apiVersion: v1
data:
  sync.py: "# Copyright 2020-2021 The Kubeflow Authors\n#\n# Licensed under the Apache
    License, Version 2.0 (the \"License\");\n# you may not use this file except in
    compliance with the License.\n# You may obtain a copy of the License at\n#\n#
    \     http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable
    law or agreed to in writing, software\n# distributed under the License is distributed
    on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
    express or implied.\n# See the License for the specific language governing permissions
    and\n# limitations under the License.\n\nfrom http.server import BaseHTTPRequestHandler,
    HTTPServer\nimport json\nimport os\nimport base64\n\n\ndef main():\n    settings
    = get_settings_from_env()\n    server = server_factory(**settings)\n    server.serve_forever()\n\n\ndef
    get_settings_from_env(controller_port=None,\n                          visualization_server_image=None,
    frontend_image=None,\n                          visualization_server_tag=None,
    frontend_tag=None, disable_istio_sidecar=None,\n                          minio_access_key=None,
    minio_secret_key=None, kfp_default_pipeline_root=None):\n    \"\"\"\n    Returns
    a dict of settings from environment variables relevant to the controller\n\n    Environment
    settings can be overridden by passing them here as arguments.\n\n    Settings
    are pulled from the all-caps version of the setting name.  The\n    following
    defaults are used if those environment variables are not set\n    to enable backwards
    compatibility with previous versions of this script:\n        visualization_server_image:
    gcr.io/ml-pipeline/visualization-server\n        visualization_server_tag: value
    of KFP_VERSION environment variable\n        frontend_image: gcr.io/ml-pipeline/frontend\n
    \       frontend_tag: value of KFP_VERSION environment variable\n        disable_istio_sidecar:
    Required (no default)\n        minio_access_key: Required (no default)\n        minio_secret_key:
    Required (no default)\n    \"\"\"\n    settings = dict()\n    settings[\"controller_port\"]
    = \\\n        controller_port or \\\n        os.environ.get(\"CONTROLLER_PORT\",
    \"8080\")\n\n    settings[\"visualization_server_image\"] = \\\n        visualization_server_image
    or \\\n        os.environ.get(\"VISUALIZATION_SERVER_IMAGE\", \"gcr.io/ml-pipeline/visualization-server\")\n\n
    \   settings[\"frontend_image\"] = \\\n        frontend_image or \\\n        os.environ.get(\"FRONTEND_IMAGE\",
    \"gcr.io/ml-pipeline/frontend\")\n\n    # Look for specific tags for each image
    first, falling back to\n    # previously used KFP_VERSION environment variable
    for backwards\n    # compatibility\n    settings[\"visualization_server_tag\"]
    = \\\n        visualization_server_tag or \\\n        os.environ.get(\"VISUALIZATION_SERVER_TAG\")
    or \\\n        os.environ[\"KFP_VERSION\"]\n\n    settings[\"frontend_tag\"] =
    \\\n        frontend_tag or \\\n        os.environ.get(\"FRONTEND_TAG\") or \\\n
    \       os.environ[\"KFP_VERSION\"]\n\n    settings[\"disable_istio_sidecar\"]
    = \\\n        disable_istio_sidecar if disable_istio_sidecar is not None \\\n
    \           else os.environ.get(\"DISABLE_ISTIO_SIDECAR\") == \"true\"\n\n    settings[\"minio_access_key\"]
    = \\\n        minio_access_key or \\\n        base64.b64encode(bytes(os.environ.get(\"MINIO_ACCESS_KEY\"),
    'utf-8')).decode('utf-8')\n\n    settings[\"minio_secret_key\"] = \\\n        minio_secret_key
    or \\\n        base64.b64encode(bytes(os.environ.get(\"MINIO_SECRET_KEY\"), 'utf-8')).decode('utf-8')\n\n
    \   # KFP_DEFAULT_PIPELINE_ROOT is optional\n    settings[\"kfp_default_pipeline_root\"]
    = \\\n        kfp_default_pipeline_root or \\\n        os.environ.get(\"KFP_DEFAULT_PIPELINE_ROOT\")\n\n
    \   return settings\n\n\ndef server_factory(visualization_server_image,\n                   visualization_server_tag,
    frontend_image, frontend_tag,\n                   disable_istio_sidecar, minio_access_key,\n
    \                  minio_secret_key, kfp_default_pipeline_root=None, \n                   url=\"\",
    controller_port=8080):\n    \"\"\"\n    Returns an HTTPServer populated with Handler
    with customized settings\n    \"\"\"\n    class Controller(BaseHTTPRequestHandler):\n
    \       def sync(self, parent, children):\n            # parent is a namespace\n
    \           namespace = parent.get(\"metadata\", {}).get(\"name\")\n\n            pipeline_enabled
    = parent.get(\"metadata\", {}).get(\n                \"labels\", {}).get(\"pipelines.kubeflow.org/enabled\")\n\n
    \           if pipeline_enabled != \"true\":\n                return {\"status\":
    {}, \"children\": []}\n\n            desired_configmap_count = 1\n            desired_resources
    = []\n            if kfp_default_pipeline_root:\n                desired_configmap_count
    = 2\n                desired_resources += [{\n                    \"apiVersion\":
    \"v1\",\n                    \"kind\": \"ConfigMap\",\n                    \"metadata\":
    {\n                        \"name\": \"kfp-launcher\",\n                        \"namespace\":
    namespace,\n                    },\n                    \"data\": {\n                        \"defaultPipelineRoot\":
    kfp_default_pipeline_root,\n                    },\n                }]\n\n\n            #
    Compute status based on observed state.\n            desired_status = {\n                \"kubeflow-pipelines-ready\":\n
    \                   len(children[\"Secret.v1\"]) == 1 and\n                    len(children[\"ConfigMap.v1\"])
    == desired_configmap_count and\n                    len(children[\"Deployment.apps/v1\"])
    == 2 and\n                    len(children[\"Service.v1\"]) == 2 and\n                    len(children[\"DestinationRule.networking.istio.io/v1alpha3\"])
    == 1 and\n                    len(children[\"AuthorizationPolicy.security.istio.io/v1beta1\"])
    == 1 and\n                    \"True\" or \"False\"\n            }\n\n            #
    Generate the desired child object(s).\n            desired_resources += [\n                {\n
    \                   \"apiVersion\": \"v1\",\n                    \"kind\": \"ConfigMap\",\n
    \                   \"metadata\": {\n                        \"name\": \"metadata-grpc-configmap\",\n
    \                       \"namespace\": namespace,\n                    },\n                    \"data\":
    {\n                        \"METADATA_GRPC_SERVICE_HOST\":\n                            \"metadata-grpc-service.kubeflow\",\n
    \                       \"METADATA_GRPC_SERVICE_PORT\": \"8080\",\n                    },\n
    \               },\n                # Visualization server related manifests below\n
    \               {\n                    \"apiVersion\": \"apps/v1\",\n                    \"kind\":
    \"Deployment\",\n                    \"metadata\": {\n                        \"labels\":
    {\n                            \"app\": \"ml-pipeline-visualizationserver\"\n
    \                       },\n                        \"name\": \"ml-pipeline-visualizationserver\",\n
    \                       \"namespace\": namespace,\n                    },\n                    \"spec\":
    {\n                        \"selector\": {\n                            \"matchLabels\":
    {\n                                \"app\": \"ml-pipeline-visualizationserver\"\n
    \                           },\n                        },\n                        \"template\":
    {\n                            \"metadata\": {\n                                \"labels\":
    {\n                                    \"app\": \"ml-pipeline-visualizationserver\"\n
    \                               },\n                                \"annotations\":
    disable_istio_sidecar and {\n                                    \"sidecar.istio.io/inject\":
    \"false\"\n                                } or {},\n                            },\n
    \                           \"spec\": {\n                                \"containers\":
    [{\n                                    \"image\": f\"{visualization_server_image}:{visualization_server_tag}\",\n
    \                                   \"imagePullPolicy\":\n                                        \"IfNotPresent\",\n
    \                                   \"name\":\n                                        \"ml-pipeline-visualizationserver\",\n
    \                                   \"ports\": [{\n                                        \"containerPort\":
    8888\n                                    }],\n                                    \"resources\":
    {\n                                        \"requests\": {\n                                            \"cpu\":
    \"50m\",\n                                            \"memory\": \"200Mi\"\n
    \                                       },\n                                        \"limits\":
    {\n                                            \"cpu\": \"500m\",\n                                            \"memory\":
    \"1Gi\"\n                                        },\n                                    }\n
    \                               }],\n                                \"serviceAccountName\":\n
    \                                   \"default-editor\",\n                            },\n
    \                       },\n                    },\n                },\n                {\n
    \                   \"apiVersion\": \"networking.istio.io/v1alpha3\",\n                    \"kind\":
    \"DestinationRule\",\n                    \"metadata\": {\n                        \"name\":
    \"ml-pipeline-visualizationserver\",\n                        \"namespace\": namespace,\n
    \                   },\n                    \"spec\": {\n                        \"host\":
    \"ml-pipeline-visualizationserver\",\n                        \"trafficPolicy\":
    {\n                            \"tls\": {\n                                \"mode\":
    \"ISTIO_MUTUAL\"\n                            }\n                        }\n                    }\n
    \               },\n                {\n                    \"apiVersion\": \"security.istio.io/v1beta1\",\n
    \                   \"kind\": \"AuthorizationPolicy\",\n                    \"metadata\":
    {\n                        \"name\": \"ml-pipeline-visualizationserver\",\n                        \"namespace\":
    namespace,\n                    },\n                    \"spec\": {\n                        \"selector\":
    {\n                            \"matchLabels\": {\n                                \"app\":
    \"ml-pipeline-visualizationserver\"\n                            }\n                        },\n
    \                       \"rules\": [{\n                            \"from\": [{\n
    \                               \"source\": {\n                                    \"principals\":
    [\"cluster.local/ns/kubeflow/sa/ml-pipeline\"]\n                                }\n
    \                           }]\n                        }]\n                    }\n
    \               },\n                {\n                    \"apiVersion\": \"v1\",\n
    \                   \"kind\": \"Service\",\n                    \"metadata\":
    {\n                        \"name\": \"ml-pipeline-visualizationserver\",\n                        \"namespace\":
    namespace,\n                    },\n                    \"spec\": {\n                        \"ports\":
    [{\n                            \"name\": \"http\",\n                            \"port\":
    8888,\n                            \"protocol\": \"TCP\",\n                            \"targetPort\":
    8888,\n                        }],\n                        \"selector\": {\n
    \                           \"app\": \"ml-pipeline-visualizationserver\",\n                        },\n
    \                   },\n                },\n                # Artifact fetcher
    related resources below.\n                {\n                    \"apiVersion\":
    \"apps/v1\",\n                    \"kind\": \"Deployment\",\n                    \"metadata\":
    {\n                        \"labels\": {\n                            \"app\":
    \"ml-pipeline-ui-artifact\"\n                        },\n                        \"name\":
    \"ml-pipeline-ui-artifact\",\n                        \"namespace\": namespace,\n
    \                   },\n                    \"spec\": {\n                        \"selector\":
    {\n                            \"matchLabels\": {\n                                \"app\":
    \"ml-pipeline-ui-artifact\"\n                            }\n                        },\n
    \                       \"template\": {\n                            \"metadata\":
    {\n                                \"labels\": {\n                                    \"app\":
    \"ml-pipeline-ui-artifact\"\n                                },\n                                \"annotations\":
    disable_istio_sidecar and {\n                                    \"sidecar.istio.io/inject\":
    \"false\"\n                                } or {},\n                            },\n
    \                           \"spec\": {\n                                \"containers\":
    [{\n                                    \"name\":\n                                        \"ml-pipeline-ui-artifact\",\n
    \                                   \"image\": f\"{frontend_image}:{frontend_tag}\",\n
    \                                   \"imagePullPolicy\":\n                                        \"IfNotPresent\",\n
    \                                   \"ports\": [{\n                                        \"containerPort\":
    3000\n                                    }],\n                                    \"resources\":
    {\n                                        \"requests\": {\n                                            \"cpu\":
    \"10m\",\n                                            \"memory\": \"70Mi\"\n                                        },\n
    \                                       \"limits\": {\n                                            \"cpu\":
    \"100m\",\n                                            \"memory\": \"500Mi\"\n
    \                                       },\n                                    }\n
    \                               }],\n                                \"serviceAccountName\":\n
    \                                   \"default-editor\"\n                            }\n
    \                       }\n                    }\n                },\n                {\n
    \                   \"apiVersion\": \"v1\",\n                    \"kind\": \"Service\",\n
    \                   \"metadata\": {\n                        \"name\": \"ml-pipeline-ui-artifact\",\n
    \                       \"namespace\": namespace,\n                        \"labels\":
    {\n                            \"app\": \"ml-pipeline-ui-artifact\"\n                        }\n
    \                   },\n                    \"spec\": {\n                        \"ports\":
    [{\n                            \"name\":\n                                \"http\",
    \ # name is required to let istio understand request protocol\n                            \"port\":
    80,\n                            \"protocol\": \"TCP\",\n                            \"targetPort\":
    3000\n                        }],\n                        \"selector\": {\n                            \"app\":
    \"ml-pipeline-ui-artifact\"\n                        }\n                    }\n
    \               },\n            ]\n            print('Received request:\\n', json.dumps(parent,
    indent=2, sort_keys=True))\n            print('Desired resources except secrets:\\n',
    json.dumps(desired_resources, indent=2, sort_keys=True))\n            # Moved
    after the print argument because this is sensitive data.\n            desired_resources.append({\n
    \               \"apiVersion\": \"v1\",\n                \"kind\": \"Secret\",\n
    \               \"metadata\": {\n                    \"name\": \"mlpipeline-minio-artifact\",\n
    \                   \"namespace\": namespace,\n                },\n                \"data\":
    {\n                    \"accesskey\": minio_access_key,\n                    \"secretkey\":
    minio_secret_key,\n                },\n            })\n\n            return {\"status\":
    desired_status, \"children\": desired_resources}\n\n        def do_POST(self):\n
    \           # Serve the sync() function as a JSON webhook.\n            observed
    = json.loads(\n                self.rfile.read(int(self.headers.get(\"content-length\"))))\n
    \           desired = self.sync(observed[\"parent\"], observed[\"children\"])\n\n
    \           self.send_response(200)\n            self.send_header(\"Content-type\",
    \"application/json\")\n            self.end_headers()\n            self.wfile.write(bytes(json.dumps(desired),
    'utf-8'))\n\n    return HTTPServer((url, int(controller_port)), Controller)\n\n\nif
    __name__ == \"__main__\":\n    main()\n"
kind: ConfigMap
metadata:
  labels:
    app: kubeflow-pipelines-profile-controller
    app.kubernetes.io/component: ml-pipeline
    app.kubernetes.io/name: kubeflow-pipelines
    application-crd-id: kubeflow-pipelines
  name: kubeflow-pipelines-profile-controller-code-dhhfgkff5f
  namespace: kubeflow
