create the name of the service account to use
112112
{{- $bucket = printf "az://%s/%s" .Values.global.bucket.name .Values.global.bucket.path -}}
113113
{{- end -}}
114114
{{- if eq .Values.global.bucket.provider "gcs" -}}
115-
{{- $bucket = printf "gs://%s" .Values.global.bucket.name -}}
115+
{{- $bucket = printf "gs://%s/%s" .Values.global.bucket.name .Values.global.bucket.path -}}
116116
{{- end -}}
117117
{{- if eq .Values.global.bucket.provider "s3" -}}
118118
{{- if and .Values.global.bucket.accessKey .Values.global.bucket.secretKey -}}

0 commit comments

Comments
 (0)