tonicai/tonic_helm_charts

tonic_helm_charts's Issues

Create and use service account

I'd like to deploy this in EKS and use an IAM role via a service account

Your docs specify this permissions which I think needs assumed by the worker node.
https://docs.tonic.ai/app/setting-up-your-database/snowflake/initial-tonic-setup#aws-instance-profile-permissions

the tonic-license was changed but the secret yaml was not

tonic_helm_charts/templates/tonic-license-secret.yaml

Line 5 in fb32eca

name: tonic-license-secret

tonicdb.dbName capitalized in template but not values file

tonic_helm_charts/templates/tonic-worker-deployment.yaml

Line 22 in 5f69551

value: {{ .Values.tonicdb.dbname }}

When I fixed it tonic paniced because database "tonic" does not exist. Slightly confused how it worked in the first place but I fixed it by setting tonicdb.dbName to ""

Wrap tonic-smtp-secret file in IF statement

When smtp settings are not present, an error is thrown saying the values needed by the tonic-smtp-secret file are not present.

Support tonicLicense to be obtained from Secret in Namespace

For environments using ExternalSecrets controller, it's not a helpful pattern to install the secret in the Chart values/metadata as it would facilitate it to be exposed in undesired places, depending on the deployment workflow.

Another pattern is to pass a reference to a secret in the namespace, and the deployment values could point to it naturally.

This way we can avoid [1] (redacted base64 string).

Example of Prometheus Operator using this pattern :

https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/alerting.md#manually-managed-secret

[1]:

# Use a Tonic license to enable different enterprise features. License keys can be obtained from Tonic.

tonicLicense: op8yukgo2ZibacJ8S5FoeiVsOOYd+1DwZJvEGRQnaANqWuU2SxNJ+uNf8C5DiWAe1Vsk9o5cuY1/y/eORR4qadTxfX2uOpUFgivacQ5yu38iFfuFWmyj47huCuMCtGs1xIxKFmdHLhcAcdtxY2B7gfw7mSD5gQ==

Add readyness probe

Install notification container regardless of smtp settings

Currently we only install the notification container if the smtp settings are present in the values.yaml file. With the addition of webhooks, it should be installed always.

Add Spark Container

Allow for env vars in worker node

The lambda role and ECR name are configured via env vars. It would be nice to pass them in via the chart

• docs for lambda role and ecr name https://docs.tonic.ai/app/setting-up-your-database/snowflake/initial-tonic-setup#aws-lambda-role
• see the env and envRaw here for an example https://github.com/KongZ/charts/blob/main/charts/graylog/templates/statefulset.yaml#L127

Add parameters for SSO

allow for service annotation spec

tonic_helm_charts/templates/tonic-web-server-service.yaml

Line 6 in 5f69551

annotations:

we use annotations on the service to configure DNS, etc. patching this post-deployment is a pain

Allow for container image repository spec

We would like to pull the container image from a local image repo.

tonic_helm_charts/templates/tonic-pii-detection-deployment.yaml

Line 25 in 5f69551

image: quay.io/tonicai/tonic_pii_detection:{{ .Values.tonicVersion }}

Not just for this deployment but for all of them.

Move passwords into secrets

For tonic db, etc