feat: update charts to support openshift requirements

charts/langflow-ide/templates/backend-statefulset.yaml

@@ -34,22 +34,25 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "langflow.serviceAccountName" . }}
       securityContext:
-        {{- toYaml .Values.langflow.backend.podSecurityContext | nindent 8 }}
-      {{- if .Values.secretProvider.enabled }}
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       volumes:
+        {{- if .Values.secretProvider.enabled }}
         - name: secrets-store-inline
           csi:
             driver: secrets-store.csi.k8s.io
             readOnly: true
             volumeAttributes:
               secretProviderClass: "{{- .Values.secretProvider.name }}"
-      {{- end }}
+        {{- end }}
+        {{- with .Values.langflow.backend.volumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
-            {{- toYaml .Values.langflow.backend.securityContext | nindent 12 }}
+            {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.langflow.backend.image.repository }}:{{ .Values.langflow.backend.image.tag  | default .Values.langflow.global.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.langflow.backend.image.pullPolicy | default .Values.langflow.global.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.langflow.backend.image.imagePullPolicy | default .Values.langflow.global.image.imagePullPolicy }}
           command: ["/bin/bash", "-c"]
           args:
             - >
@@ -65,9 +68,8 @@ spec:
             - name: http
               containerPort: {{ .Values.langflow.backend.service.port }}
               protocol: TCP
-          {{- if or .Values.secretProvider.enabled .Values.langflow.backend.sqlite.enabled }}
+          {{- if or .Values.secretProvider.enabled .Values.langflow.backend.sqlite.enabled .Values.langflow.backend.volumeMounts }}
           volumeMounts:
-          {{- end }}
             {{- if .Values.secretProvider.enabled }}
             - name: secrets-store-inline
               mountPath: "/mnt/secrets"
@@ -77,6 +79,10 @@ spec:
             - name: data
               mountPath: /data
             {{- end }}
+            {{- with .Values.langflow.backend.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- end }}
           livenessProbe:
             httpGet:
               path: /health

charts/langflow-ide/templates/clusterrole-openshift.yaml

@@ -0,0 +1,21 @@
+{{- $openshift := .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- if $openshift -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "langflow.fullname" . }}-openshift-scc
+  labels:
+    {{- include "langflow.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+    - security.openshift.io
+  resourceNames:
+    - anyuid
+    - nonroot-v2
+  resources:
+    - securitycontextconstraints
+  verbs:
+    - use
+{{- end }}
+{{- end -}}

charts/langflow-ide/templates/clusterrolebinding-openshift.yaml

@@ -0,0 +1,19 @@
+{{- $openshift := .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- if $openshift -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "langflow.fullname" . }}-openshift-scc
+  labels:
+    {{- include "langflow.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "langflow.fullname" . }}-openshift-scc
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "langflow.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}

charts/langflow-ide/templates/frontend-deployment.yaml

@@ -34,7 +34,7 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "langflow.serviceAccountName" . }}
       securityContext:
-        {{- toYaml .Values.langflow.frontend.podSecurityContext | nindent 8 }}
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       volumes:
         {{- if .Values.secretProvider.enabled }}
         - name: secrets-store-inline
@@ -44,12 +44,19 @@ spec:
             volumeAttributes:
               secretProviderClass: "{{- .Values.secretProvider.name }}"
         {{- end }}
+        {{- with .Values.langflow.frontend.volumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: nginx
+          emptyDir: {}
+        - name: nginx-cache
+          emptyDir: {}
       containers:
         - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.langflow.securityContext | nindent 12 }}
           image: "{{ .Values.langflow.frontend.image.repository }}:{{ .Values.langflow.frontend.image.tag | default .Values.langflow.global.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.langflow.frontend.image.pullPolicy | default .Values.langflow.global.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.langflow.frontend.image.imagePullPolicy | default .Values.langflow.global.image.imagePullPolicy }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
           ports:
             - name: http
               containerPort: {{ .Values.langflow.frontend.service.port }}
@@ -60,6 +67,16 @@ spec:
               mountPath: "/mnt/secrets"
               readOnly: true
             {{- end }}
+            {{- with .Values.langflow.frontend.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+
+            - name: nginx
+              mountPath: "/tmp/nginx"
+              readOnly: false
+            - name: nginx-cache
+              mountPath: "/var/cache/nginx"
+              readOnly: false
           livenessProbe:
             httpGet:
               path: /index.html

charts/langflow-ide/values.yaml

@@ -1,8 +1,10 @@
 imagePullSecrets: []
 
-nameOverride: "langflow"
+nameOverride: "langflow-service"
 # Override for the name of the helm deployment
-fullnameOverride: "langflow"
+# Note: using `langflow` as service name causes env var collision when deploying on openshift
+# https://github.com/langflow-ai/langflow/issues/4330#issuecomment-2459097917
+fullnameOverride: "langflow-service" 
 
 serviceAccount:
   # Specifies whether a service account should be created
@@ -26,11 +28,27 @@ ingress:
   #    hosts:
   #      - chart-example.local
 
+securityContext:
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+  allowPrivilegeEscalation: false
+  runAsGroup: 1000
+
+podSecurityContext:
+  fsGroup: 1000
+  runAsUser: 1000
+  runAsNonRoot: true
+  runAsGroup: 1000
+
+
 langflow:
   global:
     image:
-      pullPolicy: IfNotPresent
-      tag: ""
+      tag: "latest" 
   backend:
     replicaCount: 1
     service:
@@ -39,9 +57,9 @@ langflow:
     backendOnly: true
     numWorkers: 1
     image:
-      repository: langflowai/langflow-backend
-      pullPolicy: IfNotPresent
-      tag: ""
+      repository: langflowai/langflow
+      imagePullPolicy: IfNotPresent
+    command: ["python", "-m", "langflow", "run", "--host", "0.0.0.0", "--backend-only"]
     resources:
       requests:
         cpu: 0.5
@@ -54,27 +72,34 @@ langflow:
       periodSeconds: 10
       timeoutSeconds: 5
       initialDelaySeconds: 5
-    env: []
+    env:
+      - name: LANGFLOW_PORT
+        value: "7860"
+      - name: "LANGFLOW_ALEMBIC_LOG_FILE"
+        value: "/app/db/alembic.log"
     nodeSelector: {}
-
-
     tolerations: []
-
     affinity: {}
     podAnnotations:
       prometheus.io/scrape: "true"
-      prometheus.io/port: "9090"
+      prometheus.io/port: 9090
       prometheus.io/path: "/metrics"
 
-    securityContext: {}
-    # capabilities:
-    #   drop:
-    #   - ALL
-    # readOnlyRootFilesystem: true
-    # runAsNonRoot: true
-    # runAsUser: 1000
-
-    podSecurityContext: {}
+    securityContext:
+      capabilities:
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 1000
+      allowPrivilegeEscalation: false
+      runAsGroup: 1000
+
+    podSecurityContext:
+      fsGroup: 1000
+      runAsUser: 1000
+      runAsNonRoot: true
+      runAsGroup: 1000
 
     externalDatabase:
       # Compose in the SQLAlchemy format: https://docs.sqlalchemy.org/en/20/core/engines.html#database-urls
@@ -90,6 +115,29 @@ langflow:
         #    name: <secret-name>
       database: {}
 
+    volumes:
+      - name: flows
+        emptyDir: {}
+      - name: tmp
+        emptyDir: {}
+      - name: data
+        emptyDir: {}
+      - name: db
+        emptyDir: {}
+
+    volumeMounts:
+      - name: flows
+        mountPath: /app/flows
+        readOnly: false
+      - name: tmp
+        mountPath: /tmp
+        readOnly: false
+      - name: data
+        mountPath: /app/data
+        readOnly: false
+      - name: db
+        mountPath: /app/db
+        readOnly: false
 
     sqlite:
       enabled: true
@@ -142,8 +190,7 @@ langflow:
       port: 8080
     image:
       repository: langflowai/langflow-frontend
-      pullPolicy: IfNotPresent
-      tag: ""
+      imagePullPolicy: IfNotPresent
     resources:
       requests:
         cpu: 0.3
@@ -162,14 +209,15 @@ langflow:
 
     affinity: {}
     podAnnotations: {}
-    podSecurityContext: {}
-    securityContext: {}
-    # capabilities:
-    #   drop:
-    #   - ALL
-    # readOnlyRootFilesystem: true
-    # runAsNonRoot: true
-    # runAsUser: 1000
+
+    volumes:
+      - name: tmp
+        emptyDir: {}
+
+    volumeMounts:
+      - name: tmp
+        mountPath: /tmp
+        readOnly: false
 
 secretProvider:
   enabled: false

charts/langflow-runtime/templates/clusterrole-openshift.yaml

@@ -0,0 +1,21 @@
+{{- $openshift := .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- if $openshift -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "langflow-runtime.fullname" . }}-openshift-scc
+  labels:
+    {{- include "langflow-runtime.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+    - security.openshift.io
+  resourceNames:
+    - anyuid
+    - nonroot-v2
+  resources:
+    - securitycontextconstraints
+  verbs:
+    - use
+{{- end }}
+{{- end -}}

charts/langflow-runtime/templates/clusterrolebinding-openshift.yaml

@@ -0,0 +1,19 @@
+{{- $openshift := .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- if $openshift -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "langflow-runtime.fullname" . }}-openshift-scc
+  labels:
+    {{- include "langflow-runtime.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "langflow-runtime.fullname" . }}-openshift-scc
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "langflow-runtime.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}