feat: Add gcpSecurityPolicy (#336)

wandb · Feb 3, 2025 · b7ca0df · b7ca0df
1 parent cba096e
commit b7ca0df
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 8 deletions.
diff --git a/charts/operator-wandb/Chart.yaml b/charts/operator-wandb/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: operator-wandb
 description: A Helm chart for deploying W&B to Kubernetes
 type: application
-version: 0.24.9
+version: 0.25.0
 appVersion: 1.0.0
 icon: https://wandb.ai/logo.svg
 

diff --git a/charts/operator-wandb/charts/app/templates/service.yaml b/charts/operator-wandb/charts/app/templates/service.yaml
@@ -1,4 +1,3 @@
-{{- if .Values.global.createGCPLoadBalancerBackend }}
 {{- if eq .Values.global.cloudProvider "gcp" }}
 ---
 apiVersion: cloud.google.com/v1
@@ -8,9 +7,12 @@ metadata:
   labels:
     {{- include "wandb.commonLabels" . | nindent 4 }}
 spec:
+  {{- if .Values.global.gcpSecurityPolicy }}
+  securityPolicy:
+    name: {{ .Values.global.gcpSecurityPolicy }}
+  {{- end }}
   timeoutSec: 120
 {{- end }}
-{{- end }}
 ---
 apiVersion: v1
 kind: Service

diff --git a/charts/operator-wandb/charts/console/templates/service.yaml b/charts/operator-wandb/charts/console/templates/service.yaml
@@ -1,4 +1,3 @@
-{{- if .Values.global.createGCPLoadBalancerBackend }}
 {{- if eq .Values.global.cloudProvider "gcp" }}
 ---
 apiVersion: cloud.google.com/v1
@@ -8,9 +7,12 @@ metadata:
   labels:
     {{- include "wandb.commonLabels" . | nindent 4 }}
 spec:
+  {{- if .Values.global.gcpSecurityPolicy }}
+  securityPolicy:
+    name: {{ .Values.global.gcpSecurityPolicy }}
+  {{- end }}
   timeoutSec: 120
 {{- end }}
-{{- end }}
 ---
 {{- if .Values.enabled }}
 apiVersion: v1

diff --git a/charts/operator-wandb/values.yaml b/charts/operator-wandb/values.yaml
@@ -194,9 +194,9 @@ global:
     debug: false
     dryRun: true
 
-  # Creates a backend config to set custom values to used by the gke load balancer
-  # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#create_backendconfig
-  createGCPLoadBalancerBackend: false
+  # GCP only value: a CloudArmor policy to be attached to the gce LoadBalancer via a BackendConfig.
+  # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#cloud_armor
+  gcpSecurityPolicy: ""
 
 ingress:
   install: true