First version of VRE integrated chart #2

volodymyrss · 2025-04-08T08:20:21Z

REANA
- NFS provisioner
- added bootstrap for admin user
- used 0.95.0 alpha2, else db is reana:reana unless debug - workaround?
jupyterhub with configuration for rucio access
optional prometheus
optional grafana
add basic helm/k8s linting

Postpone for later:

add multi-RI rucio client and GW image
Built-in dev Rucio (?)
add default dashboards
add a way to setup RSE for etap sessions: mount it, use default for extension
- as a first stage, add default RSE mount
optionally mount CVMFS
add configurable session spawner
extended REANA with CRM prototype

We'll make an issue splitting some of the features for next MR.

TODO: check SWAN charts.

vre/templates/reana-ingress.yaml

paullaycock · 2025-07-14T12:09:57Z

vre/templates/reana-ingress.yaml

+    ingress.kubernetes.io/ssl-redirect: "true"
+    meta.helm.sh/release-name: reana
+    meta.helm.sh/release-namespace: reana
+    traefik.frontend.entryPoints: http,https


Doesn't hurt as it's just an annotation, but need to support ingress != traefik ?

paullaycock · 2025-07-14T12:20:29Z

vre/values-custom.yaml

@@ -0,0 +1,7 @@
+reana:


Wishlist to add
hostbase or similar, that is templated for the jhub and reana host names
Make indigo IAM client secret available for jhub too
Indigo IAM authorise, token and callback URLs for reana and jhub
nfs storage classes, both the default for persistent, and the reana shared storage class
common (postgres)db secret
Rucio host (template the extraEnv and rucio.cfg file generation ?)

Note that it is not that straightforward to remove all duplication from values. It is not possible to use template within values file itself.
It is possible to use yaml anchors but it's not for all cases (e.g. not when substring need to be templated).

Usually to avoid duplication like that, it is necessary to modify the chart itself, in this case the dependency charts.
I will see what can be done without being too invasive.

We could also template values ourselves, but it means adding a custom tool on top of helm and this will be less portable.

vre/Chart.yaml

paullaycock · 2025-07-14T12:25:16Z

skaffold.yaml

+deploy:
+  helm:
+    releases:
+      - name: cern-vre


maybe "escape-vre" is better, or even "my-escape-vre" as a default release name. Whatever this thing is, it won't actually be the CERN VRE :)

I see, interesting question.

For me, "VRE" is a generic term which I see throughout the related domains. So I assumed that name of the software product is "CERN VRE". Since it is a particular kind of a Virtual Research Environment, the kind made by CERN. See also the logo:

.

It also coincides with the name of the CERN instance.

However, we have now ESCAPE VRE, CERN VRE, ETAP VRE, and I wonder.

@garciagenrique @Soap2G what do you think? Should "CERN" be anywhere in the name of the generic VRE chart?

Thanks for raising this point.
IMO, each VRE deployment should keep their institution or "brand". In the way I imagine things, we should aim for a common "helm base layer" (let's call it vre or escape-vre). Then, each of the specific installations (CERN, ET, etc) could name their respective inherited chart as they want :)

With respect to the logo @Soap2G was the master mind behind the design. If you like it, we can create an ET VRE one, or feel free to create one based on the cern-vre one :)

paullaycock · 2025-07-14T12:27:49Z

vre/values.yaml

+      RucioAuthenticator:
+        # client_id: "" # set through secret
+        # client_secret: "" #  set through secret
+        authorize_url: https://iam-escape.cloud.cnaf.infn.it/authorize


Can the indigo client info, including callback urls (if there is a hostbase name) be factorised for reana and jhub?

I think this could be possible. Not sure whether is a good idea in terms of security - you might want to have different authorization policies for Jupyter and REANA.

Using different clients isn't (shouldn't be) that difficult. However, it's true that it would just required the creation and maintenance (propagating IdP secrets) of two(+) different clients.

garciagenrique

Hi @volodymyrss @paullaycock

Thanks for opening this PR. Let me add some general comments here.

I see that there are a lot of annotations that are cern-vre specific - which in the end are cern infrastructure specific. For example, the names of the volume and storage class naming, as well as the rucio env vars (among others).

Let me share here my (biased) vision of how I envision this repo (which doesn't need to be like this of course).

What would you think of creating an agnostic "base helm layer" (let's call it vre) which only deploys the "main services" - JupyterHub, Rucio and Reana? Then each vre flavor, that ideally inherits from the base layer, would add their own or specific services (nfs, grafana, EOS, CERN MONIT, etc.), change the chart values to point to their specific services (storage, network, db, idp, rucio and REANA server, etc), and name the charts as desired (cern-vre, etap, etc).

garciagenrique · 2025-07-22T07:27:07Z

skaffold.yaml

+deploy:
+  helm:
+    releases:
+      - name: cern-vre


Thanks for raising this point.
IMO, each VRE deployment should keep their institution or "brand". In the way I imagine things, we should aim for a common "helm base layer" (let's call it vre or escape-vre). Then, each of the specific installations (CERN, ET, etc) could name their respective inherited chart as they want :)

garciagenrique · 2025-07-22T07:30:14Z

skaffold.yaml

+deploy:
+  helm:
+    releases:
+      - name: cern-vre


With respect to the logo @Soap2G was the master mind behind the design. If you like it, we can create an ET VRE one, or feel free to create one based on the cern-vre one :)

garciagenrique · 2025-07-22T07:52:43Z

vre/README.md

+
+* <https://github.com/vre-hub/vre>
+
+## Requirements


See general comment about the different vre flavors

garciagenrique · 2025-07-22T07:59:46Z

vre/values.yaml

+      RucioAuthenticator:
+        # client_id: "" # set through secret
+        # client_secret: "" #  set through secret
+        authorize_url: https://iam-escape.cloud.cnaf.infn.it/authorize


I think this could be possible. Not sure whether is a good idea in terms of security - you might want to have different authorization policies for Jupyter and REANA.

Using different clients isn't (shouldn't be) that difficult. However, it's true that it would just required the creation and maintenance (propagating IdP secrets) of two(+) different clients.

volodymyrss · 2025-09-08T15:19:15Z

There is a question right now if it makes sense to use try using new pre-release reana 0.95.0, or port the CRM changes back onto 0.9.4.

garciagenrique · 2025-09-08T15:21:18Z

There is a question right now if it makes sense to use try using new pre-release reana 0.95.0, or port the CRM changes back onto 0.9.4.

I think it is always a good idea to try the latest version @volodymyrss. Any reason to use 0.9.4 ?

volodymyrss · 2025-09-08T15:27:56Z

There is a question right now if it makes sense to use try using new pre-release reana 0.95.0, or port the CRM changes back onto 0.9.4.

I think it is always a good idea to try the latest version @volodymyrss. Any reason to use 0.9.4 ?

The latest version is not released, it's in alpha.

Right now I am having an issue with it, related to parsing user token info from IAM . I think it was working before though, so it's strange the issue appeared both in dev and staging setup. Maybe IAM changed.

Anyway, alpha is not stable and will require continuous updates to our development.

When we last talked with @tiborsimko I think it was said it's too early to try 0.95.0, but I also did not see a huge number of changes in reana github org since, and the latest release is 0.95.0-alpha.2 is in Feb.
Do you know @tiborsimko what is the plan for 0.95.0, should we try to contribute our monitoring changes to it?

Or @garciagenrique you probably know of what is the plan for REANA version adoption in the VRE?

This reverts commit 1cd5a9b.

volodymyrss · 2025-09-15T09:35:22Z

I remembered why we moved to alpha version of REANA.

It's partly because we wanted to use included DB, but I saw this https://github.com/reanahub/reana/blob/0.9.4/helm/reana/templates/reana-db.yaml#L45 which seems to set debug values only in non-debug environment - so there seems to be maybe a bug? Of course we could use external db but it seems strange.

Second reason is that we are actually developing reana chart, so it's weird to start from old version.

But then, current alpha version stopped working, so this needs some investigation.

edit:

I think alpha version is not compatible with Indigo IAM, because recent versions of invenio_oauthclient seem to assume fetching userinfo both from endpoint and from token, specifically in the way keycloack does it. IAM fails with token userinfo decoding because it can not get the token signature right.

I am sure it is possible to adjust invenio_oauthclient and reana_server (which needs some extra configuration in this case).

In principle until 0.95.0 is stable, we could use 0.9.4 with a patch for the DB credentials in debug mode.
But 0.9.4 uses python3.8 which is already EoL.

Overall, it seems that to finish our project, we need a bit deeper changes to involvement reana and invenio_oauthclient, and count on new reana to be released.

An advice from @tiborsimko would be welcome, but I can also look myself deeper and propose further reana PRs.

volodymyrss · 2025-10-28T16:16:06Z

We discussed we need to talk about storage usage. To avoid duplication of data.

We are also thinking about using RSE per VRE instance.

add chart name

a8b76d4

volodymyrss self-assigned this Apr 8, 2025

Volodymyr Savchenko and others added 22 commits April 8, 2025 10:30

prototype chart yaml

9cd2a7a

modified

0d51000

modified

6484c13

add ci

9ae5e23

no hard-coded namespace

17102f7

adapted reana

422a1b5

adapted reana

994bddf

adapted version

6b687ae

adapted version

263a13b

adapted version

e646340

Update README.md

73b2af3

Update README.md

c5f8f41

values custom

0ae47b1

change email

b524464

change email

b5a8071

rename iam

e1b3112

rename db

51214b5

add todo for bootstrap

b508a1c

add monitoring

ec8043a

add monitoring

232ec9e

chart

8b8de6b

set some values

06d7b82

paullaycock reviewed Jul 14, 2025

View reviewed changes

vre/templates/reana-ingress.yaml Outdated Show resolved Hide resolved

paullaycock reviewed Jul 14, 2025

View reviewed changes

vre/Chart.yaml Outdated Show resolved Hide resolved

paullaycock reviewed Jul 14, 2025

View reviewed changes

Volodymyr Savchenko added 7 commits July 21, 2025 17:42

bump version

6fa246d

bump version

24145ce

bump version

e09e69f

improve backup

43bdacf

bump version

260f17b

bump chart

0a56fec

bump chart

fbe2335

garciagenrique reviewed Jul 22, 2025

View reviewed changes

Volodymyr Savchenko added 3 commits August 4, 2025 18:17

update readme a bit

58f908c

remove hook

7a0502f

move to older reana

1cd5a9b

Volodymyr Savchenko added 3 commits September 15, 2025 10:19

bump chart version

196afe1

Revert "move to older reana"

bcc9927

This reverts commit 1cd5a9b.

bump reana and chart

cc0ad3f

bump reana and chart

32decf0

volodymyrss force-pushed the first-version-vre-chart branch from b6e35a9 to 32decf0 Compare September 15, 2025 11:54

Volodymyr Savchenko added 8 commits September 15, 2025 13:55

adjust reana version

e0ee31f

increase chart version

1f2f475

add dev reana

fefb6e9

add dev reana

4a99571

reverse debug in reana

c12d566

bump version

96974fe

bump version

6f1db36

bump version

66c48f7

volodymyrss requested a review from Soap2G October 29, 2025 11:33

First version of VRE integrated chart #2

Are you sure you want to change the base?

First version of VRE integrated chart #2

Uh oh!

Conversation

volodymyrss commented Apr 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

volodymyrss Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

garciagenrique left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

volodymyrss commented Sep 8, 2025

Uh oh!

garciagenrique commented Sep 8, 2025

Uh oh!

volodymyrss commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

volodymyrss commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

volodymyrss commented Oct 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

volodymyrss commented Apr 8, 2025 •

edited

Loading

volodymyrss Jul 14, 2025 •

edited

Loading

volodymyrss commented Sep 8, 2025 •

edited

Loading

volodymyrss commented Sep 15, 2025 •

edited

Loading