Skip to content

Commit 9d5074c

Browse files
andytang-scaleandytang-scale
authored
Chainguard model engine (#702)
* chainguard mods for federal use cases * changes to enable model-engine * logging to fix enqueuing onto the redis broker for the gateway * added a PROD env variable to utilize redis queue * forgot to import PROD variable into these file locations * added configuration changes to helmchart, addressed comments in the pr * removed federal flag and replaced with fips_compliance. Gated logging behind debug mode * changes made based on pr comments * resolve comments from pr * grammar errors and gating some more logging * linting for python * black formatting * isort fixes * ruff check * type check * black * type check * dummy aws creds for circle ci * mock default profile * default config * escape * omit logging statements from testing coverage * black formatting * unit test coverge * unit test coverage * formatting * unit tests * remove unused import * fixed testing * fixed some tests * simplify tests * celery test fix * fix test celery
1 parent 533293a commit 9d5074c

27 files changed

+786
-54
lines changed

‎.circleci/config.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,20 @@ jobs:
4545
parallelism: 1
4646
steps:
4747
- checkout # checkout source code to working directory
48+
- run:
49+
name: Setup AWS Config for Testing
50+
command: |
51+
mkdir -p ~/.aws
52+
cat > ~/.aws/credentials \<< EOF
53+
[default]
54+
aws_access_key_id = dummy
55+
aws_secret_access_key = dummy
56+
EOF
57+
cat > ~/.aws/config \<< EOF
58+
[default]
59+
region = us-west-2
60+
output = json
61+
EOF
4862
- environment_setup
4963
- install_server
5064
- run:

‎charts/model-engine/templates/cacher_deployment.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,16 @@ spec:
2929
imagePullSecrets:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
32+
{{- with .Values.podSecurityContext }}
33+
securityContext:
34+
{{- toYaml . | nindent 8 }}
35+
{{- end }}
3236
containers:
3337
- name: {{ include "modelEngine.cachername" . }}
38+
{{- with .Values.containerSecurityContext }}
39+
securityContext:
40+
{{- toYaml . | nindent 12 }}
41+
{{- end }}
3442
image: "{{ .Values.image.gatewayRepository }}:{{ .Values.tag}}"
3543
imagePullPolicy: {{ .Values.image.pullPolicy }}
3644
ports:

‎charts/model-engine/templates/endpoint_builder_deployment.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,16 @@ spec:
3030
imagePullSecrets:
3131
{{- toYaml . | nindent 8 }}
3232
{{- end }}
33+
{{- with .Values.podSecurityContext }}
34+
securityContext:
35+
{{- toYaml . | nindent 8 }}
36+
{{- end }}
3337
containers:
3438
- name: {{ include "modelEngine.buildername" . }}
39+
{{- with .Values.containerSecurityContext }}
40+
securityContext:
41+
{{- toYaml . | nindent 12 }}
42+
{{- end }}
3543
image: "{{ .Values.image.builderRepository }}:{{ .Values.tag}}"
3644
imagePullPolicy: {{ .Values.image.pullPolicy }}
3745
ports:

‎charts/model-engine/templates/gateway_deployment.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,18 @@ spec:
3737
imagePullSecrets:
3838
{{- toYaml . | nindent 8 }}
3939
{{- end }}
40+
{{- with .Values.podSecurityContext }}
41+
securityContext:
42+
{{- toYaml . | nindent 8 }}
43+
{{- end }}
4044
terminationGracePeriodSeconds: 60
4145
priorityClassName: model-engine-high-priority
4246
containers:
4347
- name: {{ include "modelEngine.fullname" . }}
48+
{{- with .Values.containerSecurityContext }}
49+
securityContext:
50+
{{- toYaml . | nindent 12 }}
51+
{{- end }}
4452
image: "{{ .Values.image.gatewayRepository }}:{{ .Values.tag}}"
4553
imagePullPolicy: {{ .Values.image.pullPolicy }}
4654
ports:

‎charts/model-engine/templates/service_config_map.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,15 @@ data:
1919
{{- end }}
2020
infra_service_config: |-
2121
env: {{ .Values.context | quote }}
22+
{{- if .Values.celery_enable_sha256 }}
23+
celery_enable_sha256: {{ .Values.celery_enable_sha256 }}
24+
{{- end }}
25+
{{- if .Values.debug_mode }}
26+
debug_mode: {{ .Values.debug_mode }}
27+
{{- end }}
28+
{{- if .Values.celery_broker_type_redis }}
29+
celery_broker_type_redis: {{ .Values.celery_broker_type_redis }}
30+
{{- end }}
2231
{{- with .Values.config.values.infra }}
2332
{{- range $key, $value := . }}
2433
{{ $key }}: {{ $value | quote }}
@@ -48,6 +57,15 @@ data:
4857
{{- end }}
4958
infra_service_config: |-
5059
env: {{ .Values.context | quote }}
60+
{{- if .Values.celery_enable_sha256 }}
61+
celery_enable_sha256: {{ .Values.celery_enable_sha256 }}
62+
{{- end }}
63+
{{- if .Values.debug_mode }}
64+
debug_mode: {{ .Values.debug_mode }}
65+
{{- end }}
66+
{{- if .Values.celery_broker_type_redis }}
67+
celery_broker_type_redis: {{ .Values.celery_broker_type_redis }}
68+
{{- end }}
5169
{{- with .Values.config.values.infra }}
5270
{{- range $key, $value := . }}
5371
{{ $key }}: {{ $value | quote }}

‎charts/model-engine/values.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,30 @@
11
dd_trace_enabled: true
22
spellbook:
33
enabled: false
4+
5+
# celery_enable_sha256 [optional] uses SHA256 hashes for federal compliance mode (FIPS, enhanced security)
6+
celery_enable_sha256: null
7+
8+
# debug_mode [optional] enables detailed debug logging for infrastructure components
9+
debug_mode: null
10+
11+
# celery_broker_type_redis [optional] explicitly uses Redis for the Celery broker
12+
celery_broker_type_redis: null
13+
14+
#uncomment below if using a container image that requires nonroot (ex. chainguard)
15+
# podSecurityContext:
16+
# runAsUser: 65532
17+
# runAsGroup: 65532
18+
# runAsNonRoot: true
19+
# fsGroup: 65532
20+
21+
# containerSecurityContext:
22+
# allowPrivilegeEscalation: false
23+
# readOnlyRootFilesystem: false
24+
# capabilities:
25+
# drop:
26+
# - ALL
27+
428
redis:
529
auth:
630
enableTLS: false

‎charts/model-engine/values_circleci.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,23 @@
11
# This is a YAML-formatted file.
22

3+
celery_enable_sha256: null
4+
celery_broker_type_redis: null
5+
debug_mode: null
6+
7+
#uncomment below if using a container image that requires nonroot (ex. chainguard)
8+
# podSecurityContext:
9+
# runAsUser: 65532
10+
# runAsGroup: 65532
11+
# runAsNonRoot: true
12+
# fsGroup: 65532
13+
14+
# containerSecurityContext:
15+
# allowPrivilegeEscalation: false
16+
# readOnlyRootFilesystem: false
17+
# capabilities:
18+
# drop:
19+
# - ALL
20+
321
replicaCount:
422
gateway: 1
523
cacher: 1

‎charts/model-engine/values_sample.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,28 @@
11
# This is a YAML-formatted file.
22

3+
# celery_enable_sha256 [optional] uses SHA256 hashes for federal compliance mode (FIPS, enhanced security)
4+
celery_enable_sha256: null
5+
6+
# debug_mode [optional] enables detailed debug logging for infrastructure components
7+
debug_mode: null
8+
9+
# celery_broker_type_redis [optional] explicitly uses Redis for the Celery broker
10+
celery_broker_type_redis: null
11+
12+
#uncomment below if using a container image that requires nonroot (ex. chainguard)
13+
# podSecurityContext:
14+
# runAsUser: 65532
15+
# runAsGroup: 65532
16+
# runAsNonRoot: true
17+
# fsGroup: 65532
18+
19+
# containerSecurityContext:
20+
# allowPrivilegeEscalation: false
21+
# readOnlyRootFilesystem: false
22+
# capabilities:
23+
# drop:
24+
# - ALL
25+
326
# tag [required] is the LLM Engine docker image tag
427
tag: 60ac144c55aad971cdd7f152f4f7816ce2fb7d2f
528
# context is a user-specified deployment tag. Can be used to

‎federal/Dockerfile.chainguard‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# federal/Dockerfile.chainguard
2+
FROM cgr.dev/scale.com/python-fips:3.10.15-dev
3+
WORKDIR /workspace
4+
USER root
5+
6+
RUN apk add htop \
7+
dumb-init \
8+
libssh \
9+
openssh-client \
10+
iftop \
11+
curl \
12+
curl-dev \
13+
procps \
14+
libcurl-openssl4 \
15+
vim \
16+
kubectl
17+
18+
RUN curl -Lo /bin/aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.5.9/aws-iam-authenticator_0.5.9_linux_amd64
19+
RUN chmod +x /bin/aws-iam-authenticator
20+
21+
RUN pip install pip==24.2
22+
RUN chmod -R 777 /workspace
23+
24+
RUN pip install awscli==1.34.28 --no-cache-dir
25+
26+
COPY federal/sitecustomize.py /usr/lib/python3.10/site-packages/sitecustomize.py
27+
28+
WORKDIR /workspace/model-engine/
29+
COPY model-engine/requirements-test.txt /workspace/model-engine/requirements-test.txt
30+
COPY model-engine/requirements.txt /workspace/model-engine/requirements.txt
31+
COPY model-engine/requirements_override.txt /workspace/model-engine/requirements_override.txt
32+
RUN pip install -r requirements-test.txt --no-cache-dir
33+
RUN pip install -r requirements.txt --no-cache-dir
34+
RUN pip install -r requirements_override.txt --no-cache-dir
35+
COPY model-engine/setup.py /workspace/model-engine/setup.py
36+
COPY model-engine/model_engine_server /workspace/model-engine/model_engine_server
37+
RUN pip install -e .
38+
39+
COPY integration_tests /workspace/integration_tests
40+
41+
WORKDIR /workspace
42+
ENV PYTHONPATH /workspace
43+
ENV WORKSPACE /workspace
44+
45+
USER nonroot
46+
47+
EXPOSE 5000

‎federal/sitecustomize.py‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import hashlib
2+
3+
# Replace md5 with sha256 for FIPS compliance
4+
hashlib.md5 = hashlib.sha256
5+
6+
# Also patch SQLAlchemy specifically
7+
try:
8+
from sqlalchemy.util import langhelpers
9+
10+
def sha256_hex(data):
11+
if isinstance(data, str):
12+
data = data.encode("utf-8")
13+
return hashlib.sha256(data).hexdigest()[:8] # Match MD5 length expectation
14+
15+
langhelpers.md5_hex = sha256_hex
16+
except ImportError:
17+
pass

0 commit comments

Comments
 (0)