README.md

@@ -13,17 +13,12 @@ brew install docker
 
 # 2. Images
 
-To created the needed dependency, I did a simple 2 images base + jupyter.
+```
-The first image is a minimal python slim. I then add some 
-
-### 2.1. Base
-
-```images/base/dockerfile
 FROM python:3.12-slim-bookworm AS base
 
 LABEL org.opencontainers.image.title="tenant-base" \
       org.opencontainers.image.description="Hardened base image for tenant workspaces" \
-      org.opencontainers.image.source="https://git.bouvais.lu/adrien/"
+      org.opencontainers.image.source="https://github.com/yourorg/yourrepo"
 
 # System deps only — keep this layer stable so it's rarely rebuilt
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -41,41 +36,3 @@ USER appuser
 
 ENTRYPOINT ["tini", "--"]
 ```
-
-Then build and push it to the registry
-
-```
-docker build -t registry.bouvais.lu/tenant-base:1.0.0 images/base
-docker push registry.bouvais.lu/tenant-base:1.0.0
-```
-
-### 2.2. Jupyter
-
-Now I dp the same for a simple jupyter image.
-
-```
-ARG BASE_IMAGE=registry.bouvais.lu/tenant-base:1.0.0
-FROM ${BASE_IMAGE}
-
-LABEL org.opencontainers.image.title="tenant-jupyter" \
-      org.opencontainers.image.description="JupyterLab image built on tenant-base" \
-      org.opencontainers.image.base.name="${BASE_IMAGE}"
-
-USER root
-COPY --chown=appuser:appuser requirements.txt /tmp/requirements.txt
-RUN pip install --no-cache-dir -r /tmp/requirements.txt \
-    && rm /tmp/requirements.txt
-
-# No secrets baked in — S3 creds come from a mounted K8s Secret / env at runtime
-USER appuser
-WORKDIR /home/appuser/work
-
-EXPOSE 8888
-
-CMD ["jupyter", "lab", \
-     "--ip=0.0.0.0", \
-     "--port=8888", \
-     "--no-browser", \
-     "--ServerApp.token=", \
-     "--ServerApp.allow_remote_access=True"]
-```

gitops/root-app.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: root
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://git.bouvais.lu/adrien/ctie-exercice
-    targetRevision: main
-    path: gitops
-    directory:
-      recurse: true
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

gitops/tenants-appset.yaml

@@ -1,37 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: tenants
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-    - git:
-        repoURL: https://git.bouvais.lu/adrien/ctie-exercice
-        revision: main
-        files:
-          - path: "tenants/*/config.yaml"
-  template:
-    metadata:
-      name: 'tenant-{{.name}}'
-    spec:
-      project: tenants
-      sources:
-        - repoURL: https://git.bouvais.lu/adrien/ctie-exercice
-          targetRevision: main
-          path: charts/tenant
-          helm:
-            valueFiles:
-              - '$values/tenants/{{.name}}/config.yaml'
-        - repoURL: https://git.bouvais.lu/adrien/ctie-exercice
-          targetRevision: main
-          ref: values
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: 'tenant-{{.name}}'
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-          - CreateNamespace=true

gitops/tenants-project.yaml

@@ -1,15 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: tenants
-  namespace: argocd
-spec:
-  sourceRepos:
-    - https://git.bouvais.lu/adrien/ctie-exercice
-  destinations:
-    - server: https://kubernetes.default.svc
-      namespace: 'tenant-*'
-  clusterResourceWhitelist: []   # tenants can't touch cluster-scoped resources
-  namespaceResourceWhitelist:
-    - group: '*'
-      kind: '*'

images/base/dockerfile

@@ -1,22 +0,0 @@
-FROM python:3.12-slim-bookworm AS base
-
-LABEL org.opencontainers.image.title="tenant-base" \
-      org.opencontainers.image.description="Hardened base image for tenant workspaces" \
-      org.opencontainers.image.source="https://git.bouvais.lu/adrien/"
-
-# System deps only — keep this layer stable so it's rarely rebuilt
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates \
-        curl \
-        tini \
-    && rm -rf /var/lib/apt/lists/*
-
-# Non-root user, fixed UID/GID for predictable K8s securityContext
-RUN groupadd --gid 1000 appuser \
-    && useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
-
-WORKDIR /home/appuser
-USER appuser
-
-ENTRYPOINT ["tini", "--"]
-

images/jupyter/dockerfile

@@ -1,24 +0,0 @@
-ARG BASE_IMAGE=registry.bouvais.lu/tenant-base:1.0.0
-FROM ${BASE_IMAGE}
-
-LABEL org.opencontainers.image.title="tenant-jupyter" \
-      org.opencontainers.image.description="JupyterLab image built on tenant-base" \
-      org.opencontainers.image.base.name="${BASE_IMAGE}"
-
-USER root
-COPY --chown=appuser:appuser requirements.txt /tmp/requirements.txt
-RUN pip install --no-cache-dir -r /tmp/requirements.txt \
-    && rm /tmp/requirements.txt
-
-# No secrets baked in — S3 creds come from a mounted K8s Secret / env at runtime
-USER appuser
-WORKDIR /home/appuser/work
-
-EXPOSE 8888
-
-CMD ["jupyter", "lab", \
-     "--ip=0.0.0.0", \
-     "--port=8888", \
-     "--no-browser", \
-     "--ServerApp.token=", \
-     "--ServerApp.allow_remote_access=True"]

images/jupyter/requirements.txt

@@ -1,4 +0,0 @@
-jupyterlab==4.2.5
-boto3==1.35.0
-s3fs==2024.9.0
-pandas==2.2.2

minio/manifests.yaml

@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: minio
-  namespace: minio
-spec:
-  replicas: 1
-  selector:
-    matchLabels: {app: minio}
-  template:
-    metadata:
-      labels: {app: minio}
-    spec:
-      containers:
-        - name: minio
-          image: minio/minio:latest
-          args: ["server", "/data", "--console-address", ":9001"]
-          env:
-            - name: MINIO_ROOT_USER
-              value: "admin"
-            - name: MINIO_ROOT_PASSWORD
-              value: "changeme123" # TODO: Remove
-          ports:
-            - containerPort: 9000
-            - containerPort: 9001
-          volumeMounts:
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: data
-          emptyDir: {}    # TODO: Make it persistant
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio
-  namespace: minio
-spec:
-  selector: {app: minio}
-  ports:
-    - name: api
-      port: 9000
-      targetPort: 9000
-    - name: console
-      port: 9001
-      targetPort: 9001

tenants/tenant-a/values.yaml

@@ -1,19 +0,0 @@
-name: tenant-a
-
-image:
-  repository: registry.bouvais.lu/tenant-jupyter
-  tag: "1.0.0"
-
-resources:
-  requests:
-    cpu: 250m
-    memory: 512Mi
-  limits:
-    cpu: "1"
-    memory: 2Gi
-
-gpu:
-  enabled: true
-  type: "t4"          # one of: none | t4 | a100 | l4
-  count: 1
-