Skip to content

Commit 9aa192c

Browse files
tazarovtazarov
authored
Auth Support (#17)
* feat: Added integration workflow Refs: #1 * fix: Added kubectl wait to wait for deployment to complete Refs: #1 * fix: Some issue with service. Experimenting with listing service. Refs: #1 * fix: Fixed the service issue and added matrix testing of kube versions Refs: #1 * chore: Updated test matrix to match chart kubeVersion range >=1.24 <= 1.27 Refs: #1 * fix: Fixed chart issue with boolean flags - Added further variance to the test matrix by including allowReset and isPersistent flags (no specific tests are implemented but those are coming soon) Refs: #1 * fix: Added docker image hnswlib rebuild + sqlite3 for debugging - Added a small test to ensure chroma is up and running. - Docker image rebuilt. * docs: Added small clarification how to build/push the docker image. * chore: Added bug and feature request issue templates and docker image in ghcr Refs: #2 * feat: Backup and restore feature Refs: #6 * feat: Backup and restore feature - Adding sudo to the image for fsfreeze use Refs: #6 * feat: Backup and restore feature - Making chroma user sudoer Refs: #6 * feat: Adding tests for v0.4.5 * feat: Adding Chroma 0.4.5 support to chart * feat: Updating WFs * feat: Lowering chart requirements to k8s API 1.23.0 * feat: Adding multi-platform build * fix: Moved platforms out of the matrix and directly into platform parameter of build-push action * fix: Fixed a typo in build images workflow. * chore: Removing hnswlib reinstall to check multi-arch build * feat: Adding support for Chroma 0.4.6 * chore: Updating integration tests * feat: Updating chart version and default version to 0.4.6 * fix: chroma-hnswlib reinstall is needed as it does uniformly work across platforms. * chore: Chart version bump for hnsw lib fix * chore: Chart version bump for hnsw lib fix * feat: Support for k8s API 1.28 and Chroma 0.4.7 Refs: #14 * feat: Support for k8s API 1.28 and Chroma 0.4.7 - Bumping upper bound of chart support. - Removed isPeristent/allowReset from test matrix to reduce generated jobs. Refs: #14 * fix: Made the integration test install local copy of the chart instead of pullingit. * fix: Updating chart version to allow RC Refs: #14 * chore: Version bumps - Default Chroma version set to 0.4.7 - Chart version bump Refs: #14 * feat: Chroma auth support - Token and basic auth support - Bumping chart version - Added chroma 0.4.8 and 0.4.9 support - Minor tweaks to Dockerfile Refs: #13 * feat: Chroma auth support - Fixed image builds Refs: #13 * feat: Chroma auth support - bump wait time Refs: #13 * feat: Chroma auth support - Adding debug Refs: #13 * feat: Chroma auth support - Adding debug Refs: #13 * feat: Chroma auth support - Adding debug Refs: #13 * feat: Chroma auth support - Merging dev image build with int test Refs: #13 * feat: Chroma auth support - Fixed a typo in dev image build Refs: #13 * feat: Chroma auth support - Fixed wrong chart value in integration test. Refs: #13 * feat: Chroma auth support - Increasing wait time for pod Refs: #13 * feat: Chroma auth support - Chasing 0.4.7 bug Refs: #13 * feat: Chroma auth support - Chasing 0.4.7 bug Refs: #13 * feat: Chroma auth support - Chasing 0.4.7 bug Refs: #13 * feat: Chroma auth support - Conditional support of auth: basic (0.4.7), token (0.4.8) Refs: #13 * feat: Chroma auth support - Added full test matrix Refs: #13 * feat: Chroma auth support - Int testing is now trigger for changes in Chart, tests, Docker image Refs: #13
1 parent d1434cb commit 9aa192c

12 files changed

+242
-86
lines changed

‎.github/workflows/build-images-dev.yml

-60
This file was deleted.

‎.github/workflows/build-images.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ on:
77
env:
88
REGISTRY: ghcr.io
99
IMAGE_NAME: "ghcr.io/amikos-tech/chromadb-chart/chroma"
10-
LATEST_VERSION: "0.4.7"
10+
LATEST_VERSION: "0.4.9"
1111

1212
jobs:
1313
build-images:
1414
strategy:
1515
matrix:
16-
chroma-version: [ 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7 ]
16+
chroma-version: [ 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9 ]
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Checkout
@@ -42,7 +42,7 @@ jobs:
4242
context: .
4343
file: image/Dockerfile
4444
push: true
45-
platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
45+
platforms: linux/amd64,linux/arm64
4646
build-args: |
4747
CHROMA_VERSION=${{ matrix.chroma-version }}
4848
tags: "${{ env.IMAGE_NAME }}:${{ matrix.chroma-version }},${{ env.IMAGE_NAME }}:latest"
@@ -53,7 +53,7 @@ jobs:
5353
context: .
5454
file: image/Dockerfile
5555
push: true
56-
platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
56+
platforms: linux/amd64,linux/arm64
5757
build-args: |
5858
CHROMA_VERSION=${{ matrix.chroma-version }}
5959
tags: "${{ env.IMAGE_NAME }}:${{ matrix.chroma-version }}"

‎.github/workflows/integration-test.yml

+61-10
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,75 @@
1-
name: Integration test
1+
name: Dev Image Build and Integration test
22

33
on:
44
push:
55
branches:
6-
- main
76
- develop
7+
paths:
8+
- charts/**
9+
- image/**
10+
- tests/**
811
pull_request:
912
branches:
1013
- main
14+
env:
15+
REGISTRY: ghcr.io
16+
IMAGE_NAME: "ghcr.io/amikos-tech/chromadb-chart/chroma"
17+
LATEST_VERSION: "0.4.9"
1118
jobs:
12-
release:
19+
build-images:
20+
strategy:
21+
matrix:
22+
chroma-version: [ 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9 ]
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@v2
27+
with:
28+
fetch-depth: 0
29+
- name: Log in to the Container registry
30+
uses: docker/[email protected]
31+
with:
32+
registry: ${{ env.REGISTRY }}
33+
username: ${{ github.actor }}
34+
password: ${{ secrets.GITHUB_TOKEN }}
35+
- name: Docker meta
36+
id: meta
37+
uses: docker/metadata-action@v4
38+
with:
39+
images: ${{ env.IMAGE_NAME }}
40+
- name: Set up QEMU
41+
uses: docker/setup-qemu-action@v2
42+
- name: Set up Docker Buildx
43+
uses: docker/setup-buildx-action@v2
44+
- name: Build and push release Docker image
45+
uses: docker/[email protected]
46+
if: ${{ env.LATEST_VERSION == matrix.chroma-version }}
47+
with:
48+
context: .
49+
file: image/Dockerfile
50+
push: true
51+
platforms: linux/amd64,linux/arm64
52+
build-args: |
53+
CHROMA_VERSION=${{ matrix.chroma-version }}
54+
tags: "${{ env.IMAGE_NAME }}:${{ matrix.chroma-version }}-dev,${{ env.IMAGE_NAME }}:canary"
55+
- name: Build and push release Docker image
56+
uses: docker/[email protected]
57+
if: ${{ env.LATEST_VERSION != matrix.chroma-version }}
58+
with:
59+
context: .
60+
file: image/Dockerfile
61+
push: true
62+
platforms: linux/amd64,linux/arm64
63+
labels: ${{ steps.meta.outputs.labels }}
64+
build-args: |
65+
CHROMA_VERSION=${{ matrix.chroma-version }}
66+
tags: "${{ env.IMAGE_NAME }}:${{ matrix.chroma-version }}-dev"
67+
integration-test:
68+
needs: build-images
1369
strategy:
1470
matrix:
1571
kubernetes-version: [1.23.0, 1.24.0, 1.27.3, v1.28.0-rc.0 ]
16-
chroma-version: [ 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7 ]
72+
chroma-version: [ 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9 ]
1773
runs-on: ubuntu-latest
1874
steps:
1975
- name: Checkout
@@ -31,17 +87,12 @@ jobs:
3187
uses: medyagh/setup-minikube@latest
3288
with:
3389
kubernetes-version: ${{ matrix.kubernetes-version }}
34-
# - name: Add helm repo
35-
# run: |
36-
# set -e
37-
# helm repo add chromadb https://amikos-tech.github.io/chromadb-chart/
38-
# helm repo update
3990
- name: Install chromadb
4091
run: |
4192
set -e
4293
helm install chromadb ./charts/chromadb-chart --set chromadb.isPersistent=true \
4394
--set chromadb.allowReset=true \
44-
--set chromadb.chromaVersion=${{ matrix.chroma-version }}
95+
--set chromadb.apiVersion=${{ matrix.chroma-version }}-dev
4596
- name: Wait for deployment to be ready
4697
run: |
4798
set -e

‎.github/workflows/release.yml

+1
Original file line numberDiff line numberDiff line change
@@ -51,4 +51,5 @@ jobs:
5151
context: .
5252
file: image/Dockerfile
5353
push: true
54+
platforms: linux/amd64,linux/arm64
5455
tags: "${{ env.IMAGE_NAME }}:latest"

‎README.md

+61-3
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This chart deploys a ChromaDB Vector Store cluster on a Kubernetes cluster using
77
- [ ] Security - the ability to secure chroma API with TLS and OIDC <- PoC completed waiting to be merged in the main
88
repo
99
- [ ] Backup and restore - the ability to back up and restore the index data
10-
- [ ] Monitoring - the ability to monitor the cluster using Prometheus and Grafana
10+
- [ ] Observability - the ability to monitor the cluster using Prometheus and Grafana
1111

1212
## Prerequisites
1313

@@ -71,7 +71,9 @@ helm install chroma chroma/chromadb --set chromadb.allowReset="true"
7171
| `chromadb.serverHost` | string | `0.0.0.0` | The API server host. |
7272
| `chromadb.serverHttpPort` | int | `8000` | The API server port. |
7373
| `chromadb.dataVolumeSize` | string | `1Gi` | The data volume size. |
74-
| `chromadb.dataVolumeStorageClass` | striung | `standard` | The storage class |
74+
| `chromadb.dataVolumeStorageClass` | string | `standard` | The storage class |
75+
| `chromadb.auth.enabled` | boolean | `true` | A flag to enable/disable authentication in Chroma |
76+
| `chromadb.auth.type` | string | `token` | Type of auth. Currently "token" (apiVersion>=0.4.8) and "basic" (apiVersion>=0.4.7) are supported. |
7577

7678
## Verifying installation
7779

@@ -91,9 +93,65 @@ docker push <image:tag>
9193
For this example we'll set up a Kubernetes cluster using minikube.
9294

9395
```bash
94-
minikube start --addons=ingress
96+
minikube start --addons=ingress -p chroma #create a simple minikube cluster with ingress addon
97+
minikube profile chroma #select chroma profile in minikube as active for kubectl commands
9598
```
9699

100+
## Chroma Authentication
101+
102+
> Note: Token auth is enabled by default
103+
104+
By default, the chart will use a `chromadb-auth` secret in Chroma's namespace to authenticate requests. This secret is
105+
generated at install time.
106+
107+
Chroma authentication is supported for the following API versions:
108+
- basic >= 0.4.7
109+
- token >= 0.4.8
110+
111+
> Note: Using auth parameters with lower version will result in auth parameters being ignored.
112+
113+
### Token Auth
114+
115+
Token Auth works with two types of headers that can be configured via `chromadb.auth.token.tokenHeader`:
116+
- `AUTHORIZATION` (default) - the clients are expected to pass `Authorization: Brearer <token>` header
117+
- `X-CHROMA-TOKEN` - the clients are expected to pass `X-Chroma-Token: <token>` header
118+
119+
Get the token:
120+
121+
```bash
122+
CHROMA_TOKEN=$(kubectl --namespace default get secret chromadb-auth -o jsonpath="{.data.token}" | base64 --decode)
123+
CHROMA_HEADER_NAME=$(kubectl --namespace default get secret chromadb-auth -o jsonpath="{.data.header}" | base64 --decode)
124+
```
125+
126+
>Note: The above examples assume `default` namespace is used for Chroma deployment.
127+
128+
Test the token:
129+
130+
```bash
131+
curl -v http://localhost:8000/api/v1/collections -H "${CHROMA_HEADER_NAME}: ${CHROMA_TOKEN}"
132+
```
133+
134+
> Note: The above `curl` assumes a localhost forwarding is made to port 8000
135+
136+
### Basic Auth
137+
138+
Get auth credentials:
139+
140+
```bash
141+
CHROMA_BASIC_AUTH_USERNAME=$(kubectl --namespace default get secret chromadb-auth -o jsonpath="{.data.username}" | base64 --decode)
142+
CHROMA_BASIC_AUTH_PASSWORD=$(kubectl --namespace default get secret chromadb-auth -o jsonpath="{.data.password}" | base64 --decode)
143+
```
144+
145+
>Note: The above examples assume `default` namespace is used for Chroma deployment.
146+
147+
Test the token:
148+
149+
```bash
150+
curl -v http://localhost:8000/api/v1/collections -u "${CHROMA_BASIC_AUTH_USERNAME}:${CHROMA_BASIC_AUTH_PASSWORD}"
151+
```
152+
153+
> Note: The above `curl` assumes a localhost forwarding is made to port 8000
154+
97155
## References
98156

99157
- Helm install: https://helm.sh/docs/intro/install/

‎charts/chromadb-chart/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ keywords:
1717
- ai/ml
1818
type: application
1919

20-
version: 0.1.14
20+
version: 0.1.15
2121
# chromadb version
22-
appVersion: "0.4.7"
22+
appVersion: "0.4.9"

‎charts/chromadb-chart/templates/NOTES.txt

+8
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,11 @@
2020
echo "Visit http://127.0.0.1:8080 to use your application"
2121
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
2222
{{- end }}
23+
2. To get auth credentials run:
24+
25+
{{- if and .Values.chromadb.auth.enabled (eq .Values.chromadb.auth.type "token") }}
26+
kubectl --namespace {{ .Release.Namespace }} get secret chromadb-auth -o jsonpath="{.data.token}" | base64 --decode
27+
{{- end }}
28+
{{- if and .Values.chromadb.auth.enabled (eq .Values.chromadb.auth.type "basic") }}
29+
kubectl --namespace {{ .Release.Namespace }} get secret chromadb-auth -o json | jq -r '(.data.username | @base64d) + ":" + (.data.password | @base64d)'
30+
{{- end }}

‎charts/chromadb-chart/templates/config.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,33 @@ metadata:
66
data:
77
log_config.yaml: |-
88
{{- .Files.Get "config/log_config.yaml" | nindent 4 }}
9+
---
10+
{{- if and (semverCompare ">= 0.4.8" .Values.chromadb.apiVersion) .Values.chromadb.auth.enabled (eq .Values.chromadb.auth.type "token") }}
11+
apiVersion: v1
12+
kind: Secret
13+
metadata:
14+
name: chromadb-auth
15+
namespace: {{ .Release.Namespace }}
16+
type: Opaque
17+
data:
18+
token: {{ randAlphaNum 32 | b64enc | quote }}
19+
{{- if eq .Values.chromadb.auth.token.headerType "AUTHORIZATION" }}
20+
header: {{ "Authorization" | b64enc | quote}}
21+
{{- end }}
22+
{{- if eq .Values.chromadb.auth.token.headerType "X_CHROMA_TOKEN" }}
23+
header: {{ "X-Chroma-Token" | b64enc | quote}}
24+
{{- end }}
25+
{{- end }}
26+
---
27+
{{- if and (semverCompare ">= 0.4.7" .Values.chromadb.apiVersion) .Values.chromadb.auth.enabled (eq .Values.chromadb.auth.type "basic") }}
28+
apiVersion: v1
29+
kind: Secret
30+
metadata:
31+
name: chromadb-auth
32+
namespace: {{ .Release.Namespace }}
33+
type: Opaque
34+
data:
35+
username: {{ .Values.chromadb.auth.basic.username | b64enc | quote}}
36+
password: {{ randAlphaNum 16 | b64enc | quote }}
37+
{{- end }}
938
---

0 commit comments

Comments
 (0)