Cavern Helm Chart

Install

This README will focus on a basic install using a new values-local.yaml file.

A working Science Platform is not required, but the Persistent Volume Claims are needed. Those PVs and PVCs will provide the underlying storage for the Services and User Sessions.

From source

Installation depends on a working Kubernetes cluster version 1.23 or greater.

Traefik must be installed before platform services; see the deployment guide.

$ git clone https://github.com/opencadc/science-platform.git
$ cd science-platform/deployment/helm
$ helm install -n skaha-system --dependency-update --values my-values-local.yaml <name> ./cavern

Where <name> is the name of this installation. Example:

$ helm install -n skaha-system --dependency-update --values my-values-local.yaml cavern ./cavern

This will install Skaha service dependency, as well as the Skaha webservice and any necessary Ingress.

NAME: cavern
LAST DEPLOYED: <Timestamp e.g. Tue Nov 25 04:19:04 2025>
STATUS: deployed
REVISION: 1
TEST SUITE: None

Verification

After the install, there should exist the necessary Service. See the Namespaces:

$ kubectl -n skaha-system get services
NAME                   STATUS   AGE
...
skaha-system   cavern-tomcat-svc             ClusterIP      10.108.202.148   <none>        8080/TCP            1m

The IVOA VOSI availability endpoint can be used to check that the Skaha service has started properly. It may take a few moments to start up.

$ curl https://myhost.example.com/cavern/availability

<?xml version="1.0" encoding="UTF-8"?>
<vosi:availability xmlns:vosi="http://www.ivoa.net/xml/VOSIAvailability/v1.0">
  <vosi:available>true</vosi:available>
  <vosi:note>service is accepting requests.</vosi:note>
  <!--<clientip>192.1.1.4</clientip>-->
</vosi:availability>

Configuration

Parameter	Description	Default
kubernetesClusterDomain	Kubernetes cluster domain used to find internal hosts	cluster.local
replicaCount	Number of Cavern replicas to deploy	1
tolerations	Array of tolerations to pass to Kubernetes for fine-grained Node targeting of the Cavern API	[]
deployment.hostname	Hostname for the Cavern deployment	""
deployment.cavern.loggingGroups	List of groups permitted to adjust logging levels for the Cavern service.	[]
deployment.cavern.image	Cavern Docker image	images.opencadc.org/platform/cavern:<current release version>
deployment.cavern.imagePullPolicy	Image pull policy for the Cavern container	IfNotPresent
deployment.cavern.resourceID	Resource ID (URI) for this Cavern service	""
deployment.cavern.oidcURI	URI (or URL) for the OIDC service	""
deployment.cavern.gmsID	Resource ID (URI) for the IVOA Group Management Service	""
deployment.cavern.allocations	User allocation settings mapped to cavern.properties (default quota, parent folders, authorization)	see values.yaml
deployment.cavern.allocations.defaultSizeGB	Default allocation size in GiB when no Quota VOSpace property is set (org.opencadc.cavern.defaultQuotaGB)	10
deployment.cavern.allocations.parentFolders	Top-level folders for user allocations; each becomes org.opencadc.cavern.allocationParent. Must align with Skaha user-storage paths. At least one required.	["/home", "/projects"]
deployment.cavern.allocations.authorization.groupURIs	IVOA GMS group URIs allowed to self-allocate; each becomes org.opencadc.cavern.selfAllocateGroup	[]
deployment.cavern.allocations.authorization.permissionsAPI	SRCNet Permissions API (org.opencadc.cavern.papi.*). Leave {} to omit; when set, baseURL and authAPIBaseURL are required	{}
deployment.cavern.filesystem.dataDir	Persistent data directory in the Cavern container	""
deployment.cavern.filesystem.subPath	Relative path to the node/file content that could be mounted in other containers	""
deployment.cavern.filesystem.rootOwner.username	Username of the root owner of the filesystem data (parent of allocations) directory	""
deployment.cavern.filesystem.rootOwner.uid	UID of the root owner of the filesystem data (parent of allocations) directory	""
deployment.cavern.filesystem.rootOwner.gid	GID of the root owner of the filesystem data (parent of allocations) directory	""
deployment.cavern.filesystem.rootOwner.adminUsername	Admin username for the filesystem data (parent of allocations) directory	""
deployment.cavern.identityManagerClass	Class name for the identity manager used by Cavern	org.opencadc.auth.StandardIdentityManager
deployment.cavern.uws.db.install	Whether to deploy a local PostgreSQL database for UWS	true
deployment.cavern.uws.db.image	PostgreSQL image to use for UWS	postgres:15.12
deployment.cavern.uws.db.runUID	UID for the PostgreSQL user in the UWS database	999
deployment.cavern.uws.db.database	Name of the UWS database	uws
deployment.cavern.uws.db.url	JDBC URL for the UWS database. Use instead of database.	jdbc:postgresql://cavern-uws-db:5432/uws
deployment.cavern.uws.db.auth.existingSecret	Kubernetes Secret name (same namespace) with UWS DB username/password; not committed to Git	""
deployment.cavern.uws.db.auth.secretKeys	Keys in that Secret for username and password (defaults username, password)	see values.yaml
deployment.cavern.uws.db.schema	Schema name for the UWS database	uws
deployment.cavern.uws.db.maxActive	Maximum number of active connections to the UWS database	2
volumeInit	Init container image used to merge UWS credentials into catalina.properties	BusyBox (see values.yaml)
deployment.applicationName	Optional rename of the application from the default "cavern"	cavern
deployment.endpoint	Endpoint to serve the Cavern service from	/cavern
deployment.extraEnv	Extra environment variables to set in the Cavern container	[]
deployment.extraVolumeMounts	Extra volume mounts for the Cavern container	[]
deployment.extraVolumes	Extra volumes to mount in the Cavern container	[]
deployment.resources.requests.memory	Memory request for the Cavern container	1Gi
deployment.resources.requests.cpu	CPU request for the Cavern container	500m
deployment.resources.limits.memory	Memory limit for the Cavern container	1Gi
deployment.resources.limits.cpu	CPU limit for the Cavern container	500m
deployment.cavern.registryURL	(list OR string)	[] IVOA Registry array of IVOA Registry locations or single IVOA Registry location
livenessProbe	Configure the liveness probe check	{}
readinessProbe	Configure the readiness probe check	{}
tolerations	Tolerations to apply to the Cavern Pod	[]
secrets	Secrets to create for the Cavern service, such as CA certificates	{}
service.cavern.extraPorts	Extra ports to expose for the Cavern service	[]
storage.service.spec	Storage specification for the Cavern service	{}