Sunset keycloak from the project #1134

Tansito · 2023-11-30T16:28:26Z

Summary

This pull request continues the work of #1132 cleaning references to the project and logic that it remained there:

Removed Social Account creation
Removed keycloak from helm
Introduced a new parameter to be able to modify the mocked token
Updated READMEs with the new changes

Tansito · 2023-11-30T16:45:19Z

I didn't test it yet in kubernetes, that's why I left it in draft. I need to solve a couple of things with @psschwei and as soon as I finish I return to this.

charts/quantum-serverless/values.yaml

psschwei

Will the changes above, can confirm that the postgres pod is running, and the 5432 port is open on that pod, but continuing to get this in the gateway logs:

http://postgresql:5432 - no response
waiting for myservice

charts/quantum-serverless/values.yaml

Co-authored-by: Paul Schweigert <paul@paulschweigert.com>

psschwei · 2023-12-01T20:10:59Z

This is what's hanging:

https://github.com/Qiskit-Extensions/quantum-serverless/blob/358615896a4a0c62b0dc85125b3a6358ce4a9cc4/charts/quantum-serverless/charts/gateway/templates/deployment.yaml#L33

Tansito · 2023-12-01T20:12:36Z

Maybe DATABASE_HOST is not correct?

psschwei · 2023-12-01T20:27:19Z

I think the host is ok:

$ testpod
Running psschwei/nmap:latest pod on default namespace
If you don't see a command prompt, try pressing enter.
root@paultest:/# nmap -Pn -p 5432 postgresql
Starting Nmap 7.70 ( https://nmap.org ) at 2023-12-01 20:25 UTC
Nmap scan report for postgresql (10.96.109.241)
Host is up (0.000044s latency).
rDNS record for 10.96.109.241: postgresql.default.svc.cluster.local

PORT     STATE SERVICE
5432/tcp open  postgresql

Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds

For whatever reason, the db seems to be non-responsive

akihikokuroda · 2023-12-02T01:24:55Z

With these changes, all pods come up.

diff --git a/charts/quantum-serverless/charts/gateway/templates/deployment.yaml b/charts/quantum-serverless/charts/gateway/templates/deployment.yaml
index b8c16268..5636c5d9 100644
--- a/charts/quantum-serverless/charts/gateway/templates/deployment.yaml
+++ b/charts/quantum-serverless/charts/gateway/templates/deployment.yaml
@@ -30,7 +30,7 @@ spec:
       initContainers:
         - name: waitpostresql
           image: actions/pg_isready
-          command: ['sh', '-c', 'until pg_isready -U ${DATABASE_USER} -d "dbname=${DATABASE_NAME}" -h ${DATABASE_HOST} -p ${DATABASE_PORT}; do echo waiting for myservice; sleep 2; done']
+          command: ['sh', '-c', 'until pg_isready -U ${DATABASE_USER} -d ${DATABASE_NAME} -h ${DATABASE_HOST} -p ${DATABASE_PORT}; do echo waiting for myservice; sleep 2; done']
           volumeMounts:
           - name: gateway-pv-storage
             mountPath: /usr/src/app/media/
@@ -167,7 +167,7 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.secrets.servicePsql.name }}
+                  name: {{ .Values.secrets.servicePsql.databaseSecretName }}
                   key: {{ .Values.secrets.servicePsql.key.databasePassword }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
@@ -280,7 +280,7 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.secrets.servicePsql.name }}
+                  name: {{ .Values.secrets.servicePsql.databaseSecretName }}
                   key: {{ .Values.secrets.servicePsql.key.databasePassword }}
             - name: RAY_KUBERAY_NAMESPACE
               value: {{ .Release.Namespace }}
diff --git a/charts/quantum-serverless/charts/gateway/values.yaml b/charts/quantum-serverless/charts/gateway/values.yaml
index f792862f..84e0fc74 100644
--- a/charts/quantum-serverless/charts/gateway/values.yaml
+++ b/charts/quantum-serverless/charts/gateway/values.yaml
@@ -57,9 +57,10 @@ secrets:
   servicePsql:
     create: true
     name: service-psql-binding
+    databaseSecretName: postgresql
     key:
       databaseName: database-name
-      databasePassword: database-password
+      databasePassword: password
       host: database-host
       port: database-port
       userName: user-name
diff --git a/charts/quantum-serverless/values.yaml b/charts/quantum-serverless/values.yaml
index eabcc48a..708a57bf 100644
--- a/charts/quantum-serverless/values.yaml
+++ b/charts/quantum-serverless/values.yaml
@@ -73,18 +73,18 @@ gateway:
       name: service-psql-binding
       key:
         databaseName: database-name
-        databasePassword: database-password
+        databasePassword: password
         host: database-host
         port: database-port
         userName: user-name
       value:
         databaseName: serverlessdb
         databasePassword: serverlesspassword
-        host: "http://postgresql"
+        host: "postgresql"
         port: 5432
         userName: serverlessuser
     superuser:
-      create: false
+      create: true
       name: gateway-superuser
       key:
         name: name

psschwei · 2023-12-04T21:17:55Z

Aki's patch worked for me (was able to run the "running program" notebook successfully as well)

Tansito · 2023-12-05T20:10:35Z

@akihikokuroda , @psschwei for me it didn't work but I think my problem is another one. Related to your changes I see some problems:

Probably this change is not needed or may be needed to update too for the scheduler. So if the scheduler is working we can see to avoid the change:

-          command: ['sh', '-c', 'until pg_isready -U ${DATABASE_USER} -d "dbname=${DATABASE_NAME}" -h ${DATABASE_HOST} -p ${DATABASE_PORT}; do echo waiting for myservice; sleep 2; done']
+          command: ['sh', '-c', 'until pg_isready -U ${DATABASE_USER} -d ${DATABASE_NAME} -h ${DATABASE_HOST} -p ${DATABASE_PORT}; do echo waiting for myservice; sleep 2; done']

Why do you think this change is needed? Because I see that the secret is configured as postgresql but we are not creating that secret. And it would have implications in production too:

-                  name: {{ .Values.secrets.servicePsql.name }}
+                  name: {{ .Values.secrets.servicePsql.databaseSecretName }}

Similar to my previous comment. We are not setting password as password for the database anywhere. How does this work?

-      databasePassword: database-password
+      databasePassword: password

Sorry I'm just trying to figure out my problem in the computer to test too all of this.

akihikokuroda · 2023-12-05T20:23:25Z

-          command: ['sh', '-c', 'until pg_isready -U ${DATABASE_USER} -d "dbname=${DATABASE_NAME}" -h ${DATABASE_HOST} -p ${DATABASE_PORT}; do echo waiting for myservice; sleep 2; done']
+          command: ['sh', '-c', 'until pg_isready -U ${DATABASE_USER} -d ${DATABASE_NAME} -h ${DATABASE_HOST} -p ${DATABASE_PORT}; do echo waiting for myservice; sleep 2; done']

I'm not sure why but I tried pg_isready in the gateway container and found this works.

-                  name: {{ .Values.secrets.servicePsql.name }}
+                  name: {{ .Values.secrets.servicePsql.databaseSecretName }}

The default password is set in postgrespl secret by the helm install,

-      databasePassword: database-password
+      databasePassword: password

and the key of the password is password in the postgrespl secret.

psschwei · 2023-12-05T20:29:11Z

One trick on applying the Aki's changes: copy them into a file called patch.diff and then git apply --ignore-space-change --ignore-whitespace patch.diff

Tansito · 2023-12-05T20:33:46Z

Oooh, ok I understood @akihikokuroda , thank you. I'm going to analyze that well and propose you a change to try no to affect to much to what we had right now in production.

One trick on applying the Aki's changes: copy them into a file called patch.diff and then git apply --ignore-space-change --ignore-whitespace patch.diff

Yes yes, my problem is being with the cluster. I couldn't make it work yet in my new computer 😢

psschwei · 2023-12-05T20:36:07Z

my problem is being with the cluster. I couldn't make it work yet in my new computer

Is it still the DB check not showing as ready, or something else?

Tansito · 2023-12-05T21:42:32Z

Is it still the DB check not showing as ready, or something else?

This is my output when I try to install it.

NAME                                                        READY   STATUS                       RESTARTS   AGE
...
kuberay-operator-6594cb6695-ffw85                           1/1     Running                      0          45s
postgresql-0                                                1/1     Running                      0          45s
gateway-76685f54bd-th95q                                    0/1     CreateContainerConfigError   0          45s
scheduler-5d94cdfdb9-xp2gj                                  0/1     CreateContainerConfigError   0          45s

And the error that I get from the gateway for example is:

Events:
  Type     Reason            Age                From               Message
  ----     ------            ----               ----               -------
  Warning  FailedScheduling  58s                default-scheduler  0/1 nodes are available: pod has unbound immediate PersistentVolumeClaims. preemption: 0/1 nodes are available: 1 No preemption victims found for incoming pod..

So the database I understand that it is being created but I'm just taking a look.

psschwei · 2023-12-05T21:45:28Z

pod has unbound immediate PersistentVolumeClaims

looks like you're missing the PV to go with the PVC...

Tansito · 2023-12-05T21:57:32Z

It's giving me random errors to be honest:

Error: an error occurred while uninstalling the release. original install error: Get "https://127.0.0.1:6443/api/v1/namespaces/quantum-serverless/persistentvolumeclaims/gateway-claim": http2: client connection lost: warning: Hook pre-delete quantum-serverless/templates/predelete.yaml failed: 1 error occurred:
        * Internal error occurred: resource quota evaluation timed out


helm.go:84: [debug] 1 error occurred:
        * Internal error occurred: resource quota evaluation timed out

akihikokuroda · 2023-12-05T22:31:32Z

FYI: after chart install my system has:

(env-quantum-serverless) (base) akihikokuroda@Akihikos-MacBook-Pro quantum-serverless % kubectl get pv
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                       STORAGECLASS   REASON   AGE
gateway-volume                             2Gi        RWX            Retain           Bound    default/gateway-claim       manual                  12m
pvc-2f31a2f0-eddd-42aa-b50e-3ecad4b334a9   8Gi        RWO            Delete           Bound    default/data-postgresql-0   local-path              12m
(env-quantum-serverless) (base) akihikokuroda@Akihikos-MacBook-Pro quantum-serverless % kubectl get pvc
NAME                STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
gateway-claim       Bound    gateway-volume                             2Gi        RWX            manual         13m
data-postgresql-0   Bound    pvc-2f31a2f0-eddd-42aa-b50e-3ecad4b334a9   8Gi        RWO            local-path     13m

Tansito · 2023-12-06T15:33:26Z

I took the idea from @akihikokuroda and I simplified it a little bit reusing our secret instead to use the secret from default. This way I think it affect less to our current configuration and we add less noise. Let me know what you think Aki, @psschwei: 0a6936f

akihikokuroda · 2023-12-06T17:01:41Z

I'm getting

psycopg2.OperationalError: connection to server at "postgresql" (10.43.238.230), port 5432 failed: FATAL:  password authentication failed for user "serverlessuser"

I may be messing up something.

akihikokuroda · 2023-12-06T18:26:50Z

I reinstalled clean but I'm still getting the error.

Tansito · 2023-12-06T19:01:46Z

oh, you're right, I think I removed something important. Let me take a look 🙏

Tansito · 2023-12-06T21:27:00Z

Ok, I discovered what it was happening. The image is not getting the correct value for the password:

I have no name!@postgresql-0:/$ echo $POSTGRES_USER
serverlessuser
I have no name!@postgresql-0:/$ echo $POSTGRES_PASSWORD
IbVSGP1w00

I'm going to return to the old configuration I think 😅

Tansito · 2023-12-06T22:05:00Z

Now it's working for me @akihikokuroda. I changed it to plain text seeing that reusing secrets seems not work. Not important anyway thinking that this is for local development anyway.

akihikokuroda

It works for me. Thanks!

Tansito · 2023-12-07T14:51:08Z

I want to wait for @psschwei to see if it works for him too in kind before merge it. The tests passed but just to be sure.

psschwei

works for me too

Tansito added 4 commits November 30, 2023 11:23

Removed keycloak references

1e3c028

Updated READMEs

1af3c9d

Removed social account creation

9544268

Added mock token to the helm configuration

205e146

Tansito added 3 commits December 1, 2023 13:56

Added postgresql chart

87ecb30

Fix helm lint error

ded7a17

Update nginx controller chart

6267446

psschwei reviewed Dec 1, 2023

View reviewed changes

charts/quantum-serverless/values.yaml Outdated Show resolved Hide resolved

psschwei reviewed Dec 1, 2023

View reviewed changes

charts/quantum-serverless/values.yaml Show resolved Hide resolved

psschwei reviewed Dec 1, 2023

View reviewed changes

charts/quantum-serverless/values.yaml Show resolved Hide resolved

Tansito and others added 2 commits December 1, 2023 15:05

Update charts/quantum-serverless/values.yaml

9fb183d

Co-authored-by: Paul Schweigert <paul@paulschweigert.com>

Update charts/quantum-serverless/values.yaml

c404097

Co-authored-by: Paul Schweigert <paul@paulschweigert.com>

Added a password for the admin

dd218a5

Use custom secret to connect to the database

0a6936f

Tansito marked this pull request as ready for review December 6, 2023 15:44

Tansito requested review from akihikokuroda, psschwei and IceKhan13 December 6, 2023 15:44

fix typo

facc5f2

Tansito added 3 commits December 6, 2023 16:31

Use plain values instead the secret

b20b7d5

Removed adminpassword

204d322

Disable postgres user

10a07ec

akihikokuroda approved these changes Dec 7, 2023

View reviewed changes

psschwei approved these changes Dec 7, 2023

View reviewed changes

Tansito merged commit 481d5d8 into main Dec 7, 2023
21 checks passed

Tansito deleted the finish-to-remove-keycloak branch December 7, 2023 15:15

IceKhan13 mentioned this pull request Dec 12, 2023

Gateway: update keycloak auth #1088

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sunset keycloak from the project #1134

Sunset keycloak from the project #1134

Tansito commented Nov 30, 2023

Tansito commented Nov 30, 2023 •

edited

Loading

psschwei left a comment

psschwei commented Dec 1, 2023

Tansito commented Dec 1, 2023

psschwei commented Dec 1, 2023

akihikokuroda commented Dec 2, 2023

psschwei commented Dec 4, 2023

Tansito commented Dec 5, 2023

akihikokuroda commented Dec 5, 2023

psschwei commented Dec 5, 2023

Tansito commented Dec 5, 2023

psschwei commented Dec 5, 2023

Tansito commented Dec 5, 2023

psschwei commented Dec 5, 2023

Tansito commented Dec 5, 2023

akihikokuroda commented Dec 5, 2023

Tansito commented Dec 6, 2023 •

edited

Loading

akihikokuroda commented Dec 6, 2023

akihikokuroda commented Dec 6, 2023

Tansito commented Dec 6, 2023

Tansito commented Dec 6, 2023 •

edited

Loading

Tansito commented Dec 6, 2023

akihikokuroda left a comment

Tansito commented Dec 7, 2023

psschwei left a comment

Sunset keycloak from the project #1134

Sunset keycloak from the project #1134

Conversation

Tansito commented Nov 30, 2023

Summary

Tansito commented Nov 30, 2023 • edited Loading

psschwei left a comment

Choose a reason for hiding this comment

psschwei commented Dec 1, 2023

Tansito commented Dec 1, 2023

psschwei commented Dec 1, 2023

akihikokuroda commented Dec 2, 2023

psschwei commented Dec 4, 2023

Tansito commented Dec 5, 2023

akihikokuroda commented Dec 5, 2023

psschwei commented Dec 5, 2023

Tansito commented Dec 5, 2023

psschwei commented Dec 5, 2023

Tansito commented Dec 5, 2023

psschwei commented Dec 5, 2023

Tansito commented Dec 5, 2023

akihikokuroda commented Dec 5, 2023

Tansito commented Dec 6, 2023 • edited Loading

akihikokuroda commented Dec 6, 2023

akihikokuroda commented Dec 6, 2023

Tansito commented Dec 6, 2023

Tansito commented Dec 6, 2023 • edited Loading

Tansito commented Dec 6, 2023

akihikokuroda left a comment

Choose a reason for hiding this comment

Tansito commented Dec 7, 2023

psschwei left a comment

Choose a reason for hiding this comment

Tansito commented Nov 30, 2023 •

edited

Loading

Tansito commented Dec 6, 2023 •

edited

Loading

Tansito commented Dec 6, 2023 •

edited

Loading