setup

func CreateImagePullSecret ¶

func CreateImagePullSecret(ctx context.Context, c client.Client, namespace, secretName, server, username, password string) (string, bool, error)

CreateImagePullSecret creates a dockerconfigjson Secret for the given registry. server is the registry hostname (e.g. "nvcr.io", "ghcr.io"). username is the registry username (e.g. "$oauthtoken" for NGC, "token" for GHCR). password is the registry password or API key. secretName is the name to give the created Secret. Returns (secretName, wasCreated, error) where wasCreated is true only when a new Secret was created — false means an existing Secret was updated. Callers must only delete the secret on rollback when wasCreated is true.

func DeleteRunBinding ¶ added in v0.8.0

func DeleteRunBinding(ctx context.Context, c client.Client, namespace string, out io.Writer) error

DeleteRunBinding deletes a RoleBinding EnsureRunBinding created. Call it only once the run object is fully deleted: its finalizers write in the namespace until then.

func EnsureNamespace ¶

func EnsureNamespace(ctx context.Context, c client.Client, name string, out io.Writer) (bool, error)

EnsureNamespace creates a namespace if it doesn't exist. Returns true if the namespace was created by this call (false if it already existed).

func EnsureRunBinding ¶ added in v0.8.0

func EnsureRunBinding(ctx context.Context, c client.Client, namespace string, opts RunBindingOptions, out io.Writer) (bool, error)

EnsureRunBinding makes sure the controller can write in namespace before a run is submitted there (ADR-092), and reports whether it created a RoleBinding that the caller now owns.

It does nothing when no per-namespace binding is needed: the chart was installed with rbac.scope: cluster, or predates the role split. Otherwise it adopts an existing nvcre-manager-run binding, or creates one, but only in a namespace this run created or with --grant-run-access. In a namespace that already existed it refuses, so a shared namespace such as default never becomes a standing grant without the user asking, and the error carries the manifest.

The create runs with the user's credentials. Kubernetes allows it only if the user holds every permission in nvcre-run-role within the namespace, or has bind on the role.

func NewCommand ¶

func NewCommand(version string) *cobra.Command

NewCommand returns the "setup" cobra command. version is the running binary version and is threaded through to init/upgrade operations.

func ReleaseRunBinding ¶ added in v0.8.0

func ReleaseRunBinding(
	ctx context.Context, c client.Client, namespace string, runGone bool, runKind string, out io.Writer,
) (warned, retry bool)

ReleaseRunBinding deletes, during cleanup, a RoleBinding EnsureRunBinding created in a namespace the run did not create. It reports whether it printed a warning, and whether the run should keep owning the binding because the release could not complete, so a later --cleanup tries again. runGone says whether the run object (runKind) is fully deleted: until it is, its finalizers write in the namespace and need the binding, so it is kept with a warning instead. It is also kept while any other run is still in the namespace: a later run adopts the binding rather than creating its own, so deleting it would take that run's access away, mid-run or in its finalizers. If the other runs cannot be listed, it is kept too, as is one another run adopted within the adoption lease, with a warning: the adopter does not release it, so if its run never comes the binding is left for the user to delete. Once another run uses or adopted the binding, retrying is pointless and the caller gives up ownership.

func RunInit ¶

func RunInit(
	version string,
	image, imagePullSecret, skipPhases string, autoApprove bool,
	configFlags *kubeconfig.ConfigFlags, versionOverride string,
	chartRef, trainerChartRef, rbacScope string,
	in io.Reader, out io.Writer,
) error

RunInit executes the init phases sequentially. chartRef and trainerChartRef override the chart locations the NVCRE and Kubeflow Trainer releases are installed from; empty means the published GHCR charts. rbacScope sets the chart's rbac.scope; empty keeps the installed release's value. It passes no chart values of its own; the installed release's values are kept (ADR-098). Use RunInitWithValues to pass chart values.

func RunInitWithValues ¶ added in v0.8.0

func RunInitWithValues(
	version string,
	image, imagePullSecret, skipPhases string, autoApprove bool,
	configFlags *kubeconfig.ConfigFlags, versionOverride string,
	chartRef, trainerChartRef, rbacScope string, values ChartValues,
	in io.Reader, out io.Writer,
) error

RunInitWithValues is RunInit with this run's chart values for the NVCRE release: --values, --set, --set-json and --reset-values (ADR-098).

func RunReset ¶

func RunReset(
	skipPhases string, autoApprove bool,
	configFlags *kubeconfig.ConfigFlags,
	in io.Reader, out io.Writer,
) error

runReset executes the reset phases in reverse order.

func WaitForNamespaceDeletion ¶

func WaitForNamespaceDeletion(ctx context.Context, c client.Client, name string, out io.Writer)

waitForNamespaceDeletion polls until a namespace is fully removed.

func WorkloadPullSecretName ¶

func WorkloadPullSecretName(resourceName string) string

WorkloadPullSecretName returns the name of the workload image pull secret for a given Certification or WorkloadRun. Deriving from the resource name prevents concurrent runs in the same namespace from fighting over a single fixed name.