helm-chart: add traefik.installTraefik config to opt-out when traefik is installed separately (#857)

* feat: Make traefik installation optional

This makes traefik installation optional.

Installation of CRDs happens if traefik is set to not be installed as well. Helm has built in functionality for not installing CRDs with --skip-crds, however for this project that is suboptimal, because it also blocks the install of `daskclusters.gateway.dask.org` CRD.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* skip CRDs in tests when testing without traefik

* add description on how to install daskclusters crd manually

* docs: update docs with information about how to install without traefik

* fix docs layout

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: gardleopard

.github/workflows/test.yaml

@@ -268,6 +268,94 @@ jobs:
             deploy/controller-test-dask-gateway
             deploy/traefik-test-dask-gateway
 
+
+  kubernetes-optional-traefik-test:
+    name: Test k8s backend & chart with traefik installed
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+
+    strategy:
+      fail-fast: false
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # chartpress requires git history to set chart version and image tags
+          # correctly
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      # Starts a k8s cluster with NetworkPolicy enforcement and installs both
+      # kubectl and helm
+      #
+      # ref: https://github.com/jupyterhub/action-k3s-helm/
+      #
+      - uses: jupyterhub/action-k3s-helm@v4
+        with:
+          k3s-channel: v1.31
+          metrics-enabled: false
+          traefik-enabled: false
+          docker-enabled: true
+
+      - name: Install Python test requirements
+        run: |
+          DASK_GATEWAY_SERVER__NO_PROXY=true pip install -r tests/requirements.txt
+          pip list
+
+      - name: Generate values.schema.json from YAML equivalent
+        run: resources/helm/tools/generate-json-schema.py
+
+      - working-directory: resources/helm
+        env:
+          # DOCKER_BUILDKIT is required for building images with --mount flags,
+          # as used in dask-gateway/Dockerfile.
+          DOCKER_BUILDKIT: "1"
+        run: chartpress
+
+      - name: Install traefik
+        run: |
+          helm repo add traefik https://helm.traefik.io/traefik
+          helm install traefik traefik/traefik \
+              --namespace traefik \
+              --create-namespace \
+              --set ports.web.nodePort=30200
+
+      - name: install dask gateway crd
+        run: |
+          kubectl apply -f resources/helm/dask-gateway/crds/daskclusters.yaml
+
+      - name: helm install
+        run: |
+          helm install \
+              test-dask-gateway \
+              resources/helm/dask-gateway \
+              --values=resources/helm/testing/chart-install-values.yaml \
+              --set traefik.installTraefik=false \
+              --set gateway.backend.namespace=default \
+              --skip-crds \
+              --wait \
+              --timeout 1m0s
+
+      - name: pytest
+        run: |
+          TEST_DASK_GATEWAY_KUBE=true \
+          TEST_DASK_GATEWAY_KUBE_ADDRESS=http://localhost:30200/services/dask-gateway/ \
+          TEST_DASK_GATEWAY_KUBE_NAMESPACE=default \
+          pytest -v tests/kubernetes
+
+      # ref: https://github.com/jupyterhub/action-k8s-namespace-report
+      - name: Kubernetes namespace report
+        uses: jupyterhub/action-k8s-namespace-report@v1
+        if: always()
+        with:
+          important-workloads: >-
+            deploy/api-test-dask-gateway
+            deploy/controller-test-dask-gateway
+            deploy/traefik-test-dask-gateway
+
+
   # These tests starts a container with a specific backend (that can start
   # schedulers/workers somehow), and installing test dependencies and running
   # tests from within the container.

docs/source/install-kube.rst

@@ -390,6 +390,31 @@ dask-gateway client to authenticate with JupyterHub.
    )
 
 
+Opting out of traefik install
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If traefik is already installed in your cluster, you can opt out of installing it.
+This can be done by setting the ``traefik.installTraefik`` value to ``false`` in your
+``values.yaml`` file.
+
+.. code-block:: yaml
+
+   traefik:
+     installTraefik: false
+
+This will prevent the traefik service from being installed when you run the helm chart.
+When running helm you might want to not install the CRDs for traefik as well.
+This can be done by supplying the ``--skip-crds`` flag to the helm command.
+However this prevents the daskclusters crd from being installed.
+This needs to be installed manually.
+
+Replace 2024.1.0 with the version of dask-gateway you are using.
+
+.. code-block:: shell
+
+   kubectl apply \
+     -f https://raw.githubusercontent.com/dask/dask-gateway/2024.1.0/resources/helm/dask-gateway/crds/daskclusters.yaml
+
 .. _helm-chart-reference:
 
 Helm chart reference

resources/helm/dask-gateway/templates/traefik/dashboard.yaml

@@ -1,4 +1,5 @@
 {{- if .Values.traefik.dashboard -}}
+{{- if .Values.traefik.installTraefik -}}
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -15,3 +16,4 @@ spec:
     - name: api@internal
       kind: TraefikService
 {{- end }}
+{{- end }}

resources/helm/dask-gateway/templates/traefik/deployment.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.traefik.installTraefik -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -107,3 +108,4 @@ spec:
       imagePullSecrets:
         {{- . | toYaml | nindent 8 }}
       {{- end }}
+{{- end }}

resources/helm/dask-gateway/templates/traefik/rbac.yaml

@@ -1,4 +1,5 @@
 {{- if .Values.rbac.enabled -}}
+{{- if .Values.traefik.installTraefik -}}
 {{- if not .Values.rbac.traefik.serviceAccountName -}}
 kind: ServiceAccount
 apiVersion: v1
@@ -77,3 +78,4 @@ subjects:
   namespace: {{ .Release.Namespace }}
 {{- end }}
 {{- end }}
+{{- end }}

resources/helm/dask-gateway/templates/traefik/service.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.traefik.installTraefik -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -36,3 +37,4 @@ spec:
       targetPort: 9000
       port: 9000
     {{- end }}
+{{- end }}

resources/helm/dask-gateway/values.schema.yaml

@@ -478,6 +478,7 @@ properties:
       - loglevel
       - dashboard
       - service
+      - installTraefik
     description: |
       `traefik` nested config relates to the `traefik` Pod and Traefik running
       within it that is acting as a proxy for traffic towards the gateway or
@@ -493,6 +494,11 @@ properties:
           running in the `traefik` pod.
         properties: *image-properties
       imagePullSecrets: *imagePullSecrets-spec
+      installTraefik:
+        type: boolean
+        description: |
+          If traefik is already installed in the cluster, we do not need to
+          install traefik.
       annotations: *labels-and-annotations-spec
       resources: *resources-spec
       nodeSelector: *nodeSelector-spec

resources/helm/dask-gateway/values.yaml

@@ -234,6 +234,12 @@ controller:
 # that is acting as a proxy for traffic towards the gateway or user created
 # DaskCluster resources.
 traefik:
+  # If traefik is already installed in the cluster, we do not need to install traefik
+  # To not install CRDs use --skip-crds flag with helm install, the daskclusters crd then
+  # needs to be installed manually.
+  # `kubectl apply -f https://raw.githubusercontent.com/dask/dask-gateway/main/resources/helm/dask-gateway/crds/daskclusters.yaml`
+  installTraefik: true
+
   # Number of instances of the proxy to run
   replicas: 1