SkyPilot API Server Helm Chart 值#

SkyPilot API server helm chart 提供典型的 helm values 作为配置项。安装 Chart 时可以通过两种方式传递配置值

--values (或 -f): 指定包含覆盖配置的 YAML 文件。

cat <<EOF > values.yaml
apiService:
  image: berkeleyskypilot/skypilot:0.9.1
EOF

helm install $RELEASE_NAME skypilot/skypilot-nightly --devel --values values.yaml

--set: 在命令行上指定覆盖配置。

helm install $RELEASE_NAME skypilot/skypilot-nightly --set apiService.image="berkeleyskypilot/skypilot:0.9.1"

值#

以下是可用的 helm 值键及其默认值

apiService:
  image: berkeleyskypilot/skypilot:0.9.1
  preDeployHook: |-
    # Run commands before deploying the API server, e.g. installing an admin
    # policy. Remember to set the admin policy in the config section below.

    echo "Pre-deploy hook"

    # Uncomment the following lines to install the admin policy

    # echo "Installing admin policy"
    # pip install git+https://github.com/michaelvll/admin-policy-examples
  config: null
  skipResourceCheck: false
  resources:
    requests:
      cpu: "4"
      memory: "8Gi"
    limits:
      cpu: "4"
      memory: "8Gi"
  skypilotDev: false

storage:
  enabled: true
  storageClassName: ""
  size: 10Gi
  selector: {}
  volumeName: ""
  annotations: {}

ingress:
  enabled: true
  authSecret: null
  authCredentials: "username:$apr1$encrypted_password"
  path: '/'

ingress-nginx:
  enabled: true
  controller:
    service:
      type: LoadBalancer
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
        cloud.google.com/l4-rbs: "enabled"
        service.beta.kubernetes.io/port_443_health-probe_protocol: "TCP"
        service.beta.kubernetes.io/port_80_health-probe_protocol: "TCP"
    config:
      http-snippet: |
        map $http_upgrade $connection_upgrade {
            default upgrade;
            ''      close;
        }

rbac:
  create: true
  serviceAccountName: ""
  namespaceRules:
    - apiGroups: [ "" ]
      resources: [ "pods", "pods/status", "pods/exec", "pods/portforward" ]
      verbs: [ "*" ]
    - apiGroups: [ "" ]
      resources: [ "services" ]
      verbs: [ "*" ]
    - apiGroups: [ "" ]
      resources: [ "secrets" ]
      verbs: [ "*" ]
    - apiGroups: [ "" ]
      resources: [ "events" ]
      verbs: [ "get", "list", "watch" ]
  clusterRules:
    - apiGroups: [ "" ]
      resources: [ "nodes" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: [ "" ]
      resources: [ "pods" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: [ "node.k8s.io" ]
      resources: [ "runtimeclasses" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: [ "networking.k8s.io" ]
      resources: [ "ingressclasses" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: [""]
      resources: ["services"]
      verbs: ["list", "get"]
  manageRbacPolicies: true
  manageSystemComponents: true

kubernetesCredentials:
  useApiServerCluster: true
  useKubeconfig: false
  kubeconfigSecretName: kube-credentials
  inclusterNamespace: null

awsCredentials:
  enabled: false
  awsSecretName: aws-credentials
  accessKeyIdKeyName: aws_access_key_id
  secretAccessKeyKeyName: aws_secret_access_key

gcpCredentials:
  enabled: false
  projectId: null
  gcpSecretName: gcp-credentials

podSecurityContext: {}

securityContext:
  capabilities:
    drop:
    - ALL
  allowPrivilegeEscalation: false

runtimeClassName: ""

字段#

`apiService`#

SkyPilot API server 部署的配置。

`apiService.image`#

用于 API server 的 Docker 镜像。

默认值: "berkeleyskypilot/skypilot:0.9.1"

apiService:
  image: berkeleyskypilot/skypilot:0.9.1

要使用 nightly build，请在 pypi 上找到所需的 nightly 版本，并更新 image 值

apiService:
  # Replace 1.0.0.devYYYYMMDD with the desired nightly version
  image: berkeleyskypilot/skypilot-nightly:1.0.0.devYYYYMMDD

`apiService.preDeployHook`#

部署 API server 前运行的命令（例如，安装管理员策略）。

默认值: 见下面的 yaml。

apiService:
  preDeployHook: |-
    # Run commands before deploying the API server, e.g. installing an admin
    # policy. Remember to set the admin policy in the config section below.
    echo "Pre-deploy hook"

    # Uncomment the following lines to install the admin policy
    # echo "Installing admin policy"
    # pip install git+https://github.com/michaelvll/admin-policy-examples

`apiService.config`#

要在 API server 上设置的 SkyPilot config.yaml 的内容。设置为 null 表示使用空配置。详情请参阅设置 SkyPilot 配置。

默认值: null

apiService:
  config: |-
    allowed_clouds:
      - aws
      - gcp

`apiService.skipResourceCheck`#

跳过 API server 的资源检查（不推荐用于生产环境），详情请参阅调整 API server 资源。

默认值: false

apiService:
  skipResourceCheck: false

`apiService.resources`#

API server 容器的资源请求和限制。关于如何调整资源，请参阅调整 API server 资源。

默认值: 见下面的 yaml。

apiService:
  resources:
    requests:
      cpu: "4"
      memory: "8Gi"
    limits:
      cpu: "4"
      memory: "8Gi"

`apiService.skypilotDev`#

启用 SkyPilot 开发者模式。

默认值: false

apiService:
  skypilotDev: false

`storage`#

`storage.enabled`#

为 API server 启用持久存储，将其设置为 false 可能会导致数据丢失，仅应用于测试。

默认值: true

storage:
  enabled: true

`storage.storageClassName`#

用于 API server 的存储类，留空表示使用托管 Kubernetes 集群的默认存储类。

默认值: ""

storage:
  storageClassName: gp2

`storage.size`#

API server 持久存储卷的大小。

默认值: 10Gi

storage:
  size: 10Gi

`storage.selector`#

用于匹配特定 PersistentVolumes 的选择器。通常留空。

默认值: {}

storage:
  selector: {}

`storage.volumeName`#

要绑定的 PersistentVolume 的名称。通常留空，让 Kubernetes 自动选择和绑定卷。

默认值: ""

storage:
  volumeName: ""

`storage.annotations`#

要添加到 PersistentVolumeClaim 的注解。

默认值: {}

storage:
  annotations: {}

`ingress`#

`ingress.enabled`#

为 API server 启用 Ingress。设置为 true 可通过 Ingress controller 暴露 API server。

默认值: true

ingress:
  enabled: true

`ingress.authSecret`#

包含 Ingress 基本认证凭据的 Kubernetes Secret 的名称。如果未指定，将使用 authCredentials 创建新的 Secret。

ingress.authSecret 或 ingress.authCredentials 必须设置其中之一。

默认值: null

ingress:
  authSecret: null

`ingress.authCredentials`#

基本认证凭据，格式为 username:encrypted_password。仅在未设置 authSecret 时使用。

ingress.authSecret 或 ingress.authCredentials 必须设置其中之一。

默认值: "username:$apr1$encrypted_password"

ingress:
  authCredentials: "username:$apr1$encrypted_password"

`ingress.path`#

API server 的基本路径。您可以使用不同的路径通过统一的 Ingress controller 暴露多个 API server。

默认值: '/'

ingress:
  path: '/'

`ingress-nginx`#

`ingress-nginx.enabled`#

为 API server 启用 ingress-nginx controller。如果您有现有的 ingress-nginx controller，必须将其设置为 false 以避免冲突。

默认值: true

ingress-nginx:
  enabled: true

`ingress-nginx.controller`#

ingress-nginx.controller 下的字段将映射到 ingress-nginx controller 子 Chart 的 controller 值。详情请参阅 ingress-nginx Chart 文档。

默认值: 见下面的 yaml。

ingress-nginx:
  controller:
    service:
      # Service type of the ingress controller.
      type: LoadBalancer
      # Annotations for the ingress controller service.
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
        cloud.google.com/l4-rbs: "enabled"
        service.beta.kubernetes.io/port_443_health-probe_protocol: "TCP"
        service.beta.kubernetes.io/port_80_health-probe_protocol: "TCP"
    config:
      # Custom HTTP snippet to inject into the ingress-nginx configuration.
      http-snippet: |
        map $http_upgrade $connection_upgrade {
            default upgrade;
            ''      close;
        }

`rbac`#

`rbac.create`#

是否为 API server 创建 Service Account 和 RBAC 策略。如果为 false，则预期使用外部 Service Account。

默认值: true

rbac:
  create: true

`rbac.serviceAccountName`#

要使用的 Service Account 的名称。留空表示让 Chart 生成一个。

默认值: ""

rbac:
  serviceAccountName: ""

`rbac.namespaceRules`#

授予 SkyPilot 任务将启动的命名空间的 Namespace 范围 RBAC 规则。

注意

修改规则可能会破坏 SkyPilot API server 的功能。关于如何根据您的用例修改规则，请参阅在 Helm 部署中设置最低权限。

默认值: 见下面的 yaml。

rbac:
  namespaceRules:
    - apiGroups: [ "" ]
      resources: [ "pods", "pods/status", "pods/exec", "pods/portforward" ]
      verbs: [ "*" ]
    - apiGroups: [ "" ]
      resources: [ "services" ]
      verbs: [ "*" ]
    - apiGroups: [ "" ]
      resources: [ "secrets" ]
      verbs: [ "*" ]
    - apiGroups: [ "" ]
      resources: [ "events" ]
      verbs: [ "get", "list", "watch" ]

`rbac.clusterRules`#

API server 的集群范围 RBAC 规则。

注意

修改规则可能会破坏 SkyPilot API server 的功能。关于如何根据您的用例修改规则，请参阅在 Helm 部署中设置最低权限。

默认值: 见下面的 yaml。

rbac:
  clusterRules:
    - apiGroups: [ "" ]
      resources: [ "nodes" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: [ "" ]
      resources: [ "pods" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: [ "node.k8s.io" ]
      resources: [ "runtimeclasses" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: [ "networking.k8s.io" ]
      resources: [ "ingressclasses" ]
      verbs: [ "get", "list", "watch" ]
    - apiGroups: ["" ]
      resources: ["services"]
      verbs: ["list", "get"]

`rbac.manageRbacPolicies`#

允许 API server 授予 SkyPilot Pod 和系统组件权限。详情请参阅在 Helm 部署中设置最低权限。

默认值: true

rbac:
  manageRbacPolicies: true

`rbac.manageSystemComponents`#

允许 API server 管理 skypilot-system 命名空间中的系统组件。对象存储挂载所需。

默认值: true

rbac:
  manageSystemComponents: true

`kubernetesCredentials`#

`kubernetesCredentials.useApiServerCluster`#

启用使用 API server 所在的集群运行工作负载。

默认值: true

kubernetesCredentials:
  useApiServerCluster: true

`kubernetesCredentials.useKubeconfig`#

使用包含 kubeconfig 的 kube-credentials Secret 对 Kubernetes 进行认证。

默认值: false

kubernetesCredentials:
  useKubeconfig: false

`kubernetesCredentials.kubeconfigSecretName`#

包含 kubeconfig 文件的 Secret 的名称。仅在 useKubeconfig 为 true 时使用。

默认值: kube-credentials

kubernetesCredentials:
  kubeconfigSecretName: kube-credentials

`kubernetesCredentials.inclusterNamespace`#

用于集群内资源的命名空间。

默认值: null

kubernetesCredentials:
  inclusterNamespace: null

`awsCredentials`#

`awsCredentials.enabled`#

为 API server 启用 AWS 凭据。

默认值: false

awsCredentials:
  enabled: false

`awsCredentials.awsSecretName`#

包含 AWS 凭据的 Secret 的名称。仅在 enabled 为 true 时使用。

默认值: aws-credentials

awsCredentials:
  awsSecretName: aws-credentials

`awsCredentials.accessKeyIdKeyName`#

用于设置 AWS_ACCESS_KEY_ID 的键名。

默认值: aws_access_key_id

awsCredentials:
  accessKeyIdKeyName: aws_access_key_id

`awsCredentials.secretAccessKeyKeyName`#

用于设置 AWS_SECRET_ACCESS_KEY 的键名。

默认值: aws_secret_access_key

awsCredentials:
  secretAccessKeyKeyName: aws_secret_access_key

`gcpCredentials`#

`gcpCredentials.enabled`#

为 API server 启用 GCP 凭据。

默认值: false

gcpCredentials:
  enabled: false

`gcpCredentials.projectId`#

GCP 项目 ID。仅在 enabled 为 true 时使用。

默认值: null

gcpCredentials:
  projectId: null

`gcpCredentials.gcpSecretName`#

包含 GCP 凭据的 Secret 的名称。仅在 enabled 为 true 时使用。

默认值: gcp-credentials

gcpCredentials:
  gcpSecretName: gcp-credentials

`podSecurityContext`#

API server Pod 的安全上下文。通常留空使用默认值。详情请参阅设置 Pod 的安全上下文。

默认值: {}

podSecurityContext:
  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000

`securityContext`#

`securityContext.capabilities`#

要为 API server 容器删除的 Linux capability。

默认值: 删除所有 capability。

securityContext:
  capabilities:
    drop:
    - ALL

`securityContext.allowPrivilegeEscalation`#

是否允许 API server 容器中的权限提升。

默认值: false

securityContext:
  allowPrivilegeEscalation: false

`runtimeClassName`#

用于 API server Pod 的运行时类。通常留空使用默认的运行时类。

默认值: (空)

runtimeClassName:

SkyPilot API Server Helm Chart 值#

值#

字段#

apiService#

apiService.image#

apiService.preDeployHook#

apiService.config#

apiService.skipResourceCheck#

apiService.resources#

apiService.skypilotDev#

storage#

storage.enabled#

storage.storageClassName#

storage.size#

storage.selector#

storage.volumeName#

storage.annotations#

ingress#

ingress.enabled#

ingress.authSecret#

ingress.authCredentials#

ingress.path#

ingress-nginx#

ingress-nginx.enabled#

ingress-nginx.controller#

rbac#

rbac.create#

rbac.serviceAccountName#

rbac.namespaceRules#

rbac.clusterRules#

rbac.manageRbacPolicies#

rbac.manageSystemComponents#

kubernetesCredentials#

kubernetesCredentials.useApiServerCluster#

kubernetesCredentials.useKubeconfig#

kubernetesCredentials.kubeconfigSecretName#

kubernetesCredentials.inclusterNamespace#

awsCredentials#

awsCredentials.enabled#

awsCredentials.awsSecretName#

awsCredentials.accessKeyIdKeyName#

awsCredentials.secretAccessKeyKeyName#

gcpCredentials#

gcpCredentials.enabled#

gcpCredentials.projectId#

gcpCredentials.gcpSecretName#

podSecurityContext#

securityContext#

securityContext.capabilities#

securityContext.allowPrivilegeEscalation#

runtimeClassName#

`apiService`#

`apiService.image`#

`apiService.preDeployHook`#

`apiService.config`#

`apiService.skipResourceCheck`#

`apiService.resources`#

`apiService.skypilotDev`#

`storage`#

`storage.enabled`#

`storage.storageClassName`#

`storage.size`#

`storage.selector`#

`storage.volumeName`#

`storage.annotations`#

`ingress`#

`ingress.enabled`#

`ingress.authSecret`#

`ingress.authCredentials`#

`ingress.path`#

`ingress-nginx`#

`ingress-nginx.enabled`#

`ingress-nginx.controller`#

`rbac`#

`rbac.create`#

`rbac.serviceAccountName`#

`rbac.namespaceRules`#

`rbac.clusterRules`#

`rbac.manageRbacPolicies`#

`rbac.manageSystemComponents`#

`kubernetesCredentials`#

`kubernetesCredentials.useApiServerCluster`#

`kubernetesCredentials.useKubeconfig`#

`kubernetesCredentials.kubeconfigSecretName`#

`kubernetesCredentials.inclusterNamespace`#

`awsCredentials`#

`awsCredentials.enabled`#

`awsCredentials.awsSecretName`#

`awsCredentials.accessKeyIdKeyName`#

`awsCredentials.secretAccessKeyKeyName`#

`gcpCredentials`#

`gcpCredentials.enabled`#

`gcpCredentials.projectId`#

`gcpCredentials.gcpSecretName`#

`podSecurityContext`#

`securityContext`#

`securityContext.capabilities`#

`securityContext.allowPrivilegeEscalation`#

`runtimeClassName`#