mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 08:37:31 +09:00
Aleksei Sviridkin
f7b12cf63a
A vGPU class may be ordered only by an entitled tenant, and no tenant may grant itself the entitlement. The Tenant field gpu.vgpu is set by the parent's administrator, so the effective value is the field and the parent's value together, and it reaches the namespace as the namespace.cozystack.io/vgpu label. The label is always written, so only "true" entitles and a missing label cannot be read as consent. _namespace.vgpu is written only when entitled, since every app in the tenant reads that Secret and an always-present key would upgrade them all. gpu.cozystack.io/* budget keys are checked against GPUDevice orders, not pods, so they are dropped before the ResourceQuota render, and a tenant with only GPU budgets gets no ResourceQuota or LimitRange. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
85 lines
4.8 KiB
JSON
85 lines
4.8 KiB
JSON
{
|
|
"title": "Chart Values",
|
|
"type": "object",
|
|
"properties": {
|
|
"host": {
|
|
"description": "The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"etcd": {
|
|
"description": "Deploy own Etcd cluster.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"monitoring": {
|
|
"description": "Deploy own Monitoring Stack.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"tracingCentral": {
|
|
"description": "Send this tenant's traces to the shared VictoriaTraces store in tenant-root instead of a per-tenant backend; its Grafana reads them through a vmauth there that pins the tenant's own account, so tenants sharing the store cannot read each other's traces. It needs the tenant's own Monitoring (`monitoring: true`) and tenant-root hosting the store (`tracingCentralHost: true` on its Monitoring, with a `cluster`-mode tracingStorages entry named `generic`); without that the tenant's monitoring render fails rather than dropping spans. tenant-root, and whoever it admits to its Grafana, are inside the store's trust boundary. Applications should export over OTLP/HTTP, in requests below 3 MiB: spans above the platform's per-tenant write rate are retried over HTTP but dropped over gRPC, and a larger request is refused and not retried.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"ingress": {
|
|
"description": "Deploy own Ingress Controller.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"gateway": {
|
|
"description": "Deploy own Gateway API Gateway (backed by Cilium Gateway API controller). When unset (the default) or set to `false`, the tenant does not own a Gateway and instead publishes through the nearest ancestor tenant that owns one, regardless of whether `host` is empty or custom (`false` currently behaves the same as unset and does not opt out of that inheritance). Set to `true` to give the tenant its own Gateway with its own LoadBalancer IP and Certificate. A tenant with a custom (non-derived) `host` that needs its apex publicly reachable must set `true` explicitly, because an ancestor's TLS certificate does not cover a custom apex. Note: leave the key absent (do not write `gateway: null`): the chart distinguishes \"unset\" via missing-key, not via null value, to satisfy the JSON schema generated from this comment.",
|
|
"type": "boolean"
|
|
},
|
|
"gatewayClass": {
|
|
"description": "GatewayClass for this tenant's own Gateway. Empty uses the platform default (`gateway.className`). Only the classes the operator lists in the platform's `gateway.tenantSelectableClasses`, plus that default, may be named here — anything else fails this tenant's own gateway release and reaches no other tenant. Read only when this tenant owns a Gateway; an inheriting tenant uses its ancestor's. Whether a class terminates TLS itself or at its provider's edge is declared once per class on the platform, not here.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"seaweedfs": {
|
|
"description": "Deploy own SeaweedFS.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"computeplane": {
|
|
"description": "Deploy own ComputePlane — a single-tenant, Cozystack-managed cluster for untrusted-code applications. The tenant receives no admin kubeconfig for it. Automatic routing of catalog applications onto it (placement: ComputePlane) is a planned follow-up and is not available yet; until it lands, external catalogs target the cluster via its computeplane-cluster-admin-kubeconfig Secret. See design-proposals/compute-plane in cozystack/community.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"schedulingClass": {
|
|
"description": "The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"resourceQuotas": {
|
|
"description": "Define resource quotas for the tenant.",
|
|
"type": "object",
|
|
"default": {},
|
|
"additionalProperties": {
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
},
|
|
"gpu": {
|
|
"description": "GPU settings of the tenant.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"vgpu": {
|
|
"description": "Entitle the tenant to order vGPU devices. Takes effect only when the parent tenant is entitled too; the root tenant takes its value from the platform's `gpu.vgpu`.",
|
|
"type": "boolean",
|
|
"default": false
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|