Skip to content

Add helm installation for volcano-global#49

Open
FAUST-BENCHOU wants to merge 1 commit intovolcano-sh:mainfrom
FAUST-BENCHOU:feat/helm
Open

Add helm installation for volcano-global#49
FAUST-BENCHOU wants to merge 1 commit intovolcano-sh:mainfrom
FAUST-BENCHOU:feat/helm

Conversation

@FAUST-BENCHOU
Copy link
Copy Markdown
Contributor

Closes #30
Installed via Helm:
Controller Manager Deployment、Webhook Manager Deployment、Webhook Service、Webhook initialization(SA + ClusterRole + ClusterRoleBinding + Job)

Signed-off-by: zhoujinyu <2319109590@qq.com>
@volcano-sh-bot
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign william-wang for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@gemini-code-assist
Copy link
Copy Markdown

Summary of Changes

Hello @FAUST-BENCHOU, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the deployment experience for volcano-global by integrating Helm chart support. This change streamlines the installation and management of the project's core components within a Karmada environment, offering users a more robust and configurable deployment mechanism than manual YAML application.

Highlights

  • Helm Chart Introduction: This pull request introduces a new Helm chart for deploying volcano-global, providing a standardized and simplified installation method for its components.
  • Deployment Components: The Helm chart facilitates the deployment of the Controller Manager Deployment, Webhook Manager Deployment, Webhook Service, and necessary Webhook initialization resources (ServiceAccount, ClusterRole, ClusterRoleBinding, and an initialization Job).
  • Documentation Update: The README.md documentation has been updated to include detailed instructions for installing volcano-global using the new Helm chart, now designated as the recommended installation method.
  • Customization Options: The Helm chart includes a values.yaml file, allowing users to customize various aspects of the deployment, such as image versions, replica counts, logging levels, and resource configurations for both the controller and webhook managers.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a Helm chart for deploying volcano-global, which is a valuable addition for simplifying the installation process. The overall structure of the chart is good, but I have identified several areas for improvement concerning Helm best practices, consistency, and security. Specifically, there is a critical issue in how container arguments are specified that will likely cause container startup failures. I've also noted security concerns regarding the default container security context and the use of the latest image tag. Furthermore, the chart's maintainability can be enhanced by consistently applying the provided Helm template helpers for labels and selectors. My detailed comments below provide specific suggestions to address these points.

- --feature-gates={{ .Values.custom.feature_gates }}
{{- end }}
- -v={{ .Values.custom.controller_log_level }}
- 2>&1
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The argument 2>&1 is a shell redirection operator. When specified in the args list of a container spec, it is passed as a literal string argument to the entrypoint rather than being interpreted by a shell. This will likely cause the application to fail since it is not a valid argument. The --logtostderr flag is already in use, which should correctly handle directing logs to stderr. Please remove this line.

{{- end }}
- --port={{ .Values.custom.webhook_port }}
- -v={{ .Values.custom.webhook_log_level }}
- 2>&1
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The argument 2>&1 is a shell redirection operator. When specified in the args list of a container spec, it is passed as a literal string argument to the entrypoint rather than being interpreted by a shell. This will likely cause the application to fail since it is not a valid argument. The --logtostderr flag is already in use, which should correctly handle directing logs to stderr. Please remove this line.

webhook_image_name: "volcanosh/volcano-global-webhook-manager"
image_pull_secret: ""
image_pull_policy: "IfNotPresent"
image_tag_version: "latest"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Using the latest tag for container images is not recommended as it is mutable and can lead to unpredictable behavior and difficulties in tracking the version of the running code. It is a best practice to use a specific, immutable version tag. Since the appVersion in Chart.yaml is 1.0.0, I recommend using that as the default.

  image_tag_version: "1.0.0"

Comment on lines +128 to +130
capabilities:
add: ["DAC_OVERRIDE"]
drop: ["ALL"]
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The DAC_OVERRIDE capability in the default security context allows the container to bypass file read, write, and execute permission checks, which poses a significant security risk. If this capability is not strictly necessary, it should be removed to adhere to the principle of least privilege. If file access is needed for mounted volumes like secrets, consider using fsGroup in the pod's securityContext as a more secure alternative.

    capabilities:
      drop: ["ALL"]

@@ -0,0 +1,12 @@
apiVersion: v1
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For new Helm charts, it is recommended to use apiVersion: v2. While v1 is still supported in Helm 3, v2 is the current standard and enables access to newer Helm features and capabilities.

apiVersion: v2

Comment on lines +54 to +74
{{/*
Controller labels
*/}}
{{- define "volcano-global.controllerLabels" -}}
{{ include "volcano-global.labels" . }}
app: volcano-global-controller-manager
{{- if .Values.custom.controller_labels }}
{{- toYaml .Values.custom.controller_labels }}
{{- end }}
{{- end }}

{{/*
Webhook labels
*/}}
{{- define "volcano-global.webhookLabels" -}}
{{ include "volcano-global.labels" . }}
app: volcano-global-webhook-manager
{{- if .Values.custom.webhook_labels }}
{{- toYaml .Values.custom.webhook_labels }}
{{- end }}
{{- end }}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The helper templates volcano-global.controllerLabels and volcano-global.webhookLabels are defined but not used anywhere in the chart. To improve maintainability and avoid dead code, it's best to remove them.

Comment on lines +20 to +27
app: volcano-global-controller-manager
template:
metadata:
labels:
app: volcano-global-controller-manager
{{- if .Values.custom.controller_podLabels }}
{{- toYaml .Values.custom.controller_podLabels | nindent 8 }}
{{- end }}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To align with Helm best practices and ensure consistency across the chart, it's recommended to use the volcano-global.selectorLabels helper for defining selectors and pod labels. This helper provides standard labels such as app.kubernetes.io/name and app.kubernetes.io/instance, which are part of the Kubernetes recommended labels.

      {{- include "volcano-global.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "volcano-global.selectorLabels" . | nindent 8 }}
        {{- if .Values.custom.controller_podLabels }}
        {{- toYaml .Values.custom.controller_podLabels | nindent 8 }}
        {{- end }}

Comment on lines +21 to +29
matchLabels:
app: volcano-global-webhook-manager
template:
metadata:
labels:
app: volcano-global-webhook-manager
{{- if .Values.custom.webhook_podLabels }}
{{- toYaml .Values.custom.webhook_podLabels | nindent 8 }}
{{- end }}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To align with Helm best practices and ensure consistency across the chart, it's recommended to use the volcano-global.selectorLabels helper for defining selectors and pod labels. This helper provides standard labels such as app.kubernetes.io/name and app.kubernetes.io/instance, which are part of the Kubernetes recommended labels.

      {{- include "volcano-global.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "volcano-global.selectorLabels" . | nindent 8 }}
        {{- if .Values.custom.webhook_podLabels }}
        {{- toYaml .Values.custom.webhook_podLabels | nindent 8 }}
        {{- end }}

@JesseStutler
Copy link
Copy Markdown
Member

/cc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature] Add helm installation for volcano-global

3 participants