gitops/tenants/appset.yaml

@@ -5,7 +5,6 @@ metadata:
   namespace: argocd
 spec:
   goTemplate: true
-  goTemplateOptions: ["missingkey=error"]
   generators:
     - git:
         repoURL: https://git.bouvais.lu/adrien/ctie-exercice
@@ -14,7 +13,7 @@ spec:
           - path: "tenants/*/config.yaml"
   template:
     metadata:
-      name: 'tenant-{{ trimPrefix "tenant-" .path.basename }}'
+      name: 'tenant-{{.name}}'
     spec:
       project: tenants
       sources:
@@ -23,16 +22,13 @@ spec:
           path: charts/tenant
           helm:
             valueFiles:
-              - '$values/{{.path.path}}/config.yaml'
-            parameters:
-              - name: name
-                value: '{{ trimPrefix "tenant-" .path.basename }}'
+              - '$values/tenants/tenant-{{.name}}/config.yaml'
         - repoURL: https://git.bouvais.lu/adrien/ctie-exercice
           targetRevision: main
           ref: values
       destination:
         server: https://kubernetes.default.svc
-        namespace: 'tenant-{{ trimPrefix "tenant-" .path.basename }}'
+        namespace: 'tenant-{{.name}}'
       syncPolicy:
         automated:
           prune: true

images/base/dockerfile

@@ -4,12 +4,14 @@ LABEL org.opencontainers.image.title="tenant-base" \
       org.opencontainers.image.description="Hardened base image for tenant workspaces" \
       org.opencontainers.image.source="https://git.bouvais.lu/adrien/"
 
+# System deps only — keep this layer stable so it's rarely rebuilt
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
         tini \
     && rm -rf /var/lib/apt/lists/*
 
+# Non-root user, fixed UID/GID for predictable K8s securityContext
 RUN groupadd --gid 1000 appuser \
     && useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
 

images/jupyter/dockerfile

@@ -10,6 +10,7 @@ COPY --chown=appuser:appuser requirements.txt /tmp/requirements.txt
 RUN pip install --no-cache-dir -r /tmp/requirements.txt \
     && rm /tmp/requirements.txt
 
+# No secrets baked in — S3 creds come from a mounted K8s Secret / env at runtime
 USER appuser
 WORKDIR /home/appuser/work
 

tenants/tenant-a/config.yaml

@@ -1,3 +1,5 @@
+name: "a" # TODO: Remove this and use path instead
+
 image:
   repository: registry.bouvais.lu/tenant-jupyter
   tag: "1.0.0"
@@ -10,3 +12,8 @@ resources:
     cpu: "1"
     memory: 2Gi
 
+gpu:
+  enabled: true
+  type: "t4"          # one of: none | t4 | a100 | l4
+  count: 1
+

tenants/tenant-b/config.yaml

@@ -1,13 +0,0 @@
-name: "b"
-
-image:
-  repository: registry.bouvais.lu/tenant-jupyter
-  tag: "latest"
-
-resources:
-  requests:
-    cpu: 250m
-    memory: 512Mi
-  limits:
-    cpu: "1"
-    memory: 2Gi