1 Kubeflow #

# my-values.yaml
global:
  kserveDomain: "models.dev.example.com"   # inference domain
kubeflow-istio-resources:
  hostname: "kubeflow.dev.example.com"
  externalDNSEnabled: false

# my-values.yaml
global:
  kserveDomain: "models.dev.example.com"   # inference domain — see note above
kubeflow-istio-resources:
  hostname: "kubeflow.dev.example.com"
  externalDNSEnabled: false
  tls:
    source: "selfSigned"
    credentialName: kubeflow-gateway-tls
    httpsRedirect: true

# prod-values.yaml
# ── Access ──────────────────────────────────────────────────────────────────────
global:
  kserveDomain: "models.example.com"   # inference domain — see note above
kubeflow-istio-resources:
  hostname: "kubeflow.example.com"
  externalDNSEnabled: true
  tls:
    source: "letsEncrypt"
    credentialName: kubeflow-gateway-tls
    httpsRedirect: true
    letsEncrypt:
      email: "admin@example.com"   # your ACME account email
      server: prod                 # prod | staging (use staging first to test)
      solver: cloudflare           # dns01 via Cloudflare
    cloudflare:
      email: "admin@example.com"
      apiTokenSecretRef:
        name: cloudflare-api-key
        key: apiKey

# external-dns — watches the Istio Gateway and creates/updates DNS records
externaldns:
  enabled: true
  provider:
    name: cloudflare
  cloudflare:
    apiToken: "<YOUR-CLOUDFLARE-API-TOKEN>"  # chart creates the Secret automatically
  domainFilters:
    - "example.com"
  txtOwnerId: "kubeflow"   # unique per cluster — prevents conflicts
  sources:
    - istio-gateway
  env:
    - name: CF_API_TOKEN
      valueFrom:
        secretKeyRef:
          name: cloudflare-api-key
          key: apiKey

# ── Credentials — change ALL of these (see Production Hardening) ─────────────────
auth:
  oidc:
    clientSecret: "<STRONG-RANDOM-32-CHAR-SECRET>"
  initialUser:
    email: "admin@example.com"

dex:
  config:
    staticClients:
      - id: kubeflow-oidc-authservice
        redirectURIs:
          - /oauth2/callback
        name: kubeflow-oidc-authservice
        secret: "<STRONG-RANDOM-32-CHAR-SECRET>"   # must match auth.oidc.clientSecret
    staticPasswords:
      - email: "admin@example.com"
        # Generate: htpasswd -nbBC 12 "" 'YourPassword' | tr -d ':\n' | sed 's/$2y/$2a/'
        hash: "<BCRYPT-HASH-OF-YOUR-PASSWORD>"
        username: admin
        userID: "1"
    enablePasswordDB: true

# ── Storage credentials — change these (see Production Hardening) ────────────────
pipelines:
  seaweedfs:
    accessKey: "<STRONG-ACCESS-KEY>"
    secretKey: "<STRONG-SECRET-KEY>"
  mariadb:
    backup:
      enabled: true        # recommended for production
      schedule: "0 2 * * *"
      storageSize: 20Gi

# User namespace must use the SAME SeaweedFS credentials
user-namespace:
  pipelines:
    seaweedfs:
      accessKey: "<STRONG-ACCESS-KEY>"    # same as pipelines.seaweedfs.accessKey
      secretKey: "<STRONG-SECRET-KEY>"    # same as pipelines.seaweedfs.secretKey

# ── Optional hardening ───────────────────────────────────────────────────────────
networkPolicies:
  enabled: false   # set true when using a CNI that enforces NetworkPolicy (Calico, Cilium, Canal)
monitoring:
  enabled: false   # set true after Rancher Monitoring (kube-prometheus-stack) is installed

# prod-values.yaml
global:
  kserveDomain: "models.example.com"   # inference domain — see note above
  kserveExternalHttps: false
kubeflow-istio-resources:
  hostname: "kubeflow.example.com"
  externalDNSEnabled: false   # manage DNS separately
  tls:
    source: "secret"
    existingSecret: "my-kubeflow-tls"
    httpsRedirect: true

# Change credentials as shown in the Let's Encrypt scenario / Production Hardening
auth:
  oidc:
    clientSecret: "<STRONG-RANDOM-32-CHAR-SECRET>"
# ... (rest of credentials)

# prod-values.yaml
global:
  kserveDomain: "models.example.com"   # inference domain — see note above
kubeflow-istio-resources:
  hostname: "kubeflow.example.com"
  externalDNSEnabled: true
  tls:
    source: "issuerRef"
    httpsRedirect: true
    issuerRef:
      name: letsencrypt-production
externaldns:
  enabled: false

# Change credentials as shown in the Let's Encrypt scenario / Production Hardening
auth:
  oidc:
    clientSecret: "<STRONG-RANDOM-32-CHAR-SECRET>"
# ... (rest of credentials)

# --- KServe external HTTPS opt-in ---
global:
  kserveDomain: "models.example.com"  # base domain for inference hosts + wildcard cert. Prefer a
                                      # scoped subdomain (models.example.com) over an org-wide domain:
                                      # the wildcard is "*.<kserveDomain>", so a bare domain widens the
                                      # cert's blast radius to your whole zone.
  kserveExternalHttps: true           # the only switch — everything else is auto-derived

kubeflow-istio-resources:
  hostname: "kubeflow.example.com"    # required: the dashboard host (chart fails fast if unset). Keep
                                      # it outside the *.models.example.com wildcard so the dashboard
                                      # gets its own cert.
  tls:
    source: "letsEncrypt"             # or selfSigned / secret / issuerRef
    letsEncrypt:
      email: "admin@example.com"
      solver: cloudflare              # DNS-01 required for wildcard certs
    cloudflare:                       # required for the cloudflare DNS-01 solver
      email: "admin@example.com"
      apiTokenSecretRef:
        name: cloudflare-api-token-secret   # must live in cert-manager's namespace
        key: api-token

# in your kubeflow-override-values.yaml
user-namespace:
  additionalUsers:
    - email: tux@example.com
      namespace: tux
      resourceQuota:
        requests.cpu: "4"
        requests.memory: 8Gi
    - email: geeko@example.com
      namespace: geeko