chore: update charts

Author: ojaswa1942

ai-service/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

ai-service/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: ai-service
 description: A Helm chart for Privado AI Service on Kubernetes
 type: application
-version: 0.1.1
+version: 0.1.2
 appVersion: "1.17.0"

ai-service/init.sh

@@ -2,40 +2,44 @@
 
 # Function to prompt the user for input with a default value
 prompt() {
-  local var_name=$1
-  local prompt_text=$2
-  local default_value=$3
+  local prompt_text=$1
+  local default_value=$2
   read -p "$prompt_text ($default_value): " input
   echo "${input:-$default_value}"
 }
 
 # File to update
-values_file="values.yaml"
+BASE_PATH=$(pwd)
+ai_values_file=$BASE_PATH/values.yaml
 
 # Prompt the user for each value
-ai_service_andromeda_host=$(prompt "AI_SERVICE_ANDROMEDA_HOST" "Enter the AI Service Andromeda Host URL" "http://andromeda-service.privado.svc.cluster.local:6001")
-chroma_host=$(prompt "CHROMA_HOST" "Enter the Chroma Host (without 'http://' prefix)" "ai-service-chroma-chromadb.privado.svc.cluster.local")
-use_ecr=$(prompt "Use ECR to pull AiService container image? (true/false)" "false")
-secret_access_key_id=$(prompt "secretAccessKeyId" "Enter the AWS Secret Access Key ID (required if useECR:true)" "None")
-secret_access_key=$(prompt "secretAccessKey" "Enter the AWS Secret Access Key (required if useECR:true)" "None")
-node_instance_type=$(prompt "node.kubernetes.io/instance-type" "Enter the node instance type" "g5.xlarge")
-models_storage_class=$(prompt "aiServiceModelsPvc.storageClassName" "Enter the storage class name for models PVC" "gp2")
-log_storage_class=$(prompt "aiServiceLogPvc.storageClassName" "Enter the storage class name for log PVC" "gp2")
+cluster_domain=$(prompt "Enter the cluster domain" "cluster.local")
+use_ecr=$(prompt "Use Privado ECR to pull container images? (true/false)" "true")
+node_instance_type=$(prompt "Enter the GPU node instance type" "g5.xlarge")
+storage_class=$(prompt "Enter the storage class name that supports RWX" "efs-sc")
 enable_autoupdates=$(prompt "Enable auto-updates cronjob? (true/false)" "false")
 hf_access_token=$(prompt "Enter the Huggingface access token (provided by privado)" "None")
 
-
+if [[ "$use_ecr" == "false" ]]; then
+  echo "Using Privado ECR is disabled. This requires pre-emptively copying service images to a private repository."
+  ai_service_image_repo_url=$(prompt "Enter the AI Service image repository URL" "None")
+  secret_access_key_id=""
+  secret_access_key=""
+else
+  ai_service_image_repo_url="638117407428.dkr.ecr.eu-west-1.amazonaws.com/ai-service-on-premise"
+  secret_access_key_id=$(prompt "Enter the AWS Secret Access Key ID (required if useECR:true)" "None")
+  secret_access_key=$(prompt "Enter the AWS Secret Access Key (required if useECR:true)" "None")
+fi
 # Update the values.yaml file
-sed -i.bak -e "s/secretAccessKeyId: .*/secretAccessKeyId: \"$secret_access_key_id\"/" \
-           -e "s/secretAccessKey: .*/secretAccessKey: \"$secret_access_key\"/" \
-           -e "s/node.kubernetes.io\/instance-type: .*/node.kubernetes.io\/instance-type: $node_instance_type/" \
-           -e "s/storageClassName: gp2 # NEEDS-CUSTOMER-INPUT.*/storageClassName: $models_storage_class # NEEDS-CUSTOMER-INPUT/" \
-           -e "s/storageClassName: gp2 # NEEDS-CUSTOMER-INPUT.*/storageClassName: $log_storage_class # NEEDS-CUSTOMER-INPUT/" \
-           -e "s|value: \"http://andromeda-service.privado.svc.cluster.local:6001\" # NEEDS-CUSTOMER-INPUT|value: \"$ai_service_andromeda_host\" # NEEDS-CUSTOMER-INPUT|" \
-           -e "s|value: \"ai-service-chroma-chromadb.privado.svc.cluster.local\"  # NEEDS-CUSTOMER-INPUT \[without 'http://'\ prefix\]|value: \"$chroma_host\"  # NEEDS-CUSTOMER-INPUT \[without 'http://'\ prefix\]|" \
-           -e "s|autoUpdateEnabled: false  # NEEDS-CUSTOMER-INPUT|autoUpdateEnabled: $enable_autoupdates # NEEDS-CUSTOMER-INPUT|" \
-           -e "s|HF_ACCESS_TOKEN_PLACEHOLDER|$hf_access_token|" \
-           -e "s|useECR: false  # NEEDS-CUSTOMER-INPUT|useECR: $use_ecr|" \
-           "$values_file"
+sed -i.bak -e "s|useECR: true  # NEEDS-CUSTOMER-INPUT|useECR: $use_ecr|" \
+  -e "s/__CLUSTER_DOMAIN__/$cluster_domain/" \
+  -e "s/__AWS_ACCESS_KEY_ID__/$secret_access_key_id/" \
+  -e "s/__AWS_SECRET_ACCESS_KEY__/$secret_access_key/" \
+  -e "s/node.kubernetes.io\/instance-type: .*/node.kubernetes.io\/instance-type: $node_instance_type/" \
+  -e "s/storageClassName: gp2 # NEEDS-CUSTOMER-INPUT.*/storageClassName: $storage_class # NEEDS-CUSTOMER-INPUT/" \
+  -e "s|autoUpdateEnabled: false  # NEEDS-CUSTOMER-INPUT|autoUpdateEnabled: $enable_autoupdates # NEEDS-CUSTOMER-INPUT|" \
+  -e "s|638117407428.dkr.ecr.eu-west-1.amazonaws.com/ai-service-on-premise|$ai_service_image_repo_url|" \
+  -e "s|HF_ACCESS_TOKEN_PLACEHOLDER|$hf_access_token|" \
+  "$ai_values_file"
 
-echo "values.yaml has been updated with the provided values."
+echo "$ai_values_file has been updated with the provided values."

ai-service/values.yaml

@@ -8,9 +8,11 @@ service:
     - name: DEPLOYMENT_GROUP_NAME
       value: "enterprise-env"
     - name: AI_SERVICE_ANDROMEDA_HOST
-      value: "http://andromeda-service.privado.svc.cluster.local:6001" # NEEDS-CUSTOMER-INPUT
+      # The andromeda-service prefix corresponds to andromeda.serviceName: andromeda-service in code-analysis/values.yaml
+      # Adjust the andromeda host URL to match your deployment configuration if necessary.
+      value: http://andromeda-service.__ANDRO_NAMESPACE__.svc.__ANDRO_CLUSTER_DOMAIN__:6001
     - name: CHROMA_HOST
-      value: "ai-service-chroma-chromadb.privado.svc.cluster.local"  # NEEDS-CUSTOMER-INPUT [without 'http://' prefix]
+      value: ai-service-chroma-chromadb.__AI_NAMESPACE__.svc.__AI_CLUSTER_DOMAIN__
     - name: NVIDIA_DRIVER_CAPABILITIES
       value: "all"
     - name: HF_ACCESS_TOKEN
@@ -25,10 +27,10 @@ image:
   imagePullSecret: ai-service-ecr-secret
 
 privadoAwsSecrets:
-  useECR: false  # NEEDS-CUSTOMER-INPUT
+  useECR: true  # NEEDS-CUSTOMER-INPUT
   secretName: ai-service-ecr-secret
-  secretAccessKeyId: "_CUSTOMER_AWS_ACCESS_KEY_ID_"  # NEEDS-CUSTOMER-INPUT
-  secretAccessKey: "_CUSTOMER_AWS_SECRET_ACCESS_KEY_"  # NEEDS-CUSTOMER-INPUT
+  secretAccessKeyId: __AWS_ACCESS_KEY_ID__  # NEEDS-CUSTOMER-INPUT
+  secretAccessKey: __AWS_SECRET_ACCESS_KEY__  # NEEDS-CUSTOMER-INPUT
   annotations: { }  # Add custom labels here
 
 serviceAccount:
@@ -113,18 +115,18 @@ volumeMounts:
 persistentVolumeClaim:
   aiServiceModelsPvc:
     name: ai-service-models-pvc
-    accessModes: "ReadWriteOnce" # Update ReadWriteMany if autoscaling is enabled
+    accessModes: "ReadWriteMany" # Update ReadWriteMany if autoscaling is enabled
     resources:
       requests:
         storage: 80Gi
-    storageClassName: gp2 # NEEDS-CUSTOMER-INPUT. Adjust the storageClassName as needed.
+    storageClassName: efs-sc # NEEDS-CUSTOMER-INPUT.
   aiServiceLogPvc:
     name: ai-service-log-pvc
-    accessModes: "ReadWriteOnce"
+    accessModes: "ReadWriteMany"
     resources:
       requests:
         storage: 10Gi
-    storageClassName: gp2 # NEEDS-CUSTOMER-INPUT
+    storageClassName: efs-sc # NEEDS-CUSTOMER-INPUT
 
 podAnnotations: { } # Add custom labels here
 podLabels: { } # Add custom labels here

code-analysis/Chart.yaml

@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.3
+version: 0.2.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes. 
-appVersion: "1.0" 
+# It is recommended to use it with quotes.
+appVersion: "1.0"

code-analysis/README.md

@@ -11,7 +11,3 @@ In the [values.yaml](./values.yaml) file, verify the following attribute:
 4. Resources: All `cpu` and `memory` values.
 5. Storage: All `storage` values to set storage size. As well as the `storageClass` to configure which storage will be used.
 6. Update values in `enterpriseConf`.
-
-
-## Releasing Charts:
-Charts will be released everytime "Chart.version" is updated. To trigger a release, upgrade the version.

code-analysis/templates/config.andromeda-nginx-conf.yaml

@@ -23,14 +23,15 @@ data:
        listen 80 default_server;
        server_name {{ .Values.base.host }} {{ .Values.andromeda.serviceName }}.{{ .Release.Namespace }}.svc.{{ .Values.base.clusterDomain }} localhost 127.0.0.1;
 
+       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+       
        location /ce/ml/ {
             limit_req zone=limitmagiclinkcalls burst=10 nodelay;
             add_header Access-Control-Max-Age 3600;
             add_header Access-Control-Expose-Headers Content-Length;
             add_header Access-Control-Allow-Methods *;
             add_header Access-Control-Allow-Headers *;
             add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'";
-            add_header Strict-Transport-Security "max-age=63072000;";
             include         uwsgi_params;
             uwsgi_pass      unix:/home/ubuntu/install/code/andromeda-on-premise/andromeda-on-premise.sock;
             proxy_read_timeout 180s;
@@ -44,11 +45,23 @@ data:
             add_header Access-Control-Allow-Methods *;
             add_header Access-Control-Allow-Headers *;
             add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'";
-            add_header Strict-Transport-Security "max-age=63072000;";
             include         uwsgi_params;
             uwsgi_pass      unix:/home/ubuntu/install/code/andromeda-on-premise/andromeda-on-premise.sock;
-            proxy_read_timeout 420s;
-            client_max_body_size 800M;
+            proxy_read_timeout 180s;
+            client_max_body_size 100M;
+        }
+
+        location /ce/mobilescans/ {
+            limit_req zone=apilimit burst=40 nodelay;
+            add_header Access-Control-Max-Age 3600;
+            add_header Access-Control-Expose-Headers Content-Length;
+            add_header Access-Control-Allow-Methods *;
+            add_header Access-Control-Allow-Headers *;
+            add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'";
+            include         uwsgi_params;
+            uwsgi_pass      unix:/home/ubuntu/install/code/andromeda-on-premise/andromeda-on-premise.sock;
+            proxy_read_timeout 180s;
+            client_max_body_size 1000M;
         }
 
         location /ac/ {
@@ -58,7 +71,6 @@ data:
             add_header Access-Control-Allow-Methods *;
             add_header Access-Control-Allow-Headers *;
             add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'";
-            add_header Strict-Transport-Security "max-age=63072000;";
             include         uwsgi_params;
             uwsgi_pass      unix:/home/ubuntu/install/code/andromeda-on-premise/andromeda-on-premise.sock;
             proxy_read_timeout 180s;

code-analysis/values.yaml

@@ -1,4 +1,3 @@
-
 # --- My values below this
 base:
   isProduction: true
@@ -15,16 +14,16 @@ base:
 # values related to Privado's registry secrets & cron
 registry:
   # enables or disables usage of privado's Registry
-  # disabling this would also mean that the organization 
+  # disabling this would also mean that the organization
   # would use self-maintained secrets with the deployment
-  enable: true
+  enable: true  # NEEDS-CUSTOMER-INPUT use_privado_registry
   region: "{{ if .Values.base.isProduction }} {{ .Values.base.prodRegion }} {{ else }} {{ .Values.base.testRegion }} {{ end }}"
   roleName: ecr-token-helper
   serviceAccountName: sa-ecr-token-helper
   roleBindingName: ecr-token-helper
   cronName: ecr-token-helper
   cronSchedule: "0 */6 * * *"
-  cronPodRestartPolicy: OnFailure 
+  cronPodRestartPolicy: OnFailure
   cronjobLabels:  # key: value
   cronjobAnnotations: # key: value
   image:
@@ -36,8 +35,8 @@ registry:
     name: ecr-iam-secrets
     labels:   # key: value
     annotations:    # key: value
-    AWS_ACCESS_KEY_ID: 
-    AWS_SECRET_ACCESS_KEY: 
+    AWS_ACCESS_KEY_ID: __AWS_ACCESS_KEY_ID__  # NEEDS-CUSTOMER-INPUT
+    AWS_SECRET_ACCESS_KEY: __AWS_SECRET_ACCESS_KEY__  # NEEDS-CUSTOMER-INPUT
   dockerhub:
     # keep value of below flag as true if you are using images from dockerhub
     enable: false
@@ -52,7 +51,7 @@ autoupdates:
   # enables or disables autoupdates for deployment
   # supports ECR and DockerHub
   # registry.secrets need to be configured
-  enable: true
+  enable: true  # NEEDS-CUSTOMER-INPUT enable_auto_updates
   annotationName: "checksum/image-sha256"
   roleName: updater-role
   serviceAccountName: updater-sa
@@ -88,7 +87,7 @@ ingress:
   # needs this value from customer for their ingressClass
   # since most annotation-based support for controllers is now deprecated
   ingressClassName: "" # NEEDS-CUSTOMER-INPUT
-  annotations:  # NEEDS-CUSTOMER-INPUT
+  annotations: # NEEDS-CUSTOMER-INPUT
     kubernetes.io/ingress.class: alb  # may receive deprecated warning
     alb.ingress.kubernetes.io/scheme: internet-facing
     alb.ingress.kubernetes.io/target-type: ip
@@ -97,9 +96,9 @@ ingress:
 # Values related to mongo.yaml
 mongo:
   statefulSetName: mongo
-  statefulSetLabels:    # key: value 
-  statefulSetAnnotations:    # key: value 
-  image: 
+  statefulSetLabels:    # key: value
+  statefulSetAnnotations:    # key: value
+  image:
     name: percona/percona-server-mongodb
     tag: "5.0"
   runAsUser: 0
@@ -154,13 +153,13 @@ config:
     SCANNER_APP_INSPECTOR_IMAGE_URL:
 
 
-# Values related to andromeda.yaml 
+# Values related to andromeda.yaml
 andromeda:
   deploymentName: andromeda
-  deploymentLabels:    # key: value 
-  deploymentAnnotations:    # key: value 
+  deploymentLabels:    # key: value
+  deploymentAnnotations:    # key: value
   replicas: 1
-  image: 
+  image:
     name: "638117407428.dkr.ecr.{{ if .Values.base.isProduction }}{{ .Values.base.prodRegion }}{{ else }}{{ .Values.base.testRegion }}{{ end }}.amazonaws.com/andromeda"
     tag: latest
   podAppLabel: andromeda
@@ -177,7 +176,7 @@ andromeda:
     limits:
       cpu:
       memory:
-  node:   # overrides the global node configs
+  node: # overrides the global node configs
     hostname: "" # if customer has NFS storage attached then keep this field empty else keep node's "hostname" having larger resources
     affinity:
       enable: false
@@ -253,10 +252,12 @@ andromeda:
       CUSTOMER_EMAIL_SSL_KEYFILE: "__EMAIL_SSL_KEY__"
 
       CONFIG_AI_SERVICE_AVAILABLE: "false"
-      CONFIG_AI_SERVICE_PATH: ""
+      # Adjust AI service host URL to match your deployment configuration if necessary.
+      # The ai-service prefix corresponds to the ai-service module service name.
+      CONFIG_AI_SERVICE_PATH: http://ai-service.__AI_NAMESPACE__.svc.__AI_CLUSTER_DOMAIN__:8080
 
 
-# Values related to janus.yaml 
+# Values related to janus.yaml
 # for each provisioned code-scanner
 janus:
   resources:
@@ -281,13 +282,13 @@ janus:
       mountPath: "/root/.gradle"
 
 
-# Values related to bishamonten.yaml 
+# Values related to bishamonten.yaml
 bishamonten:
   deploymentName: bishamonten
   deploymentLabels:    # key: value
   deploymentAnnotations:    # key: value
   replicas: 1
-  image: 
+  image:
     name: "638117407428.dkr.ecr.{{ if .Values.base.isProduction }}{{ .Values.base.prodRegion }}{{ else }}{{ .Values.base.testRegion }}{{ end }}.amazonaws.com/bishamonten"
     tag: latest
   podAppLabel: bishamonten
@@ -310,13 +311,13 @@ bishamonten:
     mountPath: "/home/bishamonten/build/{{ .Values.bishamonten.volumeHostConfig.subPath }}"   # use with tpl
   config:
     hostConfig:
-      host: '{{ .Values.base.protocol }}://{{ required "A valid .Values.base.host is required" .Values.base.host }}'   # use with tpl 
+      host: '{{ .Values.base.protocol }}://{{ required "A valid .Values.base.host is required" .Values.base.host }}'   # use with tpl
       accountHost: '{{ .Values.base.protocol }}://{{ required "A valid .Values.base.host is required" .Values.base.host }}'    # use with tpl
       isPremiseVersion: 1
 
 
 mastervendor:
-  enable: false
+  enable: false  # NEEDS-CUSTOMER-INPUT enable_master_vendor
   image:
     name: "638117407428.dkr.ecr.{{ if .Values.base.isProduction }}{{ .Values.base.prodRegion }}{{ else }}{{ .Values.base.testRegion }}{{ end }}.amazonaws.com/master-vendor-base-image"
     tag: latest