From b5f03a2faf43a204e8437281be8ee0d7664d0c1a Mon Sep 17 00:00:00 2001 From: Junwei Zhao Date: Thu, 11 Mar 2021 17:13:12 +1100 Subject: [PATCH] Add longhorn --- apply.sh | 9 +- longhorn-values.yaml | 165 ++++++++++++++++++++++++++ superset-values.yaml | 267 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 440 insertions(+), 1 deletion(-) create mode 100644 longhorn-values.yaml create mode 100644 superset-values.yaml diff --git a/apply.sh b/apply.sh index e856bcd..0956ed9 100755 --- a/apply.sh +++ b/apply.sh @@ -1,5 +1,8 @@ #! /bin/bash -eu +# namespaces +kubectl create namespace longhorn + ## install nginx ingress controller grafana dashboards # https://github.com/kubernetes/ingress-nginx/tree/master/deploy/grafana/dashboards @@ -111,4 +114,8 @@ k apply -f nextcloud-pv.yaml -n media helm install datadog -f datadog-values.yaml --set datadog.site='datadoghq.com' --set datadog.apiKey=a78f4b0a6500fc28440a6c4274e6080e datadog/datadog # etcd and db backups - k apply -f backup-cronjobs.yaml -n default +k apply -f backup-cronjobs.yaml -n default + +# longhorn + +helm upgrade --install longhorn longhorn/longhorn -n longhorn -f longhorn-values.yaml diff --git a/longhorn-values.yaml b/longhorn-values.yaml new file mode 100644 index 0000000..6a7c068 --- /dev/null +++ b/longhorn-values.yaml @@ -0,0 +1,165 @@ +# Default values for longhorn. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. +global: + cattle: + systemDefaultRegistry: "" + +image: + longhorn: + engine: + repository: longhornio/longhorn-engine + tag: v1.1.0 + manager: + repository: longhornio/longhorn-manager + tag: v1.1.0 + ui: + repository: longhornio/longhorn-ui + tag: v1.1.0 + instanceManager: + repository: longhornio/longhorn-instance-manager + tag: v1_20201216 + shareManager: + repository: longhornio/longhorn-share-manager + tag: v1_20201204 + csi: + attacher: + repository: longhornio/csi-attacher + tag: v2.2.1-lh1 + provisioner: + repository: longhornio/csi-provisioner + tag: v1.6.0-lh1 + nodeDriverRegistrar: + repository: longhornio/csi-node-driver-registrar + tag: v1.2.0-lh1 + resizer: + repository: longhornio/csi-resizer + tag: v0.5.1-lh1 + snapshotter: + repository: longhornio/csi-snapshotter + tag: v2.1.1-lh1 + pullPolicy: IfNotPresent + +service: + ui: + type: ClusterIP + nodePort: null + manager: + type: ClusterIP + nodePort: "" + +persistence: + defaultClass: true + defaultClassReplicaCount: 3 + reclaimPolicy: Delete + recurringJobs: + enable: false + jobList: [] + +csi: + kubeletRootDir: ~ + attacherReplicaCount: ~ + provisionerReplicaCount: ~ + resizerReplicaCount: ~ + snapshotterReplicaCount: ~ + +defaultSettings: + backupTarget: ~ + backupTargetCredentialSecret: ~ + allowRecurringJobWhileVolumeDetached: ~ + createDefaultDiskLabeledNodes: ~ + defaultDataPath: ~ + defaultDataLocality: ~ + replicaSoftAntiAffinity: ~ + storageOverProvisioningPercentage: ~ + storageMinimalAvailablePercentage: ~ + upgradeChecker: ~ + defaultReplicaCount: ~ + guaranteedEngineCPU: ~ + defaultLonghornStaticStorageClass: ~ + backupstorePollInterval: ~ + taintToleration: ~ + priorityClass: ~ + autoSalvage: ~ + autoDeletePodWhenVolumeDetachedUnexpectedly: ~ + disableSchedulingOnCordonedNode: ~ + replicaZoneSoftAntiAffinity: ~ + volumeAttachmentRecoveryPolicy: ~ + nodeDownPodDeletionPolicy: ~ + allowNodeDrainWithLastHealthyReplica: ~ + mkfsExt4Parameters: ~ + disableReplicaRebuild: ~ + replicaReplenishmentWaitInterval: ~ + disableRevisionCounter: ~ + systemManagedPodsImagePullPolicy: ~ + allowVolumeCreationWithDegradedAvailability: ~ + autoCleanupSystemGeneratedSnapshot: ~ + +privateRegistry: + registryUrl: ~ + registryUser: ~ + registryPasswd: ~ + registrySecret: ~ + +resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi +ingress: + ## Set to true to enable ingress record generation + enabled: true + ## Ingress annotations done as key:value pairs + ## If you're using kube-lego, you will want to add: + ## kubernetes.io/tls-acme: true + ## + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md + ## + ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set + annotations: + kubernetes.io/ingress.class: "nginx" + kubernetes.io/tls-acme: "true" + cert-manager.io/cluster-issuer: "letsencrypt-prod" + nginx.ingress.kubernetes.io/auth-url: "https://id.home.toozhao.com/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://id.home.toozhao.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri" + path: / + # hosts: + # - chart-example.local + # tls: + # - hosts: + # - longhorn.home.toozhao.com + # secretName: superset-tls + # rules: + # - host: longhorn.home.toozhao.com + # http: + # paths: + # - backend: + # service: + # name: superset + # port: + # number: 8088 + # path: / + # pathType: Prefix + + host: longhorn.home.toozhao.com + + ## Set this to true in order to enable TLS on the ingress record + ## A side effect of this will be that the backend service will be connected at port 443 + tls: true + + ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS + tlsSecret: longhorn-tls + +# Configure a pod security policy in the Longhorn namespace to allow privileged pods +enablePSP: true + +## Specify override namespace, specifically this is useful for using longhorn as sub-chart +## and its release namespace is not the `longhorn-system` +namespaceOverride: "longhorn" diff --git a/superset-values.yaml b/superset-values.yaml new file mode 100644 index 0000000..e557ea3 --- /dev/null +++ b/superset-values.yaml @@ -0,0 +1,267 @@ +replicaCount: 1 + +## These requirements are used to build a requirements file which is then applied on init +## of superset containers +additionalRequirements: + - "psycopg2==2.8.5" + - "redis==3.2.1" + +## The name of the secret which we will use to generate a superset_config.py file +## Note: this secret must have the key superset_config.py in it and can include other files as well +## +configFromSecret: '{{ template "superset.fullname" . }}-config' + +## The name of the secret which we will use to populate env vars in deployed pods +## This can be useful for secret keys, etc. +## +envFromSecret: '{{ template "superset.fullname" . }}-env' + +## Extra environment variables that will be passed into pods +## +extraEnv: {} + +extraConfigs: {} + # datasources-init.yaml: | + # databases: + # - allow_csv_upload: true + # allow_ctas: true + # allow_cvas: true + # database_name: example-db + # extra: "{\r\n \"metadata_params\": {},\r\n \"engine_params\": {},\r\n \"\ + # metadata_cache_timeout\": {},\r\n \"schemas_allowed_for_csv_upload\": []\r\n\ + # }" + # sqlalchemy_uri: example://example-db.local + # tables: [] + +configMountPath: "/app/pythonpath" + +extraConfigMountPath: "/app/configs" + +image: + repository: apache/superset + tag: latest + pullPolicy: IfNotPresent + +service: + type: ClusterIP + port: 8088 + +ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: "nginx" + kubernetes.io/tls-acme: "true" + cert-manager.io/cluster-issuer: "letsencrypt-prod" + nginx.ingress.kubernetes.io/auth-url: "https://id.home.toozhao.com/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://id.home.toozhao.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri" + path: / + # hosts: + # - chart-example.local + tls: + - hosts: + - superset.home.toozhao.com + secretName: superset-tls + rules: + - host: superset.home.toozhao.com + http: + paths: + - backend: + service: + name: superset + port: + number: 8088 + path: / + pathType: Prefix + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +## +## Superset node configuration +supersetNode: + command: + - "/bin/sh" + - "-c" + - ". {{ .Values.configMountPath }}/superset_bootstrap.sh; /usr/bin/docker-entrypoint.sh" + connections: + redis_host: '{{ template "superset.fullname" . }}-redis-headless' + redis_port: "6379" + db_host: '{{ template "superset.fullname" . }}-postgresql' + db_port: "5432" + db_user: superset + db_pass: superset + db_name: superset + forceReload: false # If true, forces deployment to reload on each upgrade + initContainers: + - name: wait-for-postgres + image: busybox:latest + imagePullPolicy: IfNotPresent + envFrom: + - secretRef: + name: '{{ tpl .Values.envFromSecret . }}' + command: [ "/bin/sh", "-c", "until nc -zv $DB_HOST $DB_PORT -w1; do echo 'waiting for db'; sleep 1; done" ] + +## +## Superset worker configuration +supersetWorker: + command: + - "/bin/sh" + - "-c" + - ". {{ .Values.configMountPath }}/superset_bootstrap.sh; celery --app=superset.tasks.celery_app:app worker" + forceReload: false # If true, forces deployment to reload on each upgrade + initContainers: + - name: wait-for-postgres + image: busybox:latest + imagePullPolicy: IfNotPresent + envFrom: + - secretRef: + name: '{{ tpl .Values.envFromSecret . }}' + command: [ "/bin/sh", "-c", "until nc -zv $DB_HOST $DB_PORT -w1; do echo 'waiting for db'; sleep 1; done" ] + +## +## Init job configuration +init: + command: + - "/bin/sh" + - "-c" + - ". {{ .Values.configMountPath }}/superset_bootstrap.sh; . {{ .Values.configMountPath }}/superset_init.sh" + enabled: true + loadExamples: false + initContainers: + - name: wait-for-postgres + image: busybox:latest + imagePullPolicy: IfNotPresent + envFrom: + - secretRef: + name: '{{ tpl .Values.envFromSecret . }}' + command: [ "/bin/sh", "-c", "until nc -zv $DB_HOST $DB_PORT -w1; do echo 'waiting for db'; sleep 1; done" ] + initscript: |- + #!/bin/sh + echo "Upgrading DB schema..." + superset db upgrade + echo "Initializing roles..." + superset init + echo "Creating admin user..." + superset fab create-admin \ + --username admin \ + --firstname Superset \ + --lastname Admin \ + --email admin@superset.com \ + --password admin || true + {{ if .Values.init.loadExamples }} + echo "Loading examples..." + superset load_examples + {{- end }} +## +## Configuration values for the postgresql dependency. +## ref: https://github.com/kubernetes/charts/blob/master/stable/postgresql/README.md +postgresql: + ## + ## Use the PostgreSQL chart dependency. + ## Set to false if bringing your own PostgreSQL. + enabled: false + + ## + ## The name of an existing secret that contains the postgres password. + existingSecret: + + ## Name of the key containing the secret. + existingSecretKey: postgresql-password + + ## + ## If you are bringing your own PostgreSQL, you should set postgresHost and + ## also probably service.port, postgresqlUsername, postgresqlPassword, and postgresqlDatabase + ## postgresHost: + ## + ## PostgreSQL port + service: + port: 5432 + ## PostgreSQL User to create. + postgresqlUsername: superset + ## + ## PostgreSQL Password for the new user. + ## If not set, a random 10 characters password will be used. + postgresqlPassword: superset + ## + ## PostgreSQL Database to create. + postgresqlDatabase: superset + ## + ## Persistent Volume Storage configuration. + ## ref: https://kubernetes.io/docs/user-guide/persistent-volumes + persistence: + ## + ## Enable PostgreSQL persistence using Persistent Volume Claims. + enabled: true + ## + ## Persistant class + # storageClass: classname + ## + ## Access modes: + accessModes: + - ReadWriteOnce + +## Configuration values for the Redis dependency. +## ref: https://github.com/kubernetes/charts/blob/master/stable/redis/README.md +redis: + ## + ## Use the redis chart dependency. + ## Set to false if bringing your own redis. + enabled: true + + usePassword: false + + ## + ## The name of an existing secret that contains the redis password. + existingSecret: + + ## Name of the key containing the secret. + existingSecretKey: redis-password + + ## + ## If you are bringing your own redis, you can set the host in redisHost. + ## redisHost: + ## + ## Redis password + ## + password: superset + ## + ## Master configuration + master: + ## + ## Image configuration + # image: + ## + ## docker registry secret names (list) + # pullSecrets: nil + ## + ## Configure persistance + persistence: + ## + ## Use a PVC to persist data. + enabled: false + ## + ## Persistant class + # storageClass: classname + ## + ## Access mode: + accessModes: + - ReadWriteOnce + ## + ## Disable cluster management by default. + cluster: + enabled: false + +nodeSelector: {} + +tolerations: [] + +affinity: {}