daemons: add policy package support

rucio · Feb 24, 2025 · e107f85 · e107f85
1 parent 71f3936
commit e107f85
Show file tree

Hide file tree

Showing 20 changed files with 192 additions and 1 deletion.
diff --git a/charts/rucio-daemons/Chart.yaml b/charts/rucio-daemons/Chart.yaml
@@ -1,5 +1,5 @@
 name: rucio-daemons
-version: 36.0.2
+version: 36.0.3
 apiVersion: v1
 description: A Helm chart to deploy daemons for Rucio
 keywords:

diff --git a/charts/rucio-daemons/templates/abacus-deployment.yaml b/charts/rucio-daemons/templates/abacus-deployment.yaml
@@ -70,6 +70,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ .rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -103,6 +108,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce (.component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/automatix-deployment.yaml b/charts/rucio-daemons/templates/automatix-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -108,6 +113,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/cache-consumer-deployment.yaml b/charts/rucio-daemons/templates/cache-consumer-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
       {{- range $collection := tuple (coalesce $component_values.secretMounts .Values.secretMounts) $component_values.extraSecretMounts }}
       {{- range $key, $val := $collection }}
       - name: {{ coalesce $val.volumeName $val.secretName $val.secretFullName }}
@@ -97,6 +102,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/conveyor-deployment.yaml b/charts/rucio-daemons/templates/conveyor-deployment.yaml
@@ -70,6 +70,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ .rucio_daemon }}
+        {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -103,6 +108,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce (.component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/dark-reaper-deployment.yaml b/charts/rucio-daemons/templates/dark-reaper-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -105,6 +110,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/hermes-deployment.yaml b/charts/rucio-daemons/templates/hermes-deployment.yaml
@@ -72,6 +72,11 @@ spec:
         - name: config-component
           secret:
             secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
 {{ if $component_values.useSSL }}
         - name: usercert
           secret:
@@ -105,6 +110,9 @@ spec:
             path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/hermes-legacy-deployment.yaml b/charts/rucio-daemons/templates/hermes-legacy-deployment.yaml
@@ -72,6 +72,11 @@ spec:
         - name: config-component
           secret:
             secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
 {{ if $component_values.useSSL }}
         - name: usercert
           secret:
@@ -105,6 +110,9 @@ spec:
             path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/judge-deployment.yaml b/charts/rucio-daemons/templates/judge-deployment.yaml
@@ -70,6 +70,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ .rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -103,6 +108,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce (.component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/minos-deployment.yaml b/charts/rucio-daemons/templates/minos-deployment.yaml
@@ -70,6 +70,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ .rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -103,6 +108,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce (.component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/necromancer-deployment.yaml b/charts/rucio-daemons/templates/necromancer-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -105,6 +110,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/oauth-manager-deployment.yaml b/charts/rucio-daemons/templates/oauth-manager-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: ca-volume
         secret:
@@ -102,6 +107,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/policy-package-storage.yaml b/charts/rucio-daemons/templates/policy-package-storage.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.policyPackages.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: policy-package-volume
+spec:
+  storageClassName: {{ .Values.policyPackages.storageClass.name }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.policyPackages.resources.requests.storage }}
+{{- end }}
diff --git a/charts/rucio-daemons/templates/policy-packages-init.yaml b/charts/rucio-daemons/templates/policy-packages-init.yaml
@@ -0,0 +1,28 @@
+{{- define "rucio-daemons.policy-package-init-container" -}}
+{{- if .Values.policyPackages.enabled }}
+initContainers:
+- name: install-policy-packages
+  # A slim Python image could be used instead, but using the same image as the base image for the main container ensures that the same Python version is used
+  image: almalinux:9
+  command:
+    - /bin/bash
+    - -e
+    - -c
+    - |
+      export PYTHONPATH={{ .Values.policyPackages.mountPath }}:$PYTHONPATH
+      {{- range .Values.policyPackages.packages }}
+      if python3 -c "from importlib.metadata import version; assert version({{ .moduleName | squote }}) == {{ .version | squote }}"; then
+          echo "module {{ .moduleName }} version {{ .version }} is already installed"
+      else
+          if [[ {{ .requirement | squote }} == git+* ]]; then
+              dnf install --assumeyes git-all
+          fi
+          dnf install --assumeyes python-pip
+          pip install {{ .requirement }} --target {{ $.Values.policyPackages.mountPath }}
+      fi
+      {{- end }}
+  volumeMounts:
+  - name: policy-package-volume
+    mountPath: {{ .Values.policyPackages.mountPath }}
+{{- end }}
+{{- end }}
diff --git a/charts/rucio-daemons/templates/reaper-deployment.yaml b/charts/rucio-daemons/templates/reaper-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -105,6 +110,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/replica-recoverer-deployment.yaml b/charts/rucio-daemons/templates/replica-recoverer-deployment.yaml
@@ -73,6 +73,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -106,6 +111,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/tracer-kronos-deployment.yaml b/charts/rucio-daemons/templates/tracer-kronos-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
       {{- range $collection := tuple (coalesce $component_values.secretMounts .Values.secretMounts) $component_values.extraSecretMounts }}
       {{- range $key, $val := $collection }}
       - name: {{ coalesce $val.volumeName $val.secretName $val.secretFullName }}
@@ -92,6 +97,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"

diff --git a/charts/rucio-daemons/templates/transmogrifier-deployment.yaml b/charts/rucio-daemons/templates/transmogrifier-deployment.yaml
@@ -72,6 +72,11 @@ spec:
       - name: config-component
         secret:
           secretName: {{ template "rucio.fullname" . }}.config.{{ $rucio_daemon }}
+      {{- if .Values.policyPackages.enabled }}
+      - name: policy-package-volume
+        persistentVolumeClaim:
+          claimName: policy-package-volume
+      {{- end }}
     {{- if .Values.useDeprecatedImplicitSecrets }}
       - name: proxy-volume
         secret:
@@ -105,6 +110,9 @@ spec:
           path: {{ $val.hostPath }}
       {{- end}}
       {{- end}}
+{{- if .Values.policyPackages.enabled }}
+      {{ include "rucio-daemons.policy-package-init-container" . | indent 6 }}
+{{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ coalesce ($component_values.image | default dict).tag .Values.image.tag }}"