refactor(k8s): share Helm resource templates

bin/k8s/templates/base/_helpers.tpl

@@ -103,6 +103,83 @@ append the uid to it, so a bare value would render "http://<origin>jupyter/7". *
 {{- printf "/%s" (trimAll "/" .Values.jupyterPool.basePath) -}}
 {{- end -}}
 
+{{/* Start a release-scoped Deployment; the caller supplies the pod spec. */}}
+{{- define "texera.deploymentHeader" -}}
+{{- $app := printf "%s-" .release.Name -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $app }}{{ .name }}
+  namespace: {{ .release.Namespace }}
+  labels:
+    app: {{ $app }}{{ .name }}
+spec:
+  replicas: {{ .replicas }}
+  {{- if .recreate }}
+  # Single writer bound to one RWO volume; never run two at once.
+  strategy:
+    type: Recreate
+  {{- end }}
+  selector:
+    matchLabels:
+      app: {{ $app }}{{ .name }}
+  template:
+    metadata:
+      labels:
+        app: {{ $app }}{{ .name }}
+{{- end -}}
+
+{{- define "texera.observability.containerSecurityContext" -}}
+securityContext:
+  {{- if . }}
+  readOnlyRootFilesystem: true
+  {{- end }}
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: ["ALL"]
+{{- end -}}
+
+{{- define "texera.observability.service" -}}
+{{- $app := printf "%s-%s" .release.Name .app -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $app }}
+  namespace: {{ .release.Namespace }}
+  labels:
+    app: {{ $app }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ $app }}
+  ports:
+    {{- range .ports }}
+    - name: {{ .name }}
+      protocol: TCP
+      port: {{ .port }}
+      targetPort: {{ .port }}
+    {{- end }}
+{{- end -}}
+
+{{- define "texera.observability.dataClaim" -}}
+{{- $app := printf "%s-%s" .release.Name .app -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $app }}-data
+  namespace: {{ .release.Namespace }}
+  labels:
+    app: {{ $app }}
+spec:
+  accessModes: ["ReadWriteOnce"]
+  {{- if .storage.storageClass }}
+  storageClassName: {{ .storage.storageClass }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .storage.storage }}
+{{- end -}}
+
 {{/* Grafana datasource provisioning body. Kept as a helper so the Deployment's
 checksum/config annotation can hash just this content; hashing the template that
 holds the annotation would make it reference itself and recurse. */}}
@@ -181,3 +258,88 @@ compactor:
   retention_enabled: true
   delete_request_store: filesystem
 {{- end -}}
+{{- define "texera.releaseService" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .name }}-svc
+  namespace: {{ .release.Namespace }}
+spec:
+  type: {{ .serviceType }}
+  selector:
+    app: {{ .release.Name }}-{{ .name }}
+  ports:
+    {{- if .portName }}
+    - name: {{ .portName }}
+      protocol: TCP
+    {{- else }}
+    - protocol: TCP
+    {{- end }}
+      port: {{ .port }}
+      targetPort: {{ .port }}
+      {{- if .useNodePort }}
+      # if service type is set to NodePort, include nodePort attribute
+      {{- if eq .serviceType "NodePort" }}
+      nodePort: {{ .nodePort }}
+      {{- end }}
+      {{- end }}
+{{- end -}}
+
+{{- define "texera.localPersistence" -}}
+{{- $hostBasePath := .hostBasePath }}
+{{- $name := .name }}
+{{- $persistence := .persistence }}
+{{- $volumeName := printf "%s-data-pv" $name }}
+{{- $claimName := printf "%s-data-pvc" $name }}
+{{- $storageClass := $persistence.storageClass | default "local-path" }}
+{{- $size := $persistence.size | default .defaultSize }}
+{{- $hostPath := printf "%s/%s/%s" $hostBasePath $.root.Release.Name $name }}
+
+{{/* Only create PV for local-path storage class */}}
+{{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: {{ $volumeName }}
+  {{- if not $.root.Values.persistence.removeAfterUninstall }}
+  annotations:
+    "helm.sh/resource-policy": keep
+  {{- end }}
+  labels:
+    type: local
+    app: {{ $.root.Release.Name }}
+    component: {{ $name }}
+spec:
+  storageClassName: {{ $storageClass }}
+  capacity:
+    storage: {{ $size }}
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  hostPath:
+    path: {{ $hostPath }}
+---
+{{- end }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $claimName }}
+  namespace: {{ $.root.Release.Namespace }}
+  {{- if not $.root.Values.persistence.removeAfterUninstall }}
+  annotations:
+    "helm.sh/resource-policy": keep
+  {{- end }}
+  labels:
+    app: {{ $.root.Release.Name }}
+    component: {{ $name }}
+spec:
+  storageClassName: {{ $storageClass }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ $size }}
+  {{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
+  volumeName: {{ $volumeName }}
+  {{- end }}
+{{- end }}

bin/k8s/templates/base/access-control-service/access-control-service-service.yaml

@@ -15,16 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.accessControlService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.accessControlService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.accessControlService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.accessControlService.service.port }}
-      targetPort: {{ .Values.accessControlService.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.accessControlService.name "serviceType" .Values.accessControlService.service.type "port" .Values.accessControlService.service.port) }}

bin/k8s/templates/base/agent-service/agent-service-service.yaml

@@ -16,17 +16,5 @@
 # under the License.
 
 {{- if .Values.agentService.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.agentService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.agentService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.agentService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.agentService.service.port }}
-      targetPort: {{ .Values.agentService.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.agentService.name "serviceType" .Values.agentService.service.type "port" .Values.agentService.service.port) }}
 {{- end }}

bin/k8s/templates/base/config-service/config-service-service.yaml

@@ -15,16 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.configService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.configService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.configService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.configService.service.port }}
-      targetPort: {{ .Values.configService.service.port }} 
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.configService.name "serviceType" .Values.configService.service.type "port" .Values.configService.service.port) }}

bin/k8s/templates/base/file-service/file-service-service.yaml

@@ -15,21 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.fileService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.fileService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.fileService.name }}
-  ports:
-    - name: api-port
-      protocol: TCP
-      port: {{ .Values.fileService.service.port }}
-      targetPort: {{ .Values.fileService.service.port }}
-      # if service type is set to NodePort, include nodePort attribute
-      {{- if eq .Values.fileService.service.type "NodePort" }}
-      nodePort: {{ .Values.fileService.service.nodePort }}
-      {{- end }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.fileService.name "serviceType" .Values.fileService.service.type "port" .Values.fileService.service.port "nodePort" .Values.fileService.service.nodePort "portName" "api-port" "useNodePort" true) }}

bin/k8s/templates/base/litellm/litellm-service.yaml

@@ -16,17 +16,5 @@
 # under the License.
 
 {{- if .Values.litellm.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.litellm.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.litellm.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.litellm.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.litellm.service.port }}
-      targetPort: {{ .Values.litellm.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.litellm.name "serviceType" .Values.litellm.service.type "port" .Values.litellm.service.port) }}
 {{- end }}

bin/k8s/templates/base/notebook-migration-service/notebook-migration-service-service.yaml

@@ -15,17 +15,5 @@
 # specific language governing permissions and limitations
 # under the License.
 {{- if .Values.notebookMigrationService.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.notebookMigrationService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.notebookMigrationService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.notebookMigrationService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.notebookMigrationService.service.port }}
-      targetPort: {{ .Values.notebookMigrationService.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.notebookMigrationService.name "serviceType" .Values.notebookMigrationService.service.type "port" .Values.notebookMigrationService.service.port) }}
 {{- end }}

bin/k8s/templates/base/observability/grafana.yaml

@@ -37,22 +37,7 @@ data:
   datasources.yaml: |
     {{- include "texera.observability.grafanaDatasources" . | nindent 4 }}
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}-grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-grafana
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-grafana
-  template:
-    metadata:
-      labels:
-        app: {{ .Release.Name }}-grafana
+{{ include "texera.deploymentHeader" (dict "release" .Release "name" "grafana" "replicas" 1) }}
       annotations:
         # Roll the pod when the provisioned datasources change.
         checksum/config: {{ include "texera.observability.grafanaDatasources" . | sha256sum }}
@@ -65,10 +50,7 @@ spec:
         - name: grafana
           image: {{ .Values.observability.grafana.image }}
           imagePullPolicy: {{ .Values.texeraImages.pullPolicy }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+          {{- include "texera.observability.containerSecurityContext" false | nindent 10 }}
           env:
             # Admin login. Override for any environment reachable beyond
             # an internal port-forward.
@@ -106,20 +88,7 @@ spec:
         - name: data
           emptyDir: {}
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-grafana
-spec:
-  type: ClusterIP
-  selector:
-    app: {{ .Release.Name }}-grafana
-  ports:
-    - name: http
-      protocol: TCP
-      port: {{ .Values.observability.grafana.port }}
-      targetPort: {{ .Values.observability.grafana.port }}
+{{ include "texera.observability.service" (dict "release" .Release "app" "grafana" "ports" (list
+    (dict "name" "http" "port" .Values.observability.grafana.port)
+)) }}
 {{- end }}