Skip to main content

Standard Deployment Guide

📘 Overview​

This guide details how to deploy CSGHUB in a production environment using Helm Chart.

Production deployment has higher requirements for high availability, security, and maintainability compared to test environments. Please follow the steps strictly.

⚙️ Prerequisites​

✅ Environment Requirements​

ItemRequirement
Kubernetes Clusterv1.28+, properly configured network and storage
Helmv3.12.0+, with cluster administrator permissions
DomainRegistered domain with DNS resolution permissions
StorageConfigured StorageClass supporting dynamic volume provisioning

💡 Recommended: Use external databases and high-availability object storage in production (e.g., AWS RDS, MinIO HA, or Ceph).

💾 Resource Planning​

Plan resources according to expected usage scale:

Resource TypeSmall TeamMedium TeamLarge Team
Node Count35–1010+
Total CPU16 cores32 cores64+ cores
Total Memory32 GB64 GB128+ GB
Storage1 TB2–5 TB5+ TB

⚠️ Note: Ensure time synchronization between nodes (NTP recommended), and preconfigure sufficient Ingress bandwidth and LoadBalancer resources.

🧩 Deployment Steps​

1️⃣ Add Helm Repository​

# Add CSGHUB Helm repository
helm repo add csghub https://charts.opencsg.com/repository/csghub

# Update repository index
helm repo update

# Verify repository addition
helm search repo csghub

2️⃣ Install CSGHub​

helm upgrade --install csghub csghub/csghub \
  --namespace csghub \
  --create-namespace \
  --set global.ingress.domain="<your-domain>"  # e.g., example.com

After successful installation, you should see output like:

Release "csghub" has been upgraded. Happy Helming!
NAME: csghub
NAMESPACE: csghub
STATUS: deployed
APP VERSION: v1.12.0

✅ CSGHub has been successfully installed!

---

🔗 CSGHub & 🔐 Casdoor & 🕓 Temporal Admin Console

Access your CSGHub, Casdoor, or Temporal instance:

  🌐 CSGHub: http://csghub.example.com
  🔐 Casdoor Admin Console: http://casdoor.example.com
  🕓 Temporal Admin Console: http://csghub.example.com/-/temporal
  🔑 Credentials: root / NTRyMTNDY4MDFjVkMTEDJiMWUlc2MjQl

🔗 Access Services​

Default access endpoints and credentials:

ServiceURLDefault Credentials
🌐 CSGHUB Portalhttp://csghub.example.comAuto-generated
🔐 Casdoor Consolehttp://casdoor.example.comAuto-generated
🕓 Temporal Consolehttp://csghub.example.com/-/temporalAuto-generated

Retrieve admin username and password:

# Get Casdoor admin credentials
kubectl get secret -n csghub csghub-casdoor-init \
  -o jsonpath='{.data.INIT_ADMIN_USER}' | base64 -d && echo -n " / " && \
kubectl get secret -n csghub csghub-casdoor-init \
  -o jsonpath='{.data.INIT_ADMIN_PASSWORD}' | base64 -d

💾 MinIO Console​

Address: http://minio.example.com:30080/console/
Credentials:
  kubectl get secret -n csghub csghub-minio \
    -o jsonpath='{.data.MINIO_ROOT_USER}' | base64 -d && \
  echo -n " / " && \
  kubectl get secret -n csghub csghub-minio \
    -o jsonpath='{.data.MINIO_ROOT_PASSWORD}' | base64 -d

📦 Image Registry​

The default deployment includes a private image registry:

Endpoint: csghub.example.com:30080
Credentials:
  kubectl get secret -n csghub csghub-registry \
    -o jsonpath='{.data.REGISTRY_USERNAME}' | base64 -d && \
  echo -n " / " && \
  kubectl get secret -n csghub csghub-registry \
    -o jsonpath='{.data.REGISTRY_PASSWORD}' | base64 -d

Login example:

kubectl get secret -n csghub csghub-registry \
  -o jsonpath='{.data.REGISTRY_PASSWORD}' | base64 -d | \
docker login csghub.example.com \
  --username "$(kubectl get secret -n csghub csghub-registry \
  -o jsonpath='{.data.REGISTRY_USERNAME}' | base64 -d)" \
  --password-stdin

# Example: push/pull images
docker pull csghub.example.com/test:latest
docker push csghub.example.com/test:latest

⚠️ Tip: The default registry is basic. For production, consider integrating an enterprise-level registry service.

🔒 Enable HTTPS Access​

TLS encryption is recommended for security.

1️⃣ Create TLS Secret​

Prepare trusted TLS certificates (wildcard or multi-domain) and create a secret:

kubectl -n csghub create secret tls csghub-tls-certs \
  --cert=fullchain.pem \
  --key=privkey.pem

2️⃣ Enable TLS in Helm​

helm upgrade --install csghub csghub/csghub \
  --namespace csghub \
  --set global.ingress.domain="<your-domain>" \
  --set global.ingress.tls.enabled=true \
  --set global.ingress.tls.secretName="csghub-tls-certs"

💡 For single-domain certificates, specify separate secretName for each service:

--set portal.ingress.tls.secretName="portal-tls-certs" \
--set minio.ingress.tls.secretName="minio-tls-certs" \
--set casdoor.ingress.tls.secretName="casdoor-tls-certs"

⚡ Auto-Configured Components​

CSGHUB supports automatic installation and configuration of:

  • 🧭 Knative Serving
  • 🌀 Argo Workflow
  • ⚙️ LWS (Lightweight Scheduler)

By default autoConfigure is enabled:

--set runner.autoConfigure=true

Control namespace installation mode:

ParameterDescription
runner.mergingNamespace=disableStandard mode: create separate namespaces for each component (default)
runner.mergingNamespace=multiMerge some component namespaces reasonably
runner.mergingNamespace=singleInstall all components in a single namespace

📚 References​