Skip to content

What VICE needs

VICE (the Visual Interactive Computing Environment) runs user-supplied interactive containers — JupyterLab, RStudio, Shiny, Cloud Shell — inside the cluster, each with its own ingress and its own mount of the user's Data Store home. That means it needs more isolation than any other part of the deployment: a dedicated namespace, dedicated service accounts, and a network policy that keeps user containers away from cluster infrastructure.

Interactive analyses run on the workers in the k8s_vice_workers inventory group, kept separate from the DE service set so a runaway analysis cannot starve the platform.

Namespace and image pulls

kubectl create ns vice-apps

Interactive app images come from Harbor, so the namespace needs a pull secret:

kubectl create secret generic vice-image-pull-secret \
    --from-file=.dockerconfigjson=<PATH_TO_DOCKER_CONFIG_JSON> \
    --type=kubernetes.io/dockerconfigjson -n vice-apps

Point --from-file at a Docker config containing only the registry credentials VICE needs. A personal ~/.docker/config.json often holds credentials for several registries, and everything in the file becomes readable to anything that can read the secret.

Service accounts, bindings, and roles

From the cluster resources checkout. Check the namespace in each manifest before applying if you are not deploying into the default environment:

kubectl apply -f resources/serviceaccounts/app-exposer.yml
kubectl apply -f resources/serviceaccounts/vice-app-runner.yml
kubectl apply -f resources/clusterrolebindings/app-exposer.yml
kubectl apply -f resources/roles/vice-apps.yml

app-exposer creates and tears down per-analysis deployments, services, and ingresses; vice-app-runner is the identity the user's container itself runs as.

Network policy

resources/networkpolicies/vice-apps.yml is what stops interactive containers from reaching cluster infrastructure. It allows egress broadly and then subtracts the addresses user containers must not reach — the control plane and the worker nodes themselves:

        except:
          - <K8S_CONTROL_PLANE_CIDR>   # control plane
          - <NODE_IP>/32               # one entry per node

Add an entry for every node in the cluster, control plane and workers alike, and revisit the list whenever a node is added. A node missing from the exception list is a node that user containers can reach directly.

kubectl apply -f resources/networkpolicies/vice-apps.yml

Data transfer credentials

Analyses stage data in and out of the Data Store with porklock, which reads its configuration from a secret in the vice-apps namespace. Create irods-config.properties:

porklock.irods-home=/<IRODS_ZONE>/home
porklock.irods-user=de-irods
porklock.irods-pass=<GENERATED_SECRET>
porklock.irods-host=<IRODS_HOST>
porklock.irods-port=1247
porklock.irods-zone=<IRODS_ZONE>
porklock.irods-resc=<IRODS_DEFAULT_RESOURCE>

kubectl -n vice-apps create secret generic porklock-config \
    --from-file=irods-config.properties

Use the de-irods credentials from iRODS integration, then delete the local file — it holds an iRODS admin password in plain text.

Ingress

Interactive analyses get per-analysis hostnames under *.vice.<BASE_DOMAIN>, served today through ingress-nginx. See ingress for the controller and cert-manager for the wildcard certificate those hostnames need.

Apply configuration changes

After changing VICE configuration or secrets, restart the services that read them:

kubectl rollout restart deployment \
    app-exposer templeton-incremental templeton-periodic -n <NAMESPACE>

Before analyses will launch

A VICE operator has to be registered through the DE admin UI, which is a post-install step rather than a deployment step: register a VICE operator.

Related