studio-manifest.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: studio-nginx-config
  namespace: studio
data:
  default.conf: |+
    # Copyright (C) 2024 Intel Corporation
    # SPDX-License-Identifier: Apache-2.0

    server {
        # listen 80;
        # listen [::]:80;
        listen 443 ssl;
        listen [::]:443 ssl;

        ssl_certificate /etc/ssl/app-tls.crt;
        ssl_certificate_key /etc/ssl/app-tls.key;

        proxy_connect_timeout 600;
        proxy_send_timeout 600;
        proxy_read_timeout 600;
        send_timeout 600;

        client_max_body_size 10G;

        resolver kube-dns.kube-system.svc.cluster.local valid=300s;
        resolver_timeout 5s;

        location /home {
            root /usr/share/nginx/html;
            index index.html;
        }

        # Location block for studio-appbuilder and app-frontend
        location / {
            # Initialize the default variable for namespace
            set $namespace "";
    
            # Check if the Referer contains '?ns=' and extract the ns argument
            if ($http_referer ~* "([&?]ns=([^&]+))") {
                set $namespace $2;  # Capture the value of 'ns'
            }
    
            # If 'ns' is not in the Referer, fallback to 'arg_ns'
            if ($namespace = "") {
                set $namespace $arg_ns;  # Use the value from the 'arg_ns'
            }
    
            # Initialize the target host
            set $target_host http://${STUDIO_FRONTEND_DNS};
            if ($namespace != "") {
                set $target_host http://${APP_FRONTEND_DNS};
            }
    
            # Rewrite the request to include the namespace
            rewrite ^/(.*)$ /$1?ns=$namespace break;

            # Proxy to the desired service using the namespace
            proxy_pass $target_host;
    
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Location block for keycloak
        location /auth {
            proxy_pass https://${KEYCLOAK_DNS}/auth/;
            proxy_set_header Host $host:30007;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Location block for app-backend
        location /v1/app-backend {
            # Initialize the variable for namespace
            if ($http_referer ~* "([&?]ns=([^&]+))") {
                set $namespace $2;  # Capture the value of 'ns'
            }
    
            # Rewrite the request to include the namespace
            rewrite ^/(.*)$ /$1?ns=$namespace break;

            # Proxy to the desired service using the namespace
            proxy_pass http://${APP_BACKEND_DNS};
    
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Disable buffering for SSE
            proxy_buffering off;
            proxy_cache off;
            proxy_http_version 1.1;
            proxy_set_header Connection '';
            chunked_transfer_encoding off;
        }

        # Location block for opea_service@prepare_doc_redis_prep
        location /v1/dataprep {
            # Initialize the variable for namespace
            if ($http_referer ~* "([&?]ns=([^&]+))") {
                set $namespace $2;  # Capture the value of 'ns'
            }
    
            # Rewrite the request to include the namespace
            rewrite ^/(.*)$ /$1?ns=$namespace break;

            # Proxy to the desired service using the namespace
            proxy_pass http://${PREPARE_DOC_REDIS_PREP_DNS};
    
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
            
        # Additional location block for Grafana static assets
        location /grafana {
            proxy_pass http://${GRAFANA_DNS};
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Proxy Grafana Live WebSocket connections
        location /grafana/api/live/ {
            proxy_pass http://${GRAFANA_DNS};
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # Ensure WebSocket upgrade headers
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        location /studio-backend {
            proxy_pass http://${STUDIO_BACKEND_DNS};
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        location /studio-backend/ws {
            proxy_pass http://${STUDIO_BACKEND_DNS}/studio-backend/ws;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # Ensure WebSocket upgrade headers
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }
---
apiVersion: v1
kind: Service
metadata:
  name: studio-nginx
  namespace: studio
spec:
  selector:
    app: studio-nginx
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 443
      nodePort: 30007 
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: studio-nginx
  namespace: studio
  labels:
    app: studio-nginx
spec:
  selector:
    matchLabels:
      app: studio-nginx
  template:
    metadata:
      labels:
        app: studio-nginx
    spec:
      initContainers:
      - name: init-nginx
        image: nginx:1.27.1
        command: ["/bin/sh", "-c"]
        args:
          - |
            envsubst "$(env | grep _DNS= | awk -F= '{print "${"$1"}"}' | tr '\n' ' ')" < /tmp/default.conf > /etc/nginx/conf.d/default.conf
        envFrom:
        - configMapRef:
            name: studio-config
        volumeMounts:
        - name: tmp-volume
          mountPath: /tmp
        - name: nginx-conf-volume
          mountPath: /etc/nginx/conf.d
      containers:
      - name: nginx
        image: nginx:1.27.1
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: nginx-conf-volume
          mountPath: /etc/nginx/conf.d
        - name: app-tls
          mountPath: /etc/ssl
      securityContext: {}
      volumes:
      - name: tmp-volume
        configMap:
          defaultMode: 420
          name: studio-nginx-config
      - name: nginx-conf-volume
        emptyDir: {}
      - name: app-tls
        secret:
          secretName: app-tls
---
apiVersion: v1
kind: Service
metadata:
  name: studio-backend
  namespace: studio
spec:
  type: ClusterIP
  ports:
    - protocol: TCP
      port: 5000
      targetPort: 5000
  selector:
    app: studio-backend
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: studio-backend-sa
  namespace: studio
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-manager
rules:
- apiGroups: [""] 
  resources: ["namespaces"] 
  verbs: ["get", "create", "delete"]
- apiGroups: [""] 
  resources: ["services"] 
  verbs: ["get", "create", "list"]
- apiGroups: [""] 
  resources: ["configmaps"] 
  verbs: ["get", "create"]
- apiGroups: [""] 
  resources: ["secrets"] 
  verbs: ["get", "create"]
- apiGroups: ["apps"] 
  resources: ["deployments"] 
  verbs: ["get", "create", "list"]
- apiGroups: [""] 
  resources: ["pods"] 
  verbs: ["list", "get"]
- apiGroups: [""] 
  resources: ["nodes"] 
  verbs: ["list", "get"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "create", "list", "watch"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "create", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: namespace-manager-binding
subjects:
- kind: ServiceAccount
  name: studio-backend-sa
  namespace: studio
roleRef:
  kind: ClusterRole
  name: namespace-manager
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: studio-backend
  namespace: studio
  labels:
    app: studio-backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: studio-backend
  template:
    metadata:
      labels:
        app: studio-backend
    spec:
      containers:
      - name: studio-backend
        image: ${REGISTRY}/studio-backend:${TAG}
        imagePullPolicy: Always
        env:
        - name: APP_FRONTEND_IMAGE
          value: ${REGISTRY}/app-frontend:${TAG}
        - name: APP_BACKEND_IMAGE
          value: ${REGISTRY}/app-backend:${TAG}
        - name: REGISTRY
          value: ${REGISTRY}
        - name: TAG
          value: ${TAG}
        - name: SBX_HTTP_PROXY
          value: ${HTTP_PROXY}
        - name: SBX_NO_PROXY
          value: ${NO_PROXY}      
        envFrom:
        - configMapRef:
            name: studio-config
        ports:
        - containerPort: 5000
        resources:
          requests:
            memory: "1Gi"
            cpu: "1"
          limits:
            memory: "2Gi"
            cpu: "2"
        livenessProbe:
          httpGet:
            path: /studio-backend/health
            port: 5000
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 10
          failureThreshold: 3
      serviceAccountName: studio-backend-sa
---
apiVersion: v1
kind: Service
metadata:
  name: studio-frontend
  namespace: studio
spec:
  type: ClusterIP
  ports:
  - port: 3000
    targetPort: 3000
    protocol: TCP
    name: studio-frontend
  selector:
    app: studio-frontend
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: studio-frontend
  namespace: studio
  labels:
    app: studio-frontend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: studio-frontend
  template:
    metadata:
      labels:
        app: studio-frontend
    spec:
      securityContext: {}
      containers:
      - name: studio-frontend
        securityContext: {}
        image: ${REGISTRY}/studio-frontend:${TAG}
        imagePullPolicy: Always
        env:
        - name: DATABASE_TYPE
          value: mysql
        - name: DATABASE_HOST
          value: ${MYSQL_HOST}
        - name: DATABASE_PORT
          value: "3306"
        - name: DATABASE_USER
          value: studio
        - name: DATABASE_PASSWORD
          value: studio
        - name: DATABASE_NAME
          value: studio
        - name: DATABASE_SSL
          value: "true"
        ports:
        - name: studio-frontend
          containerPort: 8080
          protocol: TCP
        resources: {}
        volumeMounts:
        - mountPath: /tmp
          name: tmp
        - name: mysql-tls
          mountPath: /etc/mysql/ssl
          readOnly: true
      volumes:
      - name: tmp
        emptyDir: {}
      - name: mysql-tls
        secret:
          secretName: mysql-tls
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: studio
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      initContainers:
      - name: keycloak-assets
        image: curlimages/curl:latest
        command: ["/bin/sh", "-c"]
        args:
          - |
            OWNER=$(echo ${KC_ASSETS_GIT_URL} | sed -E 's|https://github.com/([^/]+)/([^/]+)/tree/([^/]+)/.*|\1|')
            REPO=$(echo ${KC_ASSETS_GIT_URL} | sed -E 's|https://github.com/([^/]+)/([^/]+)/tree/([^/]+)/.*|\2|')
            BRANCH=$(echo ${KC_ASSETS_GIT_URL} | sed -E 's|https://github.com/[^/]+/[^/]+/tree/([^/]+)/.*|\1|')
            KC_ASSETS_DIR=$(echo ${KC_ASSETS_GIT_URL} | sed -E 's|https://github.com/[^/]+/[^/]+/tree/[^/]+/(.*?)/?$|\1|')
            if [[ "${KC_ASSETS_DIR: -1}" == "/" ]]; then KC_ASSETS_DIR="${KC_ASSETS_DIR%/}"; fi
            DOWNLOAD_URL="https://codeload.github.com/${OWNER}/${REPO}/tar.gz/${BRANCH}"
            curl "${DOWNLOAD_URL}" | tar -xz --strip-components=4 -C /opt/keycloak/themes "${REPO}-${BRANCH}/${KC_ASSETS_DIR}/themes"
            curl "${DOWNLOAD_URL}" | tar -xz --strip-components=4 -C /opt/keycloak/data "${REPO}-${BRANCH}/${KC_ASSETS_DIR}/data"
        envFrom:
        - configMapRef:
            name: studio-config
        volumeMounts:
        - name: keycloak-themes-volume
          mountPath: /opt/keycloak/themes
        - name: keycloak-dataimport-volume
          mountPath: /opt/keycloak/data/import
        securityContext:
          runAsUser: 0
          runAsGroup: 0
      containers:
      - name: keycloak
        image: quay.io/keycloak/keycloak:latest
        volumeMounts:
        - name: mysql-tls
          mountPath: /etc/mysql/ssl
          readOnly: true
        - name: app-tls
          mountPath: /etc/ssl
          readOnly: true
        - name: keycloak-themes-volume
          mountPath: /opt/keycloak/themes
        - name: keycloak-dataimport-volume
          mountPath: /opt/keycloak/data/import
        args:
        - start
        - --import-realm
        ports:
        - containerPort: 8080
        - containerPort: 8443
        env:
        - name: KC_BOOTSTRAP_ADMIN_USERNAME
          value: "admin"
        - name: KC_BOOTSTRAP_ADMIN_PASSWORD
          value: "admin"
        - name: KC_PROXY_HEADERS
          value: "forwarded"
        - name: KC_HTTP_RELATIVE_PATH
          value: "/auth"
        - name: KC_PROXY
          value: edge
        - name: KC_HTTPS_CERTIFICATE_FILE
          value: /etc/ssl/app-tls.crt
        - name: KC_HTTPS_CERTIFICATE_KEY_FILE
          value: /etc/ssl/app-tls.key
        - name: KC_HOSTNAME_STRICT
          value: "false"
        - name: KC_HOSTNAME_STRICT_HTTPS
          value: "true"
        # Database Configuration for MySQL
        - name: KC_DB
          value: "mysql"
        - name: KC_DB_URL
          value: "jdbc:mysql://${MYSQL_HOST}:3306/keycloak?useSSL=true&requireSSL=true&clientCertificateKeyStoreUrl=file:/etc/mysql/ssl/client-keystore.p12&trustCertificateKeyStoreUrl=file:/etc/mysql/ssl/ca.pem"
        - name: KC_DB_USERNAME
          value: "studio"
        - name: KC_DB_PASSWORD
          value: "studio"
        - name: KC_DB_DATABASE
          value: "keycloak"
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: auth/realms/master
            port: 8443
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          requests:
            memory: "512Mi"
            cpu: "500m"
          limits:
            memory: "1Gi"
            cpu: "1"
      volumes:
      - name: app-tls
        secret:
          secretName: app-tls
      - name: mysql-tls
        secret:
          secretName: mysql-tls
      - name: keycloak-themes-volume
        emptyDir: {}
      - name: keycloak-dataimport-volume
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: keycloak
  namespace: studio
spec:
  type: ClusterIP
  ports:
  - name: https
    protocol: TCP
    port: 8443
    targetPort: 8443
  selector:
    app: keycloak