deepdata: delivery stack (docker compose, helm, CI, build scripts)

scripts/k8s/collect-secrets.sh

@@ -0,0 +1,248 @@
+#!/bin/bash
+### Collect secrets for DeepData installation.
+###
+### Usage:
+###   scripts/k8s/collect-secrets.sh [--component deepdata|milvus] [--namespace <ns>]
+###
+### Modes (auto-detected):
+###   1. Sealed-secrets mode:  controller running + kubeseal available → encrypt → apply SealedSecret
+###   2. Plain mode:           no controller → Helm creates Secret with base64 (dev mode)
+###
+### Password priority:  .env file values > interactive prompt > auto-generated
+###
+### Output: writes shell script variables to stdout (eval by caller)
+
+# NOTE: NOT using 'set -e' because interactive prompts (read) can fail
+# when stdin is not a TTY. We validate critical values explicitly instead.
+
+COMPONENT="${1:-deepdata}"
+NAMESPACE="${NAMESPACE:-deepdata}"
+ENV_FILE="${ENV_FILE:-.env}"
+
+# Parse --component and --namespace from args if passed differently
+while [[ "$#" -gt 0 ]]; do
+    case $1 in
+        --component) COMPONENT="$2"; shift 2 ;;
+        --namespace|-n) NAMESPACE="$2"; shift 2 ;;
+        *) shift ;;
+    esac
+done
+
+TMP_DIR=$(mktemp -d)
+trap "rm -rf $TMP_DIR" EXIT
+
+# ========== Detect Mode ==========
+detect_sealed_secrets() {
+    kubectl get deployment -n "$NAMESPACE" sealed-secrets >/dev/null 2>&1 && return 0
+    kubectl get deployment -n kube-system sealed-secrets >/dev/null 2>&1 && return 0
+    kubectl get pod -n "$NAMESPACE" -l app.kubernetes.io/name=sealed-secrets --no-headers 2>/dev/null | grep -q Running && return 0
+    return 1
+}
+
+KUBESEAL="$(command -v kubeseal 2>/dev/null || echo "")"
+[ -z "$KUBESEAL" ] && KUBESEAL="$HOME/bin/kubeseal"
+[ ! -x "$KUBESEAL" ] && [ -x "./tools/bin/kubeseal" ] && KUBESEAL="./tools/bin/kubeseal"
+[ ! -x "$KUBESEAL" ] && [ -x "../tools/bin/kubeseal" ] && KUBESEAL="../tools/bin/kubeseal"
+
+# Auto-download kubeseal if controller exists but binary is missing
+if detect_sealed_secrets && [ ! -x "$KUBESEAL" ]; then
+    echo "[INFO] Sealed Secrets controller detected, but kubeseal not found. Downloading..." >&2
+    KUBESEAL_URL="https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.2/kubeseal-0.27.2-$(uname -s | tr '[:upper:]' '[:lower:]')-$(dpkg --print-architecture 2>/dev/null || uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')"
+    KUBESEAL_DIR="$HOME/bin"
+    mkdir -p "$KUBESEAL_DIR"
+    curl -sSL "$KUBESEAL_URL" -o "$KUBESEAL_DIR/kubeseal" && chmod +x "$KUBESEAL_DIR/kubeseal"
+    KUBESEAL="$KUBESEAL_DIR/kubeseal"
+    echo "[INFO] Installed kubeseal to $KUBESEAL" >&2
+fi
+
+if detect_sealed_secrets && [ -x "$KUBESEAL" ]; then
+    MODE="sealed"
+else
+    MODE="plain"
+fi
+
+echo "# DeepData secrets collection — component: $COMPONENT, mode: $MODE" >&2
+
+# ========== Helper ==========
+random_hex() {
+    openssl rand -hex 16 2>/dev/null || python3 -c "import secrets;print(secrets.token_hex(16))"
+}
+
+seal_secret() {
+    local name="$1" output="$2"
+    shift 2
+    local raw="${TMP_DIR}/${name}-raw.yaml"
+    {
+        echo "apiVersion: v1"
+        echo "kind: Secret"
+        echo "metadata:"
+        echo "  name: ${name}"
+        echo "  namespace: ${NAMESPACE}"
+        echo "type: Opaque"
+        echo "stringData:"
+        for pair in "$@"; do
+            key="${pair%%=*}"
+            value="${pair#*=}"
+            echo "  ${key}: \"${value}\""
+        done
+    } > "$raw"
+    "$KUBESEAL" --controller-name=sealed-secrets --namespace="${NAMESPACE}" -o yaml -f "$raw" > "$output"
+    echo "[INFO] Created SealedSecret: $output" >&2
+}
+
+# ========== Load .env (targeted: only reads known secret keys) ==========
+if [ -f "$ENV_FILE" ]; then
+    echo "[INFO] Loading secrets from ${ENV_FILE}..." >&2
+
+    # Read .env line by line, only extract vars matching our known keys.
+    # Ignores comments, blank lines, and unrelated vars like pgsql_host/shell vars.
+    while IFS='=' read -r key value; do
+        # Skip blank lines and comments
+        [ -z "$key" ] && continue
+        case "$key" in
+            \#*) continue ;;
+        esac
+        # Strip leading/trailing whitespace from key
+        key="$(echo "$key" | xargs)"
+
+        case "$key" in
+            DB_PASSWORD|CERT_PASS|DOMAIN|HOME_PAGE_URL|JWT_SECRET|\
+            LABEL_STUDIO_PASSWORD|LABEL_STUDIO_USER_TOKEN|POSTGRE_PASSWORD|\
+            MINIO_ACCESS_KEY|MINIO_SECRET_KEY)
+                val="$value"
+                case "$val" in
+                    \'*|\"*) val="${val:1}" ;;
+                esac
+                case "$val" in
+                    *\'|*\") val="${val:0:-1}" ;;
+                esac
+                printf -v "$key" '%s' "$val"
+                ;;
+        esac
+    done < "$ENV_FILE"
+
+    [ -n "$DB_PASSWORD" ] && echo "[INFO] Loaded DB_PASSWORD from $ENV_FILE" >&2
+    [ -n "$CERT_PASS" ]   && echo "[INFO] Loaded CERT_PASS from $ENV_FILE" >&2
+    [ -n "$JWT_SECRET" ]  && echo "[INFO] Loaded JWT_SECRET from $ENV_FILE" >&2
+else
+    echo "[WARN] No .env file found at $(pwd)/${ENV_FILE} — will prompt for secrets" >&2
+fi
+
+# ========== DeepData ==========
+if [ "$COMPONENT" = "deepdata" ]; then
+    # Collect
+    [ -z "$DB_PASSWORD" ] && read -rsp "Enter DB_PASSWORD: " DB_PASSWORD && echo "" >&2
+    [ -z "$JWT_SECRET" ]  && JWT_SECRET=$(openssl rand -hex 32 2>/dev/null || python3 -c "import secrets;print(secrets.token_hex(32))") && echo "[INFO] Auto-generated JWT_SECRET" >&2
+    [ -z "$DOMAIN" ]     && read -rp "Enter DOMAIN (enter to skip): " DOMAIN >&2
+    [ -z "$CERT_PASS" ]  && read -rsp "Enter CERT_PASS (enter to skip): " CERT_PASS && echo "" >&2
+    HOME_PAGE_URL="${HOME_PAGE_URL:-/data/management}"
+    [ -z "$LABEL_STUDIO_PASSWORD" ]   && read -rsp "Enter LABEL_STUDIO_PASSWORD (enter to skip): " LABEL_STUDIO_PASSWORD && echo "" >&2
+    [ -z "$LABEL_STUDIO_USER_TOKEN" ] && LABEL_STUDIO_USER_TOKEN=$(random_hex)$(random_hex) && echo "[INFO] Auto-generated LABEL_STUDIO_USER_TOKEN" >&2
+
+    # ===== MANDATORY CHECK: DB_PASSWORD must not be empty =====
+    if [ -z "$DB_PASSWORD" ]; then
+        echo "[FATAL] DB_PASSWORD is empty! Cannot install without a database password." >&2
+        echo "[FATAL] Set DB_PASSWORD in .env or ensure interactive prompts work." >&2
+        echo "SECRETS_CREATE=SKIP"
+        echo "HELM_VALUES_FILE="
+        exit 0
+    fi
+
+    if [ "$MODE" = "sealed" ]; then
+        # Clean up any old stale Secret (prevents Helm conflict)
+        if kubectl get secret deepdata-conf -n "$NAMESPACE" >/dev/null 2>&1; then
+            echo "[INFO] Removing old deepdata-conf Secret..." >&2
+            kubectl delete secret deepdata-conf -n "$NAMESPACE" --ignore-not-found >/dev/null 2>&1
+        fi
+        # Clean up old SealedSecret (apply is idempotent, but belt-and-suspenders)
+        kubectl delete sealedsecret deepdata-conf -n "$NAMESPACE" --ignore-not-found >/dev/null 2>&1 || true
+
+        # DeepData-conf
+        seal_secret "deepdata-conf" "${TMP_DIR}/deepdata-sealed.yaml" \
+            "DB_PASSWORD=${DB_PASSWORD}" \
+            "CERT_PASS=${CERT_PASS}" \
+            "DOMAIN=${DOMAIN}" \
+            "HOME_PAGE_URL=${HOME_PAGE_URL}" \
+            "JWT_SECRET=${JWT_SECRET}" \
+            "LABEL_STUDIO_PASSWORD=${LABEL_STUDIO_PASSWORD}" \
+            "LABEL_STUDIO_USER_TOKEN=${LABEL_STUDIO_USER_TOKEN}"
+        kubectl apply -f "${TMP_DIR}/deepdata-sealed.yaml" -n "$NAMESPACE" >/dev/null
+        # Add Helm ownership labels so 'helm install --force' accepts the Secret
+        kubectl wait --for=jsonpath='{.data.DB_PASSWORD}' --timeout=30s secret/deepdata-conf -n "$NAMESPACE" >/dev/null 2>&1 || true
+        kubectl annotate secret deepdata-conf -n "$NAMESPACE" \
+            meta.helm.sh/release-name=deepdata \
+            meta.helm.sh/release-namespace="${NAMESPACE}" \
+            --overwrite >/dev/null 2>&1
+        kubectl label secret deepdata-conf -n "$NAMESPACE" \
+            app.kubernetes.io/managed-by=Helm \
+            --overwrite >/dev/null 2>&1
+
+        # Label Studio
+        if [ -n "$LABEL_STUDIO_PASSWORD" ]; then
+            POSTGRE_PASSWORD="${POSTGRE_PASSWORD:-$DB_PASSWORD}"
+            seal_secret "label-studio-env" "${TMP_DIR}/label-studio-sealed.yaml" \
+                "POSTGRE_PASSWORD=${POSTGRE_PASSWORD}" \
+                "LABEL_STUDIO_PASSWORD=${LABEL_STUDIO_PASSWORD}" \
+                "LABEL_STUDIO_USER_TOKEN=${LABEL_STUDIO_USER_TOKEN}"
+            kubectl apply -f "${TMP_DIR}/label-studio-sealed.yaml" -n "$NAMESPACE" >/dev/null
+        fi
+
+        echo "SECRETS_CREATE=false"
+        echo "HELM_VALUES_FILE="
+    else
+        # Plain — delete any old SealedSecret and stale Secret first
+        kubectl delete sealedsecret deepdata-conf -n "$NAMESPACE" --ignore-not-found >/dev/null 2>&1 || true
+        if kubectl get secret deepdata-conf -n "$NAMESPACE" >/dev/null 2>&1; then
+            echo "[INFO] Removing old deepdata-conf Secret..." >&2
+            kubectl delete secret deepdata-conf -n "$NAMESPACE" --ignore-not-found >/dev/null 2>&1
+        fi
+
+        # Write extra values to /tmp (survives script exit for Helm to read)
+        values_file="/tmp/deepdata-secret-values-$$.yaml"
+        cat > "$values_file" <<VALUES_EOF
+public:
+  secrets:
+    data:
+      DB_PASSWORD: "${DB_PASSWORD}"
+      JWT_SECRET: "${JWT_SECRET}"
+      CERT_PASS: "${CERT_PASS}"
+      DOMAIN: "${DOMAIN}"
+      HOME_PAGE_URL: "${HOME_PAGE_URL}"
+      LABEL_STUDIO_PASSWORD: "${LABEL_STUDIO_PASSWORD}"
+      LABEL_STUDIO_USER_TOKEN: "${LABEL_STUDIO_USER_TOKEN}"
+VALUES_EOF
+
+        echo "[INFO] Wrote plain secret values to ${values_file}" >&2
+        echo "SECRETS_CREATE=true"
+        echo "HELM_VALUES_FILE=${values_file}"
+    fi
+
+# ========== Milvus ==========
+elif [ "$COMPONENT" = "milvus" ]; then
+    # Only needed if secret doesn't already exist
+    if kubectl get secret milvus-minio-secret -n "$NAMESPACE" >/dev/null 2>&1; then
+        echo "# milvus-minio-secret already exists — skipping" >&2
+        exit 0
+    fi
+
+    [ -z "$MINIO_ACCESS_KEY" ] && MINIO_ACCESS_KEY=$(random_hex) && echo "[INFO] Auto-generated MINIO_ACCESS_KEY" >&2
+    [ -z "$MINIO_SECRET_KEY" ] && MINIO_SECRET_KEY=$(random_hex)$(random_hex) && echo "[INFO] Auto-generated MINIO_SECRET_KEY" >&2
+
+    if [ "$MODE" = "sealed" ]; then
+        seal_secret "milvus-minio-secret" "${TMP_DIR}/milvus-sealed.yaml" \
+            "accesskey=${MINIO_ACCESS_KEY}" \
+            "secretkey=${MINIO_SECRET_KEY}"
+        kubectl apply -f "${TMP_DIR}/milvus-sealed.yaml" -n "$NAMESPACE" >/dev/null
+        kubectl wait --for=jsonpath='{.data.accesskey}' --timeout=30s secret/milvus-minio-secret -n "$NAMESPACE" >/dev/null 2>&1 || true
+        kubectl annotate secret milvus-minio-secret -n "$NAMESPACE" \
+            meta.helm.sh/release-name=milvus-minio \
+            meta.helm.sh/release-namespace="${NAMESPACE}" \
+            --overwrite >/dev/null 2>&1
+    else
+        kubectl create secret generic milvus-minio-secret \
+            --from-literal=accesskey="$MINIO_ACCESS_KEY" \
+            --from-literal=secretkey="$MINIO_SECRET_KEY" \
+            -n "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
+        echo "[INFO] Created milvus-minio-secret (plain)" >&2
+    fi
+fi

scripts/k8s/node-cleanup.sh

@@ -0,0 +1,167 @@
+#!/bin/bash
+#
+# DeepData Node Cleanup Script
+# Remove labels and taints from nodes that were configured for DeepData deployment
+#
+# Usage: ./node-cleanup.sh [--dry-run] [--nodes NODE1,NODE2]
+#
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Default values
+DRY_RUN=false
+NAMESPACE="deepdata"
+LABEL_KEY="node-role.kubernetes.io/deepdata"
+LABEL_VALUE="true"
+TAINT_EFFECT="NoSchedule"
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --namespace)
+            NAMESPACE="$2"
+            shift 2
+            ;;
+        --dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        --nodes)
+            PROVIDED_NODES="$2"
+            shift 2
+            ;;
+        --label-key)
+            LABEL_KEY="$2"
+            shift 2
+            ;;
+        *)
+            echo "Unknown option: $1"
+            exit 1
+            ;;
+    esac
+done
+
+echo -e "${BLUE}=====================================${NC}"
+echo -e "${BLUE}  DeepData Node Cleanup${NC}"
+echo -e "${BLUE}=====================================${NC}"
+echo ""
+
+# Check if kubectl is available
+if ! command -v kubectl &> /dev/null; then
+    echo -e "${RED}Error: kubectl is not installed${NC}"
+    exit 1
+fi
+
+# Check if connected to cluster
+if ! kubectl cluster-info &> /dev/null; then
+    echo -e "${RED}Error: Cannot connect to Kubernetes cluster${NC}"
+    exit 1
+fi
+
+# Determine nodes to clean up
+if [ "$PROVIDED_NODES" != "" ]; then
+    # Use provided nodes
+    IFS=',' read -ra SELECTED_NODES <<< "$PROVIDED_NODES"
+else
+    # Find nodes with the deepdata label directly from Kubernetes
+    echo -e "${YELLOW}Finding nodes with $LABEL_KEY=$LABEL_VALUE label...${NC}"
+    NODES=$(kubectl get nodes -l "$LABEL_KEY=$LABEL_VALUE" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
+
+    if [ -z "$NODES" ]; then
+        echo -e "${GREEN}No nodes found with $LABEL_KEY=$LABEL_VALUE label.${NC}"
+        echo -e "${YELLOW}Cleanup not needed - no nodes were labeled.${NC}"
+        exit 0
+    fi
+
+    SELECTED_NODES=()
+    while IFS= read -r NODE; do
+        if [ -n "$NODE" ]; then
+            SELECTED_NODES+=("$NODE")
+        fi
+    done <<< "$NODES"
+fi
+
+if [ ${#SELECTED_NODES[@]} -eq 0 ]; then
+    echo -e "${YELLOW}No nodes to clean up.${NC}"
+    exit 0
+fi
+
+echo -e "${GREEN}Nodes to clean up:${NC}"
+for NODE in "${SELECTED_NODES[@]}"; do
+    echo "  - $NODE"
+done
+
+echo ""
+echo -e "${BLUE}Summary:${NC}"
+echo "  Label to remove: $LABEL_KEY"
+
+# Check if any node has the taint
+HAS_TAINTS=false
+for NODE in "${SELECTED_NODES[@]}"; do
+    TAINT_COUNT=$(kubectl get node "$NODE" -o jsonpath='{range .spec.taints[*]}{.key}{"\n"}{end}' | grep -c "^${LABEL_KEY}$" || echo "0")
+    if [ "$TAINT_COUNT" -gt 0 ]; then
+        HAS_TAINTS=true
+        break
+    fi
+done
+
+if [ "$HAS_TAINTS" = true ]; then
+    echo "  Taint to remove: $LABEL_KEY=$LABEL_VALUE:$TAINT_EFFECT"
+fi
+echo ""
+
+read -p "Remove labels and taints? (y/n) [y]: " CONFIRM
+CONFIRM=${CONFIRM:-y}
+
+if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then
+    echo -e "${YELLOW}Cancelled.${NC}"
+    exit 0
+fi
+
+echo ""
+echo -e "${GREEN}Removing configuration...${NC}"
+
+# Remove labels from selected nodes
+for NODE in "${SELECTED_NODES[@]}"; do
+    if [ "$DRY_RUN" = true ]; then
+        echo "[DRY-RUN] kubectl label node $NODE $LABEL_KEY-"
+    else
+        kubectl label node "$NODE" "$LABEL_KEY-" --overwrite
+        echo -e "  ${GREEN}✓${NC} Removed label from $NODE"
+    fi
+done
+
+# Remove taints (check if node has the taint)
+for NODE in "${SELECTED_NODES[@]}"; do
+    # Check if node has the taint
+    HAS_TAINT=$(kubectl get node "$NODE" -o jsonpath='{range .spec.taints[*]}{.key}{"\n"}{end}' | grep -c "^${LABEL_KEY}$" || echo "0")
+
+    if [ "$HAS_TAINT" -gt 0 ]; then
+        if [ "$DRY_RUN" = true ]; then
+            echo "[DRY-RUN] kubectl taint node $NODE $LABEL_KEY=$LABEL_VALUE:$TAINT_EFFECT-"
+        else
+            kubectl taint node "$NODE" "$LABEL_KEY=$LABEL_VALUE:$TAINT_EFFECT-" --overwrite || true
+            echo -e "  ${GREEN}✓${NC} Removed taint from $NODE"
+        fi
+    else
+        echo -e "  ${YELLOW}○${NC} No taint to remove from $NODE"
+    fi
+done
+
+echo ""
+echo -e "${GREEN}Cleanup complete!${NC}"
+
+# Clean up Helm args temp file if it exists
+if [ -f /tmp/deepdata-helm-args.sh ]; then
+    rm /tmp/deepdata-helm-args.sh
+    echo -e "${GREEN}Removed /tmp/deepdata-helm-args.sh${NC}"
+fi
+
+exit 0

scripts/k8s/node-setup.sh

@@ -0,0 +1,504 @@
+#!/bin/bash
+#
+# DeepData Node Setup Script
+# Interactive script to select nodes with keyboard navigation (↑/↓ or j/k)
+# Automatically applies labels and taints for DeepData deployment
+#
+# Usage: ./node-setup.sh [--dry-run] [--namespace NAMESPACE] [--skip-taint]
+#
+
+set -e
+
+# ============================================================================
+# Configuration
+# ============================================================================
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m' # No Color
+
+# Fixed label and taint values (no prompts needed)
+NAMESPACE="deepdata"
+LABEL_KEY="node-role.kubernetes.io/deepdata"
+LABEL_VALUE="true"
+TAINT_EFFECT="NoSchedule"
+DRY_RUN=false
+SKIP_TAINT=false
+
+# ============================================================================
+# Argument Parsing
+# ============================================================================
+
+parse_args() {
+    while [[ $# -gt 0 ]]; do
+        case $1 in
+            --dry-run)
+                DRY_RUN=true
+                shift
+                ;;
+            --namespace)
+                NAMESPACE="$2"
+                shift 2
+                ;;
+            --skip-taint)
+                SKIP_TAINT=true
+                shift
+                ;;
+            *)
+                echo "Unknown option: $1"
+                exit 1
+                ;;
+        esac
+    done
+}
+
+# ============================================================================
+# Prerequisite Checks
+# ============================================================================
+
+check_prerequisites() {
+    if ! command -v kubectl &> /dev/null; then
+        echo -e "${RED}Error: kubectl is not installed${NC}"
+        exit 1
+    fi
+
+    if ! kubectl cluster-info &> /dev/null; then
+        echo -e "${RED}Error: Cannot connect to Kubernetes cluster${NC}"
+        exit 1
+    fi
+}
+
+# ============================================================================
+# Node Data Collection
+# ============================================================================
+
+fetch_nodes() {
+    echo -e "${YELLOW}Fetching available nodes...${NC}"
+
+    NODES=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
+    NODE_COUNT=$(echo "$NODES" | wc -l | tr -d ' ')
+
+    if [ "$NODE_COUNT" -eq 0 ]; then
+        echo -e "${RED}Error: No nodes found in the cluster${NC}"
+        exit 1
+    fi
+
+    # Build node array with status info
+    NODE_ARRAY=()
+    NODE_STATUS=()
+    NODE_HAS_LABEL=()
+
+    for NODE in $NODES; do
+        NODE_ARRAY+=("$NODE")
+
+        # Get status
+        STATUS=$(kubectl get node "$NODE" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}')
+        NODE_STATUS+=("$STATUS")
+
+        # Check if already labeled
+        CURRENT_LABEL=$(kubectl get node "$NODE" -o jsonpath='{.metadata.labels.node-role\.kubernetes\.io/deepdata}')
+        if [ "$CURRENT_LABEL" = "true" ]; then
+            NODE_HAS_LABEL+=("true")
+        else
+            NODE_HAS_LABEL+=("false")
+        fi
+    done
+}
+
+# ============================================================================
+# Interactive Menu Functions
+# ============================================================================
+
+# Initialize selection state array
+init_selection() {
+    SELECTED=()
+    for i in $(seq 1 $NODE_COUNT); do
+        SELECTED+=("false")
+    done
+    CURRENT_INDEX=0
+}
+
+# Print the interactive menu
+print_menu() {
+    # Clear screen and print header
+    echo -e "\033[2J\033[H"
+    echo -e "${BLUE}=====================================${NC}"
+    echo -e "${BLUE}  DeepData Node Setup${NC}"
+    echo -e "${BLUE}=====================================${NC}"
+    echo ""
+    echo -e "${CYAN}Select nodes for DeepData deployment${NC}"
+    echo ""
+
+    # Print each node with selection marker
+    for i in $(seq 0 $(($NODE_COUNT - 1))); do
+        NODE="${NODE_ARRAY[$i]}"
+        STATUS="${NODE_STATUS[$i]}"
+        HAS_LABEL="${NODE_HAS_LABEL[$i]}"
+        IS_SELECTED="${SELECTED[$i]}"
+
+        # Status display
+        if [ "$STATUS" = "True" ]; then
+            STATUS_DISPLAY="${GREEN}Ready${NC}"
+        else
+            STATUS_DISPLAY="${RED}NotReady${NC}"
+        fi
+
+        # Label marker
+        LABEL_MARKER=""
+        if [ "$HAS_LABEL" = "true" ]; then
+            LABEL_MARKER=" ${GREEN}[deepdata]${NC}"
+        fi
+
+        # Selection marker
+        if [ "$IS_SELECTED" = "true" ]; then
+            MARKER="${GREEN}[x]${NC}"
+        else
+            MARKER="${NC}[ ]${NC}"
+        fi
+
+        # Highlight current row
+        if [ "$i" -eq "$CURRENT_INDEX" ]; then
+            echo -e "  ${YELLOW}→${NC} $MARKER ${CYAN}$NODE${NC} ($STATUS_DISPLAY)$LABEL_MARKER"
+        else
+            echo -e "    $MARKER $NODE ($STATUS_DISPLAY)$LABEL_MARKER"
+        fi
+    done
+
+    echo ""
+    echo -e "${YELLOW}Navigation:${NC} ↑/k: up  ↓/j: down  ${GREEN}space${NC}: toggle  ${GREEN}enter${NC}: confirm  ${RED}q${NC}: quit"
+    echo ""
+
+    # Show current selection count
+    SELECTED_COUNT=0
+    for s in "${SELECTED[@]}"; do
+        if [ "$s" = "true" ]; then
+            SELECTED_COUNT=$((SELECTED_COUNT + 1))
+        fi
+    done
+    echo -e "${BLUE}Selected: ${SELECTED_COUNT}/${NODE_COUNT} nodes${NC}"
+}
+
+# Toggle selection at current index
+toggle_selection() {
+    if [ "${SELECTED[$CURRENT_INDEX]}" = "true" ]; then
+        SELECTED[$CURRENT_INDEX]="false"
+    else
+        SELECTED[$CURRENT_INDEX]="true"
+    fi
+}
+
+# Move cursor up
+move_up() {
+    if [ "$CURRENT_INDEX" -gt 0 ]; then
+        CURRENT_INDEX=$((CURRENT_INDEX - 1))
+    fi
+}
+
+# Move cursor down
+move_down() {
+    if [ "$CURRENT_INDEX" -lt $(($NODE_COUNT - 1)) ]; then
+        CURRENT_INDEX=$((CURRENT_INDEX + 1))
+    fi
+}
+
+# Get selected nodes list
+get_selected_nodes() {
+    SELECTED_NODES=()
+    for i in $(seq 0 $(($NODE_COUNT - 1))); do
+        if [ "${SELECTED[$i]}" = "true" ]; then
+            SELECTED_NODES+=("${NODE_ARRAY[$i]}")
+        fi
+    done
+}
+
+# ============================================================================
+# Keyboard Input Handling
+# ============================================================================
+
+# Read single keypress (with fallback for non-terminal environments)
+read_key() {
+    # Check if we're in a proper terminal
+    if [ ! -t 0 ]; then
+        # Not in terminal - use simple read mode
+        read -r key
+        echo "$key"
+        return
+    fi
+
+    # Save current terminal settings
+    old_stty=$(stty -g 2>/dev/null) || return 1
+
+    # Set terminal to raw mode for single char read
+    stty raw -echo 2>/dev/null
+
+    # Read key
+    key=$(dd bs=1 count=1 2>/dev/null)
+
+    # Check for arrow keys (escape sequence)
+    if [ "$key" = $'\x1b' ]; then
+        # Read the next two chars for arrow key sequence
+        read -rs -t0.1 -n2 key2 2>/dev/null || true
+        key="${key}${key2}"
+    fi
+
+    # Restore terminal settings BEFORE processing
+    stty "$old_stty" 2>/dev/null || true
+
+    # In raw mode, Enter produces \r (carriage return), convert to \n for easier matching
+    if [ "$key" = $'\x0d' ]; then
+        key=$'\x0a'
+    fi
+
+    echo "$key"
+}
+
+# Main interactive loop
+interactive_selection() {
+    init_selection
+
+    while true; do
+        print_menu
+
+        key=$(read_key)
+
+        case "$key" in
+            # Arrow up or 'k'
+            $'\x1b[A'|k)
+                move_up
+                ;;
+            # Arrow down or 'j'
+            $'\x1b[B'|j)
+                move_down
+                ;;
+            # Space - toggle selection
+            ' ')
+                toggle_selection
+                ;;
+            # Enter - confirm
+            ''|$'\x0a')
+                get_selected_nodes
+                if [ ${#SELECTED_NODES[@]} -eq 0 ]; then
+                    echo -e "${YELLOW}No nodes selected. Please select at least one node.${NC}"
+                    sleep 1
+                else
+                    return 0
+                fi
+                ;;
+            # Q - quit/skip
+            q|Q)
+                echo -e "\n${YELLOW}Skipping node setup.${NC}"
+                echo ""
+                echo "HELM_NODE_SELECTOR_ARGS="
+                echo "HELM_TOLERATIONS_ARGS="
+                exit 0
+                ;;
+        esac
+    done
+}
+
+# ============================================================================
+# Apply Configuration
+# ============================================================================
+
+apply_labels_and_taints() {
+    echo ""
+    echo -e "${GREEN}Applying configuration...${NC}"
+    echo ""
+    echo -e "${BLUE}Configuration:${NC}"
+    echo "  Label: ${LABEL_KEY}=${LABEL_VALUE}"
+    if [ "$SKIP_TAINT" = false ]; then
+        echo "  Taint: ${LABEL_KEY}=${LABEL_VALUE}:${TAINT_EFFECT}"
+    fi
+    echo ""
+
+    # Apply labels
+    for NODE in "${SELECTED_NODES[@]}"; do
+        if [ "$DRY_RUN" = true ]; then
+            echo "[DRY-RUN] kubectl label node $NODE $LABEL_KEY=$LABEL_VALUE --overwrite"
+        else
+            kubectl label node "$NODE" "$LABEL_KEY=$LABEL_VALUE" --overwrite
+            echo -e "  ${GREEN}✓${NC} Applied label to $NODE"
+        fi
+    done
+
+    # Apply taints (unless skipped)
+    if [ "$SKIP_TAINT" = false ]; then
+        for NODE in "${SELECTED_NODES[@]}"; do
+            if [ "$DRY_RUN" = true ]; then
+                echo "[DRY-RUN] kubectl taint node $NODE $LABEL_KEY=$LABEL_VALUE:$TAINT_EFFECT --overwrite"
+            else
+                kubectl taint node "$NODE" "$LABEL_KEY=$LABEL_VALUE:$TAINT_EFFECT" --overwrite
+                echo -e "  ${GREEN}✓${NC} Applied taint to $NODE"
+            fi
+        done
+    fi
+
+    echo ""
+    echo -e "${GREEN}Configuration complete!${NC}"
+}
+
+# ============================================================================
+# Generate Helm Arguments
+# ============================================================================
+
+generate_helm_args() {
+    # Escape dots in label key for Helm (dots are interpreted as nested keys)
+    LABEL_KEY_ESCAPED=$(echo "$LABEL_KEY" | sed 's/\./\\./g')
+
+    # Use --set-string to force string type (avoids boolean interpretation)
+
+    # Node selector args
+    HELM_NODE_SELECTOR_ARGS="--set-string global.nodeSelector.${LABEL_KEY_ESCAPED}=${LABEL_VALUE}"
+
+    SERVICES="backend backend-python database frontend gateway runtime"
+    for SERVICE in $SERVICES; do
+        HELM_NODE_SELECTOR_ARGS="$HELM_NODE_SELECTOR_ARGS --set-string ${SERVICE}.nodeSelector.${LABEL_KEY_ESCAPED}=${LABEL_VALUE}"
+    done
+
+    # Tolerations args (if taint applied)
+    if [ "$SKIP_TAINT" = false ]; then
+        HELM_TOLERATIONS_ARGS="--set-string global.tolerations[0].key=${LABEL_KEY}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string global.tolerations[0].operator=Equal"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string global.tolerations[0].value=${LABEL_VALUE}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string global.tolerations[0].effect=${TAINT_EFFECT}"
+
+        # Milvus-specific tolerations (Milvus chart uses direct tolerations, not global.tolerations)
+        HELM_MILVUS_TOLERATIONS="--set-string tolerations[0].key=${LABEL_KEY}"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string tolerations[0].operator=Equal"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string tolerations[0].value=${LABEL_VALUE}"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string tolerations[0].effect=${TAINT_EFFECT}"
+
+        # Milvus sub-chart tolerations (etcd, minio don't inherit parent chart tolerations)
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string etcd.tolerations[0].key=${LABEL_KEY}"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string etcd.tolerations[0].operator=Equal"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string etcd.tolerations[0].value=${LABEL_VALUE}"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string etcd.tolerations[0].effect=${TAINT_EFFECT}"
+
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string minio.tolerations[0].key=${LABEL_KEY}"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string minio.tolerations[0].operator=Equal"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string minio.tolerations[0].value=${LABEL_VALUE}"
+        HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS --set-string minio.tolerations[0].effect=${TAINT_EFFECT}"
+
+        # Label-studio tolerations (app + pgbouncer)
+        HELM_LABEL_STUDIO_TOLERATIONS="--set-string tolerations[0].key=${LABEL_KEY}"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string tolerations[0].operator=Equal"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string tolerations[0].value=${LABEL_VALUE}"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string tolerations[0].effect=${TAINT_EFFECT}"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string nodeSelector.${LABEL_KEY_ESCAPED}=${LABEL_VALUE}"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string pgbouncer.tolerations[0].key=${LABEL_KEY}"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string pgbouncer.tolerations[0].operator=Equal"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string pgbouncer.tolerations[0].value=${LABEL_VALUE}"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string pgbouncer.tolerations[0].effect=${TAINT_EFFECT}"
+        HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS --set-string pgbouncer.nodeSelector.${LABEL_KEY_ESCAPED}=${LABEL_VALUE}"
+
+        for SERVICE in $SERVICES; do
+            HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ${SERVICE}.tolerations[0].key=${LABEL_KEY}"
+            HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ${SERVICE}.tolerations[0].operator=Equal"
+            HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ${SERVICE}.tolerations[0].value=${LABEL_VALUE}"
+            HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ${SERVICE}.tolerations[0].effect=${TAINT_EFFECT}"
+        done
+
+        # Ray cluster
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.head.tolerations[0].key=${LABEL_KEY}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.head.tolerations[0].operator=Equal"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.head.tolerations[0].value=${LABEL_VALUE}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.head.tolerations[0].effect=${TAINT_EFFECT}"
+
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.worker.tolerations[0].key=${LABEL_KEY}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.worker.tolerations[0].operator=Equal"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.worker.tolerations[0].value=${LABEL_VALUE}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.worker.tolerations[0].effect=${TAINT_EFFECT}"
+
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.npuGroup.tolerations[0].key=${LABEL_KEY}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.npuGroup.tolerations[0].operator=Equal"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.npuGroup.tolerations[0].value=${LABEL_VALUE}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.npuGroup.tolerations[0].effect=${TAINT_EFFECT}"
+
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.gpuGroup.tolerations[0].key=${LABEL_KEY}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.gpuGroup.tolerations[0].operator=Equal"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.gpuGroup.tolerations[0].value=${LABEL_VALUE}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string ray-cluster.additionalWorkerGroups.gpuGroup.tolerations[0].effect=${TAINT_EFFECT}"
+
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string kuberay-operator.tolerations[0].key=${LABEL_KEY}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string kuberay-operator.tolerations[0].operator=Equal"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string kuberay-operator.tolerations[0].value=${LABEL_VALUE}"
+        HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS --set-string kuberay-operator.tolerations[0].effect=${TAINT_EFFECT}"
+    else
+        HELM_TOLERATIONS_ARGS=""
+        HELM_MILVUS_TOLERATIONS=""
+        HELM_LABEL_STUDIO_TOLERATIONS=""
+    fi
+
+    # Write Helm args to temp file for Makefile to source
+    HELM_ARGS_FILE="/tmp/deepdata-helm-args.sh"
+    cat > "$HELM_ARGS_FILE" <<EOF
+export HELM_NODE_SELECTOR_ARGS="$HELM_NODE_SELECTOR_ARGS"
+export HELM_TOLERATIONS_ARGS="$HELM_TOLERATIONS_ARGS"
+export HELM_MILVUS_TOLERATIONS="$HELM_MILVUS_TOLERATIONS"
+export HELM_LABEL_STUDIO_TOLERATIONS="$HELM_LABEL_STUDIO_TOLERATIONS"
+EOF
+}
+
+# ============================================================================
+# Main Entry Point
+# ============================================================================
+
+main() {
+    parse_args "$@"
+
+    echo -e "${BLUE}=====================================${NC}"
+    echo -e "${BLUE}  DeepData Node Setup${NC}"
+    echo -e "${BLUE}=====================================${NC}"
+    echo ""
+
+    # Ask if user wants to configure nodes
+    echo "Configure dedicated nodes for DeepData deployment?"
+    echo "This will apply labels and taints to selected nodes."
+    echo ""
+    echo "1. Yes - Configure nodes interactively"
+    echo "2. No - Use default scheduling (recommended for development)"
+    echo ""
+    echo -n "Enter choice [default: 2]: "
+
+    if [ ! -t 0 ]; then
+        # Not in terminal - use simple read
+        read -r choice
+    else
+        # In terminal - can use keyboard navigation
+        choice=""
+        read -r choice
+    fi
+
+    # Default to "No" if empty or not "1"
+    if [ -z "$choice" ] || [ "$choice" != "1" ]; then
+        echo ""
+        echo -e "${YELLOW}Skipping node configuration. Using default scheduling.${NC}"
+        echo ""
+        # Create empty args file
+        HELM_ARGS_FILE="/tmp/deepdata-helm-args.sh"
+        cat > "$HELM_ARGS_FILE" <<EOF
+export HELM_NODE_SELECTOR_ARGS=""
+export HELM_TOLERATIONS_ARGS=""
+export HELM_MILVUS_TOLERATIONS=""
+export HELM_LABEL_STUDIO_TOLERATIONS=""
+EOF
+        exit 0
+    fi
+
+    echo ""
+
+    check_prerequisites
+    fetch_nodes
+    interactive_selection
+    apply_labels_and_taints
+    generate_helm_args
+
+    exit 0
+}
+
+# Run main function
+main "$@"