tapis-project / pods_service Goto Github PK
View Code? Open in Web Editor NEWNetwork Accessible Pods API.
Home Page: https://tapis.readthedocs.io/en/latest/technical/pods.html
License: BSD 3-Clause "New" or "Revised" License
Network Accessible Pods API.
Home Page: https://tapis.readthedocs.io/en/latest/technical/pods.html
License: BSD 3-Clause "New" or "Revised" License
Currently each pod gets a description field, defaulting to ''. This field is user define-able however and should have some hard limits.
In particular, description should:
If description does not mean the above criteria then a friendly error message should be given to the user.
Additionally. After completing the initial task, add at least two tests, one to ensure valid description's work correctly. And a second to ensure invalid descriptions give the correct error message.
Auto-health can attempt to use tenants that SK hasn't updated the token_generator role on yet. Should just pass.
Now that Files is not required I can test multi-namespace and find issues.
Validation for models in models routed error messages improperly. Resulted in tapipy returning message:none
TCP proxying at this point.
For everything.
Short paper regarding the Pods service. An explanation of the service architecture, the services benefits, current and possible use-cases, and performance metrics.
A bit confusing current as multiple tenants loop over one function to upgrade. Need to add in some other options for later down the line when we don't want every schema to match exactly. For example when dealing with the image allowlist.
Adding in catalog endpoint for users to share volumes/snapshots/pods with read permissions.
Template endpoint with ability for users to add their own templates. Looking to expand this further with users added complex pod definitions, not yet though, just images.
Migrations were written per tenant and then deployed. That was not smart.
Currently TLS is required so we can "ssl_preread" at the nginx level and route according to subdomain. With the bolt driver, user has to have TLS outgoing and incoming if "encrypted" attr is True. Meaning, we need to return TLS, meaning certs.
It might be possible for a user to send us non-TLS TCP, we convert that to TLS compliant TCP, THEN we preread subdomain information? This assumes that ssl_preread just works at this point. Might be possible. Nginx has the certs. We can then go back to sending non-TLS TCP to the pod. Bolt is happy in this case, because non-TLS out and non-TLS back.
Can currently do multi-namespace work only if I have a cluster role. Trying to simplify.
Logging was done very quickly, needs to be thought out more though. Currently logging is running read_namespaced_pod_log
with the Kubernetes python client. This gives us all current logs for the pod, up to the maximum Kubernetes itself stores (10 MB by default). Meaning when we update the pod's logs, we always have the latest 10 MB of logs.
Two possible problems:
Nicer failing for deployment. Abaco is now able to run without a few environment variables that it previously relied on allowing for an easier deployment.
Currently specify images as:
neo4j
custom-jstubbs/abaco_test
Ideas for solutions:
pod-templates/neo4j
could be the new way to specify using a template. Let's just reserve pod-templates on dockerhub and understand in the service that pod-templates actually means to run our code.
jstubbs/abaco_test
as you would expect.Harder to make adding templates easier. Templates could be turned into a dictionary of values to use. Hard though when we have to create custom credentials per pod or run whatever arbitrary code that's required to run the template. Possible though.
Could also have regex parse the kubernetes_templates.py
file, find functions, start_neo4j_pod
, and parse just the image name. This might be the easier way.
Traefik allows error message middleware. If we combine this with users' http api, we could check on the health of the pod and give informative information regarding the service.
For example, if someone attempts to access service and it returns a 404, we could intercept and check the health of the pod. If the pod is supposed to be set to off, we can state that. Otherwise we can say there's a problem.
This could be extended to TCP. Unsure.
Currently we can't interfere with a users pod at all. We should have that access, to change permissions or whatever else.
Maybe not though.
What we gain from having the role:
Makefile/jupyter lab. Light readme, etc.
"action_logs": [
"23/09/07 23:41: Pod object created by 'cgarcia'",
"23/09/07 23:41: spawner set status to CREATING",
"23/09/07 23:42: health set status to AVAILABLE",
"23/09/07 23:42: 'cgarcia' updated pod, updated_fields: {'description': 'test description update'}"
]
Yay.
Creating slides, work on a fun demo of "Hoppscotch" + a database, documentation overhaul.
"Who's idea was it to let third-parties run whatever they wanted in a Kubernetes?" A story on how Christian should have done this with Docker.
For Carlos
Currently I believe arbitrary code can do basically anything to our cluster. Isolation via namespace does work, but in that case we need to move spawner into it's own namespace (pods can still talk to each other though).
Note: This is also important for Abaco.
There might be real issues with the current implementation of a hot reloading NGINX. Testing is really required, it could "just work". But Nginx currently kind of breaks if it doesn't find a pod. So if we delete a pod before NGINX accounts for it, it could mean breaking NGINX every so many seconds.
This now matters as we have stop/restart commands. Seems like there is indeed an issue. Needs work.
Nginx likes to error out when an "upstream" connection is missing. As if pod is gone. Try and remedy this. Might not be a problem when reloading nginx, only initial deploy. Investigate. - stack overflow suggestions
Probably due to Files connections
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.