refactor(helm): scope resource names by release

templates/_helpers.tpl

@@ -1,19 +1,40 @@
-{{- define "sanitizeEnvVarName" -}}
-{{ regexReplaceAll "[^A-Z0-9]+" (upper .) "_" }}
+{{/*
+Envoy Gateway full name.
+*/}}
+{{- define "envoy.fullname" -}}
+  {{- printf "%s-envoy" .Release.Name -}}
 {{- end -}}
 
 {{/*
-Envoy Gateway full name
+OpenWebUI full name.
 */}}
-{{- define "envoy.fullname" -}}
-  {{- printf "%s-envoy" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- define "openwebui.fullname" -}}
+  {{- printf "%s-openwebui" .Release.Name -}}
 {{- end -}}
 
 {{/*
-Backend name for a specific model
+
+Telemetry full name.
+*/}}
+{{- define "telemetry.fullname" -}}
+  {{- printf "%s-telemetry" .Release.Name -}}
+{{- end -}}
+
+{{/*
+
+Init job full name.
+*/}}
+{{- define "initjob.fullname" -}}
+  {{- printf "%s-init" .Release.Name -}}
+{{- end -}}
+
+{{/*
+Base name for every resource of one model.
+
+Usage: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
 */}}
-{{- define "envoy.backendName" -}}
-  {{- printf "%s-%s" (include "envoy.fullname" .) .modelName | trunc 63 | trimSuffix "-" -}}
+{{- define "model.fullname" -}}
+  {{- printf "%s-model-%s" .Release.Name .modelName -}}
 {{- end -}}
 
 {{/*

templates/authentik-blueprints-secret.yaml

@@ -1,7 +1,8 @@
+{{- if and .Values.authentik.enabled .Values.authentik.blueprints.secrets }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: authentik-blueprints
+  name: {{ .Values.authentik.blueprints.secrets | first }}
 type: Opaque
 stringData:
   authentik-config.yaml: |
@@ -112,3 +113,4 @@ stringData:
           domain: authentik-default
         attrs:
           flow_device_code: !Find [authentik_flows.flow, [slug, default-source-pre-authentication]]
+{{- end }}

templates/envoy/ai-gateway-route.yaml

@@ -28,7 +28,7 @@ spec:
               name: x-ai-eg-model
               value: {{ $model.fullName }}
       backendRefs:
-        - name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+        - name: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- end }}
   {{- end }}
 {{- end }}

templates/envoy/ai-service-backend.yaml

@@ -1,11 +1,12 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: aigateway.envoyproxy.io/v1alpha1
 kind: AIServiceBackend
 metadata:
-  name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+  name: {{ $fullname }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
@@ -15,7 +16,7 @@ spec:
     name: OpenAI
     version: "v1"
   backendRef:
-    name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+    name: {{ $fullname }}
     kind: Backend
     group: gateway.envoyproxy.io
     {{- end }}

templates/envoy/authentik-httproute.yaml

@@ -1,3 +1,4 @@
+{{- if and .Values.envoy.enabled .Values.authentik.enabled }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -16,3 +17,4 @@ spec:
         namespace: {{ .Release.Namespace }}
         port: 80
 
+{{- end }}

templates/envoy/backend-security-policy.yaml

@@ -1,25 +1,25 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: aigateway.envoyproxy.io/v1alpha1
 kind: BackendSecurityPolicy
 metadata:
-  name: backend-security-{{ $name }}
+  name: {{ $fullname }}-security
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
     release: {{ $.Release.Name }}
-    test: test
 spec:
   type: APIKey
   targetRefs:
     - group: aigateway.envoyproxy.io
       kind: AIServiceBackend
-      name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+      name: {{ $fullname }}
   apiKey:
     secretRef:
-      name: vllm-secret-{{ $name }}
+      name: {{ $fullname }}
     {{- end }}
   {{- end }}
 {{- end }}

templates/envoy/backend-traffic-policy.yaml

@@ -8,7 +8,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: BackendTrafficPolicy
 metadata:
-  name: model-rate-limit-policy
+  name: {{ include "envoy.fullname" . }}-model-rate-limit
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:

templates/envoy/backend.yaml

@@ -1,11 +1,12 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: Backend
 metadata:
-  name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+  name: {{ $fullname }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
@@ -14,7 +15,7 @@ spec:
   endpoints:
       {{- if $model.internal }}
     - fqdn:
-        hostname: model-{{ $name }}.{{ $.Release.Namespace }}.svc.cluster.local
+        hostname: {{ $fullname }}.{{ $.Release.Namespace }}.svc.cluster.local
         port: 80
       {{- else if $model.apiUrl }}
     - fqdn:

templates/envoy/client-traffic-policy.yaml

@@ -4,7 +4,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: ClientTrafficPolicy
 metadata:
-  name: client-buffer-limit
+  name: {{ include "envoy.fullname" . }}-client-buffer-limit
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:

templates/envoy/envoy-proxy.yaml

@@ -52,7 +52,7 @@ spec:
             - type: OpenTelemetry
               openTelemetry:
                 port: 4317
-                host: "otlp-openmeter-bridge.{{ .Release.Namespace }}.svc.cluster.local"
+                host: "{{ include "telemetry.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local"
   {{- end }}
   {{- if or .Values.envoy.resources .Values.envoy.service }}
   provider:

templates/envoy/gateway.yaml

@@ -16,6 +16,7 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ include "envoy.fullname" . }}-wildcard-https
+  {{- if .Values.openwebui.enabled }}
     - name: https-openwebui
       protocol: HTTPS
       port: 443
@@ -25,6 +26,8 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ include "envoy.fullname" . }}-wildcard-https
+  {{- end }}
+  {{- if .Values.authentik.enabled }}
     - name: https-authentik
       protocol: HTTPS
       port: 443
@@ -39,4 +42,5 @@ spec:
       group: gateway.envoyproxy.io
       kind: EnvoyProxy
       name: {{ include "envoy.fullname" . }}
+  {{- end }}
 {{- end }}

templates/envoy/openwebui-httproute.yaml

@@ -1,3 +1,4 @@
+{{- if and .Values.envoy.enabled .Values.openwebui.enabled }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -12,7 +13,8 @@ spec:
       group: gateway.networking.k8s.io
   rules:
   - backendRefs:
-      - name: openwebui
+      - name: {{ include "openwebui.fullname" . }}
         namespace: {{ .Release.Namespace }}
         port: 8080
 
+{{- end }}

templates/envoy/security-policy.yaml

@@ -2,7 +2,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: SecurityPolicy
 metadata:
-  name: authentik-jwks
+  name: {{ include "envoy.fullname" . }}-authentik-jwks
   namespace: {{ .Release.Namespace }}
 spec:
   targetRef:

templates/init_job/init_job.yaml

@@ -1,7 +1,8 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: "{{ .Release.Name }}-init-deployment"
+  name: "{{ include "initjob.fullname" . }}"
   labels:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
@@ -12,7 +13,7 @@ spec:
   backoffLimit: 6
   template:
     metadata:
-      name: "{{.Release.Name}}-init-deployment"
+      name: "{{ include "initjob.fullname" . }}"
       labels:
         heritage: {{ .Release.Service }}
         release: {{ .Release.Name }}
@@ -21,17 +22,17 @@ spec:
       initContainers:
         - name: check-openwebui
           image: alpine/curl:latest
-          command: ["sh", "-c", "until curl -f 'http://openwebui.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
+          command: ["sh", "-c", "until curl -f 'http://{{ include "openwebui.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
       containers:
-        - name: init-deployment
-          image: {{ .Values.initJob.image.repository | default "ghcr.io/swissdatasciencecenter/llm-serving/init" }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
-          imagePullPolicy: {{ .Values.initJob.image.pullPolicy | default "IfNotPresent" }}
+        - name: init
+          image: {{ .Values.initJob.image.repository }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: {{ .Values.initJob.image.pullPolicy }}
           args: ["init"]
           env:
             - name: INIT_OPEN_WEBUI__ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: init-secret
+                  name: {{ include "initjob.fullname" . }}
                   key: OPENWEBUI_ADMIN_PASSWORD
             - name: CONFIG_PATH
               value: /svc/config.toml
@@ -43,14 +44,15 @@ spec:
               cpu: 1
               memory: 2Gi
           volumeMounts:
-            - name: init-secret
+            - name: config
               mountPath: /svc/config.toml
               subPath: config.toml
-{{- with .Values.global.imagePullSecrets }}
+  {{- with .Values.global.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
-{{- end }}
+  {{- end }}
       volumes:
-        - name: init-secret
+        - name: config
           secret:
-            secretName: init-secret
+            secretName: {{ include "initjob.fullname" . }}
+{{- end }}

templates/init_job/init_secret.yaml

@@ -1,13 +1,15 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: init-secret
+  name: {{ include "initjob.fullname" . }}
 type: Opaque
 stringData:
   config.toml: |
     [open_webui]
-    host = "openwebui.{{ $.Release.Namespace }}.svc.cluster.local:8080"
+    host = "{{ include "openwebui.fullname" . }}.{{ $.Release.Namespace }}.svc.cluster.local:8080"
     admin_user = "{{ .Values.openwebui.admin.user | required ".Values.openwebui.admin.user is required" }}"
     admin_email = "{{ .Values.openwebui.admin.email | required ".Values.openwebui.admin.email is required"}}"
     model_ids = [{{ range $name, $model := .Values.models }}"{{ $model.fullName }}",{{ end }}]
   OPENWEBUI_ADMIN_PASSWORD: {{ .Values.openwebui.admin.password | required ".Values.openwebui.admin.password" | quote }}
+{{- end }}