#4292: Home storages creator job #4342
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| apiVersion: batch/v1beta1 | ||
| kind: CronJob | ||
| metadata: | ||
| name: cp-home-dirs | ||
| namespace: default | ||
| spec: | ||
| schedule: ${CP_HOME_DIRS_SCHEDULE} | ||
| successfulJobsHistoryLimit: 1 | ||
| failedJobsHistoryLimit: 1 | ||
| jobTemplate: | ||
| spec: | ||
| template: | ||
| metadata: | ||
| namespace: default | ||
| labels: | ||
| cloud-pipeline/cp-home-dirs: "true" | ||
| cloud-pipeline/core-component: "CronJob" | ||
| spec: | ||
| nodeSelector: | ||
| cloud-pipeline/cp-home-dirs: "true" | ||
| tolerations: | ||
| - key: node-role.kubernetes.io/master | ||
| effect: NoSchedule | ||
| restartPolicy: OnFailure | ||
| containers: | ||
| - name: cp-home-dirs | ||
| image: ${CP_DOCKER_DIST_SRV}lifescience/cloud-pipeline:home-dirs-$CP_VERSION | ||
| imagePullPolicy: IfNotPresent | ||
| securityContext: | ||
| privileged: true | ||
|
Member
There was a problem hiding this comment. I believe we don't really need this, right? |
||
| command: | ||
| - /bin/sh | ||
| - -c | ||
| - /create_home_dirs.sh | ||
| envFrom: | ||
| - configMapRef: | ||
| name: cp-config-global | ||
| volumeMounts: | ||
| - name: home-dirs-logs | ||
| mountPath: /opt/home_dirs/logs | ||
| volumes: | ||
| - name: home-dirs-logs | ||
| hostPath: | ||
| path: /opt/home_dirs/logs | ||
| imagePullSecrets: | ||
| - name: cp-distr-docker-registry-secret | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,10 @@ | ||
| ARG BASE_IMG=quay.io/lifescience/cloud-pipeline:tools-base-rockylinux-8-0.17 | ||
| FROM $BASE_IMG | ||
|
|
||
| RUN yum install -y curl openssh-clients nfs-utils | ||
|
|
||
| RUN curl -sL "https://cloud-pipeline-oss-builds.s3.us-east-1.amazonaws.com/tools/jq/jq-1.6/jq-linux64" -o /usr/bin/jq && \ | ||
| chmod +x /usr/bin/jq | ||
|
|
||
| ADD create_home_dirs.sh /create_home_dirs.sh | ||
| RUN chmod +x /create_home_dirs.sh |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| # Home Storage Creator | ||
|
|
||
| This component creates Cloud Pipeline **home storages** (file share and/or object storage) for users who have no default storage, assigns them as the user's default storage and sets permissions on the share. | ||
|
|
||
| --- | ||
| ## Building the image | ||
|
|
||
| From the repository root: | ||
|
|
||
| ```bash | ||
| docker build -t <registry>/lifescience/cloud-pipeline:home-dirs-<version> \ | ||
| -f deploy/docker/cp-home-dirs-creator/Dockerfile \ | ||
| deploy/docker/cp-home-dirs-creator | ||
| ``` | ||
| The image entrypoint runs `/create_home_dirs.sh` (packaged in the image build). | ||
|
|
||
| --- | ||
|
|
||
| ## Kubernetes (CronJob) | ||
|
|
||
| The manifest `deploy/contents/k8s/cp-home-creator/cp-home-creator-dpl.yaml` defines a **CronJob** that runs **once per hour** (`schedule: "0 * * * *"`). | ||
|
|
||
| - **Configuration:** environment variables are loaded from the ConfigMap `cp-config-global` (`envFrom`). | ||
|
|
||
| Apply: | ||
|
|
||
| ```bash | ||
| kubectl apply -f deploy/contents/k8s/cp-home-creator/cp-home-creator-job.yaml | ||
| ``` | ||
|
|
||
| ## Parameters | ||
|
|
||
| Variables are read from the environment (via `cp-config-global`). Names below match the script. | ||
|
|
||
| ### Required | ||
|
|
||
| | Parameter | Description | | ||
| |--------------------------------------|-------------------------------------------------------------| | ||
| | **API_EXTERNAL** (**API**) | Cloud Pipeline REST API base URL. | | ||
| | **CP_API_JWT_ADMIN** (**API_TOKEN**) | JWT with rights to create storages and update users. | | ||
| | **CP_HOME_DIRS_ID_ROOT_FOLDER** | Library folder ID root where new home storages are created. | | ||
|
|
||
| ### Optional (general) | ||
|
|
||
| | Parameter | Default | Description | | ||
| |-----------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ||
| | **CP_HOME_DIRS_SERVICE_ACCOUNTS** | `""` | Comma-separated user IDs to skip (service accounts). | | ||
| | **CP_HOME_DIRS_SERVICE_MOUNT_CHMOD** | `755` | `chmod` applied on the NFS-mounted home directory tree after creation. | | ||
| | **CP_HOME_DIRS_FS_HOME_STORAGE_ENABLE** | `true` | If `true`, file-share home flow is used when file share settings are present; must be paired with `CP_HOME_DIRS_ID_FILE_SHARE` and `CP_HOME_DIRS_ADDR_FILE_SHARE`. | | ||
| | **CP_HOME_DIRS_FS_HOME_STORAGE_PREFIX** | `""` | Prefix for file/object storage names/paths, e.g. `'HOME.'` | | ||
| | **CP_HOME_DIRS_CREATE_OBJECT_STORAGE** | `false` | If `true`, also creates object storage for the user. | | ||
| | **CP_HOME_DIRS_CREATE_SSH_KEYS** | `true` | If `true`, ensures users have SSH keys in metadata; if `false`, skips SSH key generation/check. | | ||
| | **CP_HOME_DIRS_STORAGE_OBJECT_TYPE** | `S3` | Object storage type label used in naming. | | ||
| | **CP_HOME_DIRS_CREATE_BASHRC** | `false` | If `true`, seeds `.bashrc` from `/etc/skel` on the NFS home when missing. | | ||
|
|
||
| ### Optional (FS quotas) | ||
|
|
||
| | Parameter | Default | Description | | ||
| |-----------|---------|-------------| | ||
| | **CP_HOME_DIRS_APPLY_FS_QUOTAS** | `false` | If `true`, applies FS quota notification thresholds on default storages. | | ||
| | **CP_HOME_DIRS_FS_QUOTAS_VOLUME_THRESHOLD_GB_DISABLE_MOUNT** | `250` | Threshold (GB) for disable-mount notification. | | ||
| | **CP_HOME_DIRS_FS_QUOTAS_VOLUME_THRESHOLD_GB_READ_ONLY** | `300` | Threshold (GB) for read-only notification. | | ||
|
|
||
| ### File share (NFS / EFS) | ||
|
|
||
| When file home storage is enabled, **both** are required: | ||
|
|
||
| | Parameter | Description | | ||
| |-----------|-------------| | ||
| | **CP_HOME_DIRS_ID_FILE_SHARE** | File share mount ID in Cloud Pipeline. | | ||
| | **CP_HOME_DIRS_ADDR_FILE_SHARE** | NFS server and export root (e.g. `fs-xxxx.efs.region.amazonaws.com:/home`). Per-user path is `CP_HOME_DIRS_ADDR_FILE_SHARE/${user_name}`. | | ||
|
|
||
| --- | ||
|
|
||
| ## Overview | ||
|
|
||
| 1. Loads users without `defaultStorageId`. | ||
| 2. Skips IDs listed in `CP_HOME_DIRS_SERVICE_ACCOUNTS`. | ||
| 3. **File share path:** creates or finds the FILE_SHARE datastorage via API, grants ownership, sets default storage, updates chmod metadata, then **mounts** `CP_HOME_DIRS_ADDR_FILE_SHARE/<user>` and optional prepares the directory structure (optional `.bashrc`). | ||
| 5. **Object storage path:** if `CP_HOME_DIRS_CREATE_OBJECT_STORAGE=true`, creates object storage as configured. | ||
| 6. If `CP_HOME_DIRS_APPLY_FS_QUOTAS=true`, applies quota notification settings where applicable. |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
let's rename this file to
cp-home-creator-job.yaml