diff --git a/bitnami/etcd/Chart.yaml b/bitnami/etcd/Chart.yaml index fe97dd7cb..667f74a11 100644 --- a/bitnami/etcd/Chart.yaml +++ b/bitnami/etcd/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: etcd -version: 4.5.1 +version: 4.6.0 appVersion: 3.4.4 description: etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines keywords: diff --git a/bitnami/etcd/README.md b/bitnami/etcd/README.md index afb958b07..9676b2c85 100644 --- a/bitnami/etcd/README.md +++ b/bitnami/etcd/README.md @@ -48,95 +48,96 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the etcd chart and their default values. -| Parameter | Description | Default | -| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `global.storageClass` | Global storage class for dynamic provisioning | `nil` | -| `image.registry` | etcd image registry | `docker.io` | -| `image.repository` | etcd image name | `bitnami/etcd` | -| `image.tag` | etcd image tag | `{TAG_NAME}` | -| `image.pullPolicy` | etcd image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug values should be set | `false` | -| `nameOverride` | String to partially override etcd.fullname template with a string (will prepend the release name) | `nil` | -| `fullnameOverride` | String to fully override etcd.fullname template with a string | `nil` | -| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | -| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `buster` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | -| `volumePermissions.resources` | Init container resource requests/limit | `nil` | -| `statefulset.updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | -| `statefulset.rollingUpdatePartition` | Partition for Rolling Update strategy | `nil` | -| `statefulset.podManagementPolicy` | Pod management policy for the stateful set | `OrderedReady` | -| `statefulset.replicaCount` | Number of etcd nodes | `1` | -| `configFileConfigMap` | ConfigMap that contains a etcd.conf.yaml to be mounted | `nil` | -| `envVarsConfigMap` | ConfigMap that contains environment variables to be set in the container | `nil` | -| `allowNoneAuthentication` | Allow to use etcd without configuring RBAC authentication | `true` | -| `maxProcs` | Set GOMAXPROCS environment variable to limit the number of CPUs | `nil` | -| `auth.rbac.enabled` | Switch to enable the etcd authentication. | `true` | -| `auth.rbac.rootPassword` | Password for the root user | `nil` | -| `auth.rbac.existingSecret` | Name of the existing secret containing the root password | `nil` | -| `auth.client.secureTransport` | Switch to encrypt client communication using TLS certificates | `false` | -| `auth.client.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | -| `auth.client.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `secret` | -| `auth.client.existingSecret` | Name of the existing secret containing cert files for client communication. | `nil` | -| `auth.peer.secureTransport` | Switch to encrypt peer communication using TLS certificates | `false` | -| `auth.peer.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | -| `auth.peer.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `false` | -| `auth.peer.existingSecret` | Name of the existing secret containing cert files for peer communication. | `nil` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.port` | etcd client port | `2379` | -| `service.peerPort` | etcd peer port | `2380` | -| `service.nodePorts.clientPort` | Kubernetes etcd client node port | `""` | -| `service.nodePorts.peerPort` | Kubernetes etcd peer node port | `""` | -| `service.annotations` | Annotations for etcd service | `{}` | -| `service.loadBalancerIP` | loadBalancerIP if etcd service type is `LoadBalancer` | `nil` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for etcd volume | `nil` | -| `persistence.accessMode` | PVC Access Mode for etcd volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for etcd volume | `8Gi` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | -| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `10` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `2` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | -| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `15` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | -| `podAnnotations` | Annotations to be added to pods | `{}` | -| `affinity` | Map of node/pod affinities | `{}` (The value is evaluated as a template) | -| `nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | -| `tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | -| `metrics.enabled` | Enable Prometheus exporter to expose etcd metrics | `false` | -| `metrics.podAnnotations` | Annotations for enabling prometheus to access the metrics endpoint | {`prometheus.io/scrape: "true",prometheus.io/port: "2379"`} | -| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | -| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `nil` | -| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `nil` (Prometheus Operator default value) | -| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `nil` (Prometheus Operator default value) | -| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `nil` | -| `startFromSnapshot.enabled` | Initialize new cluster recovering an existing snapshot | `false` | -| `startFromSnapshot.existingClaim` | PVC containing the existing snapshot | `nil` | -| `startFromSnapshot.snapshotFilename` | Snapshot filename | `nil` | -| `disasterRecovery.enabled` | Enable auto disaster recovery by periodically snapshotting the keyspace | `false` | -| `disasterRecovery.debug` | Enable debug logging for snapshots | `false` | -| `disasterRecovery.cronjob.schedule` | Schedule in Cron format to save snapshots | `*/30 * * * *` | -| `disasterRecovery.cronjob.historyLimit` | Number of successful finished jobs to retain | `1` | -| `disasterRecovery.cronjob.podAnnotations` | Pod annotations for cronjob pods | `{}` | -| `disasterRecovery.pvc.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | -| `disasterRecovery.pvc.size` | PVC Storage Request | `2Gi` | -| `disasterRecovery.pvc.storageClassName` | Storage Class for snapshots volume | `nfs` | +| Parameter | Description | Default | +| ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `global.storageClass` | Global storage class for dynamic provisioning | `nil` | +| `image.registry` | etcd image registry | `docker.io` | +| `image.repository` | etcd image name | `bitnami/etcd` | +| `image.tag` | etcd image tag | `{TAG_NAME}` | +| `image.pullPolicy` | etcd image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override etcd.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override etcd.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `buster` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `statefulset.updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | +| `statefulset.rollingUpdatePartition` | Partition for Rolling Update strategy | `nil` | +| `statefulset.podManagementPolicy` | Pod management policy for the stateful set | `OrderedReady` | +| `statefulset.replicaCount` | Number of etcd nodes | `1` | +| `configFileConfigMap` | ConfigMap that contains a etcd.conf.yaml to be mounted | `nil` | +| `envVarsConfigMap` | ConfigMap that contains environment variables to be set in the container | `nil` | +| `allowNoneAuthentication` | Allow to use etcd without configuring RBAC authentication | `true` | +| `maxProcs` | Set GOMAXPROCS environment variable to limit the number of CPUs | `nil` | +| `auth.rbac.enabled` | Switch to enable the etcd authentication. | `true` | +| `auth.rbac.rootPassword` | Password for the root user | `nil` | +| `auth.rbac.existingSecret` | Name of the existing secret containing the root password | `nil` | +| `auth.client.secureTransport` | Switch to encrypt client communication using TLS certificates | `false` | +| `auth.client.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | +| `auth.client.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `secret` | +| `auth.client.existingSecret` | Name of the existing secret containing cert files for client communication. | `nil` | +| `auth.peer.secureTransport` | Switch to encrypt peer communication using TLS certificates | `false` | +| `auth.peer.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | +| `auth.peer.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `false` | +| `auth.peer.existingSecret` | Name of the existing secret containing cert files for peer communication. | `nil` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.port` | etcd client port | `2379` | +| `service.peerPort` | etcd peer port | `2380` | +| `service.nodePorts.clientPort` | Kubernetes etcd client node port | `""` | +| `service.nodePorts.peerPort` | Kubernetes etcd peer node port | `""` | +| `service.annotations` | Annotations for etcd service | `{}` | +| `service.loadBalancerIP` | loadBalancerIP if etcd service type is `LoadBalancer` | `nil` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for etcd volume | `nil` | +| `persistence.accessMode` | PVC Access Mode for etcd volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for etcd volume | `8Gi` | +| `persistence.annotations` | Annotations for the PVC | `{}` | +| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | +| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `10` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `2` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | +| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `15` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | +| `podAnnotations` | Annotations to be added to pods | `{}` | +| `affinity` | Map of node/pod affinities | `{}` (The value is evaluated as a template) | +| `nodeSelector` | Node labels for pod assignment | `{}` (The value is evaluated as a template) | +| `tolerations` | Tolerations for pod assignment | `[]` (The value is evaluated as a template) | +| `metrics.enabled` | Enable Prometheus exporter to expose etcd metrics | `false` | +| `metrics.podAnnotations` | Annotations for enabling prometheus to access the metrics endpoint | {`prometheus.io/scrape: "true",prometheus.io/port: "2379"`} | +| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | +| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `nil` | +| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `nil` (Prometheus Operator default value) | +| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `nil` (Prometheus Operator default value) | +| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `nil` | +| `startFromSnapshot.enabled` | Initialize new cluster recovering an existing snapshot | `false` | +| `startFromSnapshot.existingClaim` | PVC containing the existing snapshot | `nil` | +| `startFromSnapshot.snapshotFilename` | Snapshot filename | `nil` | +| `disasterRecovery.enabled` | Enable auto disaster recovery by periodically snapshotting the keyspace | `false` | +| `disasterRecovery.debug` | Enable debug logging for snapshots | `false` | +| `disasterRecovery.cronjob.schedule` | Schedule in Cron format to save snapshots | `*/30 * * * *` | +| `disasterRecovery.cronjob.historyLimit` | Number of successful finished jobs to retain | `1` | +| `disasterRecovery.cronjob.snapshotHistoryLimit` | Number of etcd snapshots to retain, tagged by date | `1` | +| `disasterRecovery.cronjob.podAnnotations` | Pod annotations for cronjob pods | `{}` | +| `disasterRecovery.pvc.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | +| `disasterRecovery.pvc.size` | PVC Storage Request | `2Gi` | +| `disasterRecovery.pvc.storageClassName` | Storage Class for snapshots volume | `nfs` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/bitnami/etcd/templates/scripts-configmap.yaml b/bitnami/etcd/templates/scripts-configmap.yaml index 102447929..48603a2f4 100644 --- a/bitnami/etcd/templates/scripts-configmap.yaml +++ b/bitnami/etcd/templates/scripts-configmap.yaml @@ -10,6 +10,7 @@ {{- $etcdPeerProtocol := include "etcd.peerProtocol" . }} {{- $etcdClientProtocol := include "etcd.clientProtocol" . }} {{- $initSnapshotFilename := .Values.startFromSnapshot.snapshotFilename }} +{{- $snapshotHistoryLimit := .Values.disasterRecovery.cronjob.snapshotHistoryLimit }} apiVersion: v1 kind: ConfigMap metadata: @@ -268,6 +269,11 @@ data: if etcdctl $AUTH_OPTIONS endpoint health; then echo "Snapshotting the keyspace..." 1>&3 2>&4 etcdctl $AUTH_OPTIONS snapshot save "/snapshots/db" 1>&3 2>&4 + ln /snapshots/db /snapshots/db-$(date -u "+%Y-%m-%d_%H-%M") 1>&3 2>&4 + find /snapshots/ -maxdepth 1 -type f -name 'db-*' \ + | sort -r \ + | tail -n+$((1 + {{ $snapshotHistoryLimit }})) \ + | xargs rm -f 1>&3 2>&4 exit 0 else echo "Warning - etcd endpoint ${ETCDCTL_ENDPOINTS} not healthy" 1>&3 2>&4 diff --git a/bitnami/etcd/values-production.yaml b/bitnami/etcd/values-production.yaml index bb840afef..79b1d7a4e 100644 --- a/bitnami/etcd/values-production.yaml +++ b/bitnami/etcd/values-production.yaml @@ -330,6 +330,9 @@ disasterRecovery: ## Number of successful finished jobs to retain ## historyLimit: 1 + ## Number of etcd snapshots to retain, tagged with date + ## + snapshotHistoryLimit: 1 ## Pod annotations ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## diff --git a/bitnami/etcd/values.yaml b/bitnami/etcd/values.yaml index 0b7a8b012..7445f690e 100644 --- a/bitnami/etcd/values.yaml +++ b/bitnami/etcd/values.yaml @@ -330,6 +330,9 @@ disasterRecovery: ## Number of successful finished jobs to retain ## historyLimit: 1 + ## Number of etcd snapshots to retain, tagged with date + ## + snapshotHistoryLimit: 1 ## Pod annotations ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ##