Skip to content

Commit deaaff4

Browse files
kmid5280kmid5280
committed
Merge remote-tracking branch 'upstream/develop' into develop
2 parents 7ab9788 + 91c6a8d commit deaaff4

26 files changed

+674
-377
lines changed

‎.github/ISSUE_TEMPLATE/dash-feature.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
name: Dash feature request
3+
about: Report something that's missing from the Dash version
4+
title: [dash]
5+
labels: 'dash'
6+
assignees: ''
7+
8+
---
9+
10+
### Description:
11+
12+
13+
14+
[ ] This is something we can copy over from streamlit (screenshots if applicable)

‎.github/ISSUE_TEMPLATE/general-bug-report.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
name: General bug report
3+
about: Create an report to help us improve.
4+
title: [bug]
5+
labels: 'bug'
6+
assignees: ''
7+
8+
---
9+
10+
<!--
11+
Before you begin, please help us manage volume by checking if this could be submitted another way:
12+
- Usage questions? Ask in Slack [#chime-help](https://codeforphilly.org/chat?channel=chime-help).
13+
- Feature ideas? Propose in Slack for discussion.
14+
- Is this something you can debug and fix? Pull requests are very welcome.
15+
-->
16+
17+
### Description:
18+
19+
### Steps to reproduce:
20+
1.
21+
2.
22+
3.
23+
24+
### Expected behavior:
25+
26+
### What I got instead:
27+
(screenshots if applicable)

‎.github/ISSUE_TEMPLATE/model.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
name: Bug report for model
3+
about: Feedback or bug report for the epidemiological model and analysis.
4+
title: [model]
5+
labels: 'models'
6+
assignees: ''
7+
8+
---
9+
10+
<!--
11+
Please note: Any changes to the model have a huge impact on rapidly evolving hospital system & public health decisions. The current model has been in use for a while now, and it has been validated against other similar models, so any changes to the model must meet a very high bar.
12+
13+
However, these 2 types of issue reports are very welcome:
14+
- Bugs causing this model to produce invalid results. In this case, please include details and a suggested fix.
15+
- If this model is producing a significantly different result than another well-known epidemiological model. In this case, please include proof of this difference and a suggested fix to our approach.
16+
17+
For questions or early discussion, please join us in [#chime-analysis](https://codeforphilly.org/chat?channel=chime-analysis) in Slack instead.
18+
-->
19+
20+
### Summary
21+
22+
23+
### Additional details
24+
25+
26+
### Suggested fix

‎.github/workflows/heroku.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Deploy working development app to Heroku staging project
2+
3+
on:
4+
push:
5+
branches:
6+
- 'develop'
7+
8+
env:
9+
HEROKU_USER: 32dd7c8d-eb68-4420-bfe2-9ed047ef8fb0
10+
HEROKU_SECRET: ${{ secrets.heroku_secret_key }}
11+
HEROKU_APP: cfp-ci-chime
12+
HEROKU_EMAIL: [email protected]
13+
14+
jobs:
15+
deploy-heroku-stg:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v2
19+
- name: Deploy app
20+
id: deploy_stg_job
21+
uses: akhileshns/[email protected]
22+
with:
23+
heroku_api_key: ${HEROKU_SECRET}
24+
heroku_app_name: ${HEROKU_APP}
25+
heroku_email: ${HEROKU_EMAIL}
26+
- name: Return app URL
27+
run: |
28+
echo "Deployed to: https://${HEROKU_APP}.herokuapp.com/"

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ The **C**OVID-19 **H**ospital **I**mpact **M**odel for **E**pidemics ([penn-chim
77
## Background
88
The [CHIME](https://penn-chime.phl.io/) (COVID-19 Hospital Impact Model for Epidemics) Application is designed to assist hospitals and public health officials with understanding hospital capacity needs as they relate to the COVID pandemic. CHIME enables capacity planning by providing estimates of total daily (i.e. new) and running totals of (i.e. census) inpatient hospitalizations, ICU admissions, and patients requiring ventilation. These estimates are generated using a [SIR (Susceptible, Infected, Recovered)](https://mathworld.wolfram.com/SIRModel.html) model, a standard epidemiological modeling technique. Our model has been validated by several epidemiologists including [Michael Z. Levy, PhD](https://www.dbei.med.upenn.edu/bio/michael-z-levy-phd), Associate Professor of Epidemiology, Department of Biostatistics, Epidemiology and Informatics at the Perelman School of Medicine.
99

10-
Originally developed in `github.com/pennsignals/chime`, active development is now at `github.com/pennsignals/chime`.
10+
Originally developed in `github.com/pennsignals/chime`, active development is now at `github.com/CodeForPhilly/chime`.
1111

1212
### Documentation
1313

‎docs/SUMMARY.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313
- [The `chime-live` Cluster](./operations/chime-live-cluster.md)
1414
- [Deploy to Heroku](./operations/heroku.md)
1515
- [Deploy to Your Own Cluster](./operations/byok8s.md)
16+
- [Limited Cluster Access for Deployment][1]
1617
- [Code of Conduct](CODE_OF_CONDUCT.md)
1718
- [Maintainers](MAINTAINERS.md)
1819
- [Glossary](GLOSSARY.md)
20+
21+
[1]: ./operations/limited-kubeconfigs/limited-kubeconfigs.md

‎docs/getting-started/try-online.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Try this link: https://pennchime.herokuapp.com/
1212

1313
### Run Your Own Copy Locally
1414

15-
If you're comfortable working on your computer's command line, you can head over to the [Getting Started: Run Locally](getting-started/run-locally.md) guide to run a private instance on your own computer.
15+
If you're comfortable working on your computer's command line, you can head over to the [Getting Started: Run Locally](run-locally.md) guide to run a private instance on your own computer.
1616

1717
### Run a Shared Copy Online for Your Organization
1818

‎docs/operations/limited-kubeconfigs/limited-kubeconfigs.md

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
# Creating Kubeconfigs with Limited Permissions
2+
3+
## Create a Role
4+
5+
Kubernetes has two primary resources which represent a set of permissions,
6+
Roles and ClusterRoles. ClusterRoles apply to resources in all namespaces,
7+
whereas Roles are limited to a specific namespace. Let's create a Role in the
8+
chime namespace which will allow read/write access to Deployments and
9+
read-only access to Pods.
10+
11+
deployer.yaml:
12+
13+
```
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
kind: Role
16+
metadata:
17+
name: deployer
18+
namespace: chime
19+
rules:
20+
- apiGroups:
21+
- apps
22+
resources:
23+
- deployments
24+
verbs:
25+
# we are _not_ including 'create' and 'delete'
26+
- get
27+
- list
28+
- watch
29+
- update
30+
- patch
31+
- apiGroups:
32+
- ""
33+
resources:
34+
- pods
35+
verbs:
36+
# so that we can observe our pods getting created
37+
- get
38+
- list
39+
- watch
40+
```
41+
42+
## Create a ServiceAccount
43+
44+
One of the subjects which can take on a Role is a ServiceAccount. Let's
45+
create a ServiceAccount called penn-deployer in the chime namespace:
46+
47+
```
48+
apiVersion: v1
49+
kind: ServiceAccount
50+
metadata:
51+
name: penn-deployer
52+
namespace: chime
53+
```
54+
55+
## Create a RoleBinding
56+
57+
We can now give the ServiceAccount the Role that we created earlier using a
58+
RoleBinding in the chime namespace.
59+
60+
```
61+
apiVersion: rbac.authorization.k8s.io/v1
62+
kind: RoleBinding
63+
metadata:
64+
name: penn-deployer:deployer
65+
namespace: chime
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: deployer
70+
subjects:
71+
- kind: ServiceAccount
72+
name: penn-deployer
73+
namespace: chime
74+
```
75+
76+
## Grabbing the token for the ServiceAccount
77+
78+
Every ServiceAccount gets a token, lets grab it.
79+
80+
```
81+
k get secrets -n chime
82+
```
83+
84+
Look for `penn-deployer-token-<hash>`
85+
86+
```
87+
k get secrets -n chime penn-deployer-token-<hash>
88+
```
89+
90+
Grab the "token:" base64 encoded token.
91+
92+
*base64 decode this token, which will produce base64*
93+
94+
## Creating a token-based kubeconfig
95+
96+
Now take a look at the Kubeconfig that you are currently using. Does it use a
97+
token? If so, you can construct a Kubeconfig for this ServiceAccount by copying
98+
your kubeconfig and replacing the token and user name with this decoded token
99+
and the user name "penn-deployer".
100+
101+
It will look something like this:
102+
103+
```
104+
apiVersion: v1
105+
kind: Config
106+
preferences: {}
107+
108+
clusters:
109+
- name: chime-cluster
110+
cluster:
111+
certificate-authority-data: <ca-cert-base64, same as existing>
112+
server: https://<server-hostname>:<server-port>
113+
114+
users:
115+
- name: penn-deployer
116+
user:
117+
as-user-extra: {}
118+
token: <ServiceAccount token! Be very sure that this is the ServiceAccount token!>
119+
120+
contexts:
121+
- name: penn-deployer-chime
122+
context:
123+
cluster: chime-cluster
124+
user: penn-deployer
125+
namespace: chime
126+
127+
current-context: penn-deployer-chime
128+
```
129+
130+
## Test out your token-based Kubeconfig
131+
132+
You can now use this ServiceAccount to modify Deployments, and view Pods, but do nothing else.
133+
134+
```
135+
$ k get pods -A
136+
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:chime:penn-deployer" cannot list resource "pods" in API group "" at the cluster scope
137+
```
138+
139+
```
140+
$ export KUBECONFIG=new-kubeconfig.yaml
141+
$ k get pods -n chime
142+
$ k get deployments -n chime
143+
# deploy version 0.5.0
144+
$ k set image deployment/chime -n chime chime=docker.pkg.github.com/codeforphilly/chime/penn-chime:0.5.0 --record
145+
# observe status of deployment
146+
$ k get pods -n chime
147+
```

‎docs/operations/limited-kubeconfigs/manifests/deployer.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: deployer
5+
namespace: chime
6+
rules:
7+
- apiGroups:
8+
- apps/v1
9+
resources:
10+
- deployments
11+
verbs:
12+
# we are _not_ including 'create' and 'delete'
13+
- get
14+
- list
15+
- watch
16+
- update
17+
- patch
18+
- apiGroups:
19+
- ""
20+
resources:
21+
- pods
22+
verbs:
23+
# so that we can observe our pods getting created
24+
- get
25+
- list
26+
- watch

‎docs/operations/limited-kubeconfigs/manifests/rolebinding.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: penn-deployer:deployer
5+
namespace: chime
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: deployer
10+
subjects:
11+
- kind: ServiceAccount
12+
name: penn-deployer
13+
namespace: chime

0 commit comments

Comments
 (0)