iterative/helm-charts

📦 Iterative Helm charts 🐳

helm-charts's Issues

Add support for custom root CA certificate

The Studio Helm chart does not offer any way to include a custom root CA certificate. We want to support this scenario similarly to the way we do it in the dockerized version of Studio, albeit in a more user-friendly way.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

• Update nginx Docker tag to v1.26.0
• Update Helm release postgresql to v15
• Update Helm release redis to v19

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• Update tibdex/github-app-token digest to 3eb77c7
• Update Helm release redis to v17.17.1

Detected dependencies

github-actions

.github/workflows/helm-docs.yaml

• tibdex/github-app-token b62528385c34dbc9f38e5f4225ac829252d1ea92
• actions/checkout v4
• stefanzweifel/git-auto-commit-action v5

.github/workflows/helm-lint-and-install.yaml

• actions/checkout v4
• azure/setup-helm v4
• actions/setup-python v5
• helm/chart-testing-action v2.6.1
• helm/kind-action v1.10.0
• actions/checkout v4
• azure/setup-helm v4

.github/workflows/helm.yaml

• actions/checkout v4
• dorny/paths-filter v3.0.2
• actions/checkout v4
• azure/setup-helm v4
• helm/chart-releaser-action v1.6.0

.github/workflows/leaked_secrets_scan.yaml

• actions/checkout v4

.github/workflows/studio_release.yml

• actions/checkout v4
• iterative/setup-cml v1

helm-values

charts/studio/values.yaml

• docker.io/bitnami/pgbouncer 1.22.1
• nginx 1.25.1-alpine

helmv3

charts/studio/Chart.yaml

• redis 17.14.3
• postgresql 11.9.13

---

• Check this box to trigger a request for Renovate to run again on this repository

Redis - support for non SSL protected environments

Please provide a way to securely configure Redis connection using a secret and SSL.

Use case is for using external Redis cache service instead of in-cluster. The service, by policy, has non-SSL port 6379 disabled. The service only accepts connections on port 6380 and is secured by a secret (access key / password).

Rename `ingress.protocol` to `ingress.scheme` in `_helpers.tpl`

• https://github.com/iterative/studio/pull/7690#issuecomment-1725526566
  • https://github.com/iterative/studio/pull/7690#issuecomment-1727672427

helm-charts/charts/studio/templates/_helpers.tpl

Lines 194 to 196 in b643903

	{{- define "ingress.protocol" -}}
	http{{- if $.Values.global.ingress.tlsEnabled }}s{{- end}}
	{{- end }}

Implement Job for migrations process

Add provision to inject additional environment variables to Studio

Customer specific features are controlled through environment variables / flags. Need to extend Helm chart providing a way to inject customer specific environment variables through values.yaml / override file.

For instance:

extra_vars:
  - name: CUSTOMER_SPEC_VAR_1
     value: customer-variable-value-1
  - name: CUSTOMER_SPEC_VAR_2
     value: customer-variable-value-2

These can then be added to various studio components as needed.

Add missing Readiness and Liveness probes definitions

Test Ray cluster on GitHub Actions

We should probably set .Values.ray.enabled to true when running the chart-testing workflow and make sure it works.

Include an autogenerated self-signed TLS certificate by default

For convenience, including an autogenerated self-signed TLS certificate would be nice so that HTTPS will work even when the user did not configure it explicitly.

Define Ingress for /webhook

Create Helm repository using Github Pages

We should create a Helm repository hosted on GitHub Pages so that users can do everything via the helm command and won't need to clone this Git repository.

Add support for `SELF_HOSTED_LICENSE_KEY`

Currently it's an undocumented environment variable:

values.yaml

global:
  envVars:
    SELF_HOSTED_LICENSE_KEY: ...

Let's consider documenting it as part of the values structure, and storing the value in a Kubernetes secret:

values.yaml

global:
  license: ...

Similarly, we should explore the option of unifying this setting and the container image pull secret, because in practice they're already the same.

Create a changelog

We should have a changelog for our Helm charts so that users can read about breaking changes and adjust their values.yml accordingly.

Adding Opt-in Analytics (mixpanel) Support

Opt-in value to fill in MIXPANEL_PROJECT_TOKEN env var and send it to frontend pod.
We should keep this opt-in - it's both an unexpected behavior, and also will most likely not be wanted or possible for most self-hosted installations (no internet access).

This is not considered secret, but can arguably be in the secret and not configmap 🤷

Add provision for Azure Blob as Persistent Volume config for Blobvault

As most data stored on the blobvault is supposed to be static data, ideal backend for blobvault should be an object/blob store. Add provision in the helm chart to provision an object store based Persistent Volume to be used by the studio backend component.

Support read-only mode in pod security context

Currently, enabling read-only mode in the security context for the UI pod causes it to crash.
This is because the UI uses server-side rendering and must write compiled files to the local filesystem. We should mount the directory for the compiled files as a volume to fix this.

UPGRADE FAILED: nil pointer evaluating interface

From #123 (comment)

The lint-test workflow may break unexpectedly when the pull request branch contains new values not present in the main branch. As per #123 (comment), we can wrap every level with parenteses to avoid the error, but values will still be null.

Example

Error: UPGRADE FAILED: template: studio/templates/raycluster-studio.yaml:1:14: executing "studio/templates/raycluster-studio.yaml" at <.Values.ray.enabled>: nil pointer evaluating interface {}.enabled

References

• helm/chart-testing#525
• helm/chart-testing#531
• helm/helm#9653

Support Setting User limit

Should be SELF_HOSTED_USER_LIMIT (currently using old on-prem terminology)
Need to add to values + configmap and pass to backend

Enabling Ingress configuration sets from API_URL and UI_URL

Bug

In the env_file.tpl there is a range loop:

helm-charts/charts/studio/templates/_env_vars.tpl

Line 8 in 10ef5e4

{{- range .paths }}

which for more than one entry in values.yaml

helm-charts/charts/studio/values.yaml

Line 182 in 10ef5e4

hosts:

Can cause, that the result of the range loop will have multiple values:

- name: API_URL
  value: https://api1/api
  value: https://api2/api

Expected result

The expected value here is a single endpoint.

Provision to add CA cert for Studio UI component

Studio UI being a node component, needs an extra variable to pass the CA certificate file path. Need to extend the chart to accommodate cert injection and variable configuration.

A possible solution could be:

• Create an optional configmap with CA certs which can be mounted as a volume to the UI component
• If the configmap exists, export NODE_EXTRA_CA_CERTS environment variable to UI component with value set as path/to/certificate-file

Ingress support for path based routing

Please extend the helm chart to provide a way for hosting studio with path based routing. For instance, serve studio and its sub-components on /studio path instead of default /.

Autogenerate Minio and Postgres passwords

Like we do for SECRET_KEY, we should also autogenerate Minio and Postgres passwords unless provided in values.yaml

helm-charts/charts/studio/templates/secrets.yaml

Lines 43 to 51 in c828a33

	# Set secretKey to existing value or generate a random one
	{{- if .Values.global.secrets.secretKey }}
	secretKey: {{ .Values.global.secrets.secretKey | b64enc }}
	{{- else }}
	{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "studio") | default dict }}
	{{- $secretData := (get $secretObj "data") | default dict }}
	{{- $secretKey := (get $secretData "secretKey") | default (randAscii 40 | b64enc) }}
	secretKey: {{ $secretKey | quote }}
	{{- end }}

Standardize commit messages

We'd like to include information in all git commit messages about the type of change. To achieve this, we can implement Conventional Commits or use prefixes like bug:, docs:, feat:, etc.

Lastly, we must ensure that all contributor's commit messages conform to this standard via some safeguards like pre-commit or a CI job.

CSS breaks while using path based routing

CSS break when hosting studio on non-default path, for instance /studio Screenshot attached

Make blobvault PVC storage optional, if S3 bucket is used

In #82 we introduced the local baking store to fix issues with Minio (missing path based routing). Delivering the change we started deploying nginx container, which was mounting the PVC volume blobvault attached to worker pod.

C4Dynamic
    ContainerDb(c1, "blobvault", "PVC")
    Container_Boundary(B, "Worker") {
      Container(c2, "Worker Pod")
    }
    Container_Boundary(c, "Nginx Pod",) {
      Container(c3, "Nginx")
    }
    Rel(c2, c1, "")
    Rel(c1, c3, "")

Tasks

Beta Give feedback

1. Make optional PVC volume if S3 bucket is used
2. Replace nginx helm-chart with nginx deployment
3. Add Nginx sidecar to backend pod, if basePath is configured for non /
4. Do not deploy nginx if pvc is not deployed
5. Validate if more than 1 worker is created to use S3 bucket
6. Do not deploy ingress for /blobvaul if the nginx is not deployed too