feat: Watchtower-deployed

api/v2/weightsandbiases_types.go

@@ -17,6 +17,8 @@ limitations under the License.
 package v2
 
 import (
+	"strings"
+
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -138,6 +140,94 @@ type WeightsAndBiasesSpec struct {
 	// Networking configures how the W&B application is exposed externally.
 	// +optional
 	Networking NetworkingSpec `json:"networking,omitempty"`
+
+	// Watchtower configures the in-cluster Watchtower admin UI.
+	// +optional
+	Watchtower WatchtowerSpec `json:"watchtower,omitempty"`
+}
+
+// WatchtowerSpec configures the operator-managed Watchtower deployment.
+//
+// Watchtower is served under spec.watchtower.basePath on the same hostname as
+// the W&B app so the browser's existing session cookie can be validated against
+// the app's /oidc/auth endpoint — the same piggyback the deprecated console used.
+// It is not published in the server manifest and versions independently of W&B,
+// so its image is configured here rather than resolved from the manifest.
+type WatchtowerSpec struct {
+	Install *bool `json:"install,omitempty"`
+	Image WatchtowerImageSpec `json:"image,omitempty"`
+	BasePath string `json:"basePath,omitempty"`
+	AuthService string `json:"authService,omitempty"`
+	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
+	ServiceAccount ManagedServiceAccountSpec `json:"serviceAccount,omitempty"`
+}
+
+// WatchtowerImageSpec identifies the Watchtower container image. Digest wins
+// over Tag when both are set.
+type WatchtowerImageSpec struct {
+	// +optional
+	Repository string `json:"repository,omitempty"`
+	// +optional
+	Tag string `json:"tag,omitempty"`
+	// +optional
+	Digest string `json:"digest,omitempty"`
+}
+
+const (
+	// DefaultWatchtowerImageRepository is the published Watchtower image.
+	DefaultWatchtowerImageRepository = "us-docker.pkg.dev/wandb-production/public/wandb/watchtower"
+	// DefaultWatchtowerImageTag pins the Watchtower version this operator ships
+	// against. Watchtower releases independently of W&B, so bumping it is an
+	// operator change.
+	DefaultWatchtowerImageTag = "0.11.0"
+	// DefaultWatchtowerBasePath is the URL prefix Watchtower is served under,
+	// mirroring how console was mounted at /console.
+	DefaultWatchtowerBasePath = "/watchtower"
+	// DefaultWatchtowerServiceAccountName is the ServiceAccount Watchtower runs as.
+	DefaultWatchtowerServiceAccountName = "wandb-watchtower"
+)
+
+// WatchtowerEnabled reports whether Watchtower should be deployed.
+func (w *WeightsAndBiases) WatchtowerEnabled() bool {
+	return w.Spec.Watchtower.Install != nil && *w.Spec.Watchtower.Install
+}
+
+// GetImage returns the fully qualified Watchtower image, retargeted to the
+// global image registry when one is configured for air-gapped installs.
+func (s WatchtowerSpec) GetImage(globalImageRegistry string) string {
+	repository := s.Repository()
+	if globalImageRegistry != "" {
+		repository = globalImageRegistry + "/" + repository
+	}
+	if s.Image.Digest != "" {
+		return repository + "@" + s.Image.Digest
+	}
+	tag := s.Image.Tag
+	if tag == "" {
+		tag = DefaultWatchtowerImageTag
+	}
+	return repository + ":" + tag
+}
+
+// Repository returns the configured image repository or the published default.
+func (s WatchtowerSpec) Repository() string {
+	if s.Image.Repository != "" {
+		return s.Image.Repository
+	}
+	return DefaultWatchtowerImageRepository
+}
+
+// ResolvedBasePath returns the URL prefix Watchtower is served under, without a
+// trailing slash so callers can concatenate paths onto it.
+func (s WatchtowerSpec) ResolvedBasePath() string {
+	basePath := s.BasePath
+	if basePath == "" {
+		basePath = DefaultWatchtowerBasePath
+	}
+	if !strings.HasPrefix(basePath, "/") {
+		basePath = "/" + basePath
+	}
+	return strings.TrimSuffix(basePath, "/")
 }
 
 // GlobalSpec holds settings shared across every managed component.
@@ -756,6 +846,19 @@ type WeightsAndBiasesStatus struct {
 	GatewayStatus *GatewayStatusSummary `json:"gatewayStatus,omitempty"`
 	// +optional
 	IngressStatus *IngressStatusSummary `json:"ingressStatus,omitempty"`
+
+	// WatchtowerStatus reports the Watchtower deployment. Nil when Watchtower is
+	// not installed. Watchtower is an optional admin UI, so it is kept out of
+	// status.wandb.applications and never gates the Ready condition.
+	// +optional
+	WatchtowerStatus *WatchtowerStatusSummary `json:"watchtowerStatus,omitempty"`
+}
+
+type WatchtowerStatusSummary struct {
+	Ready bool `json:"ready"`
+	URL string `json:"url,omitempty"`
+	Image string `json:"image,omitempty"`
+	AuthService string `json:"authService,omitempty"`
 }
 
 type GatewayStatusSummary struct {

config/crd/bases/apps.wandb.com_weightsandbiases.yaml

@@ -4405,6 +4405,68 @@ spec:
                 - hostname
                 - version
                 type: object
+              watchtower:
+                properties:
+                  authService:
+                    type: string
+                  basePath:
+                    type: string
+                  image:
+                    properties:
+                      digest:
+                        type: string
+                      repository:
+                        type: string
+                      tag:
+                        type: string
+                    type: object
+                  install:
+                    type: boolean
+                  resources:
+                    properties:
+                      claims:
+                        items:
+                          properties:
+                            name:
+                              type: string
+                            request:
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        type: object
+                    type: object
+                  serviceAccount:
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      create:
+                        type: boolean
+                      serviceAccountName:
+                        type: string
+                    type: object
+                type: object
             required:
             - retentionPolicy
             type: object
@@ -6356,6 +6418,19 @@ spec:
                 required:
                 - hostname
                 type: object
+              watchtowerStatus:
+                properties:
+                  authService:
+                    type: string
+                  image:
+                    type: string
+                  ready:
+                    type: boolean
+                  url:
+                    type: string
+                required:
+                - ready
+                type: object
             required:
             - observedGeneration
             - ready

internal/controller/reconciler/ingress.go

@@ -92,6 +92,10 @@ func reconcileConsolidatedIngress(ctx context.Context, c ctrlClient.Client, wand
 		})
 	}
 
+	if watchtowerPath := watchtowerIngressPath(wandb); watchtowerPath != nil {
+		paths = append(paths, *watchtowerPath)
+	}
+
 	if len(paths) == 0 {
 		return nil
 	}