diff --git a/deployments/README.md b/deployments/README.md index f8dbd57ef..329413eb6 100644 --- a/deployments/README.md +++ b/deployments/README.md @@ -38,9 +38,13 @@ cd scripts ./deploy-osmo-minimal.sh --provider aws ``` -For a development evaluation, use the unified chart's `quickstart.yaml` -profile. Kind is the recommended local cluster; KAI Scheduler, CloudNativePG, -and a default dynamic StorageClass must already be available: +For a development evaluation, use the unified chart defaults. Kind is the +recommended local cluster; KAI Scheduler, CloudNativePG, and a default dynamic +StorageClass must already be available: + +Before installing OSMO, generate the shared service-auth identity and create +the required `osmo-service-auth` Secret by following the +[`osmo` chart installation steps](charts/osmo/README.md#install-osmo). ```bash helm repo add cnpg https://cloudnative-pg.github.io/charts @@ -56,8 +60,6 @@ helm dependency build deployments/charts/osmo helm --kube-context kind-osmo upgrade --install osmo deployments/charts/osmo \ --namespace osmo \ --create-namespace \ - --values deployments/charts/osmo/profiles/quickstart.yaml \ - --set-string compute.backendName=default \ --wait \ --wait-for-jobs \ --timeout 20m @@ -75,8 +77,8 @@ helm --kube-context kind-osmo upgrade osmo deployments/charts/osmo \ --timeout 20m ``` -The quick-start profile installs the control and compute planes, PostgreSQL, -Valkey, and RustFS in one development OSMO release and creates its credentials +The quickstart defaults install the control and compute planes, PostgreSQL, +Valkey, and RustFS in one development OSMO release and create its credentials and buckets automatically. See [`charts/osmo/README.md`](charts/osmo/README.md) for readiness checks, port-forwarding, hello-world validation, recovery, and split-plane deployment. diff --git a/deployments/charts/README.md b/deployments/charts/README.md index 49e6d3f1a..9e2cb3f66 100644 --- a/deployments/charts/README.md +++ b/deployments/charts/README.md @@ -28,15 +28,17 @@ the unified chart. For an existing development cluster with KAI Scheduler, the CloudNativePG operator, and a default dynamic StorageClass, install the complete browser, -CLI, API, and CPU workflow experience with one unified OSMO release: +CLI, API, and CPU workflow experience with the chart defaults: + +Before running Helm, generate the shared service-auth identity and create the +required `osmo-service-auth` Secret by following the +[`osmo` installation steps](osmo/README.md#install-osmo). ```bash helm dependency build deployments/charts/osmo helm --kube-context kind-osmo upgrade --install osmo deployments/charts/osmo \ --namespace osmo \ --create-namespace \ - --values deployments/charts/osmo/profiles/quickstart.yaml \ - --set-string compute.backendName=default \ --wait \ --wait-for-jobs \ --timeout 20m @@ -54,15 +56,16 @@ helm --kube-context kind-osmo upgrade osmo deployments/charts/osmo \ --timeout 20m ``` -The profile deploys the UI, gateway, control and compute planes, a CloudNativePG -Cluster, persistent Valkey, and persistent RustFS. It generates development -credentials, creates the workflow/log/app buckets, and connects the backend -without a manual Secret copy. The UI and API are exposed through gateway -NodePort `30080`. +The default values deploy the UI, gateway, control and compute planes, a +CloudNativePG Cluster, persistent Valkey, and persistent RustFS. They generate +development credentials, create the workflow/log/app buckets, and connect the +backend without a manual Secret copy. The UI and API are exposed through +gateway NodePort `30080`. See the [`osmo` quick-start guide](osmo/README.md#quick-start) for prerequisite installation, browser and CLI access, a hello-world workflow, capacity, -troubleshooting, cleanup, and the profile's non-production limitations. +troubleshooting, cleanup, and the default quickstart's non-production +limitations. ## Self-contained production diff --git a/deployments/charts/osmo/README.md b/deployments/charts/osmo/README.md index 109e1e9b7..31124e2f7 100644 --- a/deployments/charts/osmo/README.md +++ b/deployments/charts/osmo/README.md @@ -7,8 +7,8 @@ SPDX-License-Identifier: Apache-2.0 The `osmo` chart is the unified OSMO deployment entry point. -See the [profile matrix](profiles/README.md) for which values files are directly -installable profiles and which are base overlays requiring environment input. +The chart defaults are the development quickstart. See the +[profile matrix](profiles/README.md) for production and split-plane overlays. The chart supports control-only, compute-only, and converged releases. It can render backend listener and worker resources directly with the control services, @@ -21,9 +21,9 @@ installations, but it is not a dependency of this chart. ## Quick start -The `quickstart.yaml` profile is a development-only path to trying the complete -OSMO browser, CLI, API, and CPU workflow experience in one converged release. -It installs: +The default values are a development-only path to trying the complete OSMO +browser, CLI, API, and CPU workflow experience in one converged release. They +install: - the Envoy gateway and browser UI; - the API, worker, router, logger, agent, and delayed-job monitor; @@ -64,7 +64,7 @@ helm --kube-context kind-osmo upgrade --install cnpg cnpg/cloudnative-pg \ ### Install OSMO Generate the shared development service-auth identity, create its Secret, then -install the unified chart with the single quick-start values file: +install the unified chart without a values file or required `--set` values: ```bash OSMO_SERVICE_AUTH_DIRECTORY="$(mktemp -d)" @@ -83,8 +83,6 @@ helm dependency build deployments/charts/osmo helm --kube-context kind-osmo upgrade --install osmo deployments/charts/osmo \ --namespace osmo \ --create-namespace \ - --values deployments/charts/osmo/profiles/quickstart.yaml \ - --set-string compute.backendName=default \ --wait \ --wait-for-jobs \ --timeout 20m @@ -186,13 +184,14 @@ kubectl --context kind-osmo delete namespace osmo \ ### Capacity and limitations -The profile runs one replica of every required OSMO service, including the UI -and delayed-job monitor, and uses persistent volumes for PostgreSQL (1 GiB), -Valkey (512 MiB), and RustFS (1 GiB). PostgreSQL requests 1 CPU and 2 GiB, while -Valkey and RustFS each request 500 millicores and 1 GiB. The nine OSMO services -request 100 millicores and 256 MiB each, and the gateway requests 50 millicores -and 64 MiB. Those long-running pods reserve approximately 2.95 CPU and 6.4 GiB -before Kubernetes, KAI, and CloudNativePG operator overhead. +The default quickstart runs one replica of every required OSMO service, +including the UI and delayed-job monitor, and uses persistent volumes for +PostgreSQL (1 GiB), Valkey (512 MiB), and RustFS (1 GiB). +PostgreSQL requests 1 CPU and 2 GiB, while Valkey and RustFS each request 500 +millicores and 1 GiB. The nine OSMO services request 100 millicores and 256 MiB +each, and the gateway requests 50 millicores and 64 MiB. Those long-running pods +reserve approximately 2.95 CPU and 6.4 GiB before Kubernetes, KAI, and +CloudNativePG operator overhead. The canonical hello-world pod additionally requests 1 CPU, 1 GiB of memory, and 1 GiB of ephemeral storage for both its user container and its `osmo-ctrl` @@ -387,7 +386,8 @@ helm upgrade --install osmo deployments/charts/osmo \ --timeout 25m ``` -The defaults create three PostgreSQL 16 instances with one 20 Gi +The split-plane control profile uses production-oriented settings that create +three PostgreSQL 16 instances with one 20 Gi `ReadWriteOnce` PVC per instance, required hostname anti-affinity, a PodDisruptionBudget, and synchronous replication to one standby. A generated application Secret is wired into every OSMO PostgreSQL client automatically. @@ -451,7 +451,8 @@ secrets: key: mek.yaml ``` -Keep `embeddedDependencies.postgresql.enabled: false` (the default), then +Keep `embeddedDependencies.postgresql.enabled: false` as set by the +split-plane control profile, then install the chart by layering the environment values after the profile: ```bash @@ -509,8 +510,8 @@ used by clients and control-plane configuration. ## Embedded Valkey -Embedded Valkey is disabled by default. Enable it with retained generated -credentials as follows: +The quickstart defaults enable a small embedded Valkey. A profile that disables +it can enable it with retained generated credentials as follows: ```yaml embeddedDependencies: @@ -527,7 +528,9 @@ secrets: existingSecret: '' ``` -The generated Secret and 8 GiB `ReadWriteOnce` PVC are retained on uninstall. +The generated Secret and configured `ReadWriteOnce` PVC are retained on +uninstall. The quickstart uses 512 MiB; the split-plane control profile uses +8 GiB when embedded Valkey is enabled there. Back up both resources and restore the original Secret before reinstalling or recovering the PVC. To supply an existing Secret instead, disable `secrets.valkey.generate` and set both `secrets.valkey.existingSecret` and @@ -579,12 +582,12 @@ rustfs: existingSecret: osmo-rustfs-credentials ``` -The chart deploys a standalone RustFS instance with a retained 10 GiB -`ReadWriteOnce` PVC. A regular Job waits for RustFS and creates the configured -workflow, log, and app buckets when they are absent. Use `--wait-for-jobs` with -Helm so an install or upgrade does not return before bucket bootstrap succeeds. -OSMO is configured with the RustFS endpoint, buckets, and generated credentials -automatically. +The split-plane control profile deploys a standalone RustFS instance with a +retained 10 GiB `ReadWriteOnce` PVC when embedded object storage is enabled. +A regular Job waits for RustFS and creates the configured workflow, log, and +app buckets when they are absent. Use `--wait-for-jobs` with Helm so an install +or upgrade does not return before bucket bootstrap succeeds. OSMO is configured +with the RustFS endpoint, buckets, and generated credentials automatically. The generated `osmo-rustfs-credentials` Secret is retained on uninstall and reused on upgrades. To provide an existing Secret, disable diff --git a/deployments/charts/osmo/profiles/README.md b/deployments/charts/osmo/profiles/README.md index 0ec8d87a8..5c11f04e6 100644 --- a/deployments/charts/osmo/profiles/README.md +++ b/deployments/charts/osmo/profiles/README.md @@ -5,27 +5,27 @@ SPDX-License-Identifier: Apache-2.0 # OSMO chart profiles -Profiles are values-file overlays, not a `profile` value selected by the chart. -Layer environment-specific values after a base overlay so that the environment -values take precedence. +The chart defaults provide the development quickstart. Profiles are values-file +overlays, not a `profile` value selected by the chart. Layer environment-specific +values after a base overlay so that the environment values take precedence. | File | Directly installable | Required environment input | | --- | --- | --- | -| `quickstart.yaml` | Yes, on a development cluster | KAI Scheduler, the CloudNativePG operator, and a default dynamic StorageClass installed separately; `osmo-service-auth` generated and created as documented; `compute.backendName` set explicitly at install time | -| `self-contained.yaml` | Yes, with production inputs | KAI Scheduler, the CloudNativePG operator, a default dynamic StorageClass, at least four schedulable nodes, a NetworkPolicy-enforcing CNI, an OIDC client and Secret with role assignments, an `osmo-service-auth` Secret generated as documented, a TLS edge and public `externalUrl`, IPv4 cluster CIDRs, and `compute.backendName` | +| Chart defaults (`values.yaml`) | Yes, on a development cluster | KAI Scheduler, the CloudNativePG operator, and a default dynamic StorageClass installed separately; `osmo-service-auth` generated and created as documented | +| `self-contained.yaml` | Yes, with production inputs | KAI Scheduler, the CloudNativePG operator, a default dynamic StorageClass, at least four schedulable nodes, a NetworkPolicy-enforcing CNI, an OIDC client and Secret with role assignments, an `osmo-service-auth` Secret generated as documented, a TLS edge and public `externalUrl`, and IPv4 cluster CIDRs | | `split-plane-control.yaml` | Base overlay | PostgreSQL, Valkey, and object-storage endpoints; Kubernetes Secrets; and `externalUrl` | | `split-plane-compute.yaml` | Base overlay | A control-plane `externalUrl`, a compute authentication Secret, and `compute.backendName` set explicitly at install time | -The quick-start profile is the smallest complete control-and-compute deployment +The default values are the smallest complete control-and-compute deployment for browser, CLI, and CPU hello-world verification. It exposes the UI and API through gateway NodePort `30080` while omitting optional production behavior. It intentionally uses `latest` OSMO images, one replica per component, development authentication, explicitly generated service auth, and small single-node stateful dependencies. -The quick-start installation path uses the chart's default image settings and -does not require application Secrets or an image-pull Secret to be created -beforehand. Configure top-level `imagePullSecrets` only when using a registry -that requires credentials. +The quick-start installation path requires the documented pre-created +`osmo-service-auth` Secret. It generates its other application credentials and +does not require an image-pull Secret beforehand. Configure top-level +`imagePullSecrets` only when using a registry that requires credentials. The self-contained profile is the production-converged path for environments that host OSMO and its stateful dependencies in Kubernetes. It uses chart-version diff --git a/deployments/charts/osmo/profiles/quickstart.yaml b/deployments/charts/osmo/profiles/quickstart.yaml deleted file mode 100644 index f49de8ccb..000000000 --- a/deployments/charts/osmo/profiles/quickstart.yaml +++ /dev/null @@ -1,308 +0,0 @@ -# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -# SPDX-License-Identifier: Apache-2.0 - -# Development-only converged profile for the shortest path to a working OSMO -# control plane, compute plane, and CPU workflow runtime. -planes: - control: - enabled: true - compute: - enabled: true - -fullnameOverride: osmo - -externalUrl: http://osmo-gateway - -embeddedDependencies: - postgresql: - enabled: true - valkey: - enabled: true - objectStorage: - enabled: true - -secrets: - postgresql: - existingSecret: '' - valkey: - generate: true - existingSecret: '' - objectStorage: - generate: true - existingSecret: '' - backendApiTokens: - enabled: true - credentials: - - name: default - managedSecret: - name: osmo-backend-token - masterEncryptionKey: - managementMode: osmo - existingSecret: - name: osmo-master-encryption-key - key: mek.yaml - bootstrap: - enabled: true - serviceAuth: - existingSecret: - name: osmo-service-auth - key: authentication-config.json - -services: - ui: - enabled: true - replicas: 1 - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - pod: - topologySpreadConstraints: [] - mcp: - enabled: false - api: - replicas: 1 - autoscaling: - enabled: false - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - pod: - topologySpreadConstraints: [] - worker: - replicas: 1 - autoscaling: - enabled: false - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - pod: - topologySpreadConstraints: [] - router: - replicas: 1 - autoscaling: - enabled: false - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - pod: - topologySpreadConstraints: [] - logger: - replicas: 1 - autoscaling: - enabled: false - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 1Gi - pod: - topologySpreadConstraints: [] - agent: - replicas: 1 - autoscaling: - enabled: false - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 1Gi - pod: - topologySpreadConstraints: [] - delayedJobMonitor: - replicas: 1 - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - pod: - topologySpreadConstraints: [] - backendListener: - replicas: 1 - image: - pullPolicy: IfNotPresent - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 1Gi - pod: - topologySpreadConstraints: [] - backendWorker: - replicas: 1 - image: - pullPolicy: IfNotPresent - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 1Gi - pod: - topologySpreadConstraints: [] - backendTestRunner: - enabled: false - -gateway: - envoy: - replicas: 1 - autoscaling: - enabled: false - image: - pullPolicy: IfNotPresent - podDisruptionBudget: - enabled: false - defaultIdentity: - user: testuser - roles: osmo-admin - allowedPools: default - service: - type: NodePort - nodePort: 30080 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - memory: 512Mi - pod: - topologySpreadConstraints: [] - oauth2Proxy: - enabled: false - authz: - enabled: false - rateLimit: - enabled: false - tls: - enabled: false - upstreams: - ui: - enabled: true - -monitoring: - podMonitor: - control: - enabled: false - compute: - enabled: false - -configuration: - enabled: true - podTemplates: - # KAI treats even a zero-valued nvidia.com/gpu resource key as a GPU pod - # and injects the NVIDIA RuntimeClass. This CPU-only profile omits the key. - default_user: - spec: - containers: - - name: '{{USER_CONTAINER_NAME}}' - resources: - limits: - cpu: '{{USER_CPU}}' - memory: '{{USER_MEMORY}}' - ephemeral-storage: '{{USER_STORAGE}}' - requests: - cpu: '{{USER_CPU}}' - memory: '{{USER_MEMORY}}' - ephemeral-storage: '{{USER_STORAGE}}' - kind_dev_auth: - spec: - containers: - - name: '{{USER_CONTAINER_NAME}}' - env: - - name: OSMO_LOGIN_DEV - value: "true" - - name: osmo-ctrl - env: - - name: OSMO_LOGIN_DEV - value: "true" - pools: - default: - common_pod_template: - - default_ctrl - - default_user - - kind_dev_auth - -postgresql: - fullnameOverride: osmo-pg - cluster: - instances: 1 - storage: - size: 1Gi - affinity: - podAntiAffinityType: "" - enablePDB: false - postgresql: - synchronous: null - backups: - enabled: false - -valkey: - fullnameOverride: osmo-valkey - dataStorage: - requestedSize: 512Mi - replica: - enabled: false - minReplicasToWrite: 0 - podDisruptionBudget: - enabled: false - -rustfs: - fullnameOverride: osmo-rustfs - affinity: - podAntiAffinity: - enabled: false - storageclass: - dataStorageSize: 1Gi - -compute: - workloadNamespace: - name: '' - create: false - backendTestNamespace: '' - authentication: - existingSecret: osmo-backend-token - tokenKey: token diff --git a/deployments/charts/osmo/profiles/self-contained.yaml b/deployments/charts/osmo/profiles/self-contained.yaml index 8c63736f2..0a1d9a5a2 100644 --- a/deployments/charts/osmo/profiles/self-contained.yaml +++ b/deployments/charts/osmo/profiles/self-contained.yaml @@ -21,6 +21,9 @@ fullnameOverride: osmo # Pin production installs to the chart application version. imageTag: '' +# Production installations must supply their public URL explicitly. +externalUrl: '' + embeddedDependencies: postgresql: enabled: true @@ -65,8 +68,117 @@ secrets: name: osmo-service-auth key: authentication-config.json +# Production service sizing and placement. +services: + ui: + resources: + requests: + cpu: null + memory: null + limits: + memory: null + pod: + topologySpreadConstraints: + - topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + api: + replicas: 3 + resources: + requests: + cpu: null + memory: null + limits: + memory: null + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + worker: + replicas: 2 + resources: + requests: + cpu: null + memory: null + limits: + memory: null + pod: + topologySpreadConstraints: + - topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + router: + replicas: 3 + resources: + requests: + cpu: null + memory: null + limits: + memory: null + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + logger: + replicas: 3 + resources: + requests: + cpu: '1' + memory: 1Gi + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + agent: + resources: + requests: + cpu: 500m + memory: 500Mi + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + delayedJobMonitor: + resources: + requests: + cpu: null + memory: null + limits: + memory: null + backendListener: + resources: + requests: + cpu: '1' + memory: 2Gi + limits: + memory: 2Gi + pod: + topologySpreadConstraints: null + backendWorker: + resources: + requests: + cpu: '1' + memory: 1Gi + pod: + topologySpreadConstraints: null + gateway: envoy: + replicas: 2 + defaultIdentity: + user: '' + roles: '' + allowedPools: '' jwt: providers: # Keep OSMO-issued access tokens valid for in-cluster compute services. @@ -79,12 +191,20 @@ gateway: service: # Put the in-cluster gateway behind an operator-managed TLS edge. type: ClusterIP + resources: + requests: + cpu: 200m + memory: 128Mi + limits: + memory: 256Mi oauth2Proxy: enabled: true authz: enabled: true rateLimit: enabled: false + tls: + enabled: true # Prevent in-cluster clients from bypassing Envoy to reach an upstream # service. Envoy strips client-supplied identity headers and applies OAuth2 # authentication plus OSMO semantic authorization. @@ -109,8 +229,45 @@ gateway: configuration: enabled: true + podTemplates: + default_user: + spec: + containers: + - name: '{{USER_CONTAINER_NAME}}' + resources: + limits: + cpu: '{{USER_CPU}}' + memory: '{{USER_MEMORY}}' + nvidia.com/gpu: '{{USER_GPU}}' + ephemeral-storage: '{{USER_STORAGE}}' + requests: + cpu: '{{USER_CPU}}' + memory: '{{USER_MEMORY}}' + nvidia.com/gpu: '{{USER_GPU}}' + ephemeral-storage: '{{USER_STORAGE}}' + pools: + default: + common_pod_template: + - default_ctrl + - default_user + +postgresql: + fullnameOverride: null + cluster: + instances: 3 + storage: + size: 20Gi + affinity: + podAntiAffinityType: required + enablePDB: true + postgresql: + synchronous: + method: any + number: 1 + dataDurability: required valkey: + fullnameOverride: null replica: enabled: true replicas: 2 @@ -119,6 +276,7 @@ valkey: enabled: true rustfs: + fullnameOverride: null replicaCount: 4 drivesPerNode: 1 localEndpointHost: diff --git a/deployments/charts/osmo/profiles/split-plane-compute.yaml b/deployments/charts/osmo/profiles/split-plane-compute.yaml index 636595d7f..c176ddee9 100644 --- a/deployments/charts/osmo/profiles/split-plane-compute.yaml +++ b/deployments/charts/osmo/profiles/split-plane-compute.yaml @@ -10,6 +10,8 @@ planes: compute: enabled: true +fullnameOverride: '' + embeddedDependencies: postgresql: enabled: false @@ -20,6 +22,21 @@ embeddedDependencies: externalUrl: https://osmo.example.com +secrets: + valkey: + generate: false + objectStorage: + generate: false + backendApiTokens: + enabled: false + credentials: [] + masterEncryptionKey: + managementMode: external + existingSecret: + name: '' + bootstrap: + enabled: false + compute: workloadNamespace: name: '' @@ -30,5 +47,21 @@ compute: tokenKey: token services: + backendListener: + resources: + requests: + cpu: '1' + memory: 2Gi + limits: + memory: 2Gi + pod: + topologySpreadConstraints: null + backendWorker: + resources: + requests: + cpu: '1' + memory: 1Gi + pod: + topologySpreadConstraints: null backendTestRunner: enabled: false diff --git a/deployments/charts/osmo/profiles/split-plane-control.yaml b/deployments/charts/osmo/profiles/split-plane-control.yaml index ca2cd74d7..eb2912573 100644 --- a/deployments/charts/osmo/profiles/split-plane-control.yaml +++ b/deployments/charts/osmo/profiles/split-plane-control.yaml @@ -7,6 +7,9 @@ planes: compute: enabled: false +fullnameOverride: '' +externalUrl: '' + embeddedDependencies: postgresql: enabled: false @@ -20,12 +23,47 @@ configuration: workflow: # Omit an optional workflow label policy in this minimal external profile. labels_config: null + podTemplates: + default_user: + spec: + containers: + - name: '{{USER_CONTAINER_NAME}}' + resources: + limits: + cpu: '{{USER_CPU}}' + memory: '{{USER_MEMORY}}' + nvidia.com/gpu: '{{USER_GPU}}' + ephemeral-storage: '{{USER_STORAGE}}' + requests: + cpu: '{{USER_CPU}}' + memory: '{{USER_MEMORY}}' + nvidia.com/gpu: '{{USER_GPU}}' + ephemeral-storage: '{{USER_STORAGE}}' + pools: + default: + common_pod_template: + - default_ctrl + - default_user services: mcp: enabled: false ui: enabled: true + resources: + requests: + cpu: null + memory: null + limits: + memory: null + pod: + topologySpreadConstraints: + - topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway worker: autoscaling: enabled: true @@ -33,12 +71,22 @@ services: requests: cpu: 500m memory: 512Mi + limits: + memory: null podDisruptionBudget: enabled: true labels: {} annotations: {} maxUnavailable: 1 unhealthyPodEvictionPolicy: AlwaysAllow + pod: + topologySpreadConstraints: + - topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway api: autoscaling: enabled: true @@ -46,12 +94,19 @@ services: requests: cpu: 500m memory: 512Mi + limits: + memory: null podDisruptionBudget: enabled: true labels: {} annotations: {} maxUnavailable: 1 unhealthyPodEvictionPolicy: AlwaysAllow + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway router: autoscaling: enabled: true @@ -59,12 +114,19 @@ services: requests: cpu: 200m memory: 256Mi + limits: + memory: null podDisruptionBudget: enabled: true labels: {} annotations: {} maxUnavailable: 1 unhealthyPodEvictionPolicy: AlwaysAllow + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway logger: autoscaling: enabled: true @@ -74,9 +136,34 @@ services: annotations: {} maxUnavailable: 1 unhealthyPodEvictionPolicy: AlwaysAllow + resources: + requests: + cpu: '1' + memory: 1Gi + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway agent: autoscaling: enabled: true + resources: + requests: + cpu: 500m + memory: 500Mi + pod: + topologySpreadConstraints: + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + delayedJobMonitor: + resources: + requests: + cpu: null + memory: null + limits: + memory: null gateway: envoy: @@ -93,12 +180,24 @@ gateway: # Keep the unauthenticated in-cluster gateway behind an operator-managed, # authenticating edge rather than provisioning a public load balancer. type: ClusterIP + defaultIdentity: + user: '' + roles: '' + allowedPools: '' + resources: + requests: + cpu: 200m + memory: 128Mi + limits: + memory: 256Mi oauth2Proxy: enabled: false authz: enabled: false rateLimit: enabled: false + tls: + enabled: true monitoring: podMonitor: @@ -107,14 +206,55 @@ monitoring: compute: enabled: false +postgresql: + fullnameOverride: null + cluster: + instances: 3 + storage: + size: 20Gi + affinity: + podAntiAffinityType: required + enablePDB: true + postgresql: + synchronous: + method: any + number: 1 + dataDurability: required + +valkey: + fullnameOverride: null + dataStorage: + requestedSize: 8Gi + replica: + enabled: null + minReplicasToWrite: 1 + podDisruptionBudget: + enabled: true + +rustfs: + fullnameOverride: null + affinity: + podAntiAffinity: + enabled: null + storageclass: + dataStorageSize: 10Gi + secrets: postgresql: existingSecret: osmo-postgresql valkey: + generate: false existingSecret: osmo-valkey objectStorage: + generate: false existingSecret: osmo-object-storage + backendApiTokens: + enabled: false + credentials: [] masterEncryptionKey: + managementMode: external existingSecret: name: osmo-master-encryption-key key: mek.yaml + bootstrap: + enabled: false diff --git a/deployments/charts/osmo/templates/_helpers.tpl b/deployments/charts/osmo/templates/_helpers.tpl index b119e2b45..8b566e5af 100644 --- a/deployments/charts/osmo/templates/_helpers.tpl +++ b/deployments/charts/osmo/templates/_helpers.tpl @@ -137,6 +137,14 @@ app.kubernetes.io/instance: {{ .Release.Name }} {{- .Values.compute.workloadNamespace.name | default .Release.Namespace -}} {{- end -}} +{{- define "osmo.compute.backendName" -}} +{{- if .Values.compute.backendName -}} +{{- .Values.compute.backendName -}} +{{- else if and .Values.planes.control.enabled .Values.planes.compute.enabled -}} +{{- "default" -}} +{{- end -}} +{{- end -}} + {{- define "osmo.compute.serviceUrl" -}} {{- if .Values.planes.control.enabled -}} {{- printf "http://%s:%v" (include "osmo.gateway.fullname" .) .Values.gateway.envoy.service.port -}} diff --git a/deployments/charts/osmo/templates/backend-listener.yaml b/deployments/charts/osmo/templates/backend-listener.yaml index 626a81d43..5140eaa95 100644 --- a/deployments/charts/osmo/templates/backend-listener.yaml +++ b/deployments/charts/osmo/templates/backend-listener.yaml @@ -82,7 +82,7 @@ spec: - --login_method - token - --backend - - {{ .Values.compute.backendName | quote }} + - {{ include "osmo.compute.backendName" . | quote }} - --namespace - {{ include "osmo.compute.backendNamespace" . | quote }} - --log_level diff --git a/deployments/charts/osmo/templates/backend-worker.yaml b/deployments/charts/osmo/templates/backend-worker.yaml index 3d401d85c..3cb8f129b 100644 --- a/deployments/charts/osmo/templates/backend-worker.yaml +++ b/deployments/charts/osmo/templates/backend-worker.yaml @@ -82,7 +82,7 @@ spec: - --login_method - token - --backend - - {{ .Values.compute.backendName | quote }} + - {{ include "osmo.compute.backendName" . | quote }} - --namespace - {{ include "osmo.compute.backendNamespace" . | quote }} - --log_level diff --git a/deployments/charts/osmo/templates/validate-values.yaml b/deployments/charts/osmo/templates/validate-values.yaml index a7c654cf7..d418b11a3 100644 --- a/deployments/charts/osmo/templates/validate-values.yaml +++ b/deployments/charts/osmo/templates/validate-values.yaml @@ -5,8 +5,8 @@ {{- fail "at least one of planes.control.enabled or planes.compute.enabled must be true" -}} {{- end -}} {{- if .Values.planes.compute.enabled -}} -{{- if not .Values.compute.backendName -}} -{{- fail "compute.backendName is required when planes.compute.enabled=true; set it explicitly with --set-string compute.backendName=" -}} +{{- if and (not .Values.planes.control.enabled) (not .Values.compute.backendName) -}} +{{- fail "compute.backendName is required for compute-only installations; set it explicitly with --set-string compute.backendName=" -}} {{- end -}} {{- if not .Values.compute.authentication.existingSecret -}} {{- fail "compute.authentication.existingSecret is required when planes.compute.enabled=true" -}} diff --git a/deployments/charts/osmo/tests/control-embedded-values.yaml b/deployments/charts/osmo/tests/control-embedded-values.yaml index 8ddbf2273..531300d10 100644 --- a/deployments/charts/osmo/tests/control-embedded-values.yaml +++ b/deployments/charts/osmo/tests/control-embedded-values.yaml @@ -1,9 +1,21 @@ # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 +planes: + control: + enabled: true + compute: + enabled: false + +fullnameOverride: '' + embeddedDependencies: postgresql: enabled: true + valkey: + enabled: false + objectStorage: + enabled: false externalUrl: http://osmo-gateway @@ -22,17 +34,56 @@ externalDependencies: logs: osmo-logs apps: osmo-apps +postgresql: + fullnameOverride: null + cluster: + instances: 3 + storage: + size: 20Gi + affinity: + podAntiAffinityType: required + enablePDB: true + postgresql: + synchronous: + method: any + number: 1 + dataDurability: required + secrets: postgresql: existingSecret: '' valkey: + generate: false existingSecret: external-control-secrets objectStorage: + generate: false existingSecret: external-control-secrets + backendApiTokens: + enabled: false + credentials: [] masterEncryptionKey: + managementMode: external existingSecret: name: external-control-secrets key: mek.yaml + bootstrap: + enabled: false + +configuration: + enabled: false + +gateway: + envoy: + defaultIdentity: + user: '' + roles: '' + allowedPools: '' + oauth2Proxy: + enabled: true + authz: + enabled: true + tls: + enabled: true services: api: diff --git a/deployments/charts/osmo/tests/control-external-values.yaml b/deployments/charts/osmo/tests/control-external-values.yaml index 93a5aa5bf..6953a93d9 100644 --- a/deployments/charts/osmo/tests/control-external-values.yaml +++ b/deployments/charts/osmo/tests/control-external-values.yaml @@ -1,6 +1,22 @@ # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 +planes: + control: + enabled: true + compute: + enabled: false + +fullnameOverride: '' + +embeddedDependencies: + postgresql: + enabled: false + valkey: + enabled: false + objectStorage: + enabled: false + externalUrl: http://osmo-gateway externalDependencies: @@ -27,13 +43,21 @@ secrets: keys: password: external-db-password valkey: + generate: false existingSecret: external-valkey-secret objectStorage: + generate: false existingSecret: external-object-storage-secret + backendApiTokens: + enabled: false + credentials: [] masterEncryptionKey: + managementMode: external existingSecret: name: external-master-encryption-key-secret key: keyring.yaml + bootstrap: + enabled: false services: api: diff --git a/deployments/charts/osmo/tests/control-workload-policy-values.yaml b/deployments/charts/osmo/tests/control-workload-policy-values.yaml index 111ef8631..d0fa18463 100644 --- a/deployments/charts/osmo/tests/control-workload-policy-values.yaml +++ b/deployments/charts/osmo/tests/control-workload-policy-values.yaml @@ -51,6 +51,7 @@ services: selector: matchLabels: user-supplied-selector: ignored + worker: podDisruptionBudget: enabled: true @@ -58,3 +59,11 @@ services: annotations: {} minAvailable: 1 unhealthyPodEvictionPolicy: IfHealthyBudget + +gateway: + oauth2Proxy: + enabled: true + authz: + enabled: true + tls: + enabled: true diff --git a/deployments/charts/osmo/tests/test_osmo_charts.sh b/deployments/charts/osmo/tests/test_osmo_charts.sh index b4150f153..6dd35140e 100755 --- a/deployments/charts/osmo/tests/test_osmo_charts.sh +++ b/deployments/charts/osmo/tests/test_osmo_charts.sh @@ -496,18 +496,19 @@ test_control_umbrella() { fail "expected a split compute release without a backend name to fail" fi require_contains "$TEST_DIRECTORY/missing-split-backend-name.out" \ - "compute.backendName is required when planes.compute.enabled=true" + "compute.backendName is required for compute-only installations" - if helm_template missing-converged-backend-name "$charts_copy/osmo" \ - --api-versions postgresql.cnpg.io/v1 \ - -f "$charts_copy/osmo/profiles/self-contained.yaml" \ - --set externalUrl=https://osmo.example.com \ - --set-string 'compute.workflowNetworkPolicy.clusterCIDRs[0]=10.0.0.0/8' \ - >"$TEST_DIRECTORY/missing-converged-backend-name.out" 2>&1; then - fail "expected a converged release without a backend name to fail" - fi - require_contains "$TEST_DIRECTORY/missing-converged-backend-name.out" \ - "compute.backendName is required when planes.compute.enabled=true" + helm_template converged-default-backend "$charts_copy/osmo" \ + --api-versions postgresql.cnpg.io/v1 \ + -f "$charts_copy/osmo/profiles/self-contained.yaml" \ + --set externalUrl=https://osmo.example.com \ + --set-string 'compute.workflowNetworkPolicy.clusterCIDRs[0]=10.0.0.0/8' \ + >"$TEST_DIRECTORY/converged-default-backend.yaml" + resource_document "$TEST_DIRECTORY/converged-default-backend.yaml" Deployment \ + osmo-backend-listener \ + >"$TEST_DIRECTORY/converged-default-backend-listener.yaml" + require_contains "$TEST_DIRECTORY/converged-default-backend-listener.yaml" \ + '- "default"' helm_template_with_backend split-compute "$charts_copy/osmo" \ -f "$charts_copy/osmo/profiles/split-plane-compute.yaml" \ @@ -849,10 +850,9 @@ test_control_umbrella() { "scheme: HTTPS" local quickstart_runtime_tag=quickstart-test - helm_template_with_backend quick-start-runtime "$charts_copy/osmo" \ + helm_template quick-start-runtime "$charts_copy/osmo" \ --namespace osmo \ --api-versions postgresql.cnpg.io/v1 \ - -f "$charts_copy/osmo/profiles/quickstart.yaml" \ --set-string imageRegistry=nvcr.io \ --set-string imageRepository=nvstaging/osmo \ --set-string imageTag="$quickstart_runtime_tag" \ @@ -877,10 +877,9 @@ test_control_umbrella() { require_occurrences "$TEST_DIRECTORY/quickstart-runtime.yaml" \ "image: nvcr.io/nvstaging/osmo/service:$quickstart_runtime_tag" 2 - helm_template_with_backend quick-start "$charts_copy/osmo" \ + helm_template quick-start "$charts_copy/osmo" \ --namespace osmo \ --api-versions postgresql.cnpg.io/v1 \ - -f "$charts_copy/osmo/profiles/quickstart.yaml" \ >"$TEST_DIRECTORY/quickstart.yaml" local quickstart_deployment for quickstart_deployment in \ @@ -949,7 +948,7 @@ test_control_umbrella() { require_not_contains "$TEST_DIRECTORY/quickstart.yaml" "kind: Ingress" require_not_contains "$TEST_DIRECTORY/quickstart.yaml" "kind: HTTPRoute" require_not_contains "$TEST_DIRECTORY/quickstart.yaml" "kind: Namespace" - require_contains "$TEST_DIRECTORY/quickstart.yaml" "OSMO_LOGIN_DEV" + require_not_contains "$TEST_DIRECTORY/quickstart.yaml" "OSMO_LOGIN_DEV" require_contains "$TEST_DIRECTORY/quickstart.yaml" "http://osmo-gateway" require_contains "$TEST_DIRECTORY/quickstart.yaml" \ "secretName: osmo-backend-token" @@ -970,9 +969,6 @@ test_control_umbrella() { require_not_contains "$TEST_DIRECTORY/quickstart.yaml" "kind-osmo" require_not_contains "$TEST_DIRECTORY/quickstart.yaml" "/home/" require_not_contains "$TEST_DIRECTORY/quickstart.yaml" "currentMek:" - require_contains "$charts_copy/osmo/profiles/README.md" "quickstart.yaml" - require_contains "$charts_copy/osmo/README.md" \ - "deployments/charts/osmo/profiles/quickstart.yaml" require_contains "$charts_copy/osmo/README.md" \ "helm --kube-context kind-osmo upgrade --install osmo" require_occurrences "$charts_copy/osmo/README.md" \ @@ -4331,6 +4327,9 @@ EOF helm_template image-defaults "$charts_copy/osmo" \ -f "$CHARTS_ROOT/osmo/tests/control-external-values.yaml" \ + --set gateway.oauth2Proxy.enabled=true \ + --set gateway.authz.enabled=true \ + --set gateway.tls.enabled=true \ --set secrets.oauthClientSecret.existingSecret=oauth-client \ --set secrets.oauthCookieSecret.existingSecret=oauth-cookie \ >"$TEST_DIRECTORY/osmo-image-defaults.yaml" @@ -4357,6 +4356,9 @@ EOF helm_template image-mirror "$charts_copy/osmo" \ -f "$CHARTS_ROOT/osmo/tests/control-external-values.yaml" \ + --set gateway.oauth2Proxy.enabled=true \ + --set gateway.authz.enabled=true \ + --set gateway.tls.enabled=true \ --set secrets.oauthClientSecret.existingSecret=oauth-client \ --set secrets.oauthCookieSecret.existingSecret=oauth-cookie \ --set imageRegistry=mirror.example.com \ @@ -4526,6 +4528,7 @@ EOF helm_template_with_backend compute-only "$charts_copy/osmo" \ --namespace compute-system \ + -f "$charts_copy/osmo/profiles/split-plane-compute.yaml" \ --set planes.control.enabled=false \ --set planes.compute.enabled=true \ --set externalUrl=https://osmo.example.com \ diff --git a/deployments/charts/osmo/values.yaml b/deployments/charts/osmo/values.yaml index 536b07f5e..b461846e5 100644 --- a/deployments/charts/osmo/values.yaml +++ b/deployments/charts/osmo/values.yaml @@ -1,7 +1,8 @@ # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 -# Select which OSMO planes this release owns. +# The chart defaults provide the development quickstart composition. Production +# and split-plane profiles override these values explicitly. planes: # Deploy the API, UI, router, workers, logging services, and gateway. This # can be disabled for a compute-only release. @@ -9,10 +10,13 @@ planes: enabled: true # Deploy backend listener, worker, RBAC, and optional compute policy resources. compute: - enabled: false + enabled: true # Compute-plane settings shared by the directly owned backend services. compute: + # Required for compute-only releases. Converged control-and-compute releases + # use "default" when this is not supplied. + # backendName: custom-backend # Workflow resources are created in this namespace. Empty uses the Helm # release namespace. workloadNamespace: @@ -22,7 +26,7 @@ compute: # Enabling services.backendTestRunner requires this namespace to be non-empty. backendTestNamespace: '' authentication: - existingSecret: '' + existingSecret: osmo-backend-token tokenKey: token nodeConditionPrefix: '' rbac: @@ -58,11 +62,11 @@ compute: # Valkey is managed directly by this release. embeddedDependencies: postgresql: - enabled: false + enabled: true valkey: - enabled: false + enabled: true objectStorage: - enabled: false + enabled: true # Must match rustfs.config.rustfs.region when enabled. Override both values # together for a non-default region. region: us-east-1 @@ -124,7 +128,7 @@ externalDependencies: # Override the names Helm derives from the chart and release. Leave empty for # conventional names such as `osmo-api` and `osmo-gateway`. nameOverride: '' -fullnameOverride: '' +fullnameOverride: osmo # Registry default for OSMO-owned component and runtime images. A non-empty # service-specific image.registry or runtimeImage.registry takes precedence. @@ -184,7 +188,7 @@ logging: # Public OSMO URL used in generated service configuration and redirects. # Include the scheme, for example `https://osmo.example.com`. -externalUrl: '' +externalUrl: http://osmo-gateway # Optional Kubernetes Ingress for the OSMO gateway Service. ingress: @@ -254,14 +258,14 @@ secrets: # either a retained generated Secret or an existing Secret; external mode # requires an existing Secret. valkey: - generate: false + generate: true existingSecret: '' rolloutNonce: '' keys: password: redis-password # Storage SDK configuration file mounted for all three object-storage uses. objectStorage: - generate: false + generate: true existingSecret: '' rolloutNonce: '' keys: @@ -272,7 +276,7 @@ secrets: # or Helm release state; existing Secrets remain externally managed. # Every Secret contains `token` and may contain `previous-token` for rotation. backendApiTokens: - enabled: false + enabled: true bootstrap: image: registry: '' @@ -283,7 +287,10 @@ secrets: # Change this non-secret value to roll the API after an externally managed # token Secret changes. rolloutNonce: '' - credentials: [] + credentials: + - name: default + managedSecret: + name: osmo-backend-token # - name: default # existingSecret: # name: osmo-backend-token @@ -294,13 +301,13 @@ secrets: masterEncryptionKey: # OSMO-managed lifecycle Jobs create and rotate the referenced Secret. # External ownership mounts the reference without Secret mutation. - managementMode: external + managementMode: osmo existingSecret: - name: '' + name: osmo-master-encryption-key key: mek.yaml bootstrap: # Must be set back to false immediately after a successful bootstrap. - enabled: false + enabled: true # Increment after a failed GitOps attempt or credential correction. attempt: "1" imagePullPolicy: IfNotPresent @@ -384,10 +391,10 @@ services: automountServiceAccountToken: true resources: requests: - cpu: "1" - memory: 2Gi + cpu: 100m + memory: 256Mi limits: - memory: 2Gi + memory: 1Gi livenessProbe: enabled: true spec: @@ -429,6 +436,7 @@ services: extraContainers: [] extraVolumes: [] hostAliases: [] + topologySpreadConstraints: [] # Compute-plane worker that materializes workflow resources in Kubernetes. backendWorker: @@ -449,8 +457,8 @@ services: automountServiceAccountToken: true resources: requests: - cpu: "1" - memory: 1Gi + cpu: 100m + memory: 256Mi limits: memory: 1Gi livenessProbe: @@ -494,6 +502,7 @@ services: extraContainers: [] extraVolumes: [] hostAliases: [] + topologySpreadConstraints: [] # Template and RBAC for optional backend validation CronJobs. backendTestRunner: @@ -721,7 +730,12 @@ services: labels: {} annotations: {} extraPorts: [] - resources: {} + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi extraPorts: [] envFrom: [] livenessProbe: @@ -761,13 +775,7 @@ services: containerSecurityContext: readOnlyRootFilesystem: true runAsUser: 1000 - topologySpreadConstraints: - - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway + topologySpreadConstraints: [] hostAliases: [] initContainers: [] extraContainers: [] @@ -796,7 +804,12 @@ services: periodSeconds: 5 timeoutSeconds: 15 initialDelaySeconds: 10 - resources: {} + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi extraArgs: [] serviceAccount: name: '' @@ -816,6 +829,7 @@ services: nodeSelector: {} containerSecurityContext: readOnlyRootFilesystem: true + topologySpreadConstraints: [] initContainers: [] extraContainers: [] extraVolumes: [] @@ -850,7 +864,12 @@ services: periodSeconds: 5 timeoutSeconds: 15 initialDelaySeconds: 10 - resources: {} + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi extraArgs: [] serviceAccount: name: '' @@ -863,7 +882,7 @@ services: annotations: {} unhealthyPodEvictionPolicy: IfHealthyBudget extraEnv: [] - replicas: 2 + replicas: 1 extraVolumeMounts: [] pod: labels: {} @@ -871,13 +890,7 @@ services: nodeSelector: {} containerSecurityContext: readOnlyRootFilesystem: true - topologySpreadConstraints: - - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway + topologySpreadConstraints: [] initContainers: [] extraContainers: [] extraVolumes: [] @@ -944,7 +957,12 @@ services: failureThreshold: 3 periodSeconds: 45 timeoutSeconds: 20 - resources: {} + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi extraArgs: [] serviceAccount: name: '' @@ -957,7 +975,7 @@ services: annotations: {} unhealthyPodEvictionPolicy: IfHealthyBudget extraEnv: [] - replicas: 3 + replicas: 1 extraVolumeMounts: [] pod: labels: {} @@ -965,10 +983,7 @@ services: nodeSelector: {} containerSecurityContext: readOnlyRootFilesystem: true - topologySpreadConstraints: - - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway + topologySpreadConstraints: [] hostAliases: [] initContainers: [] extraContainers: [] @@ -1006,7 +1021,12 @@ services: annotations: {} unhealthyPodEvictionPolicy: IfHealthyBudget extraPorts: [] - resources: {} + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi service: labels: {} annotations: {} @@ -1039,7 +1059,7 @@ services: failureThreshold: 2 timeoutSeconds: 30 extraEnv: [] - replicas: 3 + replicas: 1 extraVolumeMounts: [] pod: labels: {} @@ -1047,10 +1067,7 @@ services: nodeSelector: {} containerSecurityContext: readOnlyRootFilesystem: true - topologySpreadConstraints: - - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway + topologySpreadConstraints: [] hostAliases: [] initContainers: [] extraContainers: [] @@ -1090,8 +1107,8 @@ services: initialDelaySeconds: 10 resources: requests: - cpu: '1' - memory: 1Gi + cpu: 100m + memory: 256Mi limits: memory: 1Gi service: @@ -1110,7 +1127,7 @@ services: unhealthyPodEvictionPolicy: IfHealthyBudget envoy: {} extraEnv: [] - replicas: 3 + replicas: 1 extraVolumeMounts: [] pod: labels: {} @@ -1118,10 +1135,7 @@ services: nodeSelector: {} containerSecurityContext: readOnlyRootFilesystem: true - topologySpreadConstraints: - - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway + topologySpreadConstraints: [] initContainers: [] extraContainers: [] extraVolumes: [] @@ -1169,8 +1183,8 @@ services: timeoutSeconds: 20 resources: requests: - cpu: 500m - memory: 500Mi + cpu: 100m + memory: 256Mi limits: memory: 1Gi service: @@ -1197,10 +1211,7 @@ services: nodeSelector: {} containerSecurityContext: readOnlyRootFilesystem: true - topologySpreadConstraints: - - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway + topologySpreadConstraints: [] initContainers: [] extraContainers: [] extraVolumes: [] @@ -1242,13 +1253,13 @@ gateway: annotations: {} unhealthyPodEvictionPolicy: IfHealthyBudget defaultIdentity: - user: '' - roles: '' - allowedPools: '' + user: testuser + roles: osmo-admin + allowedPools: default service: - type: ClusterIP + type: NodePort port: 80 - nodePort: null + nodePort: 30080 labels: {} annotations: {} loadBalancerClass: '' @@ -1259,10 +1270,10 @@ gateway: secretName: envoy-ssl-cert resources: requests: - cpu: 200m - memory: 128Mi + cpu: 50m + memory: 64Mi limits: - memory: 256Mi + memory: 512Mi livenessProbe: enabled: true spec: @@ -1322,7 +1333,7 @@ gateway: extraClusters: [] maxRequests: 100 extraVolumeMounts: [] - replicas: 2 + replicas: 1 pod: nodeSelector: {} affinity: {} @@ -1341,6 +1352,7 @@ gateway: extraContainers: [] labels: {} annotations: {} + topologySpreadConstraints: [] # Internal destinations used by Envoy routes. Empty hosts resolve to this # release's Services; set a host only to route outside the release. @@ -1368,7 +1380,7 @@ gateway: # Optional OIDC login/session proxy. Enable it only after configuring an # identity provider and the required existing Secrets. oauth2Proxy: - enabled: true + enabled: false autoscaling: enabled: false minReplicas: 1 @@ -1439,7 +1451,7 @@ gateway: # Optional external-authorization service backed by OSMO role policies. authz: - enabled: true + enabled: false autoscaling: enabled: false minReplicas: 1 @@ -1596,7 +1608,7 @@ gateway: # generates stable Kubernetes Secrets; production uses operator-provided or # cert-manager-owned existing Secrets. This does not configure edge TLS. tls: - enabled: true + enabled: false # Non-secret rollout trigger after operator-owned TLS Secrets change. rolloutNonce: '' generated: @@ -1621,13 +1633,9 @@ gateway: mcp: '' caSecret: '' -# OSMO domain configuration rendered into the service ConfigMap. Enable this -# in a profile to manage workflows, pod templates, validation rules, roles, -# backends, and pools with the release. +# OSMO domain configuration rendered into the service ConfigMap. configuration: - # When false, the chart does not render or mount the OSMO configuration - # ConfigMap. The split-plane control profile enables it. - enabled: false + enabled: true extraConfigMaps: [] extraAnnotations: {} service: {} @@ -1659,12 +1667,10 @@ configuration: limits: cpu: '{{USER_CPU}}' memory: '{{USER_MEMORY}}' - nvidia.com/gpu: '{{USER_GPU}}' ephemeral-storage: '{{USER_STORAGE}}' requests: cpu: '{{USER_CPU}}' memory: '{{USER_MEMORY}}' - nvidia.com/gpu: '{{USER_GPU}}' ephemeral-storage: '{{USER_STORAGE}}' resourceValidations: default_cpu: @@ -1808,15 +1814,16 @@ configuration: # CloudNativePG cluster chart values. These settings are used only when # embeddedDependencies.postgresql.enabled is true. postgresql: + fullnameOverride: osmo-pg nameOverride: pg type: postgresql version: postgresql: "16" mode: standalone cluster: - instances: 3 + instances: 1 storage: - size: 20Gi + size: 1Gi storageClass: '' walStorage: enabled: false @@ -1833,14 +1840,11 @@ postgresql: primaryUpdateStrategy: unsupervised affinity: topologyKey: kubernetes.io/hostname - podAntiAffinityType: required + podAntiAffinityType: "" enableSuperuserAccess: false - enablePDB: true + enablePDB: false postgresql: - synchronous: - method: any - number: 1 - dataDurability: required + synchronous: null initdb: database: osmo owner: osmo @@ -1852,6 +1856,7 @@ postgresql: # The dependency also supports fixed-primary replication for read scaling and # data redundancy, but it does not provide Sentinel or automatic promotion. valkey: + fullnameOverride: osmo-valkey networkPolicy: ingress: - from: @@ -1874,7 +1879,7 @@ valkey: enabled: true dataStorage: enabled: true - requestedSize: 8Gi + requestedSize: 512Mi keepPvc: true auth: enabled: true @@ -1890,18 +1895,20 @@ valkey: maxmemory-policy noeviction deploymentStrategy: Recreate replica: - minReplicasToWrite: 1 + enabled: false + minReplicasToWrite: 0 persistence: size: 8Gi persistentVolumeClaimRetentionPolicy: whenDeleted: Retain whenScaled: Retain podDisruptionBudget: - enabled: true + enabled: false # Official RustFS dependency configuration. These defaults provide a hardened, # persistent standalone server when embedded object storage is enabled. rustfs: + fullnameOverride: osmo-rustfs replicaCount: 1 mode: standalone: @@ -1956,6 +1963,9 @@ rustfs: readOnlyRootFilesystem: true allowPrivilegeEscalation: false runAsNonRoot: true + affinity: + podAntiAffinity: + enabled: false storageclass: name: "" - dataStorageSize: 10Gi + dataStorageSize: 1Gi