Merge branch 'dev'

.github/workflows/destroy.yml

@@ -85,7 +85,7 @@ jobs:
           ONDEMAND_CONFIG_FILE: '${{ runner.temp }}/ondemand-config.yml'
 
       - name: Install ansible dependencies
-        run: ansible-galaxy install -r requirements.yml
+        run: ansible-galaxy install --force -r requirements.yml
       - name: Terraform initialise
         run: terraform init -input=false
         env:

.gitignore

@@ -4,7 +4,6 @@ host.ini
 terraform/terraform.tfstate
 terraform/terraform.tfstate.d/*
 terraform/terraform.tfstate.backup
-terraform/terraform.tfvars
 env.sh
 .terraform
 .terraform.lock.hcl

deployment-checklist.md

@@ -0,0 +1,19 @@
+# Deployment checklist
+
+In *vars/ondemand-config.yml.example*:
+
+- adjust `num_users_create` and `num_trainers_create`
+- adjust `ood_apps`
+  - check `version` and `k8s_container`
+  - enable required apps
+  - set which images to pre-pull
+- set `enable_pod_prepull` if desired (should default to on probably)
+- set `control_plane_flavor`, usually to `balanced1.4cpu8ram` for production
+- set `cluster_worker_count` and `worker_flavor` to have enough capacity for the number of users
+
+In *terraform/terraform.tfvars*:
+
+- adjust `services_flavor_id` (usually use the id for *8cpu16ram* for production)
+- adjust `services_volume_size`, must be big enough for all the user home directories
+- adjust `webnode_flavor_id` (the id for *8cpu16ram* works well for up to 30-40 users, not tested past that)
+- adjust `webnode_volume_size`, usually leave at 30 GB

destroy-k8s-cluster.yml

@@ -8,5 +8,5 @@
     shell: >-
       kubectl delete cluster {{ terraform_workspace }}
     when:
-      - "enable_k8s_openondemand|default(false)|bool == true"
+      - "k8s_ood_enable|default(false)|bool == true"
     register: destroy

roles/capi-cluster/get-nodes/defaults/main.yml

@@ -4,4 +4,4 @@ k8s_ood_enable: false
 cluster_name: capi-cluster
 capi_ssh_user: cloud-user
 
-tmp_dir: "/tmp/{{ cluster_name }}"
+tmp_dir: "/tmp/{{ cluster_name }}"

roles/capi-cluster/get-nodes/tasks/prerequisites.yml

@@ -36,3 +36,10 @@
     kubectl get secret -n {{ cluster_namespace }} {{ cluster_name }}-kubeconfig 
     -o jsonpath='{.data.value}'|base64 -d > {{ tmp_dir }}/{{ cluster_name }}.kubeconfig
   when: not new_cluster_config.stat.exists
+
+- name: Copy {{ cluster_name }} cluster kubeconfig yaml to persistent location
+  ansible.builtin.copy:
+    src: "{{ tmp_dir }}/{{ cluster_name }}.kubeconfig"
+    dest: "~/.kube/{{ cluster_name }}.kubeconfig"
+    mode: '0640'
+    remote_src: yes

roles/capi-cluster/workload/defaults/main.yml

@@ -72,4 +72,4 @@ kube_oidc_username_prefix: "-"
 kube_oidc_groups_claim: groups
 kube_oidc_groups_prefix: 'oidc:'
 # Copy oidc CA file to the following path if needed
-kube_oidc_ca_file: "{{ ca_cert_file }}"
+kube_oidc_ca_file: "{{ ca_cert_file }}"

roles/openondemand-k8s/kuberenetes/defaults/main.yml

@@ -17,4 +17,4 @@ ood_apps:
     k8s_container: ghcr.io/nesi/training-environment-jupyter-ml101-app:v0.2.1
     repo: https://github.com/nesi/training-environment-jupyter-ml101-app.git
     version: 'v0.2.1'
-    enabled: false
+    enabled: false

roles/openondemand-k8s/kuberenetes/tasks/pod-pre-puller.yml

@@ -4,7 +4,9 @@
       ood_enabled_apps: "{{ ood_enabled_apps +
                         [{ 'name': item.key, 'container_url': item.value.k8s_container }] }}"
   with_items: "{{ ood_apps | dict2items }}"
-  when: item.value.enabled == true
+  when:
+    - item.value.enabled == true
+    - item.value.pre_pull == true
   vars:
     ood_enabled_apps: []
 

roles/openondemand-k8s/web-node/defaults/main.yml

@@ -26,4 +26,4 @@ k8s_namespace_prefix: "user-"
 kube_oidc_url: https://ood-idp.training.data.nesi.org.nz/realms/ondemand
 kube_oidc_client_id: kubernetes
 kube_oidc_client_secret_id: secret
-kube_oidc_username_prefix: "-"
+kube_oidc_username_prefix: "-"