comet-ml--opik/deployment/helm_chart/opik/templates/deployment.yaml

{{- range $key, $value := .Values.component }}
{{- if $value.enabled }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "opik.name" $ }}-{{ $key | lower }}
  labels:
    {{- include "opik.labels" $  | nindent 4 }}
    component: {{ include "opik.name" $ }}-{{ $key | lower }}
    {{- with $.Values.commonLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with $value.annotations }}
  annotations: {{ . | toYaml | nindent 4 }}
  {{- end }}
spec:
  {{- if not $value.autoscaling.enabled }}
  replicas: {{ $value.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "opik.labels" $  | nindent 6 }}
      component: {{ include "opik.name" $ }}-{{ $key | lower }}
  template:
    metadata:
      {{- with $.Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "opik.labels" $  | nindent 8 }}
        component: {{ include "opik.name" $ }}-{{ $key | lower }}
        {{- with $.Values.commonLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      serviceAccountName: {{ include "service.serviceAccountName" ( merge . (dict "serviceName" $key ) ) }}
      {{- with $.Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with $value.podSecurityContext }}
      securityContext:
        {{- toYaml . | nindent 10 }}
      {{- end }}
      initContainers:
      {{- if and $value.usesJavaTrustStore (or $.Values.caCerts.additionalCACerts $.Values.caCerts.existingAdditionalCACertsRef) (not $.Values.caCerts.overwriteJavaCATrustStore.enabled) }}
        - name: ca-cert-injection
          image: "{{ $.Values.registry }}/{{ $value.image.repository }}:{{ default $.Chart.AppVersion $value.image.tag }}"
          imagePullPolicy: {{ $value.image.pullPolicy }}
          securityContext:
            {{- toYaml $value.securityContext | nindent 12 }}
          command:
            - /bin/bash
          args:
            - -exc
            - |
              TRUSTSTORE_PATH="/emptydir/cacerts"
              CERTS_DIR="/opt/opik/custom-ca-certs"

              touch $TRUSTSTORE_PATH
              cat /etc/pki/ca-trust/extracted/java/cacerts > $TRUSTSTORE_PATH

              # Ensure the truststore exists
              if [[ ! -f "$TRUSTSTORE_PATH" ]]
              then
                  echo "Truststore not found at $TRUSTSTORE_PATH"
                  exit 1
              fi
              # Handle certificates from the CERTS_DIR
              if [[ -d "$CERTS_DIR" ]]
              then
                  for CERT in "$CERTS_DIR"/*.pem
                  do
                      if [[ -f "$CERT" ]]
                      then
                          ALIAS=$(basename "$CERT" .pem)
                          $JAVA_HOME/bin/keytool -import -trustcacerts -file "$CERT" \
                              -alias "$ALIAS" -keystore "$TRUSTSTORE_PATH" \
                              -storepass changeit -noprompt
                          echo "Imported $CERT as $ALIAS"
                      fi
                  done
              fi
              echo "Certificate import process completed."
          volumeMounts:
            - name: additonal-ca-certificates
              mountPath: /opt/opik/custom-ca-certs
              readOnly: true
            - mountPath: /emptydir
              name: ca-trust-store
      {{- end }}
      {{- if and (eq $key "backend") $value.waitForMysql.enabled }}
        - name: wait-for-mysql-service
          image: "{{ default $.Values.registry $value.waitForMysql.image.registry }}/{{ $value.waitForMysql.image.repository }}:{{ $value.waitForMysql.image.tag }}"
          imagePullPolicy: {{ default $value.image.pullPolicy $value.waitForMysql.image.pullPolicy }}
          securityContext:
            {{- toYaml $value.securityContext | nindent 12 }}
          command: ["/bin/sh", "-c"]
          args:
            - |
              until nc -z -v -w5 {{ $value.waitForMysql.mysql.host }} {{ $value.waitForMysql.mysql.port }}; do
                echo "MySQL is not available. Waiting for MySQL at {{ $value.waitForMysql.mysql.host }}:{{ $value.waitForMysql.mysql.port }}...";
                sleep 5;
              done;
              echo "MySQL is available at {{ $value.waitForMysql.mysql.host }}:{{ $value.waitForMysql.mysql.port }}";
          {{- with $value.waitForMysql.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      {{- end }}
      {{- if and (eq $key "backend") $value.waitForClickhouse }}
        - name: wait-for-clickhouse-service
          image: "{{ default $.Values.registry $value.waitForClickhouse.image.registry }}/{{ $value.waitForClickhouse.image.repository }}:{{ $value.waitForClickhouse.image.tag }}"
          imagePullPolicy: {{ default $value.image.pullPolicy $value.waitForClickhouse.image.pullPolicy }}
          securityContext:
            {{- toYaml $value.securityContext | nindent 12 }}
          command: ["/bin/sh", "-c"]
          args:
            - |
              while [ $(curl -ksw "%{http_code}" "{{ $value.waitForClickhouse.clickhouse.protocol }}://{{ $value.waitForClickhouse.clickhouse.host }}:{{ $value.waitForClickhouse.clickhouse.port }}" -o /dev/null) -ne 200 ];
              do
                sleep 5;
                echo "Clickhouse is not available. Waiting for the Clickhouse...";
              done
          {{- with $value.waitForClickhouse.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      {{- end }}
      {{- if and (eq $key "backend") $value.run_migration }}
        - name: backend-migrations
          image: "{{ $.Values.registry }}/{{ $value.image.repository }}:{{ default $.Chart.AppVersion $value.image.tag }}"
          imagePullPolicy: {{ $value.image.pullPolicy }}
          securityContext:
            {{- toYaml $value.securityContext | nindent 12 }}
          command: ["./run_db_migrations.sh"]
          {{- with $value.envFrom }}
          envFrom:
            {{- toYaml . | nindent 10 }}
          {{- end }}
          volumeMounts:
          {{- if and $value.usesJavaTrustStore (or $.Values.caCerts.additionalCACerts $.Values.caCerts.existingAdditionalCACertsRef $.Values.caCerts.overwriteJavaCATrustStore.enabled) }}
            - name: {{ ternary $.Values.caCerts.overwriteJavaCATrustStore.volume.name "ca-trust-store" $.Values.caCerts.overwriteJavaCATrustStore.enabled }}
              subPath: {{ ternary $.Values.caCerts.overwriteJavaCATrustStore.subPath "cacerts" $.Values.caCerts.overwriteJavaCATrustStore.enabled }}
              mountPath: /etc/pki/ca-trust/extracted/java/cacerts
          {{- end }}
          {{- with $value.volumeMounts }}
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $value.run_migration_resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      {{- end}}
      {{- with $value.initContainers }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
        {{- with $value.additionalContainers }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
        - name: {{ include "opik.name" $ }}-{{ $key | lower }}
          securityContext:
            {{- toYaml $value.securityContext | nindent 12 }}
          image: "{{ $.Values.registry }}/{{ $value.image.repository }}:{{ default $.Chart.AppVersion $value.image.tag }}"
          imagePullPolicy: {{ $value.image.pullPolicy }}
          {{- with $value.ports }}
          ports:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $value.livenessProbe }}
          livenessProbe:
            {{- include "opik.probe" . | nindent 12 }}
          {{- end }}
          {{- with $value.readinessProbe }}
          readinessProbe:
            {{- include "opik.probe" . | nindent 12 }}
          {{- end }}
          {{- with $value.startupProbe }}
          startupProbe:
            {{- include "opik.probe" . | nindent 12 }}
          {{- end }}
          {{- with $value.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $value.envFrom }}
          envFrom:
            {{- toYaml . | nindent 10 }}
          {{- end }}
          {{- if $value.secretRefs }}
          {{- range $value.secretRefs }}
          {{- if .name }}
            - secretRef:
                name: {{ .name }}
          {{- end }}
          {{- end }}
          {{- end }}
          volumeMounts:
          {{- if and $value.usesJavaTrustStore (or $.Values.caCerts.additionalCACerts $.Values.caCerts.existingAdditionalCACertsRef $.Values.caCerts.overwriteJavaCATrustStore.enabled) }}
            - name: {{ ternary $.Values.caCerts.overwriteJavaCATrustStore.volume.name "ca-trust-store" $.Values.caCerts.overwriteJavaCATrustStore.enabled }}
              subPath: {{ ternary $.Values.caCerts.overwriteJavaCATrustStore.subPath "cacerts" $.Values.caCerts.overwriteJavaCATrustStore.enabled }}
              mountPath: /etc/pki/ca-trust/extracted/java/cacerts
          {{- end }}
          {{- if eq $key "frontend" }}
            - name: {{ include "opik.name" $ }}-frontend-nginx
              mountPath: /etc/nginx/templates/default.conf.template
              subPath: default.conf.template
              readOnly: true
          {{-   if $.Values.component.frontend.logFormats }}
            - name: {{ include "opik.name" $ }}-frontend-nginx
              mountPath: /etc/nginx/templates/10-log-formats.conf.template
              subPath: 10-log-formats.conf.template
              readOnly: true
          {{-   end }}
          {{- end }}
          {{- with $value.volumeMounts }}
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $value.lifecycle }}
          lifecycle:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      volumes:
      {{- if $value.usesJavaTrustStore }}
        {{- if $.Values.caCerts.overwriteJavaCATrustStore.enabled }}
        {{- toYaml (list $.Values.caCerts.overwriteJavaCATrustStore.volume) | nindent 8 }}
        {{- else if (or $.Values.caCerts.additionalCACerts $.Values.caCerts.existingAdditionalCACertsRef) }}
        - name: additonal-ca-certificates
          {{- if $.Values.caCerts.additionalCACertsInSecret }}
          secret:
            {{- if $.Values.caCerts.existingAdditionalCACertsRef }}
            secretName: {{ $.Values.caCerts.existingAdditionalCACertsRef }}
            {{- else }}
            secretName: {{ include "opik.name" $ }}-extra-ca-certs
            {{- end }}
          {{- else }}
          configMap:
            {{- if $.Values.caCerts.existingAdditionalCACertsRef }}
            name: {{ $.Values.caCerts.existingAdditionalCACertsRef }}
            {{- else }}
            name: {{ include "opik.name" $ }}-extra-ca-certs
            {{- end }}
          {{- end }}
        - name: ca-trust-store
          emptyDir: {}
        {{- end }}
      {{- end }}
      {{- if eq $key "frontend" }}
        - name: {{ include "opik.name" $ }}-frontend-nginx
          configMap:
            name: {{ include "opik.name" $ }}-frontend-nginx
      {{- end }}
      {{- with $value.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- $ns := ternary $value.nodeSelector $.Values.nodeSelector (hasKey $value "nodeSelector") }}
      {{- with $ns }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with $value.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- $tol := ternary $value.tolerations $.Values.tolerations (hasKey $value "tolerations") }}
      {{- with $tol }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- $tsc := ternary $value.topologySpreadConstraints $.Values.topologySpreadConstraints (hasKey $value "topologySpreadConstraints") }}
      {{- with $tsc }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
{{- end }}
{{- end }}