From e5776f95aab2cceb00a53d3ba5d8c497f83965ba Mon Sep 17 00:00:00 2001 From: juan131 Date: Mon, 18 Nov 2019 17:01:40 +0100 Subject: [PATCH] [bitnami/elasticsearch] Lint chart Signed-off-by: juan131 --- bitnami/etcd/Chart.yaml | 18 +- bitnami/etcd/README.md | 10 +- bitnami/etcd/templates/NOTES.txt | 2 +- bitnami/etcd/templates/_helpers.tpl | 42 +- bitnami/etcd/templates/cronjob.yaml | 124 ++--- bitnami/etcd/templates/scripts-configmap.yaml | 20 +- bitnami/etcd/templates/secrets.yaml | 10 +- bitnami/etcd/templates/servicemonitor.yaml | 30 +- bitnami/etcd/templates/snapshot-pvc.yaml | 8 +- bitnami/etcd/templates/statefulset.yaml | 496 ++++++++---------- bitnami/etcd/templates/svc-headless.yaml | 24 +- bitnami/etcd/templates/svc.yaml | 45 +- bitnami/etcd/values-production.yaml | 182 ++++--- bitnami/etcd/values.yaml | 173 +++--- 14 files changed, 598 insertions(+), 586 deletions(-) diff --git a/bitnami/etcd/Chart.yaml b/bitnami/etcd/Chart.yaml index 4895a88c9..8dd7b1236 100644 --- a/bitnami/etcd/Chart.yaml +++ b/bitnami/etcd/Chart.yaml @@ -1,19 +1,19 @@ apiVersion: v1 name: etcd -version: 4.4.2 +version: 4.4.3 appVersion: 3.4.3 description: etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines keywords: -- etcd -- cluster -- database -- cache -- key-value + - etcd + - cluster + - database + - cache + - key-value home: https://coreos.com/etcd/ sources: -- https://github.com/bitnami/bitnami-docker-etcd + - https://github.com/bitnami/bitnami-docker-etcd maintainers: -- name: Bitnami - email: containers@bitnami.com + - name: Bitnami + email: containers@bitnami.com engine: gotpl icon: https://bitnami.com/assets/stacks/etcd/img/etcd-stack-110x117.png diff --git a/bitnami/etcd/README.md b/bitnami/etcd/README.md index 81ecc652c..27677e79b 100644 --- a/bitnami/etcd/README.md +++ b/bitnami/etcd/README.md @@ -48,8 +48,8 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the etcd chart and their default values. -| Parameter | Description | Default | -|-------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------| +| Parameter | Description | Default | +| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | | `global.imageRegistry` | Global Docker image registry | `nil` | | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `global.storageClass` | Global storage class for dynamic provisioning | `nil` | @@ -89,12 +89,12 @@ The following tables lists the configurable parameters of the etcd chart and the | `securityContext.enabled` | Enable security context | `true` | | `securityContext.fsGroup` | Group ID for the container | `1001` | | `securityContext.runAsUser` | User ID for the container | `1001` | -| `service.dnsBase` | Kubernetes service cluster dns base name | `svc.cluster.local` | +| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.port` | etcd client port | `2379` | -| `service.nodePort` | Port to bind to for NodePort service type (client port) | `nil` | | `service.peerPort` | etcd peer port | `2380` | -| `service.peerNodePort` | Port to bind to for NodePort service type (peer port) | `nil` | +| `service.nodePorts.clientPort` | Kubernetes etcd client node port | `""` | +| `service.nodePorts.peerPort` | Kubernetes etcd peer node port | `""` | | `service.annotations` | Annotations for etcd service | `{}` | | `service.loadBalancerIP` | loadBalancerIP if etcd service type is `LoadBalancer` | `nil` | | `persistence.enabled` | Enable persistence using PVC | `true` | diff --git a/bitnami/etcd/templates/NOTES.txt b/bitnami/etcd/templates/NOTES.txt index 9000cbf06..7660ca4f4 100644 --- a/bitnami/etcd/templates/NOTES.txt +++ b/bitnami/etcd/templates/NOTES.txt @@ -19,7 +19,7 @@ etcd can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: - {{ template "etcd.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.service.dnsBase }} + {{ template "etcd.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} To set a key run the following command: diff --git a/bitnami/etcd/templates/_helpers.tpl b/bitnami/etcd/templates/_helpers.tpl index 7f0b2a318..7adc22530 100644 --- a/bitnami/etcd/templates/_helpers.tpl +++ b/bitnami/etcd/templates/_helpers.tpl @@ -30,6 +30,25 @@ Create chart name and version as used by the chart label. {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{/* +Common labels +*/}} +{{- define "etcd.labels" -}} +app.kubernetes.io/name: {{ include "etcd.name" . }} +helm.sh/chart: {{ include "etcd.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector +*/}} +{{- define "etcd.matchLabels" -}} +app.kubernetes.io/name: {{ include "etcd.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + + {{/* Return the proper etcd image name */}} @@ -174,7 +193,6 @@ Compile all warnings into a single message, and call fail. {{- $messages := append $messages (include "etcd.validateValues.startFromSnapshot.existingClaim" .) -}} {{- $messages := append $messages (include "etcd.validateValues.startFromSnapshot.snapshotFilename" .) -}} {{- $messages := append $messages (include "etcd.validateValues.disasterRecovery" .) -}} -{{- $messages := append $messages (include "etcd.validateValues.podAntiAffinity" .) -}} {{- $messages := without $messages "" -}} {{- $message := join "\n" $messages -}} @@ -210,15 +228,6 @@ etcd: disasterRecovery {{- end -}} {{- end -}} -{{/* Validate values of etcd - must provide a valid podAntiAffinity ("soft" or "hard") */}} -{{- define "etcd.validateValues.podAntiAffinity" -}} -{{- if and (ne .Values.podAntiAffinity "soft") (ne .Values.podAntiAffinity "hard") -}} -etcd: mode - Invalid podAntiAffinity selected. Valid values are "soft" and - "hard". Please set a valid mode (--set podAntiAffinity="xxxx") -{{- end -}} -{{- end -}} - {{/* Return the proper image name (for the init container volume-permissions image) */}} @@ -276,3 +285,16 @@ but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else {{- end -}} {{- end -}} {{- end -}} + +{{/* +Renders a value that contains template. +Usage: +{{ include "etcd.tplValue" ( dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "etcd.tplValue" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} diff --git a/bitnami/etcd/templates/cronjob.yaml b/bitnami/etcd/templates/cronjob.yaml index 43963625a..40db3afd4 100644 --- a/bitnami/etcd/templates/cronjob.yaml +++ b/bitnami/etcd/templates/cronjob.yaml @@ -2,12 +2,8 @@ apiVersion: batch/v1beta1 kind: CronJob metadata: - name: {{ template "etcd.fullname" . }}-snapshotter - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + name: {{ include "etcd.fullname" . }}-snapshotter + labels: {{- include "etcd.labels" . | nindent 4 }} spec: concurrencyPolicy: Forbid schedule: {{ .Values.disasterRecovery.cronjob.schedule | quote }} @@ -16,14 +12,10 @@ spec: spec: template: metadata: - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + labels: {{- include "etcd.labels" . | nindent 12 }} app.kubernetes.io/component: snapshotter {{- if .Values.disasterRecovery.cronjob.podAnnotations }} - annotations: {{ toYaml .Values.disasterRecovery.cronjob.podAnnotations | nindent 12 }} + annotations: {{- include "etcd.tplValue" ( dict "value" .Values.disasterRecovery.cronjob.podAnnotations "context" $) | nindent 12 }} {{- end }} spec: restartPolicy: OnFailure @@ -33,59 +25,59 @@ spec: runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} containers: - - name: etcd-snapshotter - image: "{{ template "etcd.image" . }}" - imagePullPolicy: "{{ .Values.image.pullPolicy }}" - command: - - /scripts/save-snapshot.sh - env: - - name: ETCDCTL_API - value: "3" - {{- if .Values.auth.client.secureTransport }} - - name: ETCD_CERT_FILE - value: "/opt/bitnami/etcd/certs/client/cert.pem" - - name: ETCD_KEY_FILE - value: "/opt/bitnami/etcd/certs/client/key.pem" - {{- if .Values.auth.client.enableAuthentication }} - - name: ETCD_CLIENT_CERT_AUTH - value: "true" - - name: ETCD_TRUSTED_CA_FILE - value: "/opt/bitnami/etcd/certs/client/ca.crt" - {{- end }} - {{- end }} - {{- if .Values.auth.rbac.enabled }} - - name: ETCD_ROOT_PASSWORD - valueFrom: - secretKeyRef: - name: {{ if .Values.auth.rbac.existingSecret }}{{ .Values.auth.rbac.existingSecret }}{{ else }}{{ template "etcd.fullname" . }}{{ end }} - key: etcd-root-password - {{- end }} - {{- if .Values.disasterRecovery.cronjob.resources }} - resources: {{ toYaml .Values.disasterRecovery.cronjob.resources | nindent 14 }} - {{- end }} - volumeMounts: - - name: scripts - mountPath: /scripts/save-snapshot.sh - subPath: save-snapshot.sh - - name: snapshot-volume - mountPath: /snapshots - {{- if .Values.auth.client.secureTransport }} - - name: certs - mountPath: /opt/bitnami/etcd/certs/client - readOnly: true - {{- end }} + - name: etcd-snapshotter + image: {{ include "etcd.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + command: + - /scripts/save-snapshot.sh + env: + - name: ETCDCTL_API + value: "3" + {{- if .Values.auth.client.secureTransport }} + - name: ETCD_CERT_FILE + value: "/opt/bitnami/etcd/certs/client/cert.pem" + - name: ETCD_KEY_FILE + value: "/opt/bitnami/etcd/certs/client/key.pem" + {{- if .Values.auth.client.enableAuthentication }} + - name: ETCD_CLIENT_CERT_AUTH + value: "true" + - name: ETCD_TRUSTED_CA_FILE + value: "/opt/bitnami/etcd/certs/client/ca.crt" + {{- end }} + {{- end }} + {{- if .Values.auth.rbac.enabled }} + - name: ETCD_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ if .Values.auth.rbac.existingSecret }}{{ .Values.auth.rbac.existingSecret }}{{ else }}{{ include "etcd.fullname" . }}{{ end }} + key: etcd-root-password + {{- end }} + {{- if .Values.disasterRecovery.cronjob.resources }} + resources: {{- toYaml .Values.disasterRecovery.cronjob.resources | nindent 16 }} + {{- end }} + volumeMounts: + - name: scripts + mountPath: /scripts/save-snapshot.sh + subPath: save-snapshot.sh + - name: snapshot-volume + mountPath: /snapshots + {{- if .Values.auth.client.secureTransport }} + - name: certs + mountPath: /opt/bitnami/etcd/certs/client + readOnly: true + {{- end }} volumes: - {{- if .Values.auth.client.secureTransport }} - - name: certs - secret: - secretName: {{ required "A secret containinig the client certificates is required" .Values.auth.client.existingSecret }} - defaultMode: 256 - {{- end }} - - name: scripts - configMap: - name: {{ template "etcd.fullname" . }}-scripts - defaultMode: 0755 - - name: snapshot-volume - persistentVolumeClaim: - claimName: {{ template "etcd.disasterRecovery.pvc.name" . }} + {{- if .Values.auth.client.secureTransport }} + - name: certs + secret: + secretName: {{ required "A secret containinig the client certificates is required" .Values.auth.client.existingSecret }} + defaultMode: 256 + {{- end }} + - name: scripts + configMap: + name: {{ include "etcd.fullname" . }}-scripts + defaultMode: 0755 + - name: snapshot-volume + persistentVolumeClaim: + claimName: {{ include "etcd.disasterRecovery.pvc.name" . }} {{- end }} diff --git a/bitnami/etcd/templates/scripts-configmap.yaml b/bitnami/etcd/templates/scripts-configmap.yaml index 4873c728f..9ef4b699e 100644 --- a/bitnami/etcd/templates/scripts-configmap.yaml +++ b/bitnami/etcd/templates/scripts-configmap.yaml @@ -6,19 +6,15 @@ {{- $etcdFullname := include "etcd.fullname" . }} {{- $releaseNamespace := .Release.Namespace }} {{- $etcdHeadlessServiceName := printf "%s-%s" $etcdFullname "headless" }} -{{- $dnsBase := .Values.service.dnsBase }} +{{- $clusterDomain := .Values.clusterDomain }} {{- $etcdPeerProtocol := include "etcd.peerProtocol" . }} {{- $etcdClientProtocol := include "etcd.clientProtocol" . }} {{- $initSnapshotFilename := .Values.startFromSnapshot.snapshotFilename }} apiVersion: v1 kind: ConfigMap metadata: - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} - name: {{ template "etcd.fullname" . }}-scripts + name: {{ include "etcd.fullname" . }}-scripts + labels: {{- include "etcd.labels" . | nindent 4 }} data: setup.sh: |- #!/bin/bash @@ -42,7 +38,7 @@ data: # Constants HOSTNAME="$(hostname -s)" AUTH_OPTIONS="{{ $etcdAuthOptions }}" - ETCDCTL_ENDPOINTS="{{range $i, $e := until $replicaCount }}{{ $etcdClientProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.{{ $dnsBase }}:{{ $clientPort }},{{ end }}" + ETCDCTL_ENDPOINTS="{{range $i, $e := until $replicaCount }}{{ $etcdClientProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $clientPort }},{{ end }}" # Remove the last comma "," introduced in the string export ETCDCTL_ENDPOINTS="$(sed 's/,/ /g' <<< $ETCDCTL_ENDPOINTS | awk '{$1=$1};1' | sed 's/ /,/g')" @@ -167,14 +163,14 @@ data: {{- end }} elif should_add_new_member; then echo "==> Adding new member to existing cluster..." 1>&3 2>&4 - etcdctl $AUTH_OPTIONS member add "$HOSTNAME" --peer-urls="{{ $etcdPeerProtocol }}://${HOSTNAME}.{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.{{ $dnsBase }}:{{ $peerPort }}" | grep "^ETCD_" > "$ETCD_DATA_DIR/new_member_envs" 1>&3 2>&4 + etcdctl $AUTH_OPTIONS member add "$HOSTNAME" --peer-urls="{{ $etcdPeerProtocol }}://${HOSTNAME}.{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:{{ $peerPort }}" | grep "^ETCD_" > "$ETCD_DATA_DIR/new_member_envs" 1>&3 2>&4 sed -ie 's/^/export /' "$ETCD_DATA_DIR/new_member_envs" echo "==> Loading env vars of existing cluster..." 1>&3 2>&4 source "$ETCD_DATA_DIR/new_member_envs" 1>&3 2>&4 store_member_id & 1>&3 2>&4 else echo "==> Updating member in existing cluster..." 1>&3 2>&4 - etcdctl $AUTH_OPTIONS member update "$(cat "$ETCD_DATA_DIR/member_id")" --peer-urls="{{ $etcdPeerProtocol }}://${HOSTNAME}.{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.{{ $dnsBase }}:{{ $peerPort }}" 1>&3 2>&4 + etcdctl $AUTH_OPTIONS member update "$(cat "$ETCD_DATA_DIR/member_id")" --peer-urls="{{ $etcdPeerProtocol }}://${HOSTNAME}.{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:{{ $peerPort }}" 1>&3 2>&4 fi fi @@ -205,7 +201,7 @@ data: # Constants HOSTNAME="$(hostname -s)" AUTH_OPTIONS="{{ $etcdAuthOptions }}" - ETCDCTL_ENDPOINTS="{{range $i, $e := until $replicaCount }}{{ $etcdClientProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.{{ $dnsBase }}:{{ $clientPort }},{{ end }}" + ETCDCTL_ENDPOINTS="{{range $i, $e := until $replicaCount }}{{ $etcdClientProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $clientPort }},{{ end }}" # Remove the last comma "," introduced in the string export ETCDCTL_ENDPOINTS="$(sed 's/,/ /g' <<< $ETCDCTL_ENDPOINTS | awk '{$1=$1};1' | sed 's/ /,/g')" @@ -257,7 +253,7 @@ data: # Constants AUTH_OPTIONS="{{ $etcdAuthOptions }}" - ETCDCTL_ENDPOINTS="{{range $i, $e := until $replicaCount }}{{ $etcdClientProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.{{ $dnsBase }}:{{ $clientPort }},{{ end }}" + ETCDCTL_ENDPOINTS="{{range $i, $e := until $replicaCount }}{{ $etcdClientProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $clientPort }},{{ end }}" # Remove the last comma "," introduced in the string export ETCDCTL_ENDPOINTS="$(sed 's/,/ /g' <<< $ETCDCTL_ENDPOINTS | awk '{$1=$1};1' | sed 's/ /,/g')" diff --git a/bitnami/etcd/templates/secrets.yaml b/bitnami/etcd/templates/secrets.yaml index 33f323d2d..d06f2ec48 100644 --- a/bitnami/etcd/templates/secrets.yaml +++ b/bitnami/etcd/templates/secrets.yaml @@ -2,17 +2,13 @@ apiVersion: v1 kind: Secret metadata: - name: {{ template "etcd.fullname" . }} - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + name: {{ include "etcd.fullname" . }} + labels: {{- include "etcd.labels" . | nindent 4 }} type: Opaque data: {{- if .Values.auth.rbac.rootPassword }} etcd-root-password: {{ .Values.auth.rbac.rootPassword | b64enc | quote }} - {{ else }} + {{- else }} etcd-root-password: {{ randAlphaNum 10 | b64enc | quote }} {{- end }} {{- end }} diff --git a/bitnami/etcd/templates/servicemonitor.yaml b/bitnami/etcd/templates/servicemonitor.yaml index 6f996165f..084c4f646 100644 --- a/bitnami/etcd/templates/servicemonitor.yaml +++ b/bitnami/etcd/templates/servicemonitor.yaml @@ -2,33 +2,27 @@ apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: - name: {{ template "etcd.fullname" . }} + name: {{ include "etcd.fullname" . }} {{- if .Values.metrics.serviceMonitor.namespace }} namespace: {{ .Values.metrics.serviceMonitor.namespace }} {{- end }} - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + labels: {{- include "etcd.labels" . | nindent 4 }} {{- range $key, $value := .Values.metrics.serviceMonitor.selector }} {{ $key }}: {{ $value | quote }} {{- end }} spec: selector: - matchLabels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} + matchLabels: {{- include "etcd.matchLabels" . | nindent 6 }} endpoints: - - port: client - path: "/metrics" - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} + - port: client + path: /metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} namespaceSelector: matchNames: - - {{ .Release.Namespace }} + - {{ .Release.Namespace }} {{- end }} diff --git a/bitnami/etcd/templates/snapshot-pvc.yaml b/bitnami/etcd/templates/snapshot-pvc.yaml index 635d8643b..8f03c4264 100644 --- a/bitnami/etcd/templates/snapshot-pvc.yaml +++ b/bitnami/etcd/templates/snapshot-pvc.yaml @@ -2,12 +2,8 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: - name: {{ template "etcd.fullname" . }}-snapshotter - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name | quote }} - app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + name: {{ include "etcd.fullname" . }}-snapshotter + labels: {{- include "etcd.labels" . | nindent 4 }} spec: accessModes: - ReadWriteMany diff --git a/bitnami/etcd/templates/statefulset.yaml b/bitnami/etcd/templates/statefulset.yaml index 348d766d7..22d77168e 100644 --- a/bitnami/etcd/templates/statefulset.yaml +++ b/bitnami/etcd/templates/statefulset.yaml @@ -1,18 +1,12 @@ apiVersion: apps/v1 kind: StatefulSet metadata: - name: {{ template "etcd.fullname" . }} - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + name: {{ include "etcd.fullname" . }} + labels: {{- include "etcd.labels" . | nindent 4 }} spec: selector: - matchLabels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - serviceName: {{ template "etcd.fullname" . }}-headless + matchLabels: {{- include "etcd.matchLabels" . | nindent 6 }} + serviceName: {{ include "etcd.fullname" . }}-headless podManagementPolicy: {{ .Values.statefulset.podManagementPolicy }} replicas: {{ .Values.statefulset.replicaCount }} updateStrategy: @@ -25,295 +19,258 @@ spec: {{- end }} template: metadata: - name: "{{ template "etcd.fullname" . }}" - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if or .Values.podAnnotations .Values.metrics.enabled }} + labels: {{- include "etcd.labels" . | nindent 8 }} + {{- if or .Values.podAnnotations .Values.metrics.enabled }} annotations: -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | indent 8 }} -{{- end }} -{{- if .Values.metrics.podAnnotations }} -{{ toYaml .Values.metrics.podAnnotations | indent 8 }} -{{- end }} -{{- end }} + {{- if .Values.podAnnotations }} + {{- include "etcd.tplValue" ( dict "value" .Values.podAnnotations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.metrics.podAnnotations }} + {{- include "etcd.tplValue" ( dict "value" .Values.metrics.podAnnotations "context" $) | nindent 8 }} + {{- end }} + {{- end }} spec: {{- include "etcd.imagePullSecrets" . | indent 6 }} + {{- if .Values.affinity }} + affinity: {{- include "etcd.tplValue" (dict "value" .Values.affinity "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{- include "etcd.tplValue" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{- include "etcd.tplValue" (dict "value" .Values.tolerations "context" $) | nindent 8 }} + {{- end }} {{- if .Values.securityContext.enabled }} securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} - affinity: - {{- with .Values.nodeAffinity }} - nodeAffinity: {{ tpl (toYaml .) $ | nindent 10 }} - {{- end }} - {{- with .Values.podAffinity }} - podAffinity: {{ tpl (toYaml .) $ | nindent 10 }} - {{- end }} - {{- if eq .Values.podAntiAffinity "hard" }} - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - topologyKey: "kubernetes.io/hostname" - labelSelector: - matchLabels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - {{- else if eq .Values.podAntiAffinity "soft" }} - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 1 - podAffinityTerm: - topologyKey: "kubernetes.io/hostname" - labelSelector: - matchLabels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: {{ tpl (toYaml .) $ | nindent 8 }} - {{- end }} {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} initContainers: - - name: volume-permissions - image: "{{ template "etcd.volumePermissions.image" . }}" - imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} - command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/etcd"] - securityContext: - runAsUser: 0 - resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} - volumeMounts: - - name: data - mountPath: "/bitnami/etcd" + - name: volume-permissions + image: {{ include "etcd.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} /bitnami/etcd + securityContext: + runAsUser: 0 + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: data + mountPath: /bitnami/etcd {{- end }} containers: - # Variables to populate static cluster - {{- $replicaCount := int .Values.statefulset.replicaCount }} - {{- $clientPort := int .Values.service.port }} - {{- $peerPort := int .Values.service.peerPort }} - {{- $etcdFullname := include "etcd.fullname" . }} - {{- $releaseNamespace := .Release.Namespace }} - {{- $etcdHeadlessServiceName := printf "%s-%s" $etcdFullname "headless" }} - {{- $dnsBase := .Values.service.dnsBase }} - {{- $etcdPeerProtocol := include "etcd.peerProtocol" . }} - {{- $etcdClientProtocol := include "etcd.clientProtocol" . }} - - name: etcd - image: "{{ template "etcd.image" . }}" - imagePullPolicy: "{{ .Values.image.pullPolicy }}" - command: - - /scripts/setup.sh - lifecycle: - preStop: + # Variables to populate static cluster + {{- $replicaCount := int .Values.statefulset.replicaCount }} + {{- $clientPort := int .Values.service.port }} + {{- $peerPort := int .Values.service.peerPort }} + {{- $etcdFullname := include "etcd.fullname" . }} + {{- $releaseNamespace := .Release.Namespace }} + {{- $etcdHeadlessServiceName := printf "%s-%s" $etcdFullname "headless" }} + {{- $clusterDomain := .Values.clusterDomain }} + {{- $etcdPeerProtocol := include "etcd.peerProtocol" . }} + {{- $etcdClientProtocol := include "etcd.clientProtocol" . }} + - name: etcd + image: {{ include "etcd.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + command: + - /scripts/setup.sh + lifecycle: + preStop: + exec: + command: + - /scripts/prestop-hook.sh + {{- if .Values.resources }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- end }} + {{- if .Values.envVarsConfigMap }} + envFrom: + - configMapRef: + name: {{ include "etcd.envVarsCM" . }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.image.debug | quote }} + - name: MY_POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: ETCDCTL_API + value: "3" + - name: ETCD_NAME + value: "$(MY_POD_NAME)" + - name: ETCD_DATA_DIR + value: {{ include "etcd.dataDir" . }} + - name: ETCD_ADVERTISE_CLIENT_URLS + value: "{{ $etcdClientProtocol }}://$(MY_POD_NAME).{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:{{ .Values.service.port }}" + - name: ETCD_LISTEN_CLIENT_URLS + value: "{{ $etcdClientProtocol }}://0.0.0.0:{{ .Values.service.port }}" + - name: ETCD_INITIAL_ADVERTISE_PEER_URLS + value: "{{ $etcdPeerProtocol }}://$(MY_POD_NAME).{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:{{ .Values.service.peerPort }}" + - name: ETCD_LISTEN_PEER_URLS + value: "{{ $etcdPeerProtocol }}://0.0.0.0:{{ .Values.service.peerPort }}" + {{- if .Values.maxProcs }} + - name: GOMAXPROCS + value: {{ .Values.maxProcs }} + {{- end }} + {{- if gt $replicaCount 1 }} + - name: ETCD_INITIAL_CLUSTER_TOKEN + value: "etcd-cluster-k8s" + - name: ETCD_INITIAL_CLUSTER_STATE + value: "new" + - name: ETCD_INITIAL_CLUSTER + value: {{range $i, $e := until $replicaCount }}{{ $etcdFullname }}-{{ $e }}={{ $etcdPeerProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $peerPort }},{{ end }} + {{- end }} + - name: ALLOW_NONE_AUTHENTICATION + value: {{ ternary "yes" "no" (or .Values.auth.rbac.enabled .Values.allowNoneAuthentication) | quote }} + {{- if .Values.auth.rbac.enabled }} + - name: ETCD_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ if .Values.auth.rbac.existingSecret }}{{ .Values.auth.rbac.existingSecret }}{{ else }}{{ include "etcd.fullname" . }}{{ end }} + key: etcd-root-password + {{- end }} + {{- if and .Values.auth.client.secureTransport .Values.auth.client.useAutoTLS }} + - name: ETCD_AUTO_TLS + value: "true" + {{- else if .Values.auth.client.secureTransport }} + - name: ETCD_CERT_FILE + value: "/opt/bitnami/etcd/certs/client/cert.pem" + - name: ETCD_KEY_FILE + value: "/opt/bitnami/etcd/certs/client/key.pem" + {{- if .Values.auth.client.enableAuthentication }} + - name: ETCD_CLIENT_CERT_AUTH + value: "true" + - name: ETCD_TRUSTED_CA_FILE + value: "/opt/bitnami/etcd/certs/client/ca.crt" + {{- end }} + {{- end }} + {{- if and .Values.auth.peer.secureTransport .Values.auth.peer.useAutoTLS }} + - name: ETCD_PEER_AUTO_TLS + value: "true" + {{- else if .Values.auth.peer.secureTransport }} + - name: ETCD_PEER_CERT_FILE + value: "/opt/bitnami/etcd/certs/peer/cert.pem" + - name: ETCD_PEER_KEY_FILE + value: "/opt/bitnami/etcd/certs/peer/key.pem" + {{- if .Values.auth.peer.enableAuthentication }} + - name: ETCD_PEER_CLIENT_CERT_AUTH + value: "true" + - name: ETCD_PEER_TRUSTED_CA_FILE + value: "/opt/bitnami/etcd/certs/peer/ca.crt" + {{- end }} + {{- end }} + ports: + - name: client + containerPort: 2379 + - name: peer + containerPort: 2380 + {{- if .Values.livenessProbe.enabled }} + livenessProbe: exec: command: - - /scripts/prestop-hook.sh - {{- if .Values.resources }} - resources: {{ toYaml .Values.resources | nindent 10 }} - {{- end }} - {{- if .Values.envVarsConfigMap }} - envFrom: - - configMapRef: - name: {{ template "etcd.envVarsCM" . }} - {{- end }} - env: - {{- if .Values.image.debug }} - - name: BASH_DEBUG - value: "1" - - name: NAMI_DEBUG - value: "1" - - name: NAMI_LOG_LEVEL - value: "trace8" - {{- end }} - - ## Basic configuration - - name: MY_POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: MY_POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: ETCDCTL_API - value: "3" - - name: ETCD_NAME - value: "$(MY_POD_NAME)" - - name: ETCD_DATA_DIR - value: {{ template "etcd.dataDir" . }} - - name: ETCD_ADVERTISE_CLIENT_URLS - value: "{{ $etcdClientProtocol }}://$(MY_POD_NAME).{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.{{ $dnsBase }}:{{ .Values.service.port }}" - - name: ETCD_LISTEN_CLIENT_URLS - value: "{{ $etcdClientProtocol }}://0.0.0.0:{{ .Values.service.port }}" - - name: ETCD_INITIAL_ADVERTISE_PEER_URLS - value: "{{ $etcdPeerProtocol }}://$(MY_POD_NAME).{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.{{ $dnsBase }}:{{ .Values.service.peerPort }}" - - name: ETCD_LISTEN_PEER_URLS - value: "{{ $etcdPeerProtocol }}://0.0.0.0:{{ .Values.service.peerPort }}" - {{- if .Values.maxProcs }} - - name: GOMAXPROCS - value: {{ .Values.maxProcs }} - {{- end }} - - ## Clustering configuration - {{- if gt $replicaCount 1 }} - - name: ETCD_INITIAL_CLUSTER_TOKEN - value: "etcd-cluster-k8s" - - name: ETCD_INITIAL_CLUSTER_STATE - value: "new" - - name: ETCD_INITIAL_CLUSTER - value: {{range $i, $e := until $replicaCount }}{{ $etcdFullname }}-{{ $e }}={{ $etcdPeerProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.{{ $dnsBase }}:{{ $peerPort }},{{ end }} - {{- end }} - - ## RBAC authentication - - name: ALLOW_NONE_AUTHENTICATION - value: {{ ternary "yes" "no" (or .Values.auth.rbac.enabled .Values.allowNoneAuthentication) | quote }} - {{- if .Values.auth.rbac.enabled }} - - name: ETCD_ROOT_PASSWORD - valueFrom: - secretKeyRef: - name: {{ if .Values.auth.rbac.existingSecret }}{{ .Values.auth.rbac.existingSecret }}{{ else }}{{ template "etcd.fullname" . }}{{ end }} - key: etcd-root-password - {{- end }} - - ## Client-to-server communication - {{- if and .Values.auth.client.secureTransport .Values.auth.client.useAutoTLS }} - - name: ETCD_AUTO_TLS - value: "true" - {{- else if .Values.auth.client.secureTransport }} - - name: ETCD_CERT_FILE - value: "/opt/bitnami/etcd/certs/client/cert.pem" - - name: ETCD_KEY_FILE - value: "/opt/bitnami/etcd/certs/client/key.pem" - {{- if .Values.auth.client.enableAuthentication }} - - name: ETCD_CLIENT_CERT_AUTH - value: "true" - - name: ETCD_TRUSTED_CA_FILE - value: "/opt/bitnami/etcd/certs/client/ca.crt" - {{- end }} - {{- end }} - - ## Peer-to-peer communication - {{- if and .Values.auth.peer.secureTransport .Values.auth.peer.useAutoTLS }} - - name: ETCD_PEER_AUTO_TLS - value: "true" - {{- else if .Values.auth.peer.secureTransport }} - - name: ETCD_PEER_CERT_FILE - value: "/opt/bitnami/etcd/certs/peer/cert.pem" - - name: ETCD_PEER_KEY_FILE - value: "/opt/bitnami/etcd/certs/peer/key.pem" - {{- if .Values.auth.peer.enableAuthentication }} - - name: ETCD_PEER_CLIENT_CERT_AUTH - value: "true" - - name: ETCD_PEER_TRUSTED_CA_FILE - value: "/opt/bitnami/etcd/certs/peer/ca.crt" - {{- end }} - {{- end }} - - ports: - - name: client - containerPort: 2379 - - name: peer - containerPort: 2380 - {{- if .Values.livenessProbe.enabled }} - livenessProbe: - exec: - command: - - /scripts/probes.sh - initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.livenessProbe.failureThreshold }} - {{- end }} - {{- if .Values.readinessProbe.enabled }} - readinessProbe: - exec: - command: - - /scripts/probes.sh - initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.readinessProbe.failureThreshold }} - {{- end }} - volumeMounts: + - /scripts/probes.sh + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + exec: + command: + - /scripts/probes.sh + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + {{- end }} + volumeMounts: + - name: scripts + mountPath: /scripts/setup.sh + subPath: setup.sh + - name: scripts + mountPath: /scripts/prestop-hook.sh + subPath: prestop-hook.sh + - name: scripts + mountPath: /scripts/probes.sh + subPath: probes.sh + - name: data + mountPath: /bitnami/etcd + {{- if .Values.startFromSnapshot.enabled }} + - name: init-snapshot-volume + mountPath: /init-snapshot + {{- end }} + {{- if .Values.disasterRecovery.enabled }} + - name: snapshot-volume + mountPath: /snapshots + {{- end }} + {{- if .Values.configFileConfigMap }} + - name: etcd-config + mountPath: /opt/bitnami/etcd/conf/ + {{- end }} + {{- if or .Values.auth.client.enableAuthentication (and .Values.auth.client.secureTransport (not .Values.auth.client.useAutoTLS )) }} + - name: etcd-client-certs + mountPath: /opt/bitnami/etcd/certs/client/ + readOnly: true + {{- end }} + {{- if or .Values.auth.peer.enableAuthentication (and .Values.auth.peer.secureTransport (not .Values.auth.peer.useAutoTLS )) }} + - name: etcd-peer-certs + mountPath: /opt/bitnami/etcd/certs/peer/ + readOnly: true + {{- end }} + volumes: - name: scripts - mountPath: /scripts/setup.sh - subPath: setup.sh - - name: scripts - mountPath: /scripts/prestop-hook.sh - subPath: prestop-hook.sh - - name: scripts - mountPath: /scripts/probes.sh - subPath: probes.sh - - name: data - mountPath: /bitnami/etcd + configMap: + name: {{ include "etcd.fullname" . }}-scripts + defaultMode: 0755 {{- if .Values.startFromSnapshot.enabled }} - name: init-snapshot-volume - mountPath: /init-snapshot + persistentVolumeClaim: + claimName: {{ .Values.startFromSnapshot.existingClaim }} {{- end }} {{- if .Values.disasterRecovery.enabled }} - name: snapshot-volume - mountPath: /snapshots + persistentVolumeClaim: + claimName: {{ include "etcd.disasterRecovery.pvc.name" . }} {{- end }} {{- if .Values.configFileConfigMap }} - name: etcd-config - mountPath: /opt/bitnami/etcd/conf/ + configMap: + name: {{ include "etcd.configFileCM" . }} {{- end }} - {{- if or .Values.auth.client.enableAuthentication (and .Values.auth.client.secureTransport (not .Values.auth.client.useAutoTLS ) ) }} + {{- if or .Values.auth.client.enableAuthentication (and .Values.auth.client.secureTransport (not .Values.auth.client.useAutoTLS )) }} - name: etcd-client-certs - mountPath: /opt/bitnami/etcd/certs/client/ - readOnly: true + secret: + secretName: {{ required "A secret containinig the client certificates is required" .Values.auth.client.existingSecret }} + defaultMode: 256 {{- end }} - {{- if or .Values.auth.peer.enableAuthentication (and .Values.auth.peer.secureTransport (not .Values.auth.peer.useAutoTLS ) ) }} + {{- if or .Values.auth.peer.enableAuthentication (and .Values.auth.peer.secureTransport (not .Values.auth.peer.useAutoTLS )) }} - name: etcd-peer-certs - mountPath: /opt/bitnami/etcd/certs/peer/ - readOnly: true + secret: + secretName: {{ required "A secret containinig the peer certificates is required" .Values.auth.peer.existingSecret }} + defaultMode: 256 {{- end }} - volumes: - - name: scripts - configMap: - name: {{ template "etcd.fullname" . }}-scripts - defaultMode: 0755 - {{- if .Values.startFromSnapshot.enabled }} - - name: init-snapshot-volume - persistentVolumeClaim: - claimName: {{ .Values.startFromSnapshot.existingClaim }} - {{- end }} - {{- if .Values.disasterRecovery.enabled }} - - name: snapshot-volume - persistentVolumeClaim: - claimName: {{ template "etcd.disasterRecovery.pvc.name" . }} - {{- end }} - {{- if .Values.configFileConfigMap }} - - name: etcd-config - configMap: - name: {{ template "etcd.configFileCM" . }} - {{- end }} - {{- if or .Values.auth.client.enableAuthentication (and .Values.auth.client.secureTransport (not .Values.auth.client.useAutoTLS ) ) }} - - name: etcd-client-certs - secret: - secretName: {{ required "A secret containinig the client certificates is required" .Values.auth.client.existingSecret }} - defaultMode: 256 - {{- end }} - {{- if or .Values.auth.peer.enableAuthentication (and .Values.auth.peer.secureTransport (not .Values.auth.peer.useAutoTLS ) ) }} - - name: etcd-peer-certs - secret: - secretName: {{ required "A secret containinig the peer certificates is required" .Values.auth.peer.existingSecret }} - defaultMode: 256 - {{- end }} -{{- if .Values.persistence.enabled }} +{{- if not .Values.persistence.enabled }} + - name: data + emptyDir: {} +{{- else }} volumeClaimTemplates: - metadata: name: data - annotations: - {{- range $key, $value := .Values.persistence.annotations }} - {{ $key }}: {{ $value }} + {{- if .Values.persistence.annotations }} + annotations: {{- include "etcd.tplValue" ( dict "value" .Values.persistence.annotations "context" $) | nindent 10 }} {{- end }} spec: accessModes: @@ -324,7 +281,4 @@ spec: requests: storage: {{ .Values.persistence.size | quote }} {{ include "etcd.storageClass" . }} -{{- else }} - - name: data - emptyDir: {} {{- end }} diff --git a/bitnami/etcd/templates/svc-headless.yaml b/bitnami/etcd/templates/svc-headless.yaml index 99e9445e9..d8a94be04 100644 --- a/bitnami/etcd/templates/svc-headless.yaml +++ b/bitnami/etcd/templates/svc-headless.yaml @@ -1,24 +1,18 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "etcd.fullname" . }}-headless + name: {{ include "etcd.fullname" . }}-headless + labels: {{- include "etcd.labels" . | nindent 4 }} annotations: service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} spec: type: ClusterIP clusterIP: None ports: - - name: client - port: {{ .Values.service.port }} - targetPort: client - - name: peer - port: {{ .Values.service.peerPort }} - targetPort: peer - selector: - app.kubernetes.io/name: {{ template "etcd.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} + - name: client + port: {{ .Values.service.port }} + targetPort: client + - name: peer + port: {{ .Values.service.peerPort }} + targetPort: peer + selector: {{- include "etcd.matchLabels" . | nindent 4 }} diff --git a/bitnami/etcd/templates/svc.yaml b/bitnami/etcd/templates/svc.yaml index f6abf62b8..4bbd52bb5 100644 --- a/bitnami/etcd/templates/svc.yaml +++ b/bitnami/etcd/templates/svc.yaml @@ -1,34 +1,31 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "etcd.fullname" . }} - labels: - app.kubernetes.io/name: {{ template "etcd.name" . }} - helm.sh/chart: {{ template "etcd.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + name: {{ include "etcd.fullname" . }} + labels: {{- include "etcd.labels" . | nindent 4 }} {{- if .Values.service.annotations }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} + annotations: {{- include "etcd.tplValue" ( dict "value" .Values.service.annotations "context" $) | nindent 4 }} {{- end }} spec: type: {{ .Values.service.type }} - {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerIP }} + {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }} loadBalancerIP: {{ .Values.service.loadBalancerIP }} {{- end }} ports: - - name: client - port: {{ .Values.service.port }} - targetPort: client - {{- if and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort)) }} - nodePort: {{ .Values.service.nodePort }} - {{- end }} - - name: peer - port: {{ .Values.service.peerPort }} - targetPort: peer - {{- if and (eq .Values.service.type "NodePort") (not (empty .Values.service.peerNodePort)) }} - nodePort: {{ .Values.service.peerNodePort }} - {{- end }} - selector: - app.kubernetes.io/name: {{ template "etcd.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} + - name: client + port: {{ .Values.service.port }} + targetPort: client + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.clientPort)) }} + nodePort: {{ .Values.service.nodePorts.clientPort }} + {{- else if eq .Values.service.type "ClusterIP" }} + nodePort: null + {{- end }} + - name: peer + port: {{ .Values.service.peerPort }} + targetPort: peer + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.peerPort)) }} + nodePort: {{ .Values.service.nodePorts.peerPort }} + {{- else if eq .Values.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "etcd.matchLabels" . | nindent 4 }} diff --git a/bitnami/etcd/values-production.yaml b/bitnami/etcd/values-production.yaml index fba3e675e..8134b4063 100644 --- a/bitnami/etcd/values-production.yaml +++ b/bitnami/etcd/values-production.yaml @@ -56,17 +56,27 @@ volumePermissions: ## # pullSecrets: # - myRegistryKeySecretName - resources: {} + ## Init container' resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: {} + # cpu: 100m + # memory: 128Mi + requests: {} + # cpu: 100m + # memory: 128Mi -## String to partially override etcd.fullname template (will maintain the release name) +## Statefulset parameters ## -# nameOverride: - -## String to fully override etcd.fullname template -## -# fullnameOverride: - statefulset: + ## Number od replicas + ## + replicaCount: 3 ## Update strategy, can be set to RollingUpdate or OnDelete by default. ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -79,9 +89,6 @@ statefulset: ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies ## podManagementPolicy: Parallel - ## Number od replicas - ## - replicaCount: 3 ## ConfigMap that includes the etcd.conf.yml file ## @@ -91,17 +98,15 @@ statefulset: ## # envVarsConfigMap: -## etcd docker image available customizations -## https://github.com/bitnami/bitnami-docker-etcd#configuration -## ## Allow to use etcd without configuring RBAC authentication +## allowNoneAuthentication: true ## Limits the number of operating system threads that can execute user-level ## Go code simultaneously by setting GOMAXPROCS environment variable ## ref: https://golang.org/pkg/runtime ## -# maxProcs +# maxProcs: ## Authentication parameteres ## https://github.com/bitnami/bitnami-docker-etcd#security @@ -109,31 +114,40 @@ allowNoneAuthentication: true auth: rbac: enabled: true - ## etcd root user password. The root user is always `root`. + ## etcd root user password. The root user is always `root` + ## # rootPassword: ## Name of the existing secret containing credentials for the root user. - # existingSecret: + ## + # existingSecret: name-of-existing-secret client: ## Switch to encrypt client communication using TLS certificates + ## secureTransport: true ## Switch to automatically create the TLS certificates + ## useAutoTLS: false ## Switch to enable host authentication using TLS certificates. Requires existing secret. + ## enableAuthentication: true ## Name of the existing secret containing cert files for client communication. - # existingSecret: + ## + # existingSecret: name-of-existing-secret peer: ## Switch to encrypt peer communication using TLS certificates + ## secureTransport: true ## Switch to automatically create the TLS certificates + ## useAutoTLS: true ## Switch to enable host authentication using TLS certificates. Requires existing secret. + ## enableAuthentication: false ## Name of the existing secret containing cert files for peer communication. - # existingSecret: - + ## + # existingSecret: name-of-existing-secret ## Kubernetes Security Context ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ @@ -143,104 +157,121 @@ securityContext: fsGroup: 1001 runAsUser: 1001 -## Kubernetes configuration -## For minikube, set this to NodePort, elsewhere use LoadBalancer +## Kubernetes Cluster Domain +## +clusterDomain: cluster.local + +## Service parameters ## service: - dnsBase: svc.cluster.local + ## K8s service type + ## type: ClusterIP + ## etcd client port + ## port: 2379 - ## Specify the nodePort value for the LoadBalancer and NodePort service types for the client port - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## etcd peer port ## - # nodePort: peerPort: 2380 - ## Specify the nodePort value for the LoadBalancer and NodePort service types for the peer port + ## Specify the nodePort(s) value(s) for the LoadBalancer and NodePort service types. ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport ## - # peerNodePort: + nodePorts: + clientPort: "" + peerPort: "" + ## Set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + # loadBalancerIP: ## Provide any additional annotations which may be required. This can be used to ## set the LoadBalancer service type to internal only. ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer ## annotations: {} - ## Use loadBalancerIP to request a specific static IP, - ## otherwise leave blank - ## - # loadBalancerIP: -## etcd data Persistent Volume Storage Class -## If defined, storageClassName: -## If set to "-", storageClassName: "", which disables dynamic provisioning -## If undefined (the default) or set to null, no storageClassName spec is -## set, choosing the default provisioner. (gp2 on AWS, standard on -## GKE, AWS & OpenStack) +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ ## persistence: + ## If true, use a Persistent Volume Claim, If false, use emptyDir + ## enabled: true + ## Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## # storageClass: "-" + ## Persistent Volume Claim annotations + ## + annotations: {} + ## Persistent Volume Access Mode + ## accessModes: - ReadWriteOnce + ## Persistent Volume size + ## size: 8Gi - annotations: {} -## Configure resource requests and limits +## Etcd containers' resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## Minimum memory for development is 4GB and 2 CPU cores +## Minimum memory for production is 8GB and 4 CPU cores +## ref: http://docs.datastax.com/en/archived/cassandra/2.0/cassandra/architecture/architecturePlanningHardware_c.html ## resources: -# limits: -# cpu: 200m -# memory: 1Gi -# requests: -# memory: 256Mi -# cpu: 250m + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: {} + # cpu: 500m + # memory: 1Gi + requests: {} + # cpu: 250m + # memory: 256Mi -## Configure extra options for liveness and readiness probes -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) +## Etcd containers' liveness and readiness probes +## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes +## livenessProbe: - enabled: false - initialDelaySeconds: 10 - periodSeconds: 10 + enabled: true + initialDelaySeconds: 60 + periodSeconds: 30 timeoutSeconds: 5 - failureThreshold: 2 successThreshold: 1 - + failureThreshold: 5 readinessProbe: - enabled: false - initialDelaySeconds: 5 + enabled: true + initialDelaySeconds: 60 periodSeconds: 10 timeoutSeconds: 5 - failureThreshold: 6 successThreshold: 1 + failureThreshold: 5 ## Pod annotations ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## podAnnotations: {} -## Node Affinity. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +## Affinity for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## -nodeAffinity: {} -## Pod Affinity. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -## -podAffinity: {} -## Pod AntiAffinity -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -## -podAntiAffinity: soft +affinity: {} -## Node labels for pod assignment. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector +## Node labels for pod assignment. Evaluated as a template. +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} -## Tolerations for pod assignment. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature -## -tolerations: {} -## Add the corresponding annotations so Prometheus can collect etcd metrics +## Tolerations for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] + +## Etcd Prometheus exporter configuration ## metrics: enabled: true @@ -270,6 +301,7 @@ metrics: ## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration ## # selector: + # prometheus: my-prometheus ## Start a new etcd cluster recovering the data from an existing snaptshot before ## initializing the members @@ -290,7 +322,7 @@ startFromSnapshot: ## the cluster from a previous snapshot. ## disasterRecovery: - enabled: true + enabled: false cronjob: ## Schedule in Cron format to save snapshots ## See https://en.wikipedia.org/wiki/Cron diff --git a/bitnami/etcd/values.yaml b/bitnami/etcd/values.yaml index 4841dbb75..d642c5514 100644 --- a/bitnami/etcd/values.yaml +++ b/bitnami/etcd/values.yaml @@ -56,9 +56,27 @@ volumePermissions: ## # pullSecrets: # - myRegistryKeySecretName - resources: {} + ## Init container' resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: {} + # cpu: 100m + # memory: 128Mi + requests: {} + # cpu: 100m + # memory: 128Mi +## Statefulset parameters +## statefulset: + ## Number od replicas + ## + replicaCount: 1 ## Update strategy, can be set to RollingUpdate or OnDelete by default. ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -71,9 +89,6 @@ statefulset: ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies ## podManagementPolicy: Parallel - ## Number od replicas - ## - replicaCount: 1 ## ConfigMap that includes the etcd.conf.yml file ## @@ -83,17 +98,15 @@ statefulset: ## # envVarsConfigMap: -## etcd docker image available customizations -## https://github.com/bitnami/bitnami-docker-etcd#configuration -## ## Allow to use etcd without configuring RBAC authentication +## allowNoneAuthentication: true ## Limits the number of operating system threads that can execute user-level ## Go code simultaneously by setting GOMAXPROCS environment variable ## ref: https://golang.org/pkg/runtime ## -# maxProcs +# maxProcs: ## Authentication parameteres ## https://github.com/bitnami/bitnami-docker-etcd#security @@ -101,31 +114,40 @@ allowNoneAuthentication: true auth: rbac: enabled: true - ## etcd root user password. The root user is always `root`. + ## etcd root user password. The root user is always `root` + ## # rootPassword: ## Name of the existing secret containing credentials for the root user. - # existingSecret: + ## + # existingSecret: name-of-existing-secret client: ## Switch to encrypt client communication using TLS certificates + ## secureTransport: false ## Switch to automatically create the TLS certificates + ## useAutoTLS: false ## Switch to enable host authentication using TLS certificates. Requires existing secret. + ## enableAuthentication: false ## Name of the existing secret containing cert files for client communication. - # existingSecret: + ## + # existingSecret: name-of-existing-secret peer: ## Switch to encrypt peer communication using TLS certificates + ## secureTransport: false ## Switch to automatically create the TLS certificates + ## useAutoTLS: false ## Switch to enable host authentication using TLS certificates. Requires existing secret. + ## enableAuthentication: false ## Name of the existing secret containing cert files for peer communication. - # existingSecret: - + ## + # existingSecret: name-of-existing-secret ## Kubernetes Security Context ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ @@ -135,104 +157,121 @@ securityContext: fsGroup: 1001 runAsUser: 1001 -## Kubernetes configuration -## For minikube, set this to NodePort, elsewhere use LoadBalancer +## Kubernetes Cluster Domain +## +clusterDomain: cluster.local + +## Service parameters ## service: - dnsBase: svc.cluster.local + ## K8s service type + ## type: ClusterIP + ## etcd client port + ## port: 2379 - ## Specify the nodePort value for the LoadBalancer and NodePort service types for the client port - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## etcd peer port ## - # nodePort: peerPort: 2380 - ## Specify the nodePort value for the LoadBalancer and NodePort service types for the peer port + ## Specify the nodePort(s) value(s) for the LoadBalancer and NodePort service types. ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport ## - # peerNodePort: + nodePorts: + clientPort: "" + peerPort: "" + ## Set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + # loadBalancerIP: ## Provide any additional annotations which may be required. This can be used to ## set the LoadBalancer service type to internal only. ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer ## annotations: {} - ## Use loadBalancerIP to request a specific static IP, - ## otherwise leave blank - ## - # loadBalancerIP: -## etcd data Persistent Volume Storage Class -## If defined, storageClassName: -## If set to "-", storageClassName: "", which disables dynamic provisioning -## If undefined (the default) or set to null, no storageClassName spec is -## set, choosing the default provisioner. (gp2 on AWS, standard on -## GKE, AWS & OpenStack) +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ ## persistence: + ## If true, use a Persistent Volume Claim, If false, use emptyDir + ## enabled: true + ## Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## # storageClass: "-" + ## Persistent Volume Claim annotations + ## + annotations: {} + ## Persistent Volume Access Mode + ## accessModes: - ReadWriteOnce + ## Persistent Volume size + ## size: 8Gi - annotations: {} -## Configure resource requests and limits +## Etcd containers' resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## Minimum memory for development is 4GB and 2 CPU cores +## Minimum memory for production is 8GB and 4 CPU cores +## ref: http://docs.datastax.com/en/archived/cassandra/2.0/cassandra/architecture/architecturePlanningHardware_c.html ## resources: -# limits: -# cpu: 200m -# memory: 1Gi -# requests: -# memory: 256Mi -# cpu: 250m + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: {} + # cpu: 500m + # memory: 1Gi + requests: {} + # cpu: 250m + # memory: 256Mi -## Configure extra options for liveness and readiness probes -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) +## Etcd containers' liveness and readiness probes +## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes +## livenessProbe: - enabled: false - initialDelaySeconds: 10 - periodSeconds: 10 + enabled: true + initialDelaySeconds: 60 + periodSeconds: 30 timeoutSeconds: 5 - failureThreshold: 2 successThreshold: 1 - + failureThreshold: 5 readinessProbe: - enabled: false - initialDelaySeconds: 15 + enabled: true + initialDelaySeconds: 60 periodSeconds: 10 timeoutSeconds: 5 - failureThreshold: 6 successThreshold: 1 + failureThreshold: 5 ## Pod annotations ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## podAnnotations: {} -## Node Affinity. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +## Affinity for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## -nodeAffinity: {} -## Pod Affinity. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -## -podAffinity: {} -## Pod AntiAffinity -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -## -podAntiAffinity: soft +affinity: {} -## Node labels for pod assignment. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector +## Node labels for pod assignment. Evaluated as a template. +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} -## Tolerations for pod assignment. The value is evaluated as a template. -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature -## -tolerations: {} -## Add the corresponding annotations so Prometheus can collect etcd metrics +## Tolerations for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] + +## Etcd Prometheus exporter configuration ## metrics: enabled: false