update repo
This commit is contained in:
jenkins
Aleksandr Antropov
commit
9dd419d845
93
README.md
Normal file
93
README.md
Normal file
@ -0,0 +1,93 @@
|
||||
# cw-infra-apps
|
||||
|
||||
|
||||
|
||||
## Getting started
|
||||
|
||||
To make it easy for you to get started with GitLab, here's a list of recommended next steps.
|
||||
|
||||
Already a pro? Just edit this README.md and make it your own. Want to make it easy? [Use the template at the bottom](#editing-this-readme)!
|
||||
|
||||
## Add your files
|
||||
|
||||
- [ ] [Create](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#create-a-file) or [upload](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#upload-a-file) files
|
||||
- [ ] [Add files using the command line](https://docs.gitlab.com/topics/git/add_files/#add-files-to-a-git-repository) or push an existing Git repository with the following command:
|
||||
|
||||
```
|
||||
cd existing_repo
|
||||
git remote add origin https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
git branch -M main
|
||||
git push -uf origin main
|
||||
```
|
||||
|
||||
## Integrate with your tools
|
||||
|
||||
- [ ] [Set up project integrations](https://gitlab.ii-p001.local/cw-devops/cw-infra-apps/-/settings/integrations)
|
||||
|
||||
## Collaborate with your team
|
||||
|
||||
- [ ] [Invite team members and collaborators](https://docs.gitlab.com/ee/user/project/members/)
|
||||
- [ ] [Create a new merge request](https://docs.gitlab.com/ee/user/project/merge_requests/creating_merge_requests.html)
|
||||
- [ ] [Automatically close issues from merge requests](https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#closing-issues-automatically)
|
||||
- [ ] [Enable merge request approvals](https://docs.gitlab.com/ee/user/project/merge_requests/approvals/)
|
||||
- [ ] [Set auto-merge](https://docs.gitlab.com/user/project/merge_requests/auto_merge/)
|
||||
|
||||
## Test and Deploy
|
||||
|
||||
Use the built-in continuous integration in GitLab.
|
||||
|
||||
- [ ] [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/)
|
||||
- [ ] [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/)
|
||||
- [ ] [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html)
|
||||
- [ ] [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/)
|
||||
- [ ] [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)
|
||||
|
||||
***
|
||||
|
||||
# Editing this README
|
||||
|
||||
When you're ready to make this README your own, just edit this file and use the handy template below (or feel free to structure it however you want - this is just a starting point!). Thanks to [makeareadme.com](https://www.makeareadme.com/) for this template.
|
||||
|
||||
## Suggestions for a good README
|
||||
|
||||
Every project is different, so consider which of these sections apply to yours. The sections used in the template are suggestions for most open source projects. Also keep in mind that while a README can be too long and detailed, too long is better than too short. If you think your README is too long, consider utilizing another form of documentation rather than cutting out information.
|
||||
|
||||
## Name
|
||||
Choose a self-explaining name for your project.
|
||||
|
||||
## Description
|
||||
Let people know what your project can do specifically. Provide context and add a link to any reference visitors might be unfamiliar with. A list of Features or a Background subsection can also be added here. If there are alternatives to your project, this is a good place to list differentiating factors.
|
||||
|
||||
## Badges
|
||||
On some READMEs, you may see small images that convey metadata, such as whether or not all the tests are passing for the project. You can use Shields to add some to your README. Many services also have instructions for adding a badge.
|
||||
|
||||
## Visuals
|
||||
Depending on what you are making, it can be a good idea to include screenshots or even a video (you'll frequently see GIFs rather than actual videos). Tools like ttygif can help, but check out Asciinema for a more sophisticated method.
|
||||
|
||||
## Installation
|
||||
Within a particular ecosystem, there may be a common way of installing things, such as using Yarn, NuGet, or Homebrew. However, consider the possibility that whoever is reading your README is a novice and would like more guidance. Listing specific steps helps remove ambiguity and gets people to using your project as quickly as possible. If it only runs in a specific context like a particular programming language version or operating system or has dependencies that have to be installed manually, also add a Requirements subsection.
|
||||
|
||||
## Usage
|
||||
Use examples liberally, and show the expected output if you can. It's helpful to have inline the smallest example of usage that you can demonstrate, while providing links to more sophisticated examples if they are too long to reasonably include in the README.
|
||||
|
||||
## Support
|
||||
Tell people where they can go to for help. It can be any combination of an issue tracker, a chat room, an email address, etc.
|
||||
|
||||
## Roadmap
|
||||
If you have ideas for releases in the future, it is a good idea to list them in the README.
|
||||
|
||||
## Contributing
|
||||
State if you are open to contributions and what your requirements are for accepting them.
|
||||
|
||||
For people who want to make changes to your project, it's helpful to have some documentation on how to get started. Perhaps there is a script that they should run or some environment variables that they need to set. Make these steps explicit. These instructions could also be useful to your future self.
|
||||
|
||||
You can also document commands to lint the code or run tests. These steps help to ensure high code quality and reduce the likelihood that the changes inadvertently break something. Having instructions for running tests is especially helpful if it requires external setup, such as starting a Selenium server for testing in a browser.
|
||||
|
||||
## Authors and acknowledgment
|
||||
Show your appreciation to those who have contributed to the project.
|
||||
|
||||
## License
|
||||
For open source projects, say how it is licensed.
|
||||
|
||||
## Project status
|
||||
If you have run out of energy or time for your project, put a note at the top of the README saying that development has slowed down or stopped completely. Someone may choose to fork your project or volunteer to step in as a maintainer or owner, allowing your project to keep going. You can also make an explicit request for maintainers.
|
||||
265
argo-infra-apps/cassandra.yaml
Normal file
265
argo-infra-apps/cassandra.yaml
Normal file
File diff suppressed because one or more lines are too long
258
argo-infra-apps/elasticsearch.yaml
Normal file
258
argo-infra-apps/elasticsearch.yaml
Normal file
@ -0,0 +1,258 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-04-22T07:01:17Z"
|
||||
generation: 166
|
||||
name: elasticsearch
|
||||
namespace: argocd
|
||||
resourceVersion: "9726027"
|
||||
uid: 928fb09c-938a-4ed5-9f05-5f8702d14a5e
|
||||
spec:
|
||||
destination:
|
||||
namespace: elasticsearch
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated: {}
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Healthy
|
||||
history:
|
||||
- deployStartedAt: "2025-04-22T09:21:48Z"
|
||||
deployedAt: "2025-04-22T09:21:48Z"
|
||||
id: 2
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 3bb4328927c2b211878533c8928b9aa50d3cb545
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:22:40Z"
|
||||
deployedAt: "2025-04-22T09:22:41Z"
|
||||
id: 3
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 3bb4328927c2b211878533c8928b9aa50d3cb545
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:23:22Z"
|
||||
deployedAt: "2025-04-22T09:23:23Z"
|
||||
id: 4
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 3bb4328927c2b211878533c8928b9aa50d3cb545
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:24:25Z"
|
||||
deployedAt: "2025-04-22T09:24:28Z"
|
||||
id: 5
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 70dfc9595b1a8138455d9225facc018518da5e8a
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:24:28Z"
|
||||
deployedAt: "2025-04-22T09:24:29Z"
|
||||
id: 6
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 3bb4328927c2b211878533c8928b9aa50d3cb545
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:26:23Z"
|
||||
deployedAt: "2025-04-22T09:26:24Z"
|
||||
id: 7
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:26:25Z"
|
||||
deployedAt: "2025-04-22T09:26:25Z"
|
||||
id: 8
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 70dfc9595b1a8138455d9225facc018518da5e8a
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:27:24Z"
|
||||
deployedAt: "2025-04-22T09:27:25Z"
|
||||
id: 9
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:27:25Z"
|
||||
deployedAt: "2025-04-22T09:27:25Z"
|
||||
id: 10
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 70dfc9595b1a8138455d9225facc018518da5e8a
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:30:48Z"
|
||||
deployedAt: "2025-04-22T09:30:48Z"
|
||||
id: 11
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-04-22T09:30:48Z"
|
||||
message: successfully synced (all tasks run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
automated: true
|
||||
retry:
|
||||
limit: 5
|
||||
sync:
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
phase: Succeeded
|
||||
startedAt: "2025-04-22T09:30:48Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: policy
|
||||
hookPhase: Running
|
||||
kind: PodDisruptionBudget
|
||||
message: poddisruptionbudget.policy/elasticsearch-master-pdb configured
|
||||
name: elasticsearch-master-pdb
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Secret
|
||||
message: secret/elasticsearch-master-certs configured
|
||||
name: elasticsearch-master-certs
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Secret
|
||||
message: secret/elasticsearch-master-credentials configured
|
||||
name: elasticsearch-master-credentials
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/elasticsearch-master-headless unchanged
|
||||
name: elasticsearch-master-headless
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/elasticsearch-master configured
|
||||
name: elasticsearch-master
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: StatefulSet
|
||||
message: statefulset.apps/elasticsearch-master configured
|
||||
name: elasticsearch-master
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-04-22T09:36:48Z"
|
||||
resources:
|
||||
- kind: Secret
|
||||
name: elasticsearch-master-certs
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: Secret
|
||||
name: elasticsearch-master-credentials
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: elasticsearch-master
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: elasticsearch-master-headless
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
message: statefulset rolling update complete 3 pods at revision elasticsearch-master-579789bbc...
|
||||
status: Healthy
|
||||
kind: StatefulSet
|
||||
name: elasticsearch-master
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: policy
|
||||
kind: PodDisruptionBudget
|
||||
name: elasticsearch-master-pdb
|
||||
namespace: elasticsearch
|
||||
status: Synced
|
||||
version: v1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
images:
|
||||
- docker.io/library/elasticsearch:8.5.1
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
namespace: elasticsearch
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: elasticsearch
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
status: Synced
|
||||
233
argo-infra-apps/grafana.yaml
Normal file
233
argo-infra-apps/grafana.yaml
Normal file
@ -0,0 +1,233 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-04-29T20:35:02Z"
|
||||
generation: 18
|
||||
name: grafana
|
||||
namespace: argocd
|
||||
resourceVersion: "12377177"
|
||||
uid: 5f1ac9c2-48c5-4778-afc3-6a9a2c525a4f
|
||||
spec:
|
||||
destination:
|
||||
namespace: grafana
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: grafana
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated: {}
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Healthy
|
||||
history:
|
||||
- deployStartedAt: "2025-04-29T20:35:04Z"
|
||||
deployedAt: "2025-04-29T20:35:06Z"
|
||||
id: 0
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 0144665f14c7e31020dbfa8c9c2746a290caec74
|
||||
source:
|
||||
path: grafana
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-04-29T20:35:07Z"
|
||||
message: successfully synced (all tasks run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
automated: true
|
||||
retry:
|
||||
limit: 5
|
||||
sync:
|
||||
revision: 0144665f14c7e31020dbfa8c9c2746a290caec74
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
phase: Succeeded
|
||||
startedAt: "2025-04-29T20:35:04Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Namespace
|
||||
message: namespace/grafana created
|
||||
name: grafana
|
||||
namespace: ""
|
||||
status: Synced
|
||||
syncPhase: PreSync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ServiceAccount
|
||||
message: serviceaccount/grafana-alloy-metrics created
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Secret
|
||||
message: secret/metrics-grafana-k8s-monitoring created
|
||||
name: metrics-grafana-k8s-monitoring
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ConfigMap
|
||||
message: configmap/grafana-alloy-metrics created
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: "clusterrole.rbac.authorization.k8s.io/grafana-alloy-metrics reconciled.
|
||||
reconciliation required create\n\tmissing rules added:\n\t\t{Verbs:[get
|
||||
list watch] APIGroups:[ discovery.k8s.io networking.k8s.io] Resources:[endpoints
|
||||
endpointslices ingresses nodes nodes/proxy nodes/metrics pods services]
|
||||
ResourceNames:[] NonResourceURLs:[]}\n\t\t{Verbs:[get list watch] APIGroups:[]
|
||||
Resources:[pods pods/log namespaces] ResourceNames:[] NonResourceURLs:[]}\n\t\t{Verbs:[get
|
||||
list watch] APIGroups:[monitoring.grafana.com] Resources:[podlogs] ResourceNames:[]
|
||||
NonResourceURLs:[]}\n\t\t{Verbs:[get list watch] APIGroups:[monitoring.coreos.com]
|
||||
Resources:[prometheusrules] ResourceNames:[] NonResourceURLs:[]}\n\t\t{Verbs:[get]
|
||||
APIGroups:[] Resources:[] ResourceNames:[] NonResourceURLs:[/metrics]}\n\t\t{Verbs:[get
|
||||
list watch] APIGroups:[monitoring.coreos.com] Resources:[podmonitors servicemonitors
|
||||
probes scrapeconfigs] ResourceNames:[] NonResourceURLs:[]}\n\t\t{Verbs:[get
|
||||
list watch] APIGroups:[] Resources:[events] ResourceNames:[] NonResourceURLs:[]}\n\t\t{Verbs:[get
|
||||
list watch] APIGroups:[] Resources:[configmaps secrets] ResourceNames:[]
|
||||
NonResourceURLs:[]}\n\t\t{Verbs:[get list watch] APIGroups:[apps] Resources:[replicasets]
|
||||
ResourceNames:[] NonResourceURLs:[]}\n\t\t{Verbs:[get list watch] APIGroups:[extensions]
|
||||
Resources:[replicasets] ResourceNames:[] NonResourceURLs:[]}. clusterrole.rbac.authorization.k8s.io/grafana-alloy-metrics
|
||||
configured. Warning: resource clusterroles/grafana-alloy-metrics is missing
|
||||
the kubectl.kubernetes.io/last-applied-configuration annotation which is
|
||||
required by apply. apply should only be used on resources created declaratively
|
||||
by either create --save-config or apply. The missing annotation will be
|
||||
patched automatically."
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRoleBinding
|
||||
message: "clusterrolebinding.rbac.authorization.k8s.io/grafana-alloy-metrics
|
||||
reconciled. reconciliation required create\n\tmissing subjects added:\n\t\t{Kind:ServiceAccount
|
||||
APIGroup: Name:grafana-alloy-metrics Namespace:grafana}. clusterrolebinding.rbac.authorization.k8s.io/grafana-alloy-metrics
|
||||
configured. Warning: resource clusterrolebindings/grafana-alloy-metrics
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically."
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/grafana-alloy-metrics-cluster created
|
||||
name: grafana-alloy-metrics-cluster
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/grafana-alloy-metrics created
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: StatefulSet
|
||||
message: statefulset.apps/grafana-alloy-metrics created
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
revision: 0144665f14c7e31020dbfa8c9c2746a290caec74
|
||||
source:
|
||||
path: grafana
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-04-29T20:48:00Z"
|
||||
resources:
|
||||
- kind: ConfigMap
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: Secret
|
||||
name: metrics-grafana-k8s-monitoring
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: grafana-alloy-metrics-cluster
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ServiceAccount
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
message: 'partitioned roll out complete: 1 new pods have been updated...'
|
||||
status: Healthy
|
||||
kind: StatefulSet
|
||||
name: grafana-alloy-metrics
|
||||
namespace: grafana
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: grafana-alloy-metrics
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRoleBinding
|
||||
name: grafana-alloy-metrics
|
||||
status: Synced
|
||||
version: v1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
images:
|
||||
- docker.io/grafana/alloy:v1.8.2
|
||||
- quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
namespace: grafana
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: grafana
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: 0144665f14c7e31020dbfa8c9c2746a290caec74
|
||||
status: Synced
|
||||
208
argo-infra-apps/ingress-nginx.yaml
Normal file
208
argo-infra-apps/ingress-nginx.yaml
Normal file
@ -0,0 +1,208 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-05-07T15:03:24Z"
|
||||
generation: 779
|
||||
name: ingress-nginx
|
||||
namespace: argocd
|
||||
resourceVersion: "15435627"
|
||||
uid: ecb21cf9-d2a3-409b-87a7-cf1a44b0bbe1
|
||||
spec:
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated: {}
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Healthy
|
||||
history:
|
||||
- deployStartedAt: "2025-05-07T15:03:25Z"
|
||||
deployedAt: "2025-05-07T15:03:50Z"
|
||||
id: 0
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 91f02aa5bf6ced7986e99b89fca21ee4452f7d5c
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-05-07T15:08:21Z"
|
||||
deployedAt: "2025-05-07T15:08:35Z"
|
||||
id: 1
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 1402201ea91b245cd137ca4e86763bfc5d995ff0
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-05-07T15:08:35Z"
|
||||
deployedAt: "2025-05-07T15:08:49Z"
|
||||
id: 2
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 91f02aa5bf6ced7986e99b89fca21ee4452f7d5c
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-05-08T10:46:45Z"
|
||||
deployedAt: "2025-05-08T10:46:57Z"
|
||||
id: 3
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 36e6d6dc59968e714b0b4ead488c5dc72682094a
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-05-08T14:28:02Z"
|
||||
deployedAt: "2025-05-08T14:28:14Z"
|
||||
id: 4
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: c8b0c0149b5392e63bf832f558305d59d82ae9af
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-05-08T14:41:29Z"
|
||||
deployedAt: "2025-05-08T14:41:44Z"
|
||||
id: 5
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 6c1a12cdae7ccf40a6ba2282482187045749be6b
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-05-08T14:53:12Z"
|
||||
deployedAt: "2025-05-08T14:53:24Z"
|
||||
id: 6
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: 6c1a12cdae7ccf40a6ba2282482187045749be6b
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-05-08T14:57:22Z"
|
||||
message: one or more objects failed to apply (dry run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
username: admin
|
||||
retry: {}
|
||||
sync:
|
||||
revision: 6c1a12cdae7ccf40a6ba2282482187045749be6b
|
||||
syncOptions:
|
||||
- Replace=true
|
||||
syncStrategy:
|
||||
hook:
|
||||
force: true
|
||||
phase: Failed
|
||||
startedAt: "2025-05-08T14:57:16Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: batch
|
||||
hookPhase: Failed
|
||||
hookType: PreSync
|
||||
kind: Job
|
||||
message: 'error when deleting "/dev/shm/4286291675": jobs.batch "ingress-nginx-admission-create"
|
||||
not found'
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: default
|
||||
status: SyncFailed
|
||||
syncPhase: PreSync
|
||||
version: v1
|
||||
revision: 6c1a12cdae7ccf40a6ba2282482187045749be6b
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-05-08T14:57:22Z"
|
||||
resources:
|
||||
- kind: ConfigMap
|
||||
name: ingress-nginx-controller
|
||||
namespace: default
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: ingress-nginx-controller
|
||||
namespace: default
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: default
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: default
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: admissionregistration.k8s.io
|
||||
kind: ValidatingWebhookConfiguration
|
||||
name: ingress-nginx-admission
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
status: Healthy
|
||||
kind: Deployment
|
||||
name: ingress-nginx-controller
|
||||
namespace: default
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: networking.k8s.io
|
||||
kind: IngressClass
|
||||
name: nginx
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRoleBinding
|
||||
name: ingress-nginx
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
namespace: default
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: RoleBinding
|
||||
name: ingress-nginx
|
||||
namespace: default
|
||||
status: Synced
|
||||
version: v1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
images:
|
||||
- registry.k8s.io/ingress-nginx/controller:v1.12.2@sha256:03497ee984628e95eca9b2279e3f3a3c1685dd48635479e627d219f00c8eefa9
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: 6c1a12cdae7ccf40a6ba2282482187045749be6b
|
||||
status: Synced
|
||||
359
argo-infra-apps/kafka.yaml
Normal file
359
argo-infra-apps/kafka.yaml
Normal file
File diff suppressed because one or more lines are too long
122
argo-infra-apps/livekit-egress.yaml
Normal file
122
argo-infra-apps/livekit-egress.yaml
Normal file
@ -0,0 +1,122 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-05-08T14:26:30Z"
|
||||
generation: 14
|
||||
name: livekit-egress
|
||||
namespace: argocd
|
||||
resourceVersion: "15428767"
|
||||
uid: e20642c8-3378-4c0c-8f8f-9c54440413ac
|
||||
spec:
|
||||
destination:
|
||||
namespace: livekit
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: livekit/livekit-egress
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated: {}
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
ignoreDifferences:
|
||||
- group: apps
|
||||
kind: Deployment
|
||||
name: livekit-egress
|
||||
namespace: livekit
|
||||
jsonPointers:
|
||||
- /spec/replicas
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Healthy
|
||||
history:
|
||||
- deployStartedAt: "2025-05-08T14:26:31Z"
|
||||
deployedAt: "2025-05-08T14:26:34Z"
|
||||
id: 0
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: c8b0c0149b5392e63bf832f558305d59d82ae9af
|
||||
source:
|
||||
path: livekit/livekit-egress
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-05-08T14:26:34Z"
|
||||
message: successfully synced (all tasks run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
automated: true
|
||||
retry:
|
||||
limit: 5
|
||||
sync:
|
||||
revision: c8b0c0149b5392e63bf832f558305d59d82ae9af
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
phase: Succeeded
|
||||
startedAt: "2025-05-08T14:26:31Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Namespace
|
||||
message: namespace/livekit created
|
||||
name: livekit
|
||||
namespace: ""
|
||||
status: Synced
|
||||
syncPhase: PreSync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ConfigMap
|
||||
message: configmap/livekit-egress created
|
||||
name: livekit-egress
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: Deployment
|
||||
message: deployment.apps/livekit-egress created
|
||||
name: livekit-egress
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
revision: c8b0c0149b5392e63bf832f558305d59d82ae9af
|
||||
source:
|
||||
path: livekit/livekit-egress
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-05-08T14:35:27Z"
|
||||
resources:
|
||||
- kind: ConfigMap
|
||||
name: livekit-egress
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
status: Healthy
|
||||
kind: Deployment
|
||||
name: livekit-egress
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
images:
|
||||
- livekit/egress:v1.9.0
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
namespace: livekit
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: livekit/livekit-egress
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: c8b0c0149b5392e63bf832f558305d59d82ae9af
|
||||
status: Synced
|
||||
194
argo-infra-apps/livekit-server.yaml
Normal file
194
argo-infra-apps/livekit-server.yaml
Normal file
@ -0,0 +1,194 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-05-12T19:26:50Z"
|
||||
generation: 54
|
||||
name: livekit-server
|
||||
namespace: argocd
|
||||
resourceVersion: "16843936"
|
||||
uid: 6fd2964a-59c7-442f-8029-d3c7095ee329
|
||||
spec:
|
||||
destination:
|
||||
namespace: livekit
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: livekit/livekit-server
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated: {}
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
ignoreDifferences:
|
||||
- group: apps
|
||||
kind: Deployment
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
jsonPointers:
|
||||
- /spec/replicas
|
||||
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Progressing
|
||||
history:
|
||||
- deployStartedAt: "2025-05-12T19:39:24Z"
|
||||
deployedAt: "2025-05-12T19:39:25Z"
|
||||
id: 0
|
||||
initiatedBy:
|
||||
username: admin
|
||||
revision: bd036c064dfb7ad6ff8537ffcbd411e433b899f1
|
||||
source:
|
||||
path: livekit/livekit-server
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-05-12T19:39:25Z"
|
||||
message: successfully synced (all tasks run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
username: admin
|
||||
retry: {}
|
||||
sync:
|
||||
revision: bd036c064dfb7ad6ff8537ffcbd411e433b899f1
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- Replace=true
|
||||
syncStrategy:
|
||||
hook:
|
||||
force: true
|
||||
phase: Succeeded
|
||||
startedAt: "2025-05-12T19:39:24Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ConfigMap
|
||||
message: |-
|
||||
configmap "livekit-server" deleted
|
||||
configmap/livekit-server replaced
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: |-
|
||||
service "livekit-server" deleted
|
||||
service/livekit-server replaced
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: |-
|
||||
service "livekit-server-turn" deleted
|
||||
service/livekit-server-turn replaced
|
||||
name: livekit-server-turn
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: Deployment
|
||||
message: |-
|
||||
deployment.apps "livekit-server" deleted
|
||||
deployment.apps/livekit-server replaced
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: networking.k8s.io
|
||||
hookPhase: Running
|
||||
kind: Ingress
|
||||
message: ingress.networking.k8s.io/livekit-server-turn created
|
||||
name: livekit-server-turn
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: networking.k8s.io
|
||||
hookPhase: Running
|
||||
kind: Ingress
|
||||
message: ingress.networking.k8s.io/livekit-server created
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
revision: bd036c064dfb7ad6ff8537ffcbd411e433b899f1
|
||||
source:
|
||||
path: livekit/livekit-server
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-05-12T20:05:28Z"
|
||||
resources:
|
||||
- kind: ConfigMap
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: livekit-server-turn
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
status: Healthy
|
||||
kind: Deployment
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: networking.k8s.io
|
||||
health:
|
||||
status: Healthy
|
||||
kind: Ingress
|
||||
name: livekit-server
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: networking.k8s.io
|
||||
health:
|
||||
status: Progressing
|
||||
kind: Ingress
|
||||
name: livekit-server-turn
|
||||
namespace: livekit
|
||||
status: Synced
|
||||
version: v1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
externalURLs:
|
||||
- https://av-s001.co-work.ru/
|
||||
- https://avt-s001.co-work.ru/
|
||||
images:
|
||||
- livekit/livekit-server:v1.8.3
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
namespace: livekit
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: livekit/livekit-server
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: bd036c064dfb7ad6ff8537ffcbd411e433b899f1
|
||||
status: Synced
|
||||
233
argo-infra-apps/nfs-subdir-external-provisione.yaml
Normal file
233
argo-infra-apps/nfs-subdir-external-provisione.yaml
Normal file
File diff suppressed because one or more lines are too long
206
argo-infra-apps/postgres.yaml
Normal file
206
argo-infra-apps/postgres.yaml
Normal file
@ -0,0 +1,206 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-04-22T07:02:15Z"
|
||||
generation: 73
|
||||
name: postgres
|
||||
namespace: argocd
|
||||
resourceVersion: "9726026"
|
||||
uid: 1fa87c44-6c12-4c29-a67d-d14db049a836
|
||||
spec:
|
||||
destination:
|
||||
namespace: postgresql
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: postgresql
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Healthy
|
||||
history:
|
||||
- deployStartedAt: "2025-04-22T07:02:18Z"
|
||||
deployedAt: "2025-04-22T07:02:22Z"
|
||||
id: 0
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 3bb4328927c2b211878533c8928b9aa50d3cb545
|
||||
source:
|
||||
path: postgresql
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:24:50Z"
|
||||
deployedAt: "2025-04-22T09:24:51Z"
|
||||
id: 1
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 70dfc9595b1a8138455d9225facc018518da5e8a
|
||||
source:
|
||||
path: postgresql
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
- deployStartedAt: "2025-04-22T09:30:49Z"
|
||||
deployedAt: "2025-04-22T09:30:49Z"
|
||||
id: 2
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
source:
|
||||
path: postgresql
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-04-22T09:30:49Z"
|
||||
message: successfully synced (all tasks run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
automated: true
|
||||
retry:
|
||||
limit: 5
|
||||
sync:
|
||||
prune: true
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
phase: Succeeded
|
||||
startedAt: "2025-04-22T09:30:49Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: networking.k8s.io
|
||||
hookPhase: Running
|
||||
kind: NetworkPolicy
|
||||
message: networkpolicy.networking.k8s.io/postgres-postgresql configured
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: policy
|
||||
hookPhase: Running
|
||||
kind: PodDisruptionBudget
|
||||
message: poddisruptionbudget.policy/postgres-postgresql configured
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ServiceAccount
|
||||
message: serviceaccount/postgres-postgresql unchanged
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Secret
|
||||
message: secret/postgres-postgresql configured
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/postgres-postgresql-hl unchanged
|
||||
name: postgres-postgresql-hl
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/postgres-postgresql configured
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: StatefulSet
|
||||
message: statefulset.apps/postgres-postgresql configured
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
source:
|
||||
path: postgresql
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-04-22T09:36:48Z"
|
||||
resources:
|
||||
- kind: Secret
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: postgres-postgresql-hl
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ServiceAccount
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
message: 'partitioned roll out complete: 1 new pods have been updated...'
|
||||
status: Healthy
|
||||
kind: StatefulSet
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: networking.k8s.io
|
||||
kind: NetworkPolicy
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: policy
|
||||
kind: PodDisruptionBudget
|
||||
name: postgres-postgresql
|
||||
namespace: postgresql
|
||||
status: Synced
|
||||
version: v1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
images:
|
||||
- docker.io/bitnami/postgresql:17.4.0-debian-12-r15
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
namespace: postgresql
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: postgresql
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: 411b0b9894242dca75f4ee170a81ceef4e635b0a
|
||||
status: Synced
|
||||
20
argo-infra-apps/postgresql-ha.yaml
Normal file
20
argo-infra-apps/postgresql-ha.yaml
Normal file
@ -0,0 +1,20 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: postgresql-ha
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
path: postgresql-ha
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: postgresql-ha
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
287
argo-infra-apps/redis.yaml
Normal file
287
argo-infra-apps/redis.yaml
Normal file
@ -0,0 +1,287 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-04-30T20:40:28Z"
|
||||
generation: 16
|
||||
name: redis
|
||||
namespace: argocd
|
||||
resourceVersion: "12737426"
|
||||
uid: e79154a8-6a82-4993-8479-4260dd93deea
|
||||
spec:
|
||||
destination:
|
||||
namespace: redis
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: redis
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Healthy
|
||||
history:
|
||||
- deployStartedAt: "2025-04-30T20:40:28Z"
|
||||
deployedAt: "2025-04-30T20:40:29Z"
|
||||
id: 0
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: d7952823366ef593ddd14f398cd8757fabc1b83a
|
||||
source:
|
||||
path: redis
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-04-30T20:40:29Z"
|
||||
message: successfully synced (all tasks run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
automated: true
|
||||
retry:
|
||||
limit: 5
|
||||
sync:
|
||||
prune: true
|
||||
revision: d7952823366ef593ddd14f398cd8757fabc1b83a
|
||||
phase: Succeeded
|
||||
startedAt: "2025-04-30T20:40:28Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: networking.k8s.io
|
||||
hookPhase: Running
|
||||
kind: NetworkPolicy
|
||||
message: networkpolicy.networking.k8s.io/redis created
|
||||
name: redis
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: policy
|
||||
hookPhase: Running
|
||||
kind: PodDisruptionBudget
|
||||
message: poddisruptionbudget.policy/redis-master created
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: policy
|
||||
hookPhase: Running
|
||||
kind: PodDisruptionBudget
|
||||
message: poddisruptionbudget.policy/redis-replicas created
|
||||
name: redis-replicas
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ServiceAccount
|
||||
message: serviceaccount/redis-master created
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ServiceAccount
|
||||
message: serviceaccount/redis-replica created
|
||||
name: redis-replica
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Secret
|
||||
message: secret/redis created
|
||||
name: redis
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ConfigMap
|
||||
message: configmap/redis-scripts created
|
||||
name: redis-scripts
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ConfigMap
|
||||
message: configmap/redis-configuration created
|
||||
name: redis-configuration
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ConfigMap
|
||||
message: configmap/redis-health created
|
||||
name: redis-health
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/redis-master created
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/redis-headless created
|
||||
name: redis-headless
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: service/redis-replicas created
|
||||
name: redis-replicas
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: StatefulSet
|
||||
message: statefulset.apps/redis-master created
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: StatefulSet
|
||||
message: statefulset.apps/redis-replicas created
|
||||
name: redis-replicas
|
||||
namespace: redis
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
revision: d7952823366ef593ddd14f398cd8757fabc1b83a
|
||||
source:
|
||||
path: redis
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-04-30T20:40:29Z"
|
||||
resources:
|
||||
- kind: ConfigMap
|
||||
name: redis-configuration
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ConfigMap
|
||||
name: redis-health
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ConfigMap
|
||||
name: redis-scripts
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: Secret
|
||||
name: redis
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: redis-headless
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: redis-replicas
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ServiceAccount
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ServiceAccount
|
||||
name: redis-replica
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
message: statefulset rolling update complete 1 pods at revision redis-master-7989dc744c...
|
||||
status: Healthy
|
||||
kind: StatefulSet
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
message: statefulset rolling update complete 3 pods at revision redis-replicas-58784fcb67...
|
||||
status: Healthy
|
||||
kind: StatefulSet
|
||||
name: redis-replicas
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: networking.k8s.io
|
||||
kind: NetworkPolicy
|
||||
name: redis
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: policy
|
||||
kind: PodDisruptionBudget
|
||||
name: redis-master
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: policy
|
||||
kind: PodDisruptionBudget
|
||||
name: redis-replicas
|
||||
namespace: redis
|
||||
status: Synced
|
||||
version: v1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
images:
|
||||
- docker.io/bitnami/redis:7.4.3-debian-12-r0
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
namespace: redis
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: redis
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: d7952823366ef593ddd14f398cd8757fabc1b83a
|
||||
status: Synced
|
||||
908
argo-infra-apps/vault-secrets-operator.yaml
Normal file
908
argo-infra-apps/vault-secrets-operator.yaml
Normal file
@ -0,0 +1,908 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
creationTimestamp: "2025-03-31T11:53:35Z"
|
||||
generation: 16
|
||||
name: vault-secrets-operator
|
||||
namespace: argocd
|
||||
resourceVersion: "3238059"
|
||||
uid: 0acb50cc-b736-4760-aa60-b1dffc497fdd
|
||||
spec:
|
||||
destination:
|
||||
namespace: vault-secrets-operator
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: vault-secrets-operator
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
status:
|
||||
controllerNamespace: argocd
|
||||
health:
|
||||
status: Healthy
|
||||
history:
|
||||
- deployStartedAt: "2025-03-31T11:53:37Z"
|
||||
deployedAt: "2025-03-31T11:53:47Z"
|
||||
id: 0
|
||||
initiatedBy:
|
||||
automated: true
|
||||
revision: c44295c14ed484dd4417f4f0ac0a0408aa1d33df
|
||||
source:
|
||||
path: vault-secrets-operator
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
operationState:
|
||||
finishedAt: "2025-03-31T11:53:47Z"
|
||||
message: successfully synced (all tasks run)
|
||||
operation:
|
||||
initiatedBy:
|
||||
automated: true
|
||||
retry:
|
||||
limit: 5
|
||||
sync:
|
||||
prune: true
|
||||
revision: c44295c14ed484dd4417f4f0ac0a0408aa1d33df
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
phase: Succeeded
|
||||
startedAt: "2025-03-31T11:53:37Z"
|
||||
syncResult:
|
||||
resources:
|
||||
- group: ""
|
||||
hookPhase: Succeeded
|
||||
hookType: PreSync
|
||||
kind: ServiceAccount
|
||||
message: vault-secrets-operator-upgrade-crds created
|
||||
name: vault-secrets-operator-upgrade-crds
|
||||
namespace: vault-secrets-operator
|
||||
syncPhase: PreSync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Succeeded
|
||||
hookType: PreSync
|
||||
kind: ClusterRole
|
||||
message: vault-secrets-operator-upgrade-crds created
|
||||
name: vault-secrets-operator-upgrade-crds
|
||||
namespace: vault-secrets-operator
|
||||
syncPhase: PreSync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Succeeded
|
||||
hookType: PreSync
|
||||
kind: ClusterRoleBinding
|
||||
message: vault-secrets-operator-upgrade-crds created
|
||||
name: vault-secrets-operator-upgrade-crds
|
||||
namespace: vault-secrets-operator
|
||||
syncPhase: PreSync
|
||||
version: v1
|
||||
- group: batch
|
||||
hookPhase: Succeeded
|
||||
hookType: PreSync
|
||||
kind: Job
|
||||
message: Reached expected number of succeeded pods
|
||||
name: upgrade-crds-vault-secrets-operator
|
||||
namespace: vault-secrets-operator
|
||||
syncPhase: PreSync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ServiceAccount
|
||||
message: 'serviceaccount/vault-secrets-operator-controller-manager configured.
|
||||
Warning: resource serviceaccounts/vault-secrets-operator-controller-manager
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-controller-manager
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: ConfigMap
|
||||
message: 'configmap/vault-secrets-operator-manager-config configured. Warning:
|
||||
resource configmaps/vault-secrets-operator-manager-config is missing the
|
||||
kubectl.kubernetes.io/last-applied-configuration annotation which is required
|
||||
by apply. apply should only be used on resources created declaratively
|
||||
by either create --save-config or apply. The missing annotation will be
|
||||
patched automatically.'
|
||||
name: vault-secrets-operator-manager-config
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/vaultconnections.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/vaultconnections.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vaultconnections.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/vaultdynamicsecrets.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/vaultdynamicsecrets.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vaultdynamicsecrets.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/vaultauths.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/vaultauths.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vaultauths.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/hcpauths.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/hcpauths.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: hcpauths.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/hcpvaultsecretsapps.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/hcpvaultsecretsapps.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: hcpvaultsecretsapps.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/secrettransformations.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/secrettransformations.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: secrettransformations.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/vaultstaticsecrets.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/vaultstaticsecrets.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vaultstaticsecrets.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/vaultauthglobals.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/vaultauthglobals.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vaultauthglobals.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
hookPhase: Running
|
||||
kind: CustomResourceDefinition
|
||||
message: 'customresourcedefinition.apiextensions.k8s.io/vaultpkisecrets.secrets.hashicorp.com
|
||||
configured. Warning: resource customresourcedefinitions/vaultpkisecrets.secrets.hashicorp.com
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vaultpkisecrets.secrets.hashicorp.com
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpsecretsapp-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpsecretsapp-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-hcpsecretsapp-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-hcpsecretsapp-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultdynamicsecret-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultdynamicsecret-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultdynamicsecret-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultdynamicsecret-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultconnection-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultconnection-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultconnection-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultconnection-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-secrettransformation-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-secrettransformation-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-secrettransformation-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-secrettransformation-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-proxy-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-proxy-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-proxy-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-proxy-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultdynamicsecret-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultdynamicsecret-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultdynamicsecret-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultdynamicsecret-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultconnection-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultconnection-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultconnection-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultconnection-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-manager-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-manager-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-manager-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-manager-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpauth-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpauth-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-hcpauth-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-hcpauth-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultstaticsecret-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultstaticsecret-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultstaticsecret-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultstaticsecret-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-secrettransformation-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-secrettransformation-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-secrettransformation-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-secrettransformation-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultpki-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultpki-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultpki-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultpki-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpauth-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpauth-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-hcpauth-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-hcpauth-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpsecretsapp-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-hcpsecretsapp-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-hcpsecretsapp-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-hcpsecretsapp-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauthglobal-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauthglobal-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultauthglobal-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultauthglobal-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauthglobal-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauthglobal-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultauthglobal-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultauthglobal-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultpki-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultpki-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultpki-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultpki-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauth-viewer-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauth-viewer-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultauth-viewer-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultauth-viewer-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultstaticsecret-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultstaticsecret-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultstaticsecret-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultstaticsecret-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauth-editor-role
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-vaultauth-editor-role
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-vaultauth-editor-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-vaultauth-editor-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRole
|
||||
message: 'clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-metrics-reader
|
||||
reconciled. clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-metrics-reader
|
||||
configured. Warning: resource clusterroles/vault-secrets-operator-metrics-reader
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-metrics-reader
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRoleBinding
|
||||
message: 'clusterrolebinding.rbac.authorization.k8s.io/vault-secrets-operator-proxy-rolebinding
|
||||
reconciled. clusterrolebinding.rbac.authorization.k8s.io/vault-secrets-operator-proxy-rolebinding
|
||||
configured. Warning: resource clusterrolebindings/vault-secrets-operator-proxy-rolebinding
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-proxy-rolebinding
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: ClusterRoleBinding
|
||||
message: 'clusterrolebinding.rbac.authorization.k8s.io/vault-secrets-operator-manager-rolebinding
|
||||
reconciled. clusterrolebinding.rbac.authorization.k8s.io/vault-secrets-operator-manager-rolebinding
|
||||
configured. Warning: resource clusterrolebindings/vault-secrets-operator-manager-rolebinding
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-manager-rolebinding
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: Role
|
||||
message: 'role.rbac.authorization.k8s.io/vault-secrets-operator-leader-election-role
|
||||
reconciled. role.rbac.authorization.k8s.io/vault-secrets-operator-leader-election-role
|
||||
configured. Warning: resource roles/vault-secrets-operator-leader-election-role
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-leader-election-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
hookPhase: Running
|
||||
kind: RoleBinding
|
||||
message: 'rolebinding.rbac.authorization.k8s.io/vault-secrets-operator-leader-election-rolebinding
|
||||
reconciled. rolebinding.rbac.authorization.k8s.io/vault-secrets-operator-leader-election-rolebinding
|
||||
configured. Warning: resource rolebindings/vault-secrets-operator-leader-election-rolebinding
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-leader-election-rolebinding
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: ""
|
||||
hookPhase: Running
|
||||
kind: Service
|
||||
message: 'service/vault-secrets-operator-metrics-service configured. Warning:
|
||||
resource services/vault-secrets-operator-metrics-service is missing the
|
||||
kubectl.kubernetes.io/last-applied-configuration annotation which is required
|
||||
by apply. apply should only be used on resources created declaratively
|
||||
by either create --save-config or apply. The missing annotation will be
|
||||
patched automatically.'
|
||||
name: vault-secrets-operator-metrics-service
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: apps
|
||||
hookPhase: Running
|
||||
kind: Deployment
|
||||
message: 'deployment.apps/vault-secrets-operator-controller-manager configured.
|
||||
Warning: resource deployments/vault-secrets-operator-controller-manager
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-controller-manager
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1
|
||||
- group: secrets.hashicorp.com
|
||||
hookPhase: Running
|
||||
kind: VaultConnection
|
||||
message: 'vaultconnection.secrets.hashicorp.com/default configured. Warning:
|
||||
resource vaultconnections/default is missing the kubectl.kubernetes.io/last-applied-configuration
|
||||
annotation which is required by apply. apply should only be used on resources
|
||||
created declaratively by either create --save-config or apply. The missing
|
||||
annotation will be patched automatically.'
|
||||
name: default
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1beta1
|
||||
- group: secrets.hashicorp.com
|
||||
hookPhase: Running
|
||||
kind: VaultAuth
|
||||
message: 'vaultauth.secrets.hashicorp.com/vault-secrets-operator-default-transit-auth
|
||||
configured. Warning: resource vaultauths/vault-secrets-operator-default-transit-auth
|
||||
is missing the kubectl.kubernetes.io/last-applied-configuration annotation
|
||||
which is required by apply. apply should only be used on resources created
|
||||
declaratively by either create --save-config or apply. The missing annotation
|
||||
will be patched automatically.'
|
||||
name: vault-secrets-operator-default-transit-auth
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
syncPhase: Sync
|
||||
version: v1beta1
|
||||
revision: c44295c14ed484dd4417f4f0ac0a0408aa1d33df
|
||||
source:
|
||||
path: vault-secrets-operator
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
reconciledAt: "2025-03-31T11:53:48Z"
|
||||
resources:
|
||||
- kind: ConfigMap
|
||||
name: vault-secrets-operator-manager-config
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1
|
||||
- health:
|
||||
status: Healthy
|
||||
kind: Service
|
||||
name: vault-secrets-operator-metrics-service
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1
|
||||
- kind: ServiceAccount
|
||||
name: vault-secrets-operator-controller-manager
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: hcpauths.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: hcpvaultsecretsapps.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: secrettransformations.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: vaultauthglobals.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: vaultauths.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: vaultconnections.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: vaultdynamicsecrets.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: vaultpkisecrets.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
name: vaultstaticsecrets.secrets.hashicorp.com
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: apps
|
||||
health:
|
||||
status: Healthy
|
||||
kind: Deployment
|
||||
name: vault-secrets-operator-controller-manager
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-hcpauth-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-hcpauth-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-hcpsecretsapp-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-hcpsecretsapp-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-manager-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-metrics-reader
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-proxy-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-secrettransformation-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-secrettransformation-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultauth-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultauth-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultauthglobal-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultauthglobal-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultconnection-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultconnection-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultdynamicsecret-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultdynamicsecret-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultpki-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultpki-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultstaticsecret-editor-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vault-secrets-operator-vaultstaticsecret-viewer-role
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRoleBinding
|
||||
name: vault-secrets-operator-manager-rolebinding
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRoleBinding
|
||||
name: vault-secrets-operator-proxy-rolebinding
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: vault-secrets-operator-leader-election-role
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: RoleBinding
|
||||
name: vault-secrets-operator-leader-election-rolebinding
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1
|
||||
- group: secrets.hashicorp.com
|
||||
kind: VaultAuth
|
||||
name: vault-secrets-operator-default-transit-auth
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1beta1
|
||||
- group: secrets.hashicorp.com
|
||||
kind: VaultConnection
|
||||
name: default
|
||||
namespace: vault-secrets-operator
|
||||
status: Synced
|
||||
version: v1beta1
|
||||
sourceType: Helm
|
||||
summary:
|
||||
images:
|
||||
- hashicorp/vault-secrets-operator:0.10.0
|
||||
- quay.io/brancz/kube-rbac-proxy:v0.18.1
|
||||
sync:
|
||||
comparedTo:
|
||||
destination:
|
||||
namespace: vault-secrets-operator
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
path: vault-secrets-operator
|
||||
repoURL: https://gitlab.ii-p001.local/cw-devops/cw-infra-apps.git
|
||||
targetRevision: main
|
||||
revision: c44295c14ed484dd4417f4f0ac0a0408aa1d33df
|
||||
status: Synced
|
||||
442
argo-infra-apps/vault.yaml
Normal file
442
argo-infra-apps/vault.yaml
Normal file
File diff suppressed because one or more lines are too long
26
caddy/.helmignore
Normal file
26
caddy/.helmignore
Normal file
@ -0,0 +1,26 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
||||
ci/
|
||||
README.md.gotmpl
|
||||
29
caddy/Chart.yaml
Normal file
29
caddy/Chart.yaml
Normal file
@ -0,0 +1,29 @@
|
||||
annotations:
|
||||
artifacthub.io/changes: |
|
||||
- kind: changed
|
||||
description: Bump application to 2.4.5
|
||||
artifacthub.io/images: |
|
||||
- name: caddy
|
||||
image: caddy:2.4.5
|
||||
apiVersion: v2
|
||||
appVersion: 2.4.5
|
||||
description: A powerful, enterprise-ready, open source web server with automatic HTTPS
|
||||
written in Go.
|
||||
home: https://caddyserver.com/
|
||||
icon: https://caddyserver.com/resources/images/favicon.png
|
||||
keywords:
|
||||
- http
|
||||
- https
|
||||
- web
|
||||
- server
|
||||
kubeVersion: '>=1.16.0-0'
|
||||
maintainers:
|
||||
- email: mark.sagikazar@gmail.com
|
||||
name: sagikazarmark
|
||||
url: https://sagikazarmark.hu
|
||||
name: caddy
|
||||
sources:
|
||||
- https://github.com/caddyserver/caddy
|
||||
- https://github.com/sagikazarmark/helm-charts/tree/master/charts/caddy
|
||||
type: application
|
||||
version: 0.0.14
|
||||
19
caddy/LICENSE
Normal file
19
caddy/LICENSE
Normal file
@ -0,0 +1,19 @@
|
||||
Copyright (c) 2021 Márk Sági-Kazár <mark.sagikazar@gmail.com>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is furnished
|
||||
to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
64
caddy/README.md
Normal file
64
caddy/README.md
Normal file
@ -0,0 +1,64 @@
|
||||
# caddy
|
||||
|
||||
    [](https://artifacthub.io/packages/helm/sagikazarmark/caddy)
|
||||
|
||||
A powerful, enterprise-ready, open source web server with automatic HTTPS written in Go.
|
||||
|
||||
**Homepage:** <https://caddyserver.com/>
|
||||
|
||||
## TL;DR;
|
||||
|
||||
```bash
|
||||
helm repo add skm https://charts.sagikazarmark.dev
|
||||
helm install --generate-name --wait skm/caddy
|
||||
```
|
||||
|
||||
## Limitations
|
||||
|
||||
The chart currently only works with a `Caddyfile` that exposes content over port 80.
|
||||
|
||||
HTTPS service support, metrics and a lot of other features are coming in later versions.
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| replicaCount | int | `1` | Number of replicas (pods) to launch. |
|
||||
| image.repository | string | `"caddy"` | Name of the image repository to pull the container image from. |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | [Image pull policy](https://kubernetes.io/docs/concepts/containers/images/#updating-images) for updating already existing images on a node. |
|
||||
| image.tag | string | `""` | Image tag override for the default value (chart appVersion). |
|
||||
| imagePullSecrets | list | `[]` | Reference to one or more secrets to be used when [pulling images](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret) (from private registries). |
|
||||
| nameOverride | string | `""` | A name in place of the chart name for `app:` labels. |
|
||||
| fullnameOverride | string | `""` | A name to substitute for the full names of resources. |
|
||||
| config | string | `nil` | Caddy configuration file content. Accepts [Caddyfile](https://caddyserver.com/docs/caddyfile) format by default. See `adapter` for other formats. |
|
||||
| adapter | string | `"caddyfile"` | Caddyfile [config adapter](https://caddyserver.com/docs/config-adapters). Set it to empty string to use JSON. |
|
||||
| watch | bool | `false` | Watch config file for changes and reload it automatically. |
|
||||
| volumes | list | `[]` | Additional storage [volumes](https://kubernetes.io/docs/concepts/storage/volumes/). See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1) for details. |
|
||||
| volumeMounts | list | `[]` | Additional [volume mounts](https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/). See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1) for details. |
|
||||
| envFrom | list | `[]` | Additional environment variables mounted from [secrets](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables) or [config maps](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables). See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables) for details. |
|
||||
| env | object | `{}` | Additional environment variables passed directly to containers. See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables) for details. |
|
||||
| serviceAccount.create | bool | `true` | Enable service account creation. |
|
||||
| serviceAccount.annotations | object | `{}` | Annotations to be added to the service account. |
|
||||
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. |
|
||||
| podAnnotations | object | `{}` | Annotations to be added to pods. |
|
||||
| podSecurityContext | object | `{}` | Pod [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod). See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) for details. |
|
||||
| securityContext | object | `{}` | Container [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container). See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) for details. |
|
||||
| service.annotations | object | `{}` | Annotations to be added to the service. |
|
||||
| service.type | string | `"ClusterIP"` | Kubernetes [service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types). |
|
||||
| service.loadBalancerIP | string | `nil` | Only applies when the service type is LoadBalancer. Load balancer will get created with the IP specified in this field. |
|
||||
| service.loadBalancerSourceRanges | list | `[]` | (list) If specified (and supported by the cloud provider), traffic through the load balancer will be restricted to the specified client IPs. Valid values are IP CIDR blocks. |
|
||||
| service.port | int | `80` | Service port. |
|
||||
| service.nodePort | int | `nil` | Service node port (when applicable). |
|
||||
| service.externalTrafficPolicy | string | `nil` | Route external traffic to node-local or cluster-wide endoints. Useful for [preserving the client source IP](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip). |
|
||||
| ingress.enabled | bool | `false` | Enable [ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/). |
|
||||
| ingress.className | string | `""` | Ingress [class name](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class). |
|
||||
| ingress.annotations | object | `{}` | Annotations to be added to the ingress. |
|
||||
| ingress.hosts | list | See [values.yaml](values.yaml). | Ingress host configuration. |
|
||||
| ingress.tls | list | See [values.yaml](values.yaml). | Ingress TLS configuration. |
|
||||
| resources | object | No requests or limits. | Container resource [requests and limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources) for details. |
|
||||
| autoscaling | object | Disabled by default. | Autoscaling configuration (see [values.yaml](values.yaml) for details). |
|
||||
| nodeSelector | object | `{}` | [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) configuration. |
|
||||
| tolerations | list | `[]` | [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) for node taints. See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) for details. |
|
||||
| affinity | object | `{}` | [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) configuration. See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) for details. |
|
||||
| livenessProbe | object | `{"httpGet":{"path":"/","port":"http"}}` | [Liveness probe](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes) See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#Probe) for details. |
|
||||
| readinessProbe | object | `{"httpGet":{"path":"/","port":"http"}}` | [Readiness probe](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes) See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#Probe) for details. |
|
||||
22
caddy/templates/NOTES.txt
Normal file
22
caddy/templates/NOTES.txt
Normal file
@ -0,0 +1,22 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "caddy.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "caddy.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "caddy.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "caddy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
75
caddy/templates/_helpers.tpl
Normal file
75
caddy/templates/_helpers.tpl
Normal file
@ -0,0 +1,75 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "caddy.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "caddy.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "caddy.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "caddy.labels" -}}
|
||||
helm.sh/chart: {{ include "caddy.chart" . }}
|
||||
{{ include "caddy.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "caddy.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "caddy.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "caddy.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "caddy.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Determine the configuration file name based on the adapter.
|
||||
*/}}
|
||||
{{- define "caddy.configFileName" -}}
|
||||
{{- if or (not .Values.config) (eq .Values.adapter "caddyfile") }}
|
||||
{{- print "Caddyfile" }}
|
||||
{{- else if .Values.adapter }}
|
||||
{{- printf "config.%s" .Values.adapter }}
|
||||
{{- else }}
|
||||
{{- print "config.json" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
11
caddy/templates/configmap.yaml
Normal file
11
caddy/templates/configmap.yaml
Normal file
@ -0,0 +1,11 @@
|
||||
{{- if .Values.config -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "caddy.fullname" . }}
|
||||
labels:
|
||||
{{- include "caddy.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{ include "caddy.configFileName" . }}: |-
|
||||
{{- .Values.config | nindent 4 }}
|
||||
{{- end }}
|
||||
105
caddy/templates/deployment.yaml
Normal file
105
caddy/templates/deployment.yaml
Normal file
@ -0,0 +1,105 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "caddy.fullname" . }}
|
||||
labels:
|
||||
{{- include "caddy.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "caddy.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- if not .Values.watch }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "caddy.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "caddy.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- caddy
|
||||
- run
|
||||
- --config
|
||||
- /etc/caddy/{{ include "caddy.configFileName" . }}
|
||||
{{- if and .Values.config .Values.adapter }}
|
||||
- --adapter
|
||||
- {{ .Values.adapter }}
|
||||
{{- end }}
|
||||
{{- if .Values.watch }}
|
||||
- --watch
|
||||
{{- end }}
|
||||
{{- with .Values.env }}
|
||||
env:
|
||||
{{- range $key, $value := . }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||
readinessProbe:
|
||||
{{- toYaml .Values.readinessProbe | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- if or .Values.config .Values.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- if .Values.config }}
|
||||
- name: config
|
||||
mountPath: /etc/caddy
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.config .Values.volumes }}
|
||||
volumes:
|
||||
{{- if .Values.config }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "caddy.fullname" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
28
caddy/templates/hpa.yaml
Normal file
28
caddy/templates/hpa.yaml
Normal file
@ -0,0 +1,28 @@
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2beta1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "caddy.fullname" . }}
|
||||
labels:
|
||||
{{- include "caddy.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "caddy.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
61
caddy/templates/ingress.yaml
Normal file
61
caddy/templates/ingress.yaml
Normal file
@ -0,0 +1,61 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "caddy.fullname" . -}}
|
||||
{{- $svcPort := .Values.service.port -}}
|
||||
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
|
||||
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
|
||||
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
{{- else -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
{{- end }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "caddy.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
|
||||
pathType: {{ .pathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ $svcPort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ $svcPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
36
caddy/templates/service.yaml
Normal file
36
caddy/templates/service.yaml
Normal file
@ -0,0 +1,36 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "caddy.fullname" . }}
|
||||
labels:
|
||||
{{- include "caddy.labels" . | nindent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- with .Values.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.service.type "LoadBalancer" }}
|
||||
{{- with .Values.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) .Values.service.nodePort }}
|
||||
nodePort: {{ .Values.service.nodePort }}
|
||||
{{- end }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
{{- if semverCompare ">=1.20-0" .Capabilities.KubeVersion.GitVersion }}
|
||||
appProtocol: http
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "caddy.selectorLabels" . | nindent 4 }}
|
||||
12
caddy/templates/serviceaccount.yaml
Normal file
12
caddy/templates/serviceaccount.yaml
Normal file
@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "caddy.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "caddy.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
19
caddy/templates/tests/test-connection.yaml
Normal file
19
caddy/templates/tests/test-connection.yaml
Normal file
@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "caddy.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{- include "caddy.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
spec:
|
||||
containers:
|
||||
- name: wget
|
||||
image: busybox
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
sleep 10 # Readiness takes some time
|
||||
wget {{ include "caddy.fullname" . }}:{{ .Values.service.port }}
|
||||
restartPolicy: Never
|
||||
180
caddy/values.yaml
Normal file
180
caddy/values.yaml
Normal file
@ -0,0 +1,180 @@
|
||||
# Default values for caddy.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
# -- Number of replicas (pods) to launch.
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
# -- Name of the image repository to pull the container image from.
|
||||
repository: caddyl4
|
||||
|
||||
# -- [Image pull policy](https://kubernetes.io/docs/concepts/containers/images/#updating-images) for updating already existing images on a node.
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# -- Image tag override for the default value (chart appVersion).
|
||||
tag: ""
|
||||
|
||||
# -- Reference to one or more secrets to be used when [pulling images](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret) (from private registries).
|
||||
imagePullSecrets: []
|
||||
|
||||
# -- A name in place of the chart name for `app:` labels.
|
||||
nameOverride: ""
|
||||
|
||||
# -- A name to substitute for the full names of resources.
|
||||
fullnameOverride: ""
|
||||
|
||||
# -- (string) Caddy configuration file content. Accepts [Caddyfile](https://caddyserver.com/docs/caddyfile) format by default.
|
||||
# See `adapter` for other formats.
|
||||
config:
|
||||
|
||||
# -- Caddyfile [config adapter](https://caddyserver.com/docs/config-adapters). Set it to empty string to use JSON.
|
||||
adapter: caddyfile
|
||||
|
||||
# -- Watch config file for changes and reload it automatically.
|
||||
watch: false
|
||||
|
||||
# -- Additional storage [volumes](https://kubernetes.io/docs/concepts/storage/volumes/).
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1) for details.
|
||||
volumes: []
|
||||
|
||||
# -- Additional [volume mounts](https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/).
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1) for details.
|
||||
volumeMounts: []
|
||||
|
||||
# -- Additional environment variables mounted from [secrets](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables) or [config maps](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables).
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables) for details.
|
||||
envFrom: []
|
||||
|
||||
# -- Additional environment variables passed directly to containers.
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables) for details.
|
||||
env: {}
|
||||
|
||||
serviceAccount:
|
||||
# -- Enable service account creation.
|
||||
create: true
|
||||
|
||||
# -- Annotations to be added to the service account.
|
||||
annotations: {}
|
||||
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template.
|
||||
name: ""
|
||||
|
||||
# -- Annotations to be added to pods.
|
||||
podAnnotations: {}
|
||||
|
||||
# -- Pod [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod).
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) for details.
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
# -- Container [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container).
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) for details.
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
service:
|
||||
# -- Annotations to be added to the service.
|
||||
annotations: {}
|
||||
|
||||
# -- Kubernetes [service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types).
|
||||
type: ClusterIP
|
||||
|
||||
# -- (string) Only applies when the service type is LoadBalancer. Load balancer will get created with the IP specified in this field.
|
||||
loadBalancerIP:
|
||||
|
||||
# -- (list) If specified (and supported by the cloud provider), traffic through the load balancer will be restricted to the specified client IPs.
|
||||
# Valid values are IP CIDR blocks.
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
# -- Service port.
|
||||
port: 80
|
||||
|
||||
# -- (int) Service node port (when applicable).
|
||||
nodePort:
|
||||
|
||||
# -- Route external traffic to node-local or cluster-wide endoints.
|
||||
# Useful for [preserving the client source IP](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip).
|
||||
externalTrafficPolicy:
|
||||
|
||||
ingress:
|
||||
# -- Enable [ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/).
|
||||
enabled: false
|
||||
|
||||
# -- Ingress [class name](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class).
|
||||
className: ""
|
||||
|
||||
# -- Annotations to be added to the ingress.
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
|
||||
# -- Ingress host configuration.
|
||||
# @default -- See [values.yaml](values.yaml).
|
||||
hosts:
|
||||
- host: chart-example.local
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
|
||||
# -- Ingress TLS configuration.
|
||||
# @default -- See [values.yaml](values.yaml).
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
# -- Container resource [requests and limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources) for details.
|
||||
# @default -- No requests or limits.
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
# -- Autoscaling configuration (see [values.yaml](values.yaml) for details).
|
||||
# @default -- Disabled by default.
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 100
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# -- [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) configuration.
|
||||
nodeSelector: {}
|
||||
|
||||
# -- [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) for node taints.
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) for details.
|
||||
tolerations: []
|
||||
|
||||
# -- [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) configuration.
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) for details.
|
||||
affinity: {}
|
||||
|
||||
# -- [Liveness probe](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes)
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#Probe) for details.
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
|
||||
# -- [Readiness probe](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes)
|
||||
# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#Probe) for details.
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
25
cassandra/.helmignore
Normal file
25
cassandra/.helmignore
Normal file
@ -0,0 +1,25 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
# img folder
|
||||
img/
|
||||
# Changelog
|
||||
CHANGELOG.md
|
||||
6
cassandra/Chart.lock
Normal file
6
cassandra/Chart.lock
Normal file
@ -0,0 +1,6 @@
|
||||
dependencies:
|
||||
- name: common
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 2.30.0
|
||||
digest: sha256:46afdf79eae69065904d430f03f7e5b79a148afed20aa45ee83ba88adc036169
|
||||
generated: "2025-03-05T09:18:46.745709854Z"
|
||||
34
cassandra/Chart.yaml
Normal file
34
cassandra/Chart.yaml
Normal file
@ -0,0 +1,34 @@
|
||||
annotations:
|
||||
category: Database
|
||||
images: |
|
||||
- name: cassandra
|
||||
image: docker.io/bitnami/cassandra:5.0.3-debian-12-r6
|
||||
- name: cassandra-exporter
|
||||
image: docker.io/bitnami/cassandra-exporter:2.3.8-debian-12-r41
|
||||
- name: os-shell
|
||||
image: docker.io/bitnami/os-shell:12-debian-12-r39
|
||||
licenses: Apache-2.0
|
||||
apiVersion: v2
|
||||
appVersion: 5.0.3
|
||||
dependencies:
|
||||
- name: common
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
tags:
|
||||
- bitnami-common
|
||||
version: 2.x.x
|
||||
description: Apache Cassandra is an open source distributed database management system
|
||||
designed to handle large amounts of data across many servers, providing high availability
|
||||
with no single point of failure. And lets test it. Now.
|
||||
home: https://bitnami.com
|
||||
icon: https://dyltqmyl993wv.cloudfront.net/assets/stacks/cassandra/img/cassandra-stack-220x234.png
|
||||
keywords:
|
||||
- cassandra
|
||||
- database
|
||||
- nosql
|
||||
maintainers:
|
||||
- name: Broadcom, Inc. All Rights Reserved.
|
||||
url: https://github.com/bitnami/charts
|
||||
name: cassandra
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/cassandra
|
||||
version: 12.2.1
|
||||
574
cassandra/README.md
Normal file
574
cassandra/README.md
Normal file
@ -0,0 +1,574 @@
|
||||
<!--- app-name: Apache Cassandra -->
|
||||
|
||||
console.sql has a big size and must be used as init script for our database. Due to a huge size it can't be placed inside configmap, and must be compresseed
|
||||
|
||||
gzip -c console.sql > init.cql.gz
|
||||
after compression it must be placed in init_cm.yaml configmap as a binary data with
|
||||
kubectl create configmap cassandra-init-script --from-file=init.cql.gz -n cassandra or in helm chart template
|
||||
|
||||
https://gemspacepro.atlassian.net/wiki/spaces/GEMB2B/pages/224657714 files are here;
|
||||
|
||||
|
||||
|
||||
# Bitnami package for Apache Cassandra
|
||||
|
||||
Apache Cassandra is an open source distributed database management system designed to handle large amounts of data across many servers, providing high availability with no single point of failure.
|
||||
|
||||
[Overview of Apache Cassandra](http://cassandra.apache.org/)
|
||||
|
||||
Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.
|
||||
|
||||
## TL;DR
|
||||
|
||||
```console
|
||||
helm install my-release oci://registry-1.docker.io/bitnamicharts/cassandra
|
||||
```
|
||||
|
||||
Looking to use Apache Cassandra in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps an [Apache Cassandra](https://github.com/bitnami/containers/tree/main/bitnami/cassandra) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.23+
|
||||
- Helm 3.8.0+
|
||||
- PV provisioner support in the underlying infrastructure
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/cassandra
|
||||
```
|
||||
|
||||
> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
|
||||
|
||||
These commands deploy one node with Apache Cassandra on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Configuration and installation details
|
||||
|
||||
### Resource requests and limits
|
||||
|
||||
Bitnami charts allow setting resource requests and limits for all containers inside the chart deployment. These are inside the `resources` value (check parameter table). Setting requests is essential for production workloads and these should be adapted to your specific use case.
|
||||
|
||||
To make this process easier, the chart contains the `resourcesPreset` values, which automatically sets the `resources` section according to different presets. Check these presets in [the bitnami/common chart](https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15). However, in production workloads using `resourcesPreset` is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
|
||||
|
||||
### Update credentials
|
||||
|
||||
Bitnami charts configure credentials at first boot. Any further change in the secrets or credentials require manual intervention. Follow these instructions:
|
||||
|
||||
- Update the user password following [the upstream documentation](https://docs.datastax.com/en/cql-oss/3.x/cql/cql_reference/cqlAlterUser.html)
|
||||
- Update the password secret with the new values (replace the SECRET_NAME and PASSWORD placeholders)
|
||||
|
||||
```shell
|
||||
kubectl create secret generic SECRET_NAME --from-literal=cassandra-password=PASSWORD --dry-run -o yaml | kubectl apply -f -
|
||||
```
|
||||
|
||||
### [Rolling vs Immutable tags](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html)
|
||||
|
||||
It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.
|
||||
|
||||
Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.
|
||||
|
||||
### Prometheus metrics
|
||||
|
||||
This chart can be integrated with Prometheus by setting `metrics.enabled` to `true`. This will deploy a sidecar container with [cassandra_exporter](https://github.com/criteo/cassandra_exporter) in all pods and will expose it via the Cassandra service. This service will have the necessary annotations to be automatically scraped by Prometheus.
|
||||
|
||||
#### Prometheus requirements
|
||||
|
||||
It is necessary to have a working installation of Prometheus or Prometheus Operator for the integration to work. Install the [Bitnami Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/prometheus) or the [Bitnami Kube Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus) to easily have a working Prometheus in your cluster.
|
||||
|
||||
#### Integration with Prometheus Operator
|
||||
|
||||
The chart can deploy `ServiceMonitor` objects for integration with Prometheus Operator installations. To do so, set the value `metrics.serviceMonitor.enabled=true`. Ensure that the Prometheus Operator `CustomResourceDefinitions` are installed in the cluster or it will fail with the following error:
|
||||
|
||||
```text
|
||||
no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1"
|
||||
```
|
||||
|
||||
Install the [Bitnami Kube Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus) for having the necessary CRDs and the Prometheus Operator.
|
||||
|
||||
### Enable TLS
|
||||
|
||||
This chart supports TLS between client and server and between nodes, as explained below:
|
||||
|
||||
- For internode cluster encryption, set the `tls.internodeEncryption` chart parameter to a value different from `none`. Available values are `all`, `dc` or `rack`.
|
||||
- For client-server encryption, set the `tls.clientEncryption` chart parameter to `true`.
|
||||
|
||||
In both cases, it is also necessary to create a secret containing the keystore and truststore certificates and their corresponding protection passwords. This secret is to be passed to the chart via the `tls.existingSecret` parameter at deployment-time, as shown below:
|
||||
|
||||
```text
|
||||
tls.internodeEncryption=all
|
||||
tls.clientEncryption=true
|
||||
tls.existingSecret=my-exisiting-stores
|
||||
tls.passwordsSecret=my-stores-password
|
||||
```
|
||||
|
||||
> TIP: The secret may be created in the standard way with the `--from-file=./keystore`, `--from-file=./truststore`, `--from-literal=keystore-password=KEYSTORE_PASSWORD` and `--from-literal=truststore-password=TRUSTSTORE_PASSWORD` options. This assumes that the stores are in the current working directory and the KEYSTORE_PASSWORD and TRUSTSTORE_PASSWORD placeholders are replaced with the correct keystore and truststore passwords respectively. Example:
|
||||
|
||||
```console
|
||||
kubectl create secret generic my-exisiting-stores --from-file=./keystore --from-file=./truststore
|
||||
kubectl create secret generic my-stores-password --from-literal=keystore-password=KEYSTORE_PASSWORD --from-literal=truststore-password=TRUSTSTORE_PASSWORD
|
||||
```
|
||||
|
||||
Keystore and Truststore files can be dynamically created from the certificates files. In this case a secret with the tls.crt, tls.key and ca.crt in pem format is required. The following example shows how the secret can be created and assumes that all certificate files are in the working directory:
|
||||
|
||||
```console
|
||||
kubectl create secret tls my-certs --cert ./tls.crt --key ./tls.key
|
||||
kubectl patch secret my-certs -p="{\"data\":{\"ca.crt\": \"$(cat ./ca.crt | base64 )\"}}"
|
||||
```
|
||||
|
||||
To enable this feature `tls.autoGenerated` must be set and the new secret should be set in `tls.certificateSecret`:
|
||||
|
||||
```text
|
||||
tls.internodeEncryption=all
|
||||
tls.clientEncryption=true
|
||||
tls.autoGenerated=true
|
||||
tls.certificatesSecret=my-certs
|
||||
tls.passwordsSecret=my-stores-password
|
||||
```
|
||||
|
||||
### Initialize the database
|
||||
|
||||
The [Apache Cassandra](https://github.com/bitnami/containers/tree/main/bitnami/cassandra) image supports the use of custom scripts to initialize a fresh instance. This may be done by creating a Kubernetes ConfigMap that includes the necessary `.sh` or `.cql` scripts and passing this ConfigMap to the chart via the `initDBConfigMap` parameter.
|
||||
|
||||
### Use a custom configuration file
|
||||
|
||||
This chart also supports mounting custom configuration file(s) for Apache Cassandra. This is achieved by setting the `existingConfiguration` parameter with the name of a ConfigMap that includes the custom configuration file(s). Here is an example of deploying the chart with a custom configuration file stored in a ConfigMap named `cassandra-configuration`:
|
||||
|
||||
```text
|
||||
existingConfiguration=cassandra-configuration
|
||||
```
|
||||
|
||||
> NOTE: This ConfigMap will override other Apache Cassandra configuration variables set in the chart.
|
||||
|
||||
### Backup and restore
|
||||
|
||||
Refer to our detailed tutorial on [backing up and restoring Bitnami Apache Cassandra deployments on Kubernetes](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-backup-restore-data-cassandra-kubernetes-index.html).
|
||||
|
||||
### Set pod affinity
|
||||
|
||||
This chart allows you to set custom pod affinity using the `XXX.affinity` parameter(s). Find more information about pod affinity in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity).
|
||||
|
||||
As an alternative, you can use the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters.
|
||||
|
||||
## Persistence
|
||||
|
||||
The [Bitnami Apache Cassandra](https://github.com/bitnami/containers/tree/main/bitnami/cassandra) image stores the Apache Cassandra data at the `/bitnami/cassandra` path of the container.
|
||||
|
||||
Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube.
|
||||
See the [Parameters](#parameters) section to configure the PVC or to disable persistence.
|
||||
|
||||
If you encounter errors when working with persistent volumes, refer to our [troubleshooting guide for persistent volumes](https://docs.bitnami.com/kubernetes/faq/troubleshooting/troubleshooting-persistence-volumes/).
|
||||
|
||||
### Adjust permissions of persistent volume mountpoint
|
||||
|
||||
As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. There are two approaches to achieve this:
|
||||
|
||||
- Use Kubernetes SecurityContexts by setting the `podSecurityContext.enabled` and `containerSecurityContext.enabled` to `true`. This option is enabled by default in the chart. However, this feature does not work in all Kubernetes distributions.
|
||||
- Use an init container to change the ownership of the volume before mounting it in the final destination. Enable this container by setting the `volumePermissions.enabled` parameter to `true`.
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `global.imageRegistry` | Global Docker image registry | `""` |
|
||||
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
|
||||
| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` |
|
||||
| `global.security.allowInsecureImages` | Allows skipping image verification | `false` |
|
||||
| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` |
|
||||
|
||||
### Common parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
|
||||
| `nameOverride` | String to partially override common.names.fullname | `""` |
|
||||
| `fullnameOverride` | String to fully override common.names.fullname | `""` |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `commonLabels` | Labels to add to all deployed objects (sub-charts are not considered) | `{}` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `usePasswordFiles` | Mount credentials as files instead of using environment variables | `true` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
|
||||
|
||||
### Cassandra parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------- | --------------------------- |
|
||||
| `image.registry` | Cassandra image registry | `REGISTRY_NAME` |
|
||||
| `image.repository` | Cassandra image repository | `REPOSITORY_NAME/cassandra` |
|
||||
| `image.digest` | Cassandra image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `image.pullPolicy` | image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Cassandra image pull secrets | `[]` |
|
||||
| `image.debug` | Enable image debug mode | `false` |
|
||||
| `dbUser.user` | Cassandra admin user | `cassandra` |
|
||||
| `dbUser.forcePassword` | Force the user to provide a non | `false` |
|
||||
| `dbUser.password` | Password for `dbUser.user`. Randomly generated if empty | `""` |
|
||||
| `dbUser.existingSecret` | Use an existing secret object for `dbUser.user` password (will ignore `dbUser.password`) | `""` |
|
||||
| `initDB` | Object with cql scripts. Useful for creating a keyspace and pre-populating data | `{}` |
|
||||
| `initDBConfigMap` | ConfigMap with cql scripts. Useful for creating a keyspace and pre-populating data | `""` |
|
||||
| `initDBSecret` | Secret with cql script (with sensitive data). Useful for creating a keyspace and pre-populating data | `""` |
|
||||
| `existingConfiguration` | ConfigMap with custom cassandra configuration files. This overrides any other Cassandra configuration set in the chart | `""` |
|
||||
| `cluster.name` | Cassandra cluster name | `cassandra` |
|
||||
| `cluster.seedCount` | Number of seed nodes | `1` |
|
||||
| `cluster.numTokens` | Number of tokens for each node | `256` |
|
||||
| `cluster.datacenter` | Datacenter name | `dc1` |
|
||||
| `cluster.rack` | Rack name | `rack1` |
|
||||
| `cluster.endpointSnitch` | Endpoint Snitch | `SimpleSnitch` |
|
||||
| `cluster.clientEncryption` | Client Encryption | `false` |
|
||||
| `cluster.extraSeeds` | For an external/second cassandra ring. | `[]` |
|
||||
| `cluster.enableUDF` | Enable User defined functions | `false` |
|
||||
| `jvm.extraOpts` | Set the value for Java Virtual Machine extra options | `""` |
|
||||
| `jvm.maxHeapSize` | Set Java Virtual Machine maximum heap size (MAX_HEAP_SIZE). Calculated automatically if `nil` | `""` |
|
||||
| `jvm.newHeapSize` | Set Java Virtual Machine new heap size (HEAP_NEWSIZE). Calculated automatically if `nil` | `""` |
|
||||
| `command` | Command for running the container (set to default if not set). Use array form | `[]` |
|
||||
| `args` | Args for running the container (set to default if not set). Use array form | `[]` |
|
||||
| `extraEnvVars` | Extra environment variables to be set on cassandra container | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` |
|
||||
|
||||
### Statefulset parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
|
||||
| `replicaCount` | Number of Cassandra replicas | `1` |
|
||||
| `updateStrategy.type` | updateStrategy for Cassandra statefulset | `RollingUpdate` |
|
||||
| `automountServiceAccountToken` | Mount Service Account token in pod | `false` |
|
||||
| `hostAliases` | Add deployment host aliases | `[]` |
|
||||
| `podManagementPolicy` | StatefulSet pod management policy | `OrderedReady` |
|
||||
| `priorityClassName` | Cassandra pods' priority. | `""` |
|
||||
| `podAnnotations` | Additional pod annotations | `{}` |
|
||||
| `podLabels` | Additional pod labels | `{}` |
|
||||
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set | `""` |
|
||||
| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` |
|
||||
| `podSecurityContext.enabled` | Enabled Cassandra pods' Security Context | `true` |
|
||||
| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
|
||||
| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
|
||||
| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
|
||||
| `podSecurityContext.fsGroup` | Set Cassandra pod's Security Context fsGroup | `1001` |
|
||||
| `containerSecurityContext.enabled` | Enabled Cassandra containers' Security Context | `true` |
|
||||
| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
|
||||
| `containerSecurityContext.runAsUser` | Set Cassandra containers' Security Context runAsUser | `1001` |
|
||||
| `containerSecurityContext.runAsGroup` | Set Cassandra containers' Security Context runAsGroup | `1001` |
|
||||
| `containerSecurityContext.allowPrivilegeEscalation` | Set Cassandra containers' Security Context allowPrivilegeEscalation | `false` |
|
||||
| `containerSecurityContext.capabilities.drop` | Set Cassandra containers' Security Context capabilities to be dropped | `["ALL"]` |
|
||||
| `containerSecurityContext.readOnlyRootFilesystem` | Set Cassandra containers' Security Context readOnlyRootFilesystem | `true` |
|
||||
| `containerSecurityContext.runAsNonRoot` | Set Cassandra containers' Security Context runAsNonRoot | `true` |
|
||||
| `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
|
||||
| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `large` |
|
||||
| `resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `livenessProbe.enabled` | Enable livenessProbe | `true` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `60` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `30` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `30` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` |
|
||||
| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `readinessProbe.enabled` | Enable readinessProbe | `true` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `60` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `30` |
|
||||
| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` |
|
||||
| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `startupProbe.enabled` | Enable startupProbe | `false` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
|
||||
| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `customStartupProbe` | Override default startup probe | `{}` |
|
||||
| `lifecycleHooks` | Override default etcd container hooks | `{}` |
|
||||
| `schedulerName` | Alternative scheduler | `""` |
|
||||
| `terminationGracePeriodSeconds` | In seconds, time the given to the Cassandra pod needs to terminate gracefully | `""` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes for cassandra container | `[]` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for cassandra container | `[]` |
|
||||
| `initContainers` | Add additional init containers to the cassandra pods | `[]` |
|
||||
| `sidecars` | Add additional sidecar containers to the cassandra pods | `[]` |
|
||||
| `pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
|
||||
| `pdb.minAvailable` | Mininimum number of pods that must still be available after the eviction | `""` |
|
||||
| `pdb.maxUnavailable` | Max number of pods that can be unavailable after the eviction | `""` |
|
||||
| `hostNetwork` | Enable HOST Network | `false` |
|
||||
| `containerPorts.intra` | Intra Port on the Host and Container | `7000` |
|
||||
| `containerPorts.tls` | TLS Port on the Host and Container | `7001` |
|
||||
| `containerPorts.jmx` | JMX Port on the Host and Container | `7199` |
|
||||
| `containerPorts.cql` | CQL Port on the Host and Container | `9042` |
|
||||
| `hostPorts.intra` | Intra Port on the Host | `""` |
|
||||
| `hostPorts.tls` | TLS Port on the Host | `""` |
|
||||
| `hostPorts.jmx` | JMX Port on the Host | `""` |
|
||||
| `hostPorts.cql` | CQL Port on the Host | `""` |
|
||||
|
||||
### RBAC parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------- | ---------------------------------------------------------- | ------- |
|
||||
| `serviceAccount.create` | Enable the creation of a ServiceAccount for Cassandra pods | `true` |
|
||||
| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `serviceAccount.annotations` | Annotations for Cassandra Service Account | `{}` |
|
||||
| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account. | `false` |
|
||||
|
||||
### Traffic Exposure Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | ---------------------------------------------------------------------------------- | ----------- |
|
||||
| `service.type` | Cassandra service type | `ClusterIP` |
|
||||
| `service.ports.cql` | Cassandra service CQL Port | `9042` |
|
||||
| `service.ports.metrics` | Cassandra service metrics port | `8080` |
|
||||
| `service.nodePorts.cql` | Node port for CQL | `""` |
|
||||
| `service.nodePorts.metrics` | Node port for metrics | `""` |
|
||||
| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `[]` |
|
||||
| `service.loadBalancerIP` | LoadBalancerIP if service type is `LoadBalancer` | `""` |
|
||||
| `service.loadBalancerSourceRanges` | Service Load Balancer sources | `[]` |
|
||||
| `service.clusterIP` | Service Cluster IP | `""` |
|
||||
| `service.externalTrafficPolicy` | Service external traffic policy | `Cluster` |
|
||||
| `service.annotations` | Provide any additional annotations which may be required. | `{}` |
|
||||
| `service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` |
|
||||
| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `service.headless.annotations` | Annotations for the headless service. | `{}` |
|
||||
| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
|
||||
| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
|
||||
### Persistence parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| `persistence.enabled` | Enable Cassandra data persistence using PVC, use a Persistent Volume Claim, If false, use emptyDir | `true` |
|
||||
| `persistence.existingClaim` | Name of an existing PVC to use | `""` |
|
||||
| `persistence.storageClass` | PVC Storage Class for Cassandra data volume | `""` |
|
||||
| `persistence.commitStorageClass` | PVC Storage Class for Cassandra Commit Log volume | `""` |
|
||||
| `persistence.annotations` | Persistent Volume Claim annotations | `{}` |
|
||||
| `persistence.accessModes` | Persistent Volume Access Mode | `["ReadWriteOnce"]` |
|
||||
| `persistence.size` | PVC Storage Request for Cassandra data volume | `8Gi` |
|
||||
| `persistence.commitLogsize` | PVC Storage Request for Cassandra commit log volume. Unset by default | `2Gi` |
|
||||
| `persistence.mountPath` | The path the data volume will be mounted at | `/bitnami/cassandra` |
|
||||
| `persistence.commitLogMountPath` | The path the commit log volume will be mounted at. Unset by default. Set it to '/bitnami/cassandra/commitlog' to enable a separate commit log volume | `""` |
|
||||
|
||||
### Volume Permissions parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume | `false` |
|
||||
| `volumePermissions.image.registry` | Init container volume image registry | `REGISTRY_NAME` |
|
||||
| `volumePermissions.image.repository` | Init container volume image repository | `REPOSITORY_NAME/os-shell` |
|
||||
| `volumePermissions.image.digest` | Init container volume image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `volumePermissions.image.pullPolicy` | Init container volume pull policy | `IfNotPresent` |
|
||||
| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `volumePermissions.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` |
|
||||
| `volumePermissions.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `volumePermissions.securityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
|
||||
| `volumePermissions.securityContext.runAsUser` | User ID for the init container | `0` |
|
||||
|
||||
### Metrics parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ |
|
||||
| `metrics.enabled` | Start a side-car prometheus exporter | `false` |
|
||||
| `metrics.image.registry` | Cassandra exporter image registry | `REGISTRY_NAME` |
|
||||
| `metrics.image.repository` | Cassandra exporter image name | `REPOSITORY_NAME/cassandra-exporter` |
|
||||
| `metrics.image.digest` | Cassandra exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `metrics.image.pullPolicy` | image pull policy | `IfNotPresent` |
|
||||
| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` |
|
||||
| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` |
|
||||
| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `45` |
|
||||
| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `metrics.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for cassandra-exporter container | `[]` |
|
||||
| `metrics.podAnnotations` | Metrics exporter pod Annotation and Labels | `{}` |
|
||||
| `metrics.serviceMonitor.enabled` | If `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` |
|
||||
| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `monitoring` |
|
||||
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` |
|
||||
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
|
||||
| `metrics.serviceMonitor.metricRelabelings` | Specify Metric Relabelings to add to the scrape endpoint | `[]` |
|
||||
| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` |
|
||||
| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` |
|
||||
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` |
|
||||
| `metrics.serviceMonitor.labels` | Used to pass Labels that are required by the installed Prometheus Operator | `{}` |
|
||||
| `metrics.containerPorts.http` | HTTP Port on the Host and Container | `8080` |
|
||||
| `metrics.containerPorts.jmx` | JMX Port on the Host and Container | `5555` |
|
||||
| `metrics.hostPorts.http` | HTTP Port on the Host | `""` |
|
||||
| `metrics.hostPorts.jmx` | JMX Port on the Host | `""` |
|
||||
| `metrics.configuration` | Configure Cassandra-exporter with a custom config.yml file | `""` |
|
||||
|
||||
### TLS/SSL parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `tls.internodeEncryption` | Set internode encryption | `none` |
|
||||
| `tls.clientEncryption` | Set client-server encryption | `false` |
|
||||
| `tls.autoGenerated` | Generate automatically self-signed TLS certificates. Currently only supports PEM certificates | `false` |
|
||||
| `tls.existingSecret` | Existing secret that contains Cassandra Keystore and truststore | `""` |
|
||||
| `tls.passwordsSecret` | Secret containing the Keystore and Truststore passwords if needed | `""` |
|
||||
| `tls.keystorePassword` | Password for the keystore, if needed. | `""` |
|
||||
| `tls.truststorePassword` | Password for the truststore, if needed. | `""` |
|
||||
| `tls.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if tls.resources is set (tls.resources is recommended for production). | `nano` |
|
||||
| `tls.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `tls.certificatesSecret` | Secret with the TLS certificates. | `""` |
|
||||
| `tls.tlsEncryptionSecretName` | Secret with the encryption of the TLS certificates | `""` |
|
||||
|
||||
The above parameters map to the env variables defined in [bitnami/cassandra](https://github.com/bitnami/containers/tree/main/bitnami/cassandra). For more information please refer to the [bitnami/cassandra](https://github.com/bitnami/containers/tree/main/bitnami/cassandra) image documentation.
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
helm install my-release \
|
||||
--set dbUser.user=admin,dbUser.password=password \
|
||||
oci://REGISTRY_NAME/REPOSITORY_NAME/cassandra
|
||||
```
|
||||
|
||||
> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/cassandra
|
||||
```
|
||||
|
||||
> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
|
||||
> **Tip**: You can use the default [values.yaml](https://github.com/bitnami/charts/tree/main/bitnami/cassandra/values.yaml)
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
|
||||
|
||||
## Upgrading
|
||||
|
||||
It's necessary to set the `dbUser.password` parameter when upgrading for readiness/liveness probes to work properly. When you install this chart for the first time, some notes will be displayed providing the credentials you must use. Please note down the password and run the command below to upgrade your chart:
|
||||
|
||||
```console
|
||||
helm upgrade my-release oci://REGISTRY_NAME/REPOSITORY_NAME/cassandra --set dbUser.password=[PASSWORD]
|
||||
```
|
||||
|
||||
> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
|
||||
|
||||
| Note: you need to substitute the placeholder *[PASSWORD]* with the value obtained in the installation notes.
|
||||
|
||||
### To 12.1.0
|
||||
|
||||
This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850).
|
||||
|
||||
### To 12.0.0
|
||||
|
||||
Cassandra's version was bumped to `5.0`, [the latest GA version](https://cassandra.apache.org/_/blog/Apache-Cassandra-5.0-Announcement.html). Users can upgrade from version 4 to 5.0 through an online upgrade, minimizing downtime for applications. Nevertheless, a backup creation prior to undergoing the upgrade process is recommended. Please, refer to the [official guide](https://cassandra.apache.org/doc/latest/operating/backups.html#snapshots) for further information.
|
||||
|
||||
### To 10.0.0
|
||||
|
||||
This major bump changes the following security defaults:
|
||||
|
||||
- `runAsGroup` is changed from `0` to `1001`
|
||||
- `readOnlyRootFilesystem` is set to `true`
|
||||
- `resourcesPreset` is changed from `none` to the minimum size working in our test suites (NOTE: `resourcesPreset` is not meant for production usage, but `resources` adapted to your use case).
|
||||
- `global.compatibility.openshift.adaptSecurityContext` is changed from `disabled` to `auto`.
|
||||
|
||||
This could potentially break any customization or init scripts used in your deployment. If this is the case, change the default values to the previous ones.
|
||||
|
||||
### To 9.0.0
|
||||
|
||||
This major release renames several values in this chart and adds missing features, in order to be inline with the rest of assets in the Bitnami charts repository.
|
||||
|
||||
Affected values:
|
||||
|
||||
- `serviceMonitor.labels` renamed as `serviceMonitor.selector`.
|
||||
- `service.port` renamed as `service.ports.cql`.
|
||||
- `service.metricsPort` renamed as `service.ports.metrics`.
|
||||
- `service.nodePort` renamed as `service.nodePorts.cql`.
|
||||
- `updateStrategy` changed from String type (previously default to 'rollingUpdate') to Object type, allowing users to configure other updateStrategy parameters, similar to other charts.
|
||||
- Removed value `rollingUpdatePartition`, now configured using `updateStrategy` setting `updateStrategy.rollingUpdate.partition`.
|
||||
|
||||
### To 8.0.0
|
||||
|
||||
Cassandra's version was bumped to `4.0`, [the new major](https://cassandra.apache.org/_/blog/Apache-Cassandra-4.0-is-Here.html) considered LTS. Among other features, this release removes support for [Thrift](https://issues.apache.org/jira/browse/CASSANDRA-11115), which means that the following properties of the chart will no longer be available:
|
||||
|
||||
- `cluster.enableRPC`
|
||||
- `service.thriftPort`
|
||||
- `service.nodePorts.thrift`
|
||||
- `containerPorts.thrift`
|
||||
|
||||
For this version, there have been [intensive efforts](https://cwiki.apache.org/confluence/display/CASSANDRA/4.0+Quality%3A+Components+and+Test+Plans) from Apache to ensure that a safe cluster upgrade can be performed. Nevertheless, a backup creation prior to undergoing the upgrade process is recommended. Please, refer to the [official guide](https://cassandra.apache.org/doc/latest/operating/backups.html#snapshots) for further information.
|
||||
|
||||
### To 7.0.0
|
||||
|
||||
[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
|
||||
|
||||
### To 6.0.0
|
||||
|
||||
- Several parameters were renamed or disappeared in favor of new ones on this major version:
|
||||
- `securityContext.*` is deprecated in favor of `podSecurityContext` and `containerSecurityContext`.
|
||||
- Parameters prefixed with `statefulset.` were renamed removing the prefix. E.g. `statefulset.rollingUpdatePartition` -> renamed to `rollingUpdatePartition`.
|
||||
- `cluster.replicaCount` is renamed to `replicaCount`.
|
||||
- `cluster.domain` is renamed to `clusterDomain`.
|
||||
- Chart labels were adapted to follow the [Helm charts standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels).
|
||||
- This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/main/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade.
|
||||
|
||||
Consequences:
|
||||
|
||||
- Backwards compatibility is not guaranteed. To upgrade to `6.0.0`, install a new release of the Cassandra chart, and migrate the data from your previous release. To do so, create an snapshot of the database, and restore it on the new database. Check [this guide](https://cassandra.apache.org/doc/latest/operating/backups.html#snapshots) for more information.
|
||||
|
||||
### To 5.4.0
|
||||
|
||||
The `minimumAvailable` option has been renamed to `minAvailable` for consistency with other charts. This is not a breaking change as `minimumAvailable` never worked before because of an error in chart templates.
|
||||
|
||||
### To 5.0.0
|
||||
|
||||
An issue in StatefulSet manifest of the 4.x chart series rendered chart upgrades to be broken. The 5.0.0 series fixes this issue. To upgrade to the 5.x series you need to manually delete the Cassandra StatefulSet before executing the `helm upgrade` command.
|
||||
|
||||
```console
|
||||
kubectl delete sts -l release=<RELEASE_NAME>
|
||||
helm upgrade <RELEASE_NAME> ...
|
||||
```
|
||||
|
||||
### To 4.0.0
|
||||
|
||||
This release changes uses Bitnami Cassandra container `3.11.4-debian-9-r188`, based on Bash.
|
||||
|
||||
### To 2.0.0
|
||||
|
||||
This release make it possible to specify custom initialization scripts in both cql and sh files.
|
||||
|
||||
#### Breaking changes
|
||||
|
||||
- `startupCQL` has been removed. Instead, for initializing the database, see [this section](#initialize-the-database).
|
||||
|
||||
## License
|
||||
|
||||
Copyright © 2025 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
<http://www.apache.org/licenses/LICENSE-2.0>
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
26
cassandra/charts/common/.helmignore
Normal file
26
cassandra/charts/common/.helmignore
Normal file
@ -0,0 +1,26 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
# img folder
|
||||
img/
|
||||
# Changelog
|
||||
CHANGELOG.md
|
||||
23
cassandra/charts/common/Chart.yaml
Normal file
23
cassandra/charts/common/Chart.yaml
Normal file
@ -0,0 +1,23 @@
|
||||
annotations:
|
||||
category: Infrastructure
|
||||
licenses: Apache-2.0
|
||||
apiVersion: v2
|
||||
appVersion: 2.30.0
|
||||
description: A Library Helm Chart for grouping common logic between bitnami charts.
|
||||
This chart is not deployable by itself.
|
||||
home: https://bitnami.com
|
||||
icon: https://dyltqmyl993wv.cloudfront.net/downloads/logos/bitnami-mark.png
|
||||
keywords:
|
||||
- common
|
||||
- helper
|
||||
- template
|
||||
- function
|
||||
- bitnami
|
||||
maintainers:
|
||||
- name: Broadcom, Inc. All Rights Reserved.
|
||||
url: https://github.com/bitnami/charts
|
||||
name: common
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/common
|
||||
type: library
|
||||
version: 2.30.0
|
||||
235
cassandra/charts/common/README.md
Normal file
235
cassandra/charts/common/README.md
Normal file
@ -0,0 +1,235 @@
|
||||
# Bitnami Common Library Chart
|
||||
|
||||
A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between Bitnami charts.
|
||||
|
||||
## TL;DR
|
||||
|
||||
```yaml
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 2.x.x
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
```
|
||||
|
||||
```console
|
||||
helm dependency update
|
||||
```
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
data:
|
||||
myvalue: "Hello World"
|
||||
```
|
||||
|
||||
Looking to use our applications in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager.
|
||||
|
||||
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.23+
|
||||
- Helm 3.8.0+
|
||||
|
||||
## Parameters
|
||||
|
||||
## Special input schemas
|
||||
|
||||
### ImageRoot
|
||||
|
||||
```yaml
|
||||
registry:
|
||||
type: string
|
||||
description: Docker registry where the image is located
|
||||
example: docker.io
|
||||
|
||||
repository:
|
||||
type: string
|
||||
description: Repository and image name
|
||||
example: bitnami/nginx
|
||||
|
||||
tag:
|
||||
type: string
|
||||
description: image tag
|
||||
example: 1.16.1-debian-10-r63
|
||||
|
||||
pullPolicy:
|
||||
type: string
|
||||
description: Specify a imagePullPolicy.'
|
||||
|
||||
pullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: Optionally specify an array of imagePullSecrets (evaluated as templates).
|
||||
|
||||
debug:
|
||||
type: boolean
|
||||
description: Set to true if you would like to see extra information on logs
|
||||
example: false
|
||||
|
||||
## An instance would be:
|
||||
# registry: docker.io
|
||||
# repository: bitnami/nginx
|
||||
# tag: 1.16.1-debian-10-r63
|
||||
# pullPolicy: IfNotPresent
|
||||
# debug: false
|
||||
```
|
||||
|
||||
### Persistence
|
||||
|
||||
```yaml
|
||||
enabled:
|
||||
type: boolean
|
||||
description: Whether enable persistence.
|
||||
example: true
|
||||
|
||||
storageClass:
|
||||
type: string
|
||||
description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning.
|
||||
example: "-"
|
||||
|
||||
accessMode:
|
||||
type: string
|
||||
description: Access mode for the Persistent Volume Storage.
|
||||
example: ReadWriteOnce
|
||||
|
||||
size:
|
||||
type: string
|
||||
description: Size the Persistent Volume Storage.
|
||||
example: 8Gi
|
||||
|
||||
path:
|
||||
type: string
|
||||
description: Path to be persisted.
|
||||
example: /bitnami
|
||||
|
||||
## An instance would be:
|
||||
# enabled: true
|
||||
# storageClass: "-"
|
||||
# accessMode: ReadWriteOnce
|
||||
# size: 8Gi
|
||||
# path: /bitnami
|
||||
```
|
||||
|
||||
### ExistingSecret
|
||||
|
||||
```yaml
|
||||
name:
|
||||
type: string
|
||||
description: Name of the existing secret.
|
||||
example: mySecret
|
||||
keyMapping:
|
||||
description: Mapping between the expected key name and the name of the key in the existing secret.
|
||||
type: object
|
||||
|
||||
## An instance would be:
|
||||
# name: mySecret
|
||||
# keyMapping:
|
||||
# password: myPasswordKey
|
||||
```
|
||||
|
||||
#### Example of use
|
||||
|
||||
When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets.
|
||||
|
||||
```yaml
|
||||
# templates/secret.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "common.names.fullname" . }}
|
||||
type: Opaque
|
||||
data:
|
||||
password: {{ .Values.password | b64enc | quote }}
|
||||
|
||||
# templates/dpl.yaml
|
||||
---
|
||||
...
|
||||
env:
|
||||
- name: PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }}
|
||||
key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }}
|
||||
...
|
||||
|
||||
# values.yaml
|
||||
---
|
||||
name: mySecret
|
||||
keyMapping:
|
||||
password: myPasswordKey
|
||||
```
|
||||
|
||||
### ValidateValue
|
||||
|
||||
#### NOTES.txt
|
||||
|
||||
```console
|
||||
{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}}
|
||||
|
||||
{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||
```
|
||||
|
||||
If we force those values to be empty we will see some alerts
|
||||
|
||||
```console
|
||||
helm install test mychart --set path.to.value00="",path.to.value01=""
|
||||
'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value:
|
||||
|
||||
export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d)
|
||||
|
||||
'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value:
|
||||
|
||||
export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d)
|
||||
```
|
||||
|
||||
## Upgrading
|
||||
|
||||
### To 1.0.0
|
||||
|
||||
[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
|
||||
|
||||
#### What changes were introduced in this major version?
|
||||
|
||||
- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field.
|
||||
- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information.
|
||||
- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts
|
||||
|
||||
#### Considerations when upgrading to this version
|
||||
|
||||
- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues
|
||||
- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore
|
||||
- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3
|
||||
|
||||
#### Useful links
|
||||
|
||||
- <https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-resolve-helm2-helm3-post-migration-issues-index.html>
|
||||
- <https://helm.sh/docs/topics/v2_v3_migration/>
|
||||
- <https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/>
|
||||
|
||||
## License
|
||||
|
||||
Copyright © 2025 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
<http://www.apache.org/licenses/LICENSE-2.0>
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
155
cassandra/charts/common/templates/_affinities.tpl
Normal file
155
cassandra/charts/common/templates/_affinities.tpl
Normal file
@ -0,0 +1,155 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return a soft nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.soft" -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- preference:
|
||||
matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
weight: 1
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.hard" -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a nodeAffinity definition
|
||||
{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.nodes.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.nodes.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a topologyKey definition
|
||||
{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.topologyKey" -}}
|
||||
{{ .topologyKey | default "kubernetes.io/hostname" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a soft podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.soft" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $customLabels := default (dict) .customLabels -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
|
||||
{{- $extraNamespaces := default (list) .extraNamespaces -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 10 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if $extraNamespaces }}
|
||||
namespaces:
|
||||
- {{ .context.Release.Namespace }}
|
||||
{{- with $extraNamespaces }}
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
weight: 1
|
||||
{{- range $extraPodAffinityTerms }}
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 10 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
weight: {{ .weight | default 1 -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.hard" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $customLabels := default (dict) .customLabels -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
|
||||
{{- $extraNamespaces := default (list) .extraNamespaces -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if $extraNamespaces }}
|
||||
namespaces:
|
||||
- {{ .context.Release.Namespace }}
|
||||
{{- with $extraNamespaces }}
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
{{- range $extraPodAffinityTerms }}
|
||||
- labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 8 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.pods.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.pods.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
253
cassandra/charts/common/templates/_capabilities.tpl
Normal file
253
cassandra/charts/common/templates/_capabilities.tpl
Normal file
@ -0,0 +1,253 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return the target Kubernetes version
|
||||
*/}}
|
||||
{{- define "common.capabilities.kubeVersion" -}}
|
||||
{{- default (default .Capabilities.KubeVersion.Version .Values.kubeVersion) ((.Values.global).kubeVersion) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if the apiVersion is supported
|
||||
Usage:
|
||||
{{ include "common.capabilities.apiVersions.has" (dict "version" "batch/v1" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.capabilities.apiVersions.has" -}}
|
||||
{{- $providedAPIVersions := default .context.Values.apiVersions ((.context.Values.global).apiVersions) -}}
|
||||
{{- if and (empty $providedAPIVersions) (.context.Capabilities.APIVersions.Has .version) -}}
|
||||
{{- true -}}
|
||||
{{- else if has .version $providedAPIVersions -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for poddisruptionbudget.
|
||||
*/}}
|
||||
{{- define "common.capabilities.policy.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
|
||||
{{- print "policy/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "policy/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for networkpolicy.
|
||||
*/}}
|
||||
{{- define "common.capabilities.networkPolicy.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.7-0" $kubeVersion) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for job.
|
||||
*/}}
|
||||
{{- define "common.capabilities.job.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
|
||||
{{- print "batch/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "batch/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for cronjob.
|
||||
*/}}
|
||||
{{- define "common.capabilities.cronjob.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
|
||||
{{- print "batch/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "batch/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for daemonset.
|
||||
*/}}
|
||||
{{- define "common.capabilities.daemonset.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for deployment.
|
||||
*/}}
|
||||
{{- define "common.capabilities.deployment.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for statefulset.
|
||||
*/}}
|
||||
{{- define "common.capabilities.statefulset.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||
{{- print "apps/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for ingress.
|
||||
*/}}
|
||||
{{- define "common.capabilities.ingress.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if (.Values.ingress).apiVersion -}}
|
||||
{{- .Values.ingress.apiVersion -}}
|
||||
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}}
|
||||
{{- print "networking.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for RBAC resources.
|
||||
*/}}
|
||||
{{- define "common.capabilities.rbac.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.17-0" $kubeVersion) -}}
|
||||
{{- print "rbac.authorization.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "rbac.authorization.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for CRDs.
|
||||
*/}}
|
||||
{{- define "common.capabilities.crd.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}}
|
||||
{{- print "apiextensions.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apiextensions.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for APIService.
|
||||
*/}}
|
||||
{{- define "common.capabilities.apiService.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.10-0" $kubeVersion) -}}
|
||||
{{- print "apiregistration.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apiregistration.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for Horizontal Pod Autoscaler.
|
||||
*/}}
|
||||
{{- define "common.capabilities.hpa.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
|
||||
{{- if .beta2 -}}
|
||||
{{- print "autoscaling/v2beta2" -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v2beta1" -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v2" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for Vertical Pod Autoscaler.
|
||||
*/}}
|
||||
{{- define "common.capabilities.vpa.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.11-0" $kubeVersion) -}}
|
||||
{{- print "autoscaling/v1beta1" -}}
|
||||
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||
{{- print "autoscaling/v1beta2" -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if PodSecurityPolicy is supported
|
||||
*/}}
|
||||
{{- define "common.capabilities.psp.supported" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if or (empty $kubeVersion) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if AdmissionConfiguration is supported
|
||||
*/}}
|
||||
{{- define "common.capabilities.admissionConfiguration.supported" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if or (empty $kubeVersion) (not (semverCompare "<1.23-0" $kubeVersion)) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for AdmissionConfiguration.
|
||||
*/}}
|
||||
{{- define "common.capabilities.admissionConfiguration.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
|
||||
{{- print "apiserver.config.k8s.io/v1alpha1" -}}
|
||||
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||
{{- print "apiserver.config.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apiserver.config.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for PodSecurityConfiguration.
|
||||
*/}}
|
||||
{{- define "common.capabilities.podSecurityConfiguration.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
|
||||
{{- print "pod-security.admission.config.k8s.io/v1alpha1" -}}
|
||||
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||
{{- print "pod-security.admission.config.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "pod-security.admission.config.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if the used Helm version is 3.3+.
|
||||
A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure.
|
||||
This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error.
|
||||
**To be removed when the catalog's minimun Helm version is 3.3**
|
||||
*/}}
|
||||
{{- define "common.capabilities.supportsHelmVersion" -}}
|
||||
{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
46
cassandra/charts/common/templates/_compatibility.tpl
Normal file
46
cassandra/charts/common/templates/_compatibility.tpl
Normal file
@ -0,0 +1,46 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return true if the detected platform is Openshift
|
||||
Usage:
|
||||
{{- include "common.compatibility.isOpenshift" . -}}
|
||||
*/}}
|
||||
{{- define "common.compatibility.isOpenshift" -}}
|
||||
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Render a compatible securityContext depending on the platform. By default it is maintained as it is. In other platforms like Openshift we remove default user/group values that do not work out of the box with the restricted-v1 SCC
|
||||
Usage:
|
||||
{{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.compatibility.renderSecurityContext" -}}
|
||||
{{- $adaptedContext := .secContext -}}
|
||||
|
||||
{{- if (((.context.Values.global).compatibility).openshift) -}}
|
||||
{{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "common.compatibility.isOpenshift" .context)) -}}
|
||||
{{/* Remove incompatible user/group values that do not work in Openshift out of the box */}}
|
||||
{{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}}
|
||||
{{- if not .secContext.seLinuxOptions -}}
|
||||
{{/* If it is an empty object, we remove it from the resulting context because it causes validation issues */}}
|
||||
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{/* Remove empty seLinuxOptions object if global.compatibility.omitEmptySeLinuxOptions is set to true */}}
|
||||
{{- if and (((.context.Values.global).compatibility).omitEmptySeLinuxOptions) (not .secContext.seLinuxOptions) -}}
|
||||
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||||
{{- end -}}
|
||||
{{/* Remove fields that are disregarded when running the container in privileged mode */}}
|
||||
{{- if $adaptedContext.privileged -}}
|
||||
{{- $adaptedContext = omit $adaptedContext "capabilities" -}}
|
||||
{{- end -}}
|
||||
{{- omit $adaptedContext "enabled" | toYaml -}}
|
||||
{{- end -}}
|
||||
85
cassandra/charts/common/templates/_errors.tpl
Normal file
85
cassandra/charts/common/templates/_errors.tpl
Normal file
@ -0,0 +1,85 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Throw error when upgrading using empty passwords values that must not be empty.
|
||||
|
||||
Usage:
|
||||
{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}}
|
||||
{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }}
|
||||
|
||||
Required password params:
|
||||
- validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error.
|
||||
- context - Context - Required. Parent context.
|
||||
*/}}
|
||||
{{- define "common.errors.upgrade.passwords.empty" -}}
|
||||
{{- $validationErrors := join "" .validationErrors -}}
|
||||
{{- if and $validationErrors .context.Release.IsUpgrade -}}
|
||||
{{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}}
|
||||
{{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}}
|
||||
{{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}}
|
||||
{{- $errorString = print $errorString "\n%s" -}}
|
||||
{{- printf $errorString $validationErrors | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Throw error when original container images are replaced.
|
||||
The error can be bypassed by setting the "global.security.allowInsecureImages" to true. In this case,
|
||||
a warning message will be shown instead.
|
||||
|
||||
Usage:
|
||||
{{ include "common.errors.insecureImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.errors.insecureImages" -}}
|
||||
{{- $relocatedImages := list -}}
|
||||
{{- $replacedImages := list -}}
|
||||
{{- $retaggedImages := list -}}
|
||||
{{- $globalRegistry := ((.context.Values.global).imageRegistry) -}}
|
||||
{{- $originalImages := .context.Chart.Annotations.images -}}
|
||||
{{- range .images -}}
|
||||
{{- $registryName := default .registry $globalRegistry -}}
|
||||
{{- $fullImageNameNoTag := printf "%s/%s" $registryName .repository -}}
|
||||
{{- $fullImageName := printf "%s:%s" $fullImageNameNoTag .tag -}}
|
||||
{{- if not (contains $fullImageNameNoTag $originalImages) -}}
|
||||
{{- if not (contains $registryName $originalImages) -}}
|
||||
{{- $relocatedImages = append $relocatedImages $fullImageName -}}
|
||||
{{- else if not (contains .repository $originalImages) -}}
|
||||
{{- $replacedImages = append $replacedImages $fullImageName -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not (contains (printf "%s:%s" .repository .tag) $originalImages) -}}
|
||||
{{- $retaggedImages = append $retaggedImages $fullImageName -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if and (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) (((.context.Values.global).security).allowInsecureImages) -}}
|
||||
{{- print "\n\n⚠ SECURITY WARNING: Verifying original container images was skipped. Please note this Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.\n" -}}
|
||||
{{- else if (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) -}}
|
||||
{{- $errorString := "Original containers have been substituted for unrecognized ones. Deploying this chart with non-standard containers is likely to cause degraded security and performance, broken chart features, and missing environment variables." -}}
|
||||
{{- $errorString = print $errorString "\n\nUnrecognized images:" -}}
|
||||
{{- range (concat $relocatedImages $replacedImages) -}}
|
||||
{{- $errorString = print $errorString "\n - " . -}}
|
||||
{{- end -}}
|
||||
{{- if or (contains "docker.io/bitnami/" $originalImages) (contains "docker.io/bitnamiprem/" $originalImages) -}}
|
||||
{{- $errorString = print "\n\n⚠ ERROR: " $errorString -}}
|
||||
{{- $errorString = print $errorString "\n\nIf you are sure you want to proceed with non-standard containers, you can skip container image verification by setting the global parameter 'global.security.allowInsecureImages' to true." -}}
|
||||
{{- $errorString = print $errorString "\nFurther information can be obtained at https://github.com/bitnami/charts/issues/30850" -}}
|
||||
{{- print $errorString | fail -}}
|
||||
{{- else if gt (len $replacedImages) 0 -}}
|
||||
{{- $errorString = print "\n\n⚠ WARNING: " $errorString -}}
|
||||
{{- print $errorString -}}
|
||||
{{- end -}}
|
||||
{{- else if gt (len $retaggedImages) 0 -}}
|
||||
{{- $warnString := "\n\n⚠ WARNING: Original containers have been retagged. Please note this Helm chart was tested, and validated on multiple platforms using a specific set of Tanzu Application Catalog containers. Substituting original image tags could cause unexpected behavior." -}}
|
||||
{{- $warnString = print $warnString "\n\nRetagged images:" -}}
|
||||
{{- range $retaggedImages -}}
|
||||
{{- $warnString = print $warnString "\n - " . -}}
|
||||
{{- end -}}
|
||||
{{- print $warnString -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
115
cassandra/charts/common/templates/_images.tpl
Normal file
115
cassandra/charts/common/templates/_images.tpl
Normal file
@ -0,0 +1,115 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Return the proper image name.
|
||||
If image tag and digest are not defined, termination fallbacks to chart appVersion.
|
||||
{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" .Values.global "chart" .Chart ) }}
|
||||
*/}}
|
||||
{{- define "common.images.image" -}}
|
||||
{{- $registryName := default .imageRoot.registry ((.global).imageRegistry) -}}
|
||||
{{- $repositoryName := .imageRoot.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $termination := .imageRoot.tag | toString -}}
|
||||
|
||||
{{- if not .imageRoot.tag }}
|
||||
{{- if .chart }}
|
||||
{{- $termination = .chart.AppVersion | toString -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .imageRoot.digest }}
|
||||
{{- $separator = "@" -}}
|
||||
{{- $termination = .imageRoot.digest | toString -}}
|
||||
{{- end -}}
|
||||
{{- if $registryName }}
|
||||
{{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s%s%s" $repositoryName $separator $termination -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
|
||||
{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
|
||||
*/}}
|
||||
{{- define "common.images.pullSecrets" -}}
|
||||
{{- $pullSecrets := list }}
|
||||
|
||||
{{- range ((.global).imagePullSecrets) -}}
|
||||
{{- if kindIs "map" . -}}
|
||||
{{- $pullSecrets = append $pullSecrets .name -}}
|
||||
{{- else -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- range .images -}}
|
||||
{{- range .pullSecrets -}}
|
||||
{{- if kindIs "map" . -}}
|
||||
{{- $pullSecrets = append $pullSecrets .name -}}
|
||||
{{- else -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not (empty $pullSecrets)) -}}
|
||||
imagePullSecrets:
|
||||
{{- range $pullSecrets | uniq }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names evaluating values as templates
|
||||
{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.images.renderPullSecrets" -}}
|
||||
{{- $pullSecrets := list }}
|
||||
{{- $context := .context }}
|
||||
|
||||
{{- range (($context.Values.global).imagePullSecrets) -}}
|
||||
{{- if kindIs "map" . -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}}
|
||||
{{- else -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range .images -}}
|
||||
{{- range .pullSecrets -}}
|
||||
{{- if kindIs "map" . -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}}
|
||||
{{- else -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not (empty $pullSecrets)) -}}
|
||||
imagePullSecrets:
|
||||
{{- range $pullSecrets | uniq }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image version (ingores image revision/prerelease info & fallbacks to chart appVersion)
|
||||
{{ include "common.images.version" ( dict "imageRoot" .Values.path.to.the.image "chart" .Chart ) }}
|
||||
*/}}
|
||||
{{- define "common.images.version" -}}
|
||||
{{- $imageTag := .imageRoot.tag | toString -}}
|
||||
{{/* regexp from https://github.com/mainminds/semver/blob/23f51de38a0866c5ef0bfc42b3f735c73107b700/version.go#L41-L44 */}}
|
||||
{{- if regexMatch `^([0-9]+)(\.[0-9]+)?(\.[0-9]+)?(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?$` $imageTag -}}
|
||||
{{- $version := semver $imageTag -}}
|
||||
{{- printf "%d.%d.%d" $version.Major $version.Minor $version.Patch -}}
|
||||
{{- else -}}
|
||||
{{- print .chart.AppVersion -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
73
cassandra/charts/common/templates/_ingress.tpl
Normal file
73
cassandra/charts/common/templates/_ingress.tpl
Normal file
@ -0,0 +1,73 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Generate backend entry that is compatible with all Kubernetes API versions.
|
||||
|
||||
Usage:
|
||||
{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }}
|
||||
|
||||
Params:
|
||||
- serviceName - String. Name of an existing service backend
|
||||
- servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer.
|
||||
- context - Dict - Required. The context for the template evaluation.
|
||||
*/}}
|
||||
{{- define "common.ingress.backend" -}}
|
||||
{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}}
|
||||
{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}}
|
||||
serviceName: {{ .serviceName }}
|
||||
servicePort: {{ .servicePort }}
|
||||
{{- else -}}
|
||||
service:
|
||||
name: {{ .serviceName }}
|
||||
port:
|
||||
{{- if typeIs "string" .servicePort }}
|
||||
name: {{ .servicePort }}
|
||||
{{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }}
|
||||
number: {{ .servicePort | int }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Print "true" if the API pathType field is supported
|
||||
Usage:
|
||||
{{ include "common.ingress.supportsPathType" . }}
|
||||
*/}}
|
||||
{{- define "common.ingress.supportsPathType" -}}
|
||||
{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}}
|
||||
{{- print "false" -}}
|
||||
{{- else -}}
|
||||
{{- print "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if the ingressClassname field is supported
|
||||
Usage:
|
||||
{{ include "common.ingress.supportsIngressClassname" . }}
|
||||
*/}}
|
||||
{{- define "common.ingress.supportsIngressClassname" -}}
|
||||
{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "false" -}}
|
||||
{{- else -}}
|
||||
{{- print "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if cert-manager required annotations for TLS signed
|
||||
certificates are set in the Ingress annotations
|
||||
Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
|
||||
Usage:
|
||||
{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }}
|
||||
*/}}
|
||||
{{- define "common.ingress.certManagerRequest" -}}
|
||||
{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
46
cassandra/charts/common/templates/_labels.tpl
Normal file
46
cassandra/charts/common/templates/_labels.tpl
Normal file
@ -0,0 +1,46 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Kubernetes standard labels
|
||||
{{ include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.labels.standard" -}}
|
||||
{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
|
||||
{{- $default := dict "app.kubernetes.io/name" (include "common.names.name" .context) "helm.sh/chart" (include "common.names.chart" .context) "app.kubernetes.io/instance" .context.Release.Name "app.kubernetes.io/managed-by" .context.Release.Service -}}
|
||||
{{- with .context.Chart.AppVersion -}}
|
||||
{{- $_ := set $default "app.kubernetes.io/version" . -}}
|
||||
{{- end -}}
|
||||
{{ template "common.tplvalues.merge" (dict "values" (list .customLabels $default) "context" .context) }}
|
||||
{{- else -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
helm.sh/chart: {{ include "common.names.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- with .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels used on immutable fields such as deploy.spec.selector.matchLabels or svc.spec.selector
|
||||
{{ include "common.labels.matchLabels" (dict "customLabels" .Values.podLabels "context" $) -}}
|
||||
|
||||
We don't want to loop over custom labels appending them to the selector
|
||||
since it's very likely that it will break deployments, services, etc.
|
||||
However, it's important to overwrite the standard labels if the user
|
||||
overwrote them on metadata.labels fields.
|
||||
*/}}
|
||||
{{- define "common.labels.matchLabels" -}}
|
||||
{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
|
||||
{{ merge (pick (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) "app.kubernetes.io/name" "app.kubernetes.io/instance") (dict "app.kubernetes.io/name" (include "common.names.name" .context) "app.kubernetes.io/instance" .context.Release.Name ) | toYaml }}
|
||||
{{- else -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
71
cassandra/charts/common/templates/_names.tpl
Normal file
71
cassandra/charts/common/templates/_names.tpl
Normal file
@ -0,0 +1,71 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "common.names.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "common.names.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "common.names.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified dependency name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
Usage:
|
||||
{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.names.dependency.fullname" -}}
|
||||
{{- if .chartValues.fullnameOverride -}}
|
||||
{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .chartName .chartValues.nameOverride -}}
|
||||
{{- if contains $name .context.Release.Name -}}
|
||||
{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
|
||||
*/}}
|
||||
{{- define "common.names.namespace" -}}
|
||||
{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a fully qualified app name adding the installation's namespace.
|
||||
*/}}
|
||||
{{- define "common.names.fullname.namespace" -}}
|
||||
{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
50
cassandra/charts/common/templates/_resources.tpl
Normal file
50
cassandra/charts/common/templates/_resources.tpl
Normal file
@ -0,0 +1,50 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return a resource request/limit object based on a given preset.
|
||||
These presets are for basic testing and not meant to be used in production
|
||||
{{ include "common.resources.preset" (dict "type" "nano") -}}
|
||||
*/}}
|
||||
{{- define "common.resources.preset" -}}
|
||||
{{/* The limits are the requests increased by 50% (except ephemeral-storage and xlarge/2xlarge sizes)*/}}
|
||||
{{- $presets := dict
|
||||
"nano" (dict
|
||||
"requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "150m" "memory" "192Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"micro" (dict
|
||||
"requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "375m" "memory" "384Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"small" (dict
|
||||
"requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "750m" "memory" "768Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"medium" (dict
|
||||
"requests" (dict "cpu" "500m" "memory" "1024Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "750m" "memory" "1536Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"large" (dict
|
||||
"requests" (dict "cpu" "1.0" "memory" "2048Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "1.5" "memory" "3072Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"xlarge" (dict
|
||||
"requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "3.0" "memory" "6144Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"2xlarge" (dict
|
||||
"requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "6.0" "memory" "12288Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
}}
|
||||
{{- if hasKey $presets .type -}}
|
||||
{{- index $presets .type | toYaml -}}
|
||||
{{- else -}}
|
||||
{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
192
cassandra/charts/common/templates/_secrets.tpl
Normal file
192
cassandra/charts/common/templates/_secrets.tpl
Normal file
@ -0,0 +1,192 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Generate secret name.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }}
|
||||
|
||||
Params:
|
||||
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||
- defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment.
|
||||
- context - Dict - Required. The context for the template evaluation.
|
||||
*/}}
|
||||
{{- define "common.secrets.name" -}}
|
||||
{{- $name := (include "common.names.fullname" .context) -}}
|
||||
|
||||
{{- if .defaultNameSuffix -}}
|
||||
{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with .existingSecret -}}
|
||||
{{- if not (typeIs "string" .) -}}
|
||||
{{- with .name -}}
|
||||
{{- $name = . -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $name = . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- printf "%s" $name -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate secret key.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }}
|
||||
|
||||
Params:
|
||||
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||
- key - String - Required. Name of the key in the secret.
|
||||
*/}}
|
||||
{{- define "common.secrets.key" -}}
|
||||
{{- $key := .key -}}
|
||||
|
||||
{{- if .existingSecret -}}
|
||||
{{- if not (typeIs "string" .existingSecret) -}}
|
||||
{{- if .existingSecret.keyMapping -}}
|
||||
{{- $key = index .existingSecret.keyMapping $.key -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- printf "%s" $key -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate secret password or retrieve one if already created.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "honorProvidedValues" false "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- key - String - Required - Name of the key in the secret.
|
||||
- providedValues - List<String> - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||
- length - int - Optional - Length of the generated random password.
|
||||
- strong - Boolean - Optional - Whether to add symbols to the generated random password.
|
||||
- chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart.
|
||||
- context - Context - Required - Parent context.
|
||||
- failOnNew - Boolean - Optional - Default to true. If set to false, skip errors adding new keys to existing secrets.
|
||||
- skipB64enc - Boolean - Optional - Default to false. If set to true, no the secret will not be base64 encrypted.
|
||||
- skipQuote - Boolean - Optional - Default to false. If set to true, no quotes will be added around the secret.
|
||||
- honorProvidedValues - Boolean - Optional - Default to false. If set to true, the values in providedValues have higher priority than an existing secret
|
||||
The order in which this function returns a secret password:
|
||||
1. Password provided via the values.yaml if honorProvidedValues = true
|
||||
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
|
||||
2. Already existing 'Secret' resource
|
||||
(If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned)
|
||||
3. Password provided via the values.yaml if honorProvidedValues = false
|
||||
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
|
||||
4. Randomly generated secret password
|
||||
(A new random secret password with the length specified in the 'length' parameter will be generated and returned)
|
||||
|
||||
*/}}
|
||||
{{- define "common.secrets.passwords.manage" -}}
|
||||
|
||||
{{- $password := "" }}
|
||||
{{- $subchart := "" }}
|
||||
{{- $chartName := default "" .chartName }}
|
||||
{{- $passwordLength := default 10 .length }}
|
||||
{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }}
|
||||
{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }}
|
||||
{{- if $secretData }}
|
||||
{{- if hasKey $secretData .key }}
|
||||
{{- $password = index $secretData .key | b64dec }}
|
||||
{{- else if not (eq .failOnNew false) }}
|
||||
{{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if and $providedPasswordValue .honorProvidedValues }}
|
||||
{{- $password = $providedPasswordValue | toString }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not $password }}
|
||||
{{- if $providedPasswordValue }}
|
||||
{{- $password = $providedPasswordValue | toString }}
|
||||
{{- else }}
|
||||
{{- if .context.Values.enabled }}
|
||||
{{- $subchart = $chartName }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not (eq .failOnNew false) }}
|
||||
{{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}}
|
||||
{{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}}
|
||||
{{- $passwordValidationErrors := list $requiredPasswordError -}}
|
||||
{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if .strong }}
|
||||
{{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }}
|
||||
{{- $password = randAscii $passwordLength }}
|
||||
{{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }}
|
||||
{{- $password = printf "%s%s" $subStr $password | toString | shuffle }}
|
||||
{{- else }}
|
||||
{{- $password = randAlphaNum $passwordLength }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not .skipB64enc }}
|
||||
{{- $password = $password | b64enc }}
|
||||
{{- end -}}
|
||||
{{- if .skipQuote -}}
|
||||
{{- printf "%s" $password -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" $password | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Reuses the value from an existing secret, otherwise sets its value to a default value.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- key - String - Required - Name of the key in the secret.
|
||||
- defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||
- context - Context - Required - Parent context.
|
||||
|
||||
*/}}
|
||||
{{- define "common.secrets.lookup" -}}
|
||||
{{- $value := "" -}}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}}
|
||||
{{- if and $secretData (hasKey $secretData .key) -}}
|
||||
{{- $value = index $secretData .key -}}
|
||||
{{- else if .defaultValue -}}
|
||||
{{- $value = .defaultValue | toString | b64enc -}}
|
||||
{{- end -}}
|
||||
{{- if $value -}}
|
||||
{{- printf "%s" $value -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns whether a previous generated secret already exists
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- context - Context - Required - Parent context.
|
||||
*/}}
|
||||
{{- define "common.secrets.exists" -}}
|
||||
{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }}
|
||||
{{- if $secret }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
21
cassandra/charts/common/templates/_storage.tpl
Normal file
21
cassandra/charts/common/templates/_storage.tpl
Normal file
@ -0,0 +1,21 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return the proper Storage Class
|
||||
{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }}
|
||||
*/}}
|
||||
{{- define "common.storage.class" -}}
|
||||
{{- $storageClass := (.global).storageClass | default .persistence.storageClass | default (.global).defaultStorageClass | default "" -}}
|
||||
{{- if $storageClass -}}
|
||||
{{- if (eq "-" $storageClass) -}}
|
||||
{{- printf "storageClassName: \"\"" -}}
|
||||
{{- else -}}
|
||||
{{- printf "storageClassName: %s" $storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
52
cassandra/charts/common/templates/_tplvalues.tpl
Normal file
52
cassandra/charts/common/templates/_tplvalues.tpl
Normal file
@ -0,0 +1,52 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Renders a value that contains template perhaps with scope if the scope is present.
|
||||
Usage:
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }}
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }}
|
||||
*/}}
|
||||
{{- define "common.tplvalues.render" -}}
|
||||
{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }}
|
||||
{{- if contains "{{" (toJson .value) }}
|
||||
{{- if .scope }}
|
||||
{{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }}
|
||||
{{- else }}
|
||||
{{- tpl $value .context }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- $value }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Merge a list of values that contains template after rendering them.
|
||||
Merge precedence is consistent with http://mainminds.github.io/sprig/dicts.html#merge-mustmerge
|
||||
Usage:
|
||||
{{ include "common.tplvalues.merge" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }}
|
||||
*/}}
|
||||
{{- define "common.tplvalues.merge" -}}
|
||||
{{- $dst := dict -}}
|
||||
{{- range .values -}}
|
||||
{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | merge $dst -}}
|
||||
{{- end -}}
|
||||
{{ $dst | toYaml }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Merge a list of values that contains template after rendering them.
|
||||
Merge precedence is consistent with https://mainminds.github.io/sprig/dicts.html#mergeoverwrite-mustmergeoverwrite
|
||||
Usage:
|
||||
{{ include "common.tplvalues.merge-overwrite" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }}
|
||||
*/}}
|
||||
{{- define "common.tplvalues.merge-overwrite" -}}
|
||||
{{- $dst := dict -}}
|
||||
{{- range .values -}}
|
||||
{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | mergeOverwrite $dst -}}
|
||||
{{- end -}}
|
||||
{{ $dst | toYaml }}
|
||||
{{- end -}}
|
||||
77
cassandra/charts/common/templates/_utils.tpl
Normal file
77
cassandra/charts/common/templates/_utils.tpl
Normal file
@ -0,0 +1,77 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Print instructions to get a secret value.
|
||||
Usage:
|
||||
{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.secret.getvalue" -}}
|
||||
{{- $varname := include "common.utils.fieldToEnvVar" . -}}
|
||||
export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d)
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Build env var name given a field
|
||||
Usage:
|
||||
{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }}
|
||||
*/}}
|
||||
{{- define "common.utils.fieldToEnvVar" -}}
|
||||
{{- $fieldNameSplit := splitList "-" .field -}}
|
||||
{{- $upperCaseFieldNameSplit := list -}}
|
||||
|
||||
{{- range $fieldNameSplit -}}
|
||||
{{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ join "_" $upperCaseFieldNameSplit }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Gets a value from .Values given
|
||||
Usage:
|
||||
{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.getValueFromKey" -}}
|
||||
{{- $splitKey := splitList "." .key -}}
|
||||
{{- $value := "" -}}
|
||||
{{- $latestObj := $.context.Values -}}
|
||||
{{- range $splitKey -}}
|
||||
{{- if not $latestObj -}}
|
||||
{{- printf "please review the entire path of '%s' exists in values" $.key | fail -}}
|
||||
{{- end -}}
|
||||
{{- $value = ( index $latestObj . ) -}}
|
||||
{{- $latestObj = $value -}}
|
||||
{{- end -}}
|
||||
{{- printf "%v" (default "" $value) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns first .Values key with a defined value or first of the list if all non-defined
|
||||
Usage:
|
||||
{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.getKeyFromList" -}}
|
||||
{{- $key := first .keys -}}
|
||||
{{- $reverseKeys := reverse .keys }}
|
||||
{{- range $reverseKeys }}
|
||||
{{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }}
|
||||
{{- if $value -}}
|
||||
{{- $key = . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $key -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Checksum a template at "path" containing a *single* resource (ConfigMap,Secret) for use in pod annotations, excluding the metadata (see #18376).
|
||||
Usage:
|
||||
{{ include "common.utils.checksumTemplate" (dict "path" "/configmap.yaml" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.checksumTemplate" -}}
|
||||
{{- $obj := include (print .context.Template.BasePath .path) .context | fromYaml -}}
|
||||
{{ omit $obj "apiVersion" "kind" "metadata" | toYaml | sha256sum }}
|
||||
{{- end -}}
|
||||
109
cassandra/charts/common/templates/_warnings.tpl
Normal file
109
cassandra/charts/common/templates/_warnings.tpl
Normal file
@ -0,0 +1,109 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Warning about using rolling tag.
|
||||
Usage:
|
||||
{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }}
|
||||
*/}}
|
||||
{{- define "common.warnings.rollingTag" -}}
|
||||
|
||||
{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Warning about replaced images from the original.
|
||||
Usage:
|
||||
{{ include "common.warnings.modifiedImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.warnings.modifiedImages" -}}
|
||||
{{- $affectedImages := list -}}
|
||||
{{- $printMessage := false -}}
|
||||
{{- $originalImages := .context.Chart.Annotations.images -}}
|
||||
{{- range .images -}}
|
||||
{{- $fullImageName := printf (printf "%s/%s:%s" .registry .repository .tag) -}}
|
||||
{{- if not (contains $fullImageName $originalImages) }}
|
||||
{{- $affectedImages = append $affectedImages (printf "%s/%s:%s" .registry .repository .tag) -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $printMessage }}
|
||||
|
||||
⚠ SECURITY WARNING: Original containers have been substituted. This Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.
|
||||
|
||||
Substituted images detected:
|
||||
{{- range $affectedImages }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Warning about not setting the resource object in all deployments.
|
||||
Usage:
|
||||
{{ include "common.warnings.resources" (dict "sections" (list "path1" "path2") context $) }}
|
||||
Example:
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "csiProvider.provider" "server" "volumePermissions" "") "context" $) }}
|
||||
The list in the example assumes that the following values exist:
|
||||
- csiProvider.provider.resources
|
||||
- server.resources
|
||||
- volumePermissions.resources
|
||||
- resources
|
||||
*/}}
|
||||
{{- define "common.warnings.resources" -}}
|
||||
{{- $values := .context.Values -}}
|
||||
{{- $printMessage := false -}}
|
||||
{{ $affectedSections := list -}}
|
||||
{{- range .sections -}}
|
||||
{{- if eq . "" -}}
|
||||
{{/* Case where the resources section is at the root (one main deployment in the chart) */}}
|
||||
{{- if not (index $values "resources") -}}
|
||||
{{- $affectedSections = append $affectedSections "resources" -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{/* Case where the are multiple resources sections (more than one main deployment in the chart) */}}
|
||||
{{- $keys := split "." . -}}
|
||||
{{/* We iterate through the different levels until arriving to the resource section. Example: a.b.c.resources */}}
|
||||
{{- $section := $values -}}
|
||||
{{- range $keys -}}
|
||||
{{- $section = index $section . -}}
|
||||
{{- end -}}
|
||||
{{- if not (index $section "resources") -}}
|
||||
{{/* If the section has enabled=false or replicaCount=0, do not include it */}}
|
||||
{{- if and (hasKey $section "enabled") -}}
|
||||
{{- if index $section "enabled" -}}
|
||||
{{/* enabled=true */}}
|
||||
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- else if and (hasKey $section "replicaCount") -}}
|
||||
{{/* We need a casting to int because number 0 is not treated as an int by default */}}
|
||||
{{- if (gt (index $section "replicaCount" | int) 0) -}}
|
||||
{{/* replicaCount > 0 */}}
|
||||
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{/* Default case, add it to the affected sections */}}
|
||||
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $printMessage }}
|
||||
|
||||
WARNING: There are "resources" sections in the chart not set. Using "resourcesPreset" is not recommended for production. For production installations, please set the following values according to your workload needs:
|
||||
{{- range $affectedSections }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
+info https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
51
cassandra/charts/common/templates/validations/_cassandra.tpl
Normal file
51
cassandra/charts/common/templates/validations/_cassandra.tpl
Normal file
@ -0,0 +1,51 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.cassandra.dbUser.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.dbUser.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled cassandra.
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.cassandra.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key dbUser
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.key.dbUser" -}}
|
||||
{{- if .subchart -}}
|
||||
cassandra.dbUser
|
||||
{{- else -}}
|
||||
dbUser
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
108
cassandra/charts/common/templates/validations/_mariadb.tpl
Normal file
108
cassandra/charts/common/templates/validations/_mariadb.tpl
Normal file
@ -0,0 +1,108 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate MariaDB required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.mariadb.passwords" -}}
|
||||
{{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}}
|
||||
{{- $enabled := include "common.mariadb.values.enabled" . -}}
|
||||
{{- $architecture := include "common.mariadb.values.architecture" . -}}
|
||||
{{- $authPrefix := include "common.mariadb.values.key.auth" . -}}
|
||||
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||
{{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||
|
||||
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||
{{- if not (empty $valueUsername) -}}
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (eq $architecture "replication") -}}
|
||||
{{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mariadb.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mariadb.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mariadb.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mariadb.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mariadb.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
67
cassandra/charts/common/templates/validations/_mongodb.tpl
Normal file
67
cassandra/charts/common/templates/validations/_mongodb.tpl
Normal file
@ -0,0 +1,67 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mongodb.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mongodb.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mongodb.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mongodb.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mongodb.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
67
cassandra/charts/common/templates/validations/_mysql.tpl
Normal file
67
cassandra/charts/common/templates/validations/_mysql.tpl
Normal file
@ -0,0 +1,67 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mysql.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mysql.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mysql.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mysql.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mysql.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mysql.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
105
cassandra/charts/common/templates/validations/_postgresql.tpl
Normal file
105
cassandra/charts/common/templates/validations/_postgresql.tpl
Normal file
@ -0,0 +1,105 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Auxiliary function to decide whether evaluate global values.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }}
|
||||
Params:
|
||||
- key - String - Required. Field to be evaluated within global, e.g: "existingSecret"
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.use.global" -}}
|
||||
{{- if .context.Values.global -}}
|
||||
{{- if .context.Values.global.postgresql -}}
|
||||
{{- index .context.Values.global.postgresql .key | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.existingSecret" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.existingSecret" -}}
|
||||
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}}
|
||||
|
||||
{{- if .subchart -}}
|
||||
{{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}}
|
||||
{{- else -}}
|
||||
{{- default (.context.Values.existingSecret | quote) $globalValue -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled postgresql.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.postgresql.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key postgressPassword.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.key.postgressPassword" -}}
|
||||
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}}
|
||||
|
||||
{{- if not $globalValue -}}
|
||||
{{- if .subchart -}}
|
||||
postgresql.postgresqlPassword
|
||||
{{- else -}}
|
||||
postgresqlPassword
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
global.postgresql.postgresqlPassword
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled.replication.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.enabled.replication" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.postgresql.replication.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" .context.Values.replication.enabled -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key replication.password.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.key.replicationPassword" -}}
|
||||
{{- if .subchart -}}
|
||||
postgresql.replication.password
|
||||
{{- else -}}
|
||||
replication.password
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
48
cassandra/charts/common/templates/validations/_redis.tpl
Normal file
48
cassandra/charts/common/templates/validations/_redis.tpl
Normal file
@ -0,0 +1,48 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled redis.
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.redis.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.redis.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right prefix path for the values
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.redis.values.keys.prefix" -}}
|
||||
{{- if .subchart -}}redis.{{- else -}}{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Checks whether the redis chart's includes the standarizations (version >= 14)
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.standarized.version" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.redis.values.standarized.version" -}}
|
||||
|
||||
{{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}}
|
||||
{{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }}
|
||||
|
||||
{{- if $standarizedAuthValues -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@ -0,0 +1,51 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate values must not be empty.
|
||||
|
||||
Usage:
|
||||
{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}}
|
||||
{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||
|
||||
Validate value params:
|
||||
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||
*/}}
|
||||
{{- define "common.validations.values.multiple.empty" -}}
|
||||
{{- range .required -}}
|
||||
{{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate a value must not be empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }}
|
||||
|
||||
Validate value params:
|
||||
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||
- subchart - String - Optional - Name of the subchart that the validated password is part of.
|
||||
*/}}
|
||||
{{- define "common.validations.values.single.empty" -}}
|
||||
{{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }}
|
||||
{{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }}
|
||||
|
||||
{{- if not $value -}}
|
||||
{{- $varname := "my-value" -}}
|
||||
{{- $getCurrentValue := "" -}}
|
||||
{{- if and .secret .field -}}
|
||||
{{- $varname = include "common.utils.fieldToEnvVar" . -}}
|
||||
{{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}}
|
||||
{{- end -}}
|
||||
{{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
8
cassandra/charts/common/values.yaml
Normal file
8
cassandra/charts/common/values.yaml
Normal file
@ -0,0 +1,8 @@
|
||||
# Copyright Broadcom, Inc. All Rights Reserved.
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## bitnami/common
|
||||
## It is required by CI/CD tools and processes.
|
||||
## @skip exampleValue
|
||||
##
|
||||
exampleValue: common-chart
|
||||
96
cassandra/templates/NOTES.txt
Normal file
96
cassandra/templates/NOTES.txt
Normal file
@ -0,0 +1,96 @@
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
Did you know there are enterprise versions of the Bitnami catalog? For enhanced secure software supply chain features, unlimited pulls from Docker, LTS support, or application customization, see Bitnami Premium or Tanzu Application Catalog. See https://www.arrow.com/globalecs/na/vendors/bitnami for more information.
|
||||
|
||||
{{- $cassandraPasswordKey := ( include "common.secrets.key" (dict "existingSecret" .Values.dbUser.existingSecret "key" "cassandra-password") ) -}}
|
||||
{{- $cassandraSecretName := ( include "common.secrets.name" (dict "existingSecret" .Values.dbUser.existingSecret "context" $) ) -}}
|
||||
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||
|
||||
Get the list of pods by executing:
|
||||
|
||||
kubectl get pods --namespace {{ include "common.names.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||
|
||||
Access the pod you want to debug by executing
|
||||
|
||||
kubectl exec --namespace {{ include "common.names.namespace" . }} -ti <NAME OF THE POD> -- bash
|
||||
|
||||
In order to replicate the container startup scripts execute this command:
|
||||
|
||||
/opt/bitnami/scripts/cassandra/entrypoint.sh /opt/bitnami/scripts/cassandra/run.sh
|
||||
|
||||
{{- else }}
|
||||
|
||||
Cassandra can be accessed through the following URLs from within the cluster:
|
||||
|
||||
- CQL: {{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.ports.cql }}
|
||||
|
||||
To get your password run:
|
||||
|
||||
{{ include "common.utils.secret.getvalue" (dict "secret" $cassandraSecretName "field" $cassandraPasswordKey "context" $) }}
|
||||
|
||||
Check the cluster status by running:
|
||||
|
||||
kubectl exec -it --namespace {{ include "common.names.namespace" . }} $(kubectl get pods --namespace {{ include "common.names.namespace" . }} -l app.kubernetes.io/name={{ include "common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }} -o jsonpath='{.items[0].metadata.name}') nodetool status
|
||||
|
||||
To connect to your Cassandra cluster using CQL:
|
||||
|
||||
1. Run a Cassandra pod that you can use as a client:
|
||||
|
||||
kubectl run --namespace {{ include "common.names.namespace" . }} {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' \
|
||||
--env CASSANDRA_PASSWORD=$CASSANDRA_PASSWORD \
|
||||
{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ include "common.names.name" . }}-client=true"{{ end }} \
|
||||
--image {{ include "cassandra.image" . }} -- bash
|
||||
|
||||
2. Connect using the cqlsh client:
|
||||
|
||||
cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD {{ include "common.names.fullname" . }}
|
||||
|
||||
{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
|
||||
Note: Since NetworkPolicy is enabled, only pods with the label below will be able to connect to Cassandra:
|
||||
|
||||
"{{ include "common.names.fullname" . }}-client=true"
|
||||
|
||||
{{- else -}}
|
||||
|
||||
To connect to your database from outside the cluster execute the following commands:
|
||||
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
|
||||
cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD $NODE_IP $NODE_PORT
|
||||
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
Watch the status with: 'kubectl get svc --namespace {{ include "common.names.namespace" . }} -w {{ include "common.names.fullname" . }}'
|
||||
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
|
||||
cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD $SERVICE_IP
|
||||
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} {{ .Values.service.ports.cql }}:{{ .Values.service.ports.cql }} &
|
||||
cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD 127.0.0.1 {{ .Values.service.ports.cql }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.metrics.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
|
||||
{{- include "cassandra.validateValues" . }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "metrics" "" "tls" "volumePermissions") "context" $) }}
|
||||
{{- include "cassandra.warnings.jvm" . }}{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }}
|
||||
282
cassandra/templates/_helpers.tpl
Normal file
282
cassandra/templates/_helpers.tpl
Normal file
@ -0,0 +1,282 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return the proper Cassandra image name
|
||||
*/}}
|
||||
{{- define "cassandra.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper metrics image name
|
||||
*/}}
|
||||
{{- define "cassandra.metrics.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "cassandra.volumePermissions.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "cassandra.imagePullSecrets" -}}
|
||||
{{ include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image) "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "cassandra.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the list of Cassandra seed nodes
|
||||
*/}}
|
||||
{{- define "cassandra.seeds" -}}
|
||||
{{- $seeds := list }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $releaseNamespace := include "common.names.namespace" . }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $seedCount := .Values.cluster.seedCount | int }}
|
||||
{{- range $e, $i := until $seedCount }}
|
||||
{{- $seeds = append $seeds (printf "%s-%d.%s-headless.%s.svc.%s" $fullname $i $fullname $releaseNamespace $clusterDomain) }}
|
||||
{{- end }}
|
||||
{{- range .Values.cluster.extraSeeds }}
|
||||
{{- $seeds = append $seeds . }}
|
||||
{{- end }}
|
||||
{{- join "," $seeds }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
{{- define "cassandra.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "cassandra.validateValues.seedCount" .) -}}
|
||||
{{- $messages := append $messages (include "cassandra.validateValues.tls" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Cassandra - Number of seed nodes */}}
|
||||
{{- define "cassandra.validateValues.seedCount" -}}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- $seedCount := int .Values.cluster.seedCount }}
|
||||
{{- if or (lt $seedCount 1) (gt $seedCount $replicaCount) }}
|
||||
cassandra: cluster.seedCount
|
||||
|
||||
Number of seed nodes must be greater or equal than 1 and less or
|
||||
equal to `replicaCount`.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Cassandra - Tls enabled */}}
|
||||
{{- define "cassandra.validateValues.tls" -}}
|
||||
{{- if and (include "cassandra.tlsEncryption" .) (not .Values.tls.autoGenerated) (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }}
|
||||
cassandra: tls.enabled
|
||||
In order to enable TLS, you also need to provide
|
||||
an existing secret containing the Keystore and Truststore or
|
||||
enable auto-generated certificates.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Return the proper Commit Storage Class
|
||||
{{ include "cassandra.commitstorage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }}
|
||||
*/}}
|
||||
{{- define "cassandra.commitstorage.class" -}}
|
||||
{{- $storageClass := default .persistence.commitStorageClass | default (.global).defaultStorageClass | default "" -}}
|
||||
|
||||
{{- if $storageClass -}}
|
||||
{{- if (eq "-" $storageClass) -}}
|
||||
{{- printf "storageClassName: \"\"" -}}
|
||||
{{- else }}
|
||||
{{- printf "storageClassName: %s" $storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS for client connections should be configured
|
||||
*/}}
|
||||
{{- define "cassandra.client.tlsEncryption" -}}
|
||||
{{- if (or .Values.tls.clientEncryption .Values.cluster.clientEncryption) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS for internode communication connections should be configured
|
||||
*/}}
|
||||
{{- define "cassandra.internode.tlsEncryption" -}}
|
||||
{{- if (ne .Values.tls.internodeEncryption "none") -}}
|
||||
{{- printf "%s" .Values.tls.internodeEncryption -}}
|
||||
{{- else -}}
|
||||
{{- printf "none" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS should be configured
|
||||
*/}}
|
||||
{{- define "cassandra.tlsEncryption" -}}
|
||||
{{- if or (include "cassandra.client.tlsEncryption" . ) ( ne "none" (include "cassandra.internode.tlsEncryption" . )) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Convert memory to M
|
||||
Usage:
|
||||
{{ include "cassandra.memory.convertToM" (dict "value" "3Gi") }}
|
||||
*/}}
|
||||
{{- define "cassandra.memory.convertToM" -}}
|
||||
{{- $res := 0 -}}
|
||||
{{- if regexMatch "G" .value -}}
|
||||
{{- /* Multiply by 1000 if it is Gigabytes */ -}}
|
||||
{{- $res = regexFind "[0-9.]+" .value | float64 | mulf 1000 | int -}}
|
||||
{{- else -}}
|
||||
{{- /* Assume M for the rest, so simply extract the number and convert to int */ -}}
|
||||
{{- $res = regexFind "[0-9]+" .value | int -}}
|
||||
{{- end -}}
|
||||
{{- $res -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return memory limit if resources or resourcesPreset has been set (in M)
|
||||
*/}}
|
||||
{{- define "cassandra.memory.getLimitInM" -}}
|
||||
{{- $res := "" -}}
|
||||
{{- if .Values.resources -}}
|
||||
{{- /* We need to go step by step to avoid nil pointer exceptions */ -}}
|
||||
{{- if .Values.resources.limits -}}
|
||||
{{- if .Values.resources.limits.memory -}}
|
||||
{{- $res = .Values.resources.limits.memory -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- else if (ne .Values.resourcesPreset "none") -}}
|
||||
{{- $preset := include "common.resources.preset" (dict "type" .Values.resourcesPreset) | fromYaml -}}
|
||||
{{- $res = $preset.limits.memory -}}
|
||||
{{- end -}}
|
||||
{{- if $res -}}
|
||||
{{- /* Convert to M */ -}}
|
||||
{{- include "cassandra.memory.convertToM" (dict "value" $res) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Calculate Max Heap Size based on the given values
|
||||
*/}}
|
||||
{{- define "cassandra.memory.calculateMaxHeapSize" -}}
|
||||
{{- if .Values.jvm.maxHeapSize -}}
|
||||
{{- /* Honor value explicitly set */ -}}
|
||||
{{- print .Values.jvm.maxHeapSize -}}
|
||||
{{- else -}}
|
||||
{{- /* Calculate based on resources set */ -}}
|
||||
{{- /* Reference: https://docs.oracle.com/javase/8/docs/technotes/guides/vm/gc-ergonomics.html */ -}}
|
||||
{{- $res := include "cassandra.memory.getLimitInM" . -}}
|
||||
{{- $res = div $res 4 | min 1000 -}}
|
||||
{{- printf "%vM" $res -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Calculate New Heap Size based on the given values
|
||||
*/}}
|
||||
{{- define "cassandra.memory.calculateNewHeapSize" -}}
|
||||
{{- if .Values.jvm.newHeapSize -}}
|
||||
{{- /* Honor value explicitly set */ -}}
|
||||
{{- print .Values.jvm.newHeapSize -}}
|
||||
{{- else -}}
|
||||
{{- /* Calculate based on resources set */ -}}
|
||||
{{- /* Reference: https://docs.oracle.com/javase/8/docs/technotes/guides/vm/gc-ergonomics.html */ -}}
|
||||
{{- $res := include "cassandra.memory.getLimitInM" . -}}
|
||||
{{- $res = div $res 64 | max 256 -}}
|
||||
{{- printf "%vM" $res -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Cassandra TLS credentials secret
|
||||
*/}}
|
||||
{{- define "cassandra.tlsSecretName" -}}
|
||||
{{- $secretName := coalesce .Values.tls.existingSecret .Values.tls.tlsEncryptionSecretName -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-crt" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "cassandra.createTlsSecret" -}}
|
||||
{{- if and (include "cassandra.tlsEncryption" .) .Values.tls.autoGenerated (not .Values.tls.existingSecret) (not .Values.tls.tlsEncryptionSecretName) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "cassandra.tlsPasswordsSecret" -}}
|
||||
{{- $secretName := coalesce .Values.tls.passwordsSecret .Values.tls.tlsEncryptionSecretName -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-tls-pass" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the password to use to access Cassandra
|
||||
*/}}
|
||||
{{- define "cassandra.password" -}}
|
||||
{{- if (and (empty .Values.dbUser.password) .Values.dbUser.forcePassword) }}
|
||||
{{ required "A Cassandra Password is required!" .Values.dbUser.password }}
|
||||
{{- else }}
|
||||
{{- include "common.secrets.passwords.manage" (dict "secret" (include "common.names.fullname" .) "key" "cassandra-password" "providedValues" (list "dbUser.password") "context" $) -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the metrics config map name.
|
||||
*/}}
|
||||
{{- define "cassandra.metricsConfConfigMap" -}}
|
||||
{{- printf "%s-metrics-conf" (include "common.names.fullname" . ) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Print warning if jvm memory not set
|
||||
*/}}
|
||||
{{- define "cassandra.warnings.jvm" -}}
|
||||
{{- if not .Values.jvm.maxHeapSize }}
|
||||
WARNING: JVM Max Heap Size not set in value jvm.maxHeapSize. When not set, the chart will calculate the following size:
|
||||
MIN(Memory Limit (if set) / 4, 1024M)
|
||||
{{- end }}
|
||||
{{- if not .Values.jvm.maxHeapSize }}
|
||||
WARNING: JVM New Heap Size not set in value jvm.newHeapSize. When not set, the chart will calculate the following size:
|
||||
MAX(Memory Limit (if set) / 64, 256M)
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
39
cassandra/templates/cassandra-secret.yaml
Normal file
39
cassandra/templates/cassandra-secret.yaml
Normal file
@ -0,0 +1,39 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (not .Values.dbUser.existingSecret) -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
cassandra-password: {{ include "cassandra.password" . }}
|
||||
{{ end }}
|
||||
{{- if and (or .Values.tls.keystorePassword .Values.tls.truststorePassword .Values.tls.autoGenerated) (not .Values.tls.passwordsSecret) (not .Values.tls.tlsEncryptionSecretName) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-tls-pass" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if or .Values.tls.keystorePassword .Values.tls.autoGenerated }}
|
||||
keystore-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-%s" (include "common.names.fullname" .) "tls-pass" | trunc 63 | trimSuffix "-") "key" "keystore-password" "providedValues" (list "tls.keystorePassword") "context" $) }}
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.truststorePassword .Values.tls.autoGenerated }}
|
||||
truststore-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-%s" (include "common.names.fullname" .) "tls-pass" | trunc 63 | trimSuffix "-") "key" "truststore-password" "providedValues" (list "tls.truststorePassword") "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
9
cassandra/templates/extra-list.yaml
Normal file
9
cassandra/templates/extra-list.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
33
cassandra/templates/headless-svc.yaml
Normal file
33
cassandra/templates/headless-svc.yaml
Normal file
@ -0,0 +1,33 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.service.headless.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
- name: intra
|
||||
port: 7000
|
||||
targetPort: intra
|
||||
- name: tls
|
||||
port: 7001
|
||||
targetPort: tls
|
||||
- name: jmx
|
||||
port: 7199
|
||||
targetPort: jmx
|
||||
- name: cql
|
||||
port: {{ .Values.service.ports.cql }}
|
||||
targetPort: cql
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
7
cassandra/templates/init_cm.yaml
Normal file
7
cassandra/templates/init_cm.yaml
Normal file
File diff suppressed because one or more lines are too long
19
cassandra/templates/initdb-configmap.yaml
Normal file
19
cassandra/templates/initdb-configmap.yaml
Normal file
@ -0,0 +1,19 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.initDB (not .Values.initDBConfigMap) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-init-scripts" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: cassandra
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.initDB "context" .) | nindent 2 }}
|
||||
{{ end }}
|
||||
19
cassandra/templates/metrics-configmap.yaml
Normal file
19
cassandra/templates/metrics-configmap.yaml
Normal file
@ -0,0 +1,19 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-metrics-conf" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: cassandra
|
||||
app.kubernetes.io/component: cassandra-exporter
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
config.yml: |-
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.configuration "context" $) | nindent 4 }}
|
||||
82
cassandra/templates/networkpolicy.yaml
Normal file
82
cassandra/templates/networkpolicy.yaml
Normal file
@ -0,0 +1,82 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow connection to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.cql }}
|
||||
- port: {{ .Values.containerPorts.jmx }}
|
||||
- port: {{ .Values.containerPorts.tls }}
|
||||
- port: {{ .Values.containerPorts.intra }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.rts.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.cql }}
|
||||
- port: {{ .Values.containerPorts.jmx }}
|
||||
- port: {{ .Values.containerPorts.tls }}
|
||||
- port: {{ .Values.containerPorts.intra }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- port: {{ .Values.metrics.containerPorts.http }}
|
||||
- port: {{ .Values.metrics.containerPorts.jmx }}
|
||||
{{- end }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
26
cassandra/templates/pdb.yaml
Normal file
26
cassandra/templates/pdb.yaml
Normal file
@ -0,0 +1,26 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.pdb.maxUnavailable ( not .Values.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
59
cassandra/templates/service.yaml
Normal file
59
cassandra/templates/service.yaml
Normal file
@ -0,0 +1,59 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerSourceRanges)) }}
|
||||
loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.service.clusterIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
|
||||
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: cql
|
||||
port: {{ .Values.service.ports.cql }}
|
||||
targetPort: cql
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.cql)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.cql }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
port: {{ .Values.service.ports.metrics }}
|
||||
targetPort: metrics
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.metrics)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.metrics }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
18
cassandra/templates/serviceaccount.yaml
Normal file
18
cassandra/templates/serviceaccount.yaml
Normal file
@ -0,0 +1,18 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "cassandra.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
46
cassandra/templates/servicemonitor.yaml
Normal file
46
cassandra/templates/servicemonitor.yaml
Normal file
@ -0,0 +1,46 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ default ( include "common.names.namespace" . ) .Values.metrics.serviceMonitor.namespace | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
endpoints:
|
||||
- port: metrics
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . }}
|
||||
{{- end }}
|
||||
690
cassandra/templates/statefulset.yaml
Normal file
690
cassandra/templates/statefulset.yaml
Normal file
@ -0,0 +1,690 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
updateStrategy: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
{{- if or .Values.podAnnotations (and .Values.metrics.enabled .Values.metrics.podAnnotations) }}
|
||||
annotations:
|
||||
{{- if .Values.podAnnotations }}
|
||||
{{- toYaml .Values.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.podAnnotations }}
|
||||
{{- toYaml .Values.metrics.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "cassandra.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- if .Values.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "cassandra.serviceAccountName" . }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: {{ .Values.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if or .Values.initContainers (include "cassandra.tlsEncryption" . ) (and .Values.podSecurityContext.enabled .Values.volumePermissions.enabled .Values.persistence.enabled) }}
|
||||
initContainers:
|
||||
{{- if and .Values.podSecurityContext.enabled .Values.volumePermissions.enabled .Values.persistence.enabled }}
|
||||
- name: volume-permissions
|
||||
image: {{ include "cassandra.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -cx
|
||||
- |
|
||||
{{- if .Values.persistence.enabled }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
|
||||
chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.persistence.mountPath }}
|
||||
{{- else }}
|
||||
chown {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
|
||||
{{- end }}
|
||||
mkdir -p {{ .Values.persistence.mountPath }}/data
|
||||
chmod 700 {{ .Values.persistence.mountPath }}/data
|
||||
find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
|
||||
{{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
|
||||
xargs chown -R `id -u`:`id -G | cut -d " " -f2`
|
||||
{{- else }}
|
||||
xargs chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.commitLogMountPath }}
|
||||
- /bin/sh
|
||||
- -cx
|
||||
- |
|
||||
{{- if .Values.persistence.enabled }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
|
||||
chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.persistence.mountPath }}
|
||||
{{- else }}
|
||||
chown {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
|
||||
{{- end }}
|
||||
mkdir -p {{ .Values.persistence.commitLogMountPath }}/commitlog
|
||||
chmod 700 {{ .Values.persistence.commitLogMountPath }}/commitlog
|
||||
find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
|
||||
{{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
|
||||
xargs -r chown -R `id -u`:`id -G | cut -d " " -f2`
|
||||
{{- else }}
|
||||
xargs -r chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
|
||||
securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }}
|
||||
{{- else }}
|
||||
securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.persistence.commitLogMountPath }}
|
||||
- name: commitlog
|
||||
mountPath: {{ .Values.persistence.commitLogMountPath }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (include "cassandra.tlsEncryption" . ) }}
|
||||
- name: init-certs
|
||||
image: {{ include "cassandra.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |-
|
||||
{{- if .Values.tls.autoGenerated }}
|
||||
if [[ -f "/certs/tls.key" ]] && [[ -f "/certs/tls.crt" ]] && [[ -f "/certs/ca.crt" ]]; then
|
||||
openssl pkcs12 -export -in "/certs/tls.crt" \
|
||||
-passout pass:"${CASSANDRA_KEYSTORE_PASSWORD}" \
|
||||
-inkey "/certs/tls.key" \
|
||||
-out "/tmp/keystore.p12"
|
||||
keytool -importkeystore -srckeystore "/tmp/keystore.p12" \
|
||||
-srcstoretype PKCS12 \
|
||||
-srcstorepass "${CASSANDRA_KEYSTORE_PASSWORD}" \
|
||||
-deststorepass "${CASSANDRA_KEYSTORE_PASSWORD}" \
|
||||
-destkeystore "/opt/bitnami/cassandra/certs/keystore" \
|
||||
-noprompt
|
||||
rm "/tmp/keystore.p12"
|
||||
keytool -import -file "/certs/ca.crt" \
|
||||
-keystore "/opt/bitnami/cassandra/certs/truststore" \
|
||||
-storepass "${CASSANDRA_TRUSTSTORE_PASSWORD}" \
|
||||
-noprompt
|
||||
else
|
||||
echo "Couldn't find the expected PEM certificates! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- else }}
|
||||
if [[ -f "/certs/truststore" ]] && [[ -f "/certs/keystore" ]]; then
|
||||
cp "/certs/truststore" "/opt/bitnami/cassandra/certs/truststore"
|
||||
cp "/certs/keystore" "/opt/bitnami/cassandra/certs/keystore"
|
||||
else
|
||||
echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
env:
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
{{- if or .Values.tls.passwordsSecret .Values.tls.tlsEncryptionSecretName .Values.tls.truststorePassword .Values.tls.autoGenerated }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: CASSANDRA_TRUSTSTORE_PASSWORD_FILE
|
||||
value: "/opt/bitnami/cassandra/secrets/truststore-password"
|
||||
{{- else }}
|
||||
- name: CASSANDRA_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "cassandra.tlsPasswordsSecret" . }}
|
||||
key: truststore-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.passwordsSecret .Values.tls.tlsEncryptionSecretName .Values.tls.keystorePassword .Values.tls.autoGenerated }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: CASSANDRA_KEYSTORE_PASSWORD_FILE
|
||||
value: "/opt/bitnami/cassandra/secrets/keystore-password"
|
||||
{{- else }}
|
||||
- name: CASSANDRA_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "cassandra.tlsPasswordsSecret" . }}
|
||||
key: keystore-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.resources }}
|
||||
resources: {{- toYaml .Values.tls.resources | nindent 12 }}
|
||||
{{- else if ne .Values.tls.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.tls.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: script-volume
|
||||
mountPath: /scripts
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
- name: certs-shared
|
||||
mountPath: /opt/bitnami/cassandra/certs
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: cassandra-secrets
|
||||
mountPath: /opt/bitnami/cassandra/secrets
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: cassandra
|
||||
command:
|
||||
{{- if .Values.command }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
- bash
|
||||
- -ec
|
||||
- |
|
||||
# Node 0 is the password seeder
|
||||
if [[ $POD_NAME =~ (.*)-0$ ]]; then
|
||||
echo "Setting node as password seeder"
|
||||
export CASSANDRA_PASSWORD_SEEDER=yes
|
||||
else
|
||||
# Only node 0 will execute the startup initdb scripts
|
||||
export CASSANDRA_IGNORE_INITDB_SCRIPTS=1
|
||||
fi
|
||||
/opt/bitnami/scripts/cassandra/entrypoint.sh /opt/bitnami/scripts/cassandra/run.sh
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
image: {{ include "cassandra.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: CASSANDRA_CLUSTER_NAME
|
||||
value: {{ .Values.cluster.name }}
|
||||
- name: CASSANDRA_SEEDS
|
||||
value: {{ (include "cassandra.seeds" .) | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: CASSANDRA_PASSWORD_FILE
|
||||
value: {{ printf "/opt/bitnami/cassandra/secrets/%s" (include "common.secrets.key" (dict "existingSecret" .Values.dbUser.existingSecret "key" "cassandra-password")) }}
|
||||
{{- else }}
|
||||
- name: CASSANDRA_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.dbUser.existingSecret "context" $) }}
|
||||
key: {{ include "common.secrets.key" (dict "existingSecret" .Values.dbUser.existingSecret "key" "cassandra-password") }}
|
||||
{{- end }}
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: CASSANDRA_USER
|
||||
value: {{ .Values.dbUser.user | quote }}
|
||||
- name: CASSANDRA_NUM_TOKENS
|
||||
value: {{ .Values.cluster.numTokens | quote }}
|
||||
- name: CASSANDRA_DATACENTER
|
||||
value: {{ .Values.cluster.datacenter }}
|
||||
- name: CASSANDRA_ENDPOINT_SNITCH
|
||||
value: {{ .Values.cluster.endpointSnitch }}
|
||||
- name: CASSANDRA_KEYSTORE_LOCATION
|
||||
value: "/opt/bitnami/cassandra/certs/keystore"
|
||||
- name: CASSANDRA_TRUSTSTORE_LOCATION
|
||||
value: "/opt/bitnami/cassandra/certs/truststore"
|
||||
{{- if ne "none" (include "cassandra.internode.tlsEncryption" .) }}
|
||||
- name: CASSANDRA_INTERNODE_ENCRYPTION
|
||||
value: {{ (include "cassandra.internode.tlsEncryption" .) | quote }}
|
||||
{{- end }}
|
||||
{{- if (include "cassandra.client.tlsEncryption" .) }}
|
||||
- name: CASSANDRA_CLIENT_ENCRYPTION
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.passwordsSecret .Values.tls.tlsEncryptionSecretName .Values.tls.truststorePassword .Values.tls.autoGenerated }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: CASSANDRA_TRUSTSTORE_PASSWORD_FILE
|
||||
value: "/opt/bitnami/cassandra/secrets/truststore-password"
|
||||
{{- else }}
|
||||
- name: CASSANDRA_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "cassandra.tlsPasswordsSecret" . }}
|
||||
key: truststore-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.passwordsSecret .Values.tls.tlsEncryptionSecretName .Values.tls.keystorePassword .Values.tls.autoGenerated }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: CASSANDRA_KEYSTORE_PASSWORD_FILE
|
||||
value: "/opt/bitnami/cassandra/secrets/keystore-password"
|
||||
{{- else }}
|
||||
- name: CASSANDRA_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "cassandra.tlsPasswordsSecret" . }}
|
||||
key: keystore-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: CASSANDRA_RACK
|
||||
value: {{ .Values.cluster.rack }}
|
||||
{{- if or .Values.jvm.maxHeapSize (include "cassandra.memory.getLimitInM" .) }}
|
||||
- name: MAX_HEAP_SIZE
|
||||
value: {{ include "cassandra.memory.calculateMaxHeapSize" . | quote }}
|
||||
{{- end }}
|
||||
{{- if or .Values.jvm.newHeapSize (include "cassandra.memory.getLimitInM" .) }}
|
||||
- name: HEAP_NEWSIZE
|
||||
value: {{ include "cassandra.memory.calculateNewHeapSize" . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.jvm.extraOpts }}
|
||||
- name: JVM_EXTRA_OPTS
|
||||
value: {{ .Values.jvm.extraOpts | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.cluster.enableUDF }}
|
||||
- name: CASSANDRA_ENABLE_USER_DEFINED_FUNCTIONS
|
||||
value: {{ .Values.cluster.enableUDF | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.containerPorts.intra }}
|
||||
- name: CASSANDRA_TRANSPORT_PORT_NUMBER
|
||||
value: {{ .Values.containerPorts.intra | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.containerPorts.jmx }}
|
||||
- name: CASSANDRA_JMX_PORT_NUMBER
|
||||
value: {{ .Values.containerPorts.jmx | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.containerPorts.cql }}
|
||||
- name: CASSANDRA_CQL_PORT_NUMBER
|
||||
value: {{ .Values.containerPorts.cql | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.commitLogMountPath }}
|
||||
- name: CASSANDRA_COMMITLOG_DIR
|
||||
value: {{ .Values.persistence.commitLogMountPath | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |
|
||||
nodetool info | grep "Native Transport active: true"
|
||||
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |
|
||||
nodetool status | grep -E "^UN\\s+${POD_IP}"
|
||||
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |
|
||||
nodetool status | grep -E "^UN\\s+${POD_IP}"
|
||||
initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.startupProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if not .Values.lifecycleHooks }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- set -euo pipefail
|
||||
- mkdir -p /tmp/scripts
|
||||
- cp /scripts/init.cql.gz /tmp/scripts/
|
||||
- cd /tmp/scripts && gzip -d init.cql.gz
|
||||
until cqlsh -u cassandra -p "$(cat /opt/bitnami/cassandra/secrets/cassandra-password)" -e "DESCRIBE KEYSPACES" | grep -q 'system_schema'; do
|
||||
echo "Waiting for Cassandra to fully start..."
|
||||
sleep 5
|
||||
done
|
||||
- cqlsh -u cassandra -p "$(cat /opt/bitnami/cassandra/secrets/cassandra-password)" -f /tmp/scripts/init.cql
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
{{- if not .Values.persistence.enabled }}
|
||||
- nodetool decommission
|
||||
{{- else }}
|
||||
- nodetool drain
|
||||
{{- end }}
|
||||
{{- else if .Values.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: intra
|
||||
containerPort: {{ .Values.containerPorts.intra | default "7000" }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostPort: {{ .Values.containerPorts.intra }}
|
||||
{{- else if .Values.hostPorts.intra }}
|
||||
hostPort: {{ .Values.hostPorts.intra }}
|
||||
{{- end }}
|
||||
{{- if (ne (include "cassandra.internode.tlsEncryption" .) "none") }}
|
||||
- name: tls
|
||||
containerPort: {{ .Values.containerPorts.tls | default "7001" }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostPort: {{ .Values.containerPorts.tls }}
|
||||
{{- else if .Values.hostPorts.tls }}
|
||||
hostPort: {{ .Values.hostPorts.tls }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: jmx
|
||||
containerPort: {{ .Values.containerPorts.jmx | default "7199" }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostPort: {{ .Values.containerPorts.jmx }}
|
||||
{{- else if .Values.hostPorts.jmx }}
|
||||
hostPort: {{ .Values.hostPorts.jmx }}
|
||||
{{- end }}
|
||||
- name: cql
|
||||
containerPort: {{ .Values.containerPorts.cql | default "9042" }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostPort: {{ .Values.containerPorts.cql }}
|
||||
{{- else if .Values.hostPorts.cql }}
|
||||
hostPort: {{ .Values.hostPorts.cql }}
|
||||
{{- end }}
|
||||
{{- if .Values.resources }}
|
||||
resources: {{ toYaml .Values.resources | nindent 12 }}
|
||||
{{- else if ne .Values.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: script-volume
|
||||
mountPath: /scripts
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: cassandra-secrets
|
||||
mountPath: /opt/bitnami/cassandra/secrets
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.commitLogMountPath }}
|
||||
- name: commitlog
|
||||
mountPath: {{ .Values.persistence.commitLogMountPath }}
|
||||
{{- end }}
|
||||
{{- if (include "cassandra.tlsEncryption" . ) }}
|
||||
- name: certs-shared
|
||||
mountPath: /opt/bitnami/cassandra/certs
|
||||
{{- end }}
|
||||
{{- if or .Values.initDBConfigMap .Values.initDB }}
|
||||
- name: init-db-cm
|
||||
mountPath: /docker-entrypoint-initdb.d/configmap
|
||||
{{- end }}
|
||||
{{- if .Values.initDBSecret }}
|
||||
- name: init-db-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/secret
|
||||
{{- end }}
|
||||
{{ if .Values.existingConfiguration }}
|
||||
- name: configurations
|
||||
mountPath: {{ .Values.persistence.mountPath }}/conf
|
||||
{{- end }}
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/cassandra/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/cassandra/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/cassandra/logs
|
||||
subPath: app-logs-dir
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
image: {{ include "cassandra.metrics.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.containerPorts.http | default "8080" }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostPort: {{ .Values.metrics.containerPorts.http }}
|
||||
{{- else if .Values.metrics.hostPorts.http }}
|
||||
hostPort: {{ .Values.metrics.hostPorts.http }}
|
||||
{{- end }}
|
||||
protocol: TCP
|
||||
- name: jmx
|
||||
containerPort: {{ .Values.metrics.containerPorts.jmx | default "5555" }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostPort: {{ .Values.metrics.containerPorts.jmx }}
|
||||
{{- else if .Values.metrics.hostPorts.jmx }}
|
||||
hostPort: {{ .Values.metrics.hostPorts.jmx }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.resources }}
|
||||
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
|
||||
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: metrics
|
||||
initialDelaySeconds: {{ .Values.metrics.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.metrics.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.metrics.readinessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.metrics.readinessProbe.failureThreshold }}
|
||||
successThreshold: {{ .Values.metrics.readinessProbe.successThreshold }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: metrics-conf
|
||||
mountPath: /opt/bitnami/cassandra-exporter/config.yml
|
||||
subPath: config.yml
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.metrics.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: script-volume
|
||||
configMap:
|
||||
name: cassandra-init-script
|
||||
- name: metrics-conf
|
||||
configMap:
|
||||
name: {{ include "cassandra.metricsConfConfigMap" . }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: cassandra-secrets
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.dbUser.existingSecret "context" $) }}
|
||||
{{- if or .Values.tls.passwordsSecret .Values.tls.tlsEncryptionSecretName .Values.tls.keystorePassword .Values.tls.truststorePassword .Values.tls.autoGenerated }}
|
||||
- secret:
|
||||
name: {{ include "cassandra.tlsPasswordsSecret" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (include "cassandra.tlsEncryption" . ) }}
|
||||
- name: certs
|
||||
secret:
|
||||
secretName: {{ include "cassandra.tlsSecretName" . }}
|
||||
defaultMode: 256
|
||||
- name: certs-shared
|
||||
emptyDir:
|
||||
sizeLimit: 500Mi
|
||||
{{- end }}
|
||||
{{- if .Values.existingConfiguration }}
|
||||
- name: configurations
|
||||
configMap:
|
||||
name: {{ tpl .Values.existingConfiguration $ }}
|
||||
{{- end }}
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if or .Values.initDB .Values.initDBConfigMap }}
|
||||
- name: init-db-cm
|
||||
configMap:
|
||||
name: {{ ternary (printf "%s-init-scripts" (include "common.names.fullname" .)) (tpl .Values.initDBConfigMap $) (empty .Values.initDBConfigMap) }}
|
||||
{{- end }}
|
||||
{{- if .Values.initDBSecret }}
|
||||
- name: init-db-secret
|
||||
secret:
|
||||
secretName: {{ tpl .Values.initDBSecret $ }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ tpl .Values.persistence.existingClaim $ }}
|
||||
{{- else if not .Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else }}
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
labels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 10 }}
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- toYaml .Values.persistence.annotations | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- if .Values.persistence.commitLogMountPath }}
|
||||
- metadata:
|
||||
name: commitlog
|
||||
labels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 10 }}
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- toYaml .Values.persistence.annotations | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.commitLogsize | quote }}
|
||||
{{- include "cassandra.commitstorage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
30
cassandra/templates/tls-secret.yaml
Normal file
30
cassandra/templates/tls-secret.yaml
Normal file
@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "cassandra.createTlsSecret" . ) }}
|
||||
{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $ca := genCA "cassandra-ca" 365 }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $releaseNamespace := include "common.names.namespace" . }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $serviceName := include "common.names.fullname" . }}
|
||||
{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) "localhost" "127.0.0.1" $fullname }}
|
||||
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
{{- end }}
|
||||
972
cassandra/values.yaml
Normal file
972
cassandra/values.yaml
Normal file
@ -0,0 +1,972 @@
|
||||
# Copyright Broadcom, Inc. All Rights Reserved.
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## @section Global parameters
|
||||
## Global Docker image parameters
|
||||
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
|
||||
## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
|
||||
##
|
||||
|
||||
## @param global.imageRegistry Global Docker image registry
|
||||
## @param global.imagePullSecrets Global Docker registry secret names as an array
|
||||
## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)
|
||||
##
|
||||
global:
|
||||
imageRegistry: ""
|
||||
## E.g.
|
||||
## imagePullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
imagePullSecrets: []
|
||||
defaultStorageClass: ""
|
||||
## Security parameters
|
||||
##
|
||||
security:
|
||||
## @param global.security.allowInsecureImages Allows skipping image verification
|
||||
allowInsecureImages: false
|
||||
## Compatibility adaptations for Kubernetes platforms
|
||||
##
|
||||
compatibility:
|
||||
## Compatibility adaptations for Openshift
|
||||
##
|
||||
openshift:
|
||||
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
|
||||
##
|
||||
adaptSecurityContext: auto
|
||||
## @section Common parameters
|
||||
##
|
||||
|
||||
## @param nameOverride String to partially override common.names.fullname
|
||||
##
|
||||
nameOverride: ""
|
||||
## @param fullnameOverride String to fully override common.names.fullname
|
||||
##
|
||||
fullnameOverride: ""
|
||||
## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)
|
||||
##
|
||||
kubeVersion: ""
|
||||
## @param commonLabels Labels to add to all deployed objects (sub-charts are not considered)
|
||||
##
|
||||
commonLabels: {}
|
||||
## @param commonAnnotations Annotations to add to all deployed objects
|
||||
##
|
||||
commonAnnotations: {}
|
||||
## @param clusterDomain Kubernetes cluster domain name
|
||||
##
|
||||
clusterDomain: cluster.local
|
||||
## @param extraDeploy Array of extra objects to deploy with the release
|
||||
##
|
||||
extraDeploy: []
|
||||
## @param usePasswordFiles Mount credentials as files instead of using environment variables
|
||||
##
|
||||
usePasswordFiles: true
|
||||
## Enable diagnostic mode in the deployment
|
||||
##
|
||||
diagnosticMode:
|
||||
## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
|
||||
##
|
||||
enabled: false
|
||||
## @param diagnosticMode.command Command to override all containers in the deployment
|
||||
##
|
||||
command:
|
||||
- sleep
|
||||
## @param diagnosticMode.args Args to override all containers in the deployment
|
||||
##
|
||||
args:
|
||||
- infinity
|
||||
## @section Cassandra parameters
|
||||
##
|
||||
|
||||
## Bitnami Cassandra image
|
||||
## ref: https://hub.docker.com/r/bitnami/cassandra/tags/
|
||||
## @param image.registry [default: REGISTRY_NAME] Cassandra image registry
|
||||
## @param image.repository [default: REPOSITORY_NAME/cassandra] Cassandra image repository
|
||||
## @skip image.tag Cassandra image tag (immutable tags are recommended)
|
||||
## @param image.digest Cassandra image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||||
## @param image.pullPolicy image pull policy
|
||||
## @param image.pullSecrets Cassandra image pull secrets
|
||||
## @param image.debug Enable image debug mode
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/cassandra
|
||||
tag: 5.0.3-debian-12-r6
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## e.g:
|
||||
## pullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
pullSecrets: []
|
||||
## Enable debug mode
|
||||
##
|
||||
debug: false
|
||||
## Secret with keystore, keystore password, truststore, truststore password
|
||||
## DEPRECATED. Use tls.existingSecret instead
|
||||
# tlsEncryptionSecretName:
|
||||
|
||||
## Database credentials
|
||||
## @param dbUser.user Cassandra admin user
|
||||
## @param dbUser.forcePassword Force the user to provide a non
|
||||
## @param dbUser.password Password for `dbUser.user`. Randomly generated if empty
|
||||
## @param dbUser.existingSecret Use an existing secret object for `dbUser.user` password (will ignore `dbUser.password`)
|
||||
##
|
||||
dbUser:
|
||||
user: cassandra
|
||||
forcePassword: false
|
||||
password: "tnQ5jUwRv2I"
|
||||
## Use an existing secrets which already stores your password data.
|
||||
## for backwards compatibility, existingSecret can be a simple string,
|
||||
## referencing the secret by name.
|
||||
## existingSecret:
|
||||
## ## Name of the existing secret
|
||||
## ##
|
||||
## name: mySecret
|
||||
## ## Key mapping where <key> is the value which the deployment is expecting and
|
||||
## ## <value> is the name of the key in the existing secret.
|
||||
## ##
|
||||
## keyMapping:
|
||||
## cassandra-password: myCassandraPasswordKey
|
||||
##
|
||||
existingSecret: ""
|
||||
existingSecretPasswordKey: ""
|
||||
## @param initDB Object with cql scripts. Useful for creating a keyspace and pre-populating data
|
||||
##
|
||||
initDB: {}
|
||||
## @param initDBConfigMap ConfigMap with cql scripts. Useful for creating a keyspace and pre-populating data
|
||||
##
|
||||
initDBConfigMap: {}
|
||||
|
||||
## @param initDBSecret Secret with cql script (with sensitive data). Useful for creating a keyspace and pre-populating data
|
||||
##
|
||||
initDBSecret: ""
|
||||
## @param existingConfiguration ConfigMap with custom cassandra configuration files. This overrides any other Cassandra configuration set in the chart
|
||||
##
|
||||
existingConfiguration: ""
|
||||
## Cluster parameters
|
||||
## @param cluster.name Cassandra cluster name
|
||||
## @param cluster.seedCount Number of seed nodes
|
||||
## @param cluster.numTokens Number of tokens for each node
|
||||
## @param cluster.datacenter Datacenter name
|
||||
## @param cluster.rack Rack name
|
||||
## @param cluster.endpointSnitch Endpoint Snitch
|
||||
## @param cluster.clientEncryption Client Encryption
|
||||
## @param cluster.extraSeeds For an external/second cassandra ring.
|
||||
## @param cluster.enableUDF Enable User defined functions
|
||||
##
|
||||
cluster:
|
||||
name: cassandra
|
||||
seedCount: 1
|
||||
numTokens: 256
|
||||
datacenter: dc1
|
||||
rack: rack1
|
||||
endpointSnitch: SimpleSnitch
|
||||
clientEncryption: false
|
||||
## eg:
|
||||
## extraSeeds:
|
||||
## - hostname/IP
|
||||
## - hostname/IP
|
||||
##
|
||||
extraSeeds: []
|
||||
enableUDF: false
|
||||
## JVM Settings
|
||||
## @param jvm.extraOpts Set the value for Java Virtual Machine extra options
|
||||
## @param jvm.maxHeapSize Set Java Virtual Machine maximum heap size (MAX_HEAP_SIZE). Calculated automatically if `nil`
|
||||
## @param jvm.newHeapSize Set Java Virtual Machine new heap size (HEAP_NEWSIZE). Calculated automatically if `nil`
|
||||
##
|
||||
jvm:
|
||||
extraOpts: ""
|
||||
## Memory settings: These are calculated automatically unless specified otherwise
|
||||
## To run on environments with little resources (<= 8GB), tune your heap settings:
|
||||
## - calculate 1/2 ram and cap to 1024MB
|
||||
## - calculate 1/4 ram and cap to 8192MB
|
||||
## - pick the max
|
||||
##
|
||||
maxHeapSize: ""
|
||||
## newHeapSize:
|
||||
## A good guideline is 100 MB per CPU core.
|
||||
## - min(100 * num_cores, 1/4 * heap size)
|
||||
## ref: https://docs.datastax.com/en/archived/cassandra/2.0/cassandra/operations/ops_tune_jvm_c.html
|
||||
##
|
||||
newHeapSize: ""
|
||||
## @param command Command for running the container (set to default if not set). Use array form
|
||||
##
|
||||
command: []
|
||||
## @param args Args for running the container (set to default if not set). Use array form
|
||||
##
|
||||
args: []
|
||||
## @param extraEnvVars Extra environment variables to be set on cassandra container
|
||||
## For example:
|
||||
## - name: FOO
|
||||
## value: BAR
|
||||
##
|
||||
extraEnvVars: []
|
||||
## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars
|
||||
##
|
||||
extraEnvVarsCM: ""
|
||||
## @param extraEnvVarsSecret Name of existing Secret containing extra env vars
|
||||
##
|
||||
extraEnvVarsSecret: ""
|
||||
## @section Statefulset parameters
|
||||
##
|
||||
|
||||
## @param replicaCount Number of Cassandra replicas
|
||||
##
|
||||
replicaCount: 1
|
||||
## @param updateStrategy.type updateStrategy for Cassandra statefulset
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
|
||||
##
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
## @param automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @param hostAliases Add deployment host aliases
|
||||
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
|
||||
##
|
||||
hostAliases: []
|
||||
## @param podManagementPolicy StatefulSet pod management policy
|
||||
##
|
||||
podManagementPolicy: OrderedReady
|
||||
## @param priorityClassName Cassandra pods' priority.
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
||||
##
|
||||
priorityClassName: ""
|
||||
## @param podAnnotations Additional pod annotations
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
##
|
||||
podAnnotations: {}
|
||||
## @param podLabels Additional pod labels
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
##
|
||||
podLabels: {}
|
||||
## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAffinityPreset: ""
|
||||
## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAntiAffinityPreset: soft
|
||||
## Node affinity preset
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
|
||||
##
|
||||
nodeAffinityPreset:
|
||||
## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
##
|
||||
type: ""
|
||||
## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set
|
||||
##
|
||||
key: ""
|
||||
## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set
|
||||
## E.g.
|
||||
## values:
|
||||
## - e2e-az1
|
||||
## - e2e-az2
|
||||
##
|
||||
values: []
|
||||
## @param affinity Affinity for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
## NOTE: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
|
||||
##
|
||||
affinity: {}
|
||||
## @param nodeSelector Node labels for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## @param tolerations Tolerations for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
##
|
||||
tolerations: []
|
||||
## @param topologySpreadConstraints Topology Spread Constraints for pod assignment
|
||||
## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## The value is evaluated as a template
|
||||
##
|
||||
topologySpreadConstraints: []
|
||||
## Pod security context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param podSecurityContext.enabled Enabled Cassandra pods' Security Context
|
||||
## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
|
||||
## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
|
||||
## @param podSecurityContext.supplementalGroups Set filesystem extra groups
|
||||
## @param podSecurityContext.fsGroup Set Cassandra pod's Security Context fsGroup
|
||||
##
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroupChangePolicy: Always
|
||||
sysctls: []
|
||||
supplementalGroups: []
|
||||
fsGroup: 1001
|
||||
## Configure Container Security Context (only main container)
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param containerSecurityContext.enabled Enabled Cassandra containers' Security Context
|
||||
## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||||
## @param containerSecurityContext.runAsUser Set Cassandra containers' Security Context runAsUser
|
||||
## @param containerSecurityContext.runAsGroup Set Cassandra containers' Security Context runAsGroup
|
||||
## @param containerSecurityContext.allowPrivilegeEscalation Set Cassandra containers' Security Context allowPrivilegeEscalation
|
||||
## @param containerSecurityContext.capabilities.drop Set Cassandra containers' Security Context capabilities to be dropped
|
||||
## @param containerSecurityContext.readOnlyRootFilesystem Set Cassandra containers' Security Context readOnlyRootFilesystem
|
||||
## @param containerSecurityContext.runAsNonRoot Set Cassandra containers' Security Context runAsNonRoot
|
||||
## @param containerSecurityContext.privileged Set container's Security Context privileged
|
||||
## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
## Cassandra pods' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## Minimum memory for development is 4GB and 2 CPU cores
|
||||
## Minimum memory for production is 8GB and 4 CPU cores
|
||||
## ref: http://docs.datastax.com/en/archived/cassandra/2.0/cassandra/architecture/architecturePlanningHardware_c.html
|
||||
##
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
## choice for the user. This also increases chances charts run on environments with little
|
||||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "large"
|
||||
## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources: {}
|
||||
## Configure extra options for Cassandra containers' liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
|
||||
## @param livenessProbe.enabled Enable livenessProbe
|
||||
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||||
## @param livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||||
## @param livenessProbe.successThreshold Success threshold for livenessProbe
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 30
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
## @param readinessProbe.enabled Enable readinessProbe
|
||||
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
## @param readinessProbe.successThreshold Success threshold for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 30
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
## Configure extra options for startup probe
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
|
||||
## @param startupProbe.enabled Enable startupProbe
|
||||
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||
## @param startupProbe.periodSeconds Period seconds for startupProbe
|
||||
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||
## @param startupProbe.failureThreshold Failure threshold for startupProbe
|
||||
## @param startupProbe.successThreshold Success threshold for startupProbe
|
||||
##
|
||||
startupProbe:
|
||||
enabled: false
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 60
|
||||
## @param customLivenessProbe Custom livenessProbe that overrides the default one
|
||||
##
|
||||
customLivenessProbe: {}
|
||||
## @param customReadinessProbe Custom readinessProbe that overrides the default one
|
||||
##
|
||||
customReadinessProbe: {}
|
||||
## @param customStartupProbe [object] Override default startup probe
|
||||
##
|
||||
customStartupProbe: {}
|
||||
## @param lifecycleHooks [object] Override default etcd container hooks
|
||||
##
|
||||
lifecycleHooks: {}
|
||||
## @param schedulerName Alternative scheduler
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
## @param terminationGracePeriodSeconds In seconds, time the given to the Cassandra pod needs to terminate gracefully
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
|
||||
##
|
||||
terminationGracePeriodSeconds: ""
|
||||
## @param extraVolumes Optionally specify extra list of additional volumes for cassandra container
|
||||
##
|
||||
extraVolumes: []
|
||||
## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for cassandra container
|
||||
##
|
||||
extraVolumeMounts: []
|
||||
## @param initContainers Add additional init containers to the cassandra pods
|
||||
##
|
||||
initContainers: []
|
||||
## @param sidecars Add additional sidecar containers to the cassandra pods
|
||||
##
|
||||
sidecars: []
|
||||
## Cassandra Pod Disruption Budget configuration
|
||||
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
|
||||
##
|
||||
pdb:
|
||||
## @param pdb.create Enable/disable a Pod Disruption Budget creation
|
||||
##
|
||||
create: true
|
||||
## @param pdb.minAvailable Mininimum number of pods that must still be available after the eviction
|
||||
##
|
||||
minAvailable: ""
|
||||
## @param pdb.maxUnavailable Max number of pods that can be unavailable after the eviction
|
||||
##
|
||||
maxUnavailable: ""
|
||||
## @param hostNetwork Enable HOST Network
|
||||
## If hostNetwork true -> dnsPolicy is set to ClusterFirstWithHostNet
|
||||
##
|
||||
hostNetwork: false
|
||||
## Cassandra container ports to open
|
||||
## If hostNetwork true: the hostPort is set identical to the containerPort
|
||||
## @param containerPorts.intra Intra Port on the Host and Container
|
||||
## @param containerPorts.tls TLS Port on the Host and Container
|
||||
## @param containerPorts.jmx JMX Port on the Host and Container
|
||||
## @param containerPorts.cql CQL Port on the Host and Container
|
||||
##
|
||||
containerPorts:
|
||||
intra: 7000
|
||||
tls: 7001
|
||||
jmx: 7199
|
||||
cql: 9042
|
||||
## Cassandra ports to be exposed as hostPort
|
||||
## If hostNetwork is false, only the ports specified here will be exposed (or not if set to an empty string)
|
||||
## @param hostPorts.intra Intra Port on the Host
|
||||
## @param hostPorts.tls TLS Port on the Host
|
||||
## @param hostPorts.jmx JMX Port on the Host
|
||||
## @param hostPorts.cql CQL Port on the Host
|
||||
##
|
||||
hostPorts:
|
||||
intra: ""
|
||||
tls: ""
|
||||
jmx: ""
|
||||
cql: ""
|
||||
## @section RBAC parameters
|
||||
##
|
||||
|
||||
## Cassandra pods ServiceAccount
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
##
|
||||
serviceAccount:
|
||||
## @param serviceAccount.create Enable the creation of a ServiceAccount for Cassandra pods
|
||||
##
|
||||
create: true
|
||||
## @param serviceAccount.name The name of the ServiceAccount to use.
|
||||
## If not set and create is true, a name is generated using the cassandra.fullname template
|
||||
##
|
||||
name: ""
|
||||
## @param serviceAccount.annotations Annotations for Cassandra Service Account
|
||||
##
|
||||
annotations: {}
|
||||
## @param serviceAccount.automountServiceAccountToken Automount API credentials for a service account.
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @section Traffic Exposure Parameters
|
||||
##
|
||||
|
||||
## Cassandra service parameters
|
||||
##
|
||||
service:
|
||||
## @param service.type Cassandra service type
|
||||
##
|
||||
type: ClusterIP
|
||||
## @param service.ports.cql Cassandra service CQL Port
|
||||
## @param service.ports.metrics Cassandra service metrics port
|
||||
##
|
||||
ports:
|
||||
cql: 9042
|
||||
metrics: 8080
|
||||
## Node ports to expose
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
## @param service.nodePorts.cql Node port for CQL
|
||||
## @param service.nodePorts.metrics Node port for metrics
|
||||
##
|
||||
nodePorts:
|
||||
cql: ""
|
||||
metrics: ""
|
||||
## @param service.extraPorts Extra ports to expose in the service (normally used with the `sidecar` value)
|
||||
##
|
||||
extraPorts: []
|
||||
## @param service.loadBalancerIP LoadBalancerIP if service type is `LoadBalancer`
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
##
|
||||
loadBalancerIP: ""
|
||||
## @param service.loadBalancerSourceRanges Service Load Balancer sources
|
||||
## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
|
||||
## e.g:
|
||||
## loadBalancerSourceRanges:
|
||||
## - 10.10.10.0/24
|
||||
##
|
||||
loadBalancerSourceRanges: []
|
||||
## @param service.clusterIP Service Cluster IP
|
||||
## e.g.:
|
||||
## clusterIP: None
|
||||
##
|
||||
clusterIP: ""
|
||||
## @param service.externalTrafficPolicy Service external traffic policy
|
||||
## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
##
|
||||
externalTrafficPolicy: Cluster
|
||||
## @param service.annotations Provide any additional annotations which may be required.
|
||||
## This can be used to set the LoadBalancer service type to internal only.
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
##
|
||||
annotations: {}
|
||||
## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"
|
||||
## If "ClientIP", consecutive client requests will be directed to the same Pod
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
|
||||
##
|
||||
sessionAffinity: None
|
||||
## @param service.sessionAffinityConfig Additional settings for the sessionAffinity
|
||||
## sessionAffinityConfig:
|
||||
## clientIP:
|
||||
## timeoutSeconds: 300
|
||||
##
|
||||
sessionAffinityConfig: {}
|
||||
## Headless service properties
|
||||
##
|
||||
headless:
|
||||
## @param service.headless.annotations Annotations for the headless service.
|
||||
##
|
||||
annotations: {}
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
## @section Persistence parameters
|
||||
##
|
||||
|
||||
## Enable persistence using Persistent Volume Claims
|
||||
## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
|
||||
##
|
||||
persistence:
|
||||
## @param persistence.enabled Enable Cassandra data persistence using PVC, use a Persistent Volume Claim, If false, use emptyDir
|
||||
##
|
||||
enabled: true
|
||||
## @param persistence.existingClaim Name of an existing PVC to use
|
||||
##
|
||||
existingClaim: ""
|
||||
## @param persistence.storageClass PVC Storage Class for Cassandra data volume
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
storageClass: ""
|
||||
## @param persistence.commitStorageClass PVC Storage Class for Cassandra Commit Log volume
|
||||
## Storage class to use with CASSANDRA_COMMITLOG_DIR to reduce the concurrence for writing data and commit logs
|
||||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/cassandra
|
||||
## If set to "-", commitStorageClass: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
commitStorageClass: ""
|
||||
## @param persistence.annotations Persistent Volume Claim annotations
|
||||
##
|
||||
annotations: {}
|
||||
## @param persistence.accessModes Persistent Volume Access Mode
|
||||
##
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
## @param persistence.size PVC Storage Request for Cassandra data volume
|
||||
##
|
||||
size: 8Gi
|
||||
## @param persistence.commitLogsize PVC Storage Request for Cassandra commit log volume. Unset by default
|
||||
##
|
||||
commitLogsize: 2Gi
|
||||
## @param persistence.mountPath The path the data volume will be mounted at
|
||||
##
|
||||
mountPath: /bitnami/cassandra
|
||||
## @param persistence.commitLogMountPath The path the commit log volume will be mounted at. Unset by default. Set it to '/bitnami/cassandra/commitlog' to enable a separate commit log volume
|
||||
##
|
||||
# commitLogMountPath: /bitnami/cassandra/commitlog
|
||||
commitLogMountPath: ""
|
||||
## @section Volume Permissions parameters
|
||||
##
|
||||
|
||||
## Init containers parameters:
|
||||
## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.
|
||||
##
|
||||
volumePermissions:
|
||||
## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume
|
||||
##
|
||||
enabled: false
|
||||
## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume image registry
|
||||
## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume image repository
|
||||
## @skip volumePermissions.image.tag Init container volume image tag (immutable tags are recommended)
|
||||
## @param volumePermissions.image.digest Init container volume image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||||
## @param volumePermissions.image.pullPolicy Init container volume pull policy
|
||||
## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/os-shell
|
||||
tag: 12-debian-12-r39
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## e.g:
|
||||
## pullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
pullSecrets: []
|
||||
## Init container' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
## choice for the user. This also increases chances charts run on environments with little
|
||||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "nano"
|
||||
## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources: {}
|
||||
## Init container Security Context
|
||||
## Note: the chown of the data folder is done to securityContext.runAsUser
|
||||
## and not the below volumePermissions.securityContext.runAsUser
|
||||
## @param volumePermissions.securityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||||
## @param volumePermissions.securityContext.runAsUser User ID for the init container
|
||||
##
|
||||
## When runAsUser is set to special value "auto", init container will try to chwon the
|
||||
## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2`
|
||||
## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed).
|
||||
## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with
|
||||
## pod securityContext.enabled=false and shmVolume.chmod.enabled=false
|
||||
##
|
||||
securityContext:
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 0
|
||||
## @section Metrics parameters
|
||||
##
|
||||
|
||||
## Cassandra Prometheus exporter configuration
|
||||
##
|
||||
metrics:
|
||||
## @param metrics.enabled Start a side-car prometheus exporter
|
||||
##
|
||||
enabled: false
|
||||
## Bitnami Cassandra Exporter image
|
||||
## ref: https://hub.docker.com/r/bitnami/cassandra-exporter/tags/
|
||||
## @param metrics.image.registry [default: REGISTRY_NAME] Cassandra exporter image registry
|
||||
## @param metrics.image.repository [default: REPOSITORY_NAME/cassandra-exporter] Cassandra exporter image name
|
||||
## @skip metrics.image.tag Cassandra exporter image tag
|
||||
## @param metrics.image.digest Cassandra exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||||
## @param metrics.image.pullPolicy image pull policy
|
||||
## @param metrics.image.pullSecrets Specify docker-registry secret names as an array
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/cassandra-exporter
|
||||
tag: 2.3.8-debian-12-r41
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## e.g:
|
||||
## pullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
pullSecrets: []
|
||||
## Cassandra Prometheus exporter resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
## choice for the user. This also increases chances charts run on environments with little
|
||||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "nano"
|
||||
## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources: {}
|
||||
## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 45
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
## @param metrics.extraVolumeMounts Optionally specify extra list of additional volumeMounts for cassandra-exporter container
|
||||
##
|
||||
extraVolumeMounts: []
|
||||
## @param metrics.podAnnotations [object] Metrics exporter pod Annotation and Labels
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
##
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "8080"
|
||||
## Prometheus Operator ServiceMonitor configuration
|
||||
##
|
||||
serviceMonitor:
|
||||
## @param metrics.serviceMonitor.enabled If `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)
|
||||
##
|
||||
enabled: false
|
||||
## @param metrics.serviceMonitor.namespace Namespace in which Prometheus is running
|
||||
##
|
||||
namespace: monitoring
|
||||
## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped.
|
||||
## ref: https://github.com/coreos/prometheus-operator/blob/main/Documentation/api.md#endpoint
|
||||
## e.g:
|
||||
## interval: 10s
|
||||
##
|
||||
interval: ""
|
||||
## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended
|
||||
## ref: https://github.com/coreos/prometheus-operator/blob/main/Documentation/api.md#endpoint
|
||||
## e.g:
|
||||
## scrapeTimeout: 10s
|
||||
##
|
||||
scrapeTimeout: ""
|
||||
## @param metrics.serviceMonitor.selector Prometheus instance selector labels
|
||||
## ref: https://github.com/bitnami/charts/tree/main/bitnami/prometheus-operator#prometheus-configuration
|
||||
## e.g:
|
||||
## selector:
|
||||
## prometheus: my-prometheus
|
||||
##
|
||||
selector: {}
|
||||
## @param metrics.serviceMonitor.metricRelabelings Specify Metric Relabelings to add to the scrape endpoint
|
||||
## ref: https://github.com/coreos/prometheus-operator/blob/main/Documentation/api.md#relabelconfig
|
||||
##
|
||||
metricRelabelings: []
|
||||
## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping
|
||||
## ref: https://github.com/coreos/prometheus-operator/blob/main/Documentation/api.md#relabelconfig
|
||||
##
|
||||
relabelings: []
|
||||
## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint
|
||||
##
|
||||
honorLabels: false
|
||||
## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus.
|
||||
##
|
||||
jobLabel: ""
|
||||
## @param metrics.serviceMonitor.labels Used to pass Labels that are required by the installed Prometheus Operator
|
||||
## ref: https://github.com/coreos/prometheus-operator/blob/main/Documentation/api.md#prometheusspec
|
||||
##
|
||||
labels: {}
|
||||
## Metrics container ports to open
|
||||
## If hostNetwork true: the hostPort is set identical to the containerPort
|
||||
## @param metrics.containerPorts.http HTTP Port on the Host and Container
|
||||
## @param metrics.containerPorts.jmx JMX Port on the Host and Container
|
||||
##
|
||||
containerPorts:
|
||||
http: 8080
|
||||
jmx: 5555
|
||||
## Metrics ports to be exposed as hostPort
|
||||
## If hostNetwork is false, only the ports specified here will be exposed (or not if set to an empty string)
|
||||
## @param metrics.hostPorts.http HTTP Port on the Host
|
||||
## @param metrics.hostPorts.jmx JMX Port on the Host
|
||||
##
|
||||
hostPorts:
|
||||
http: ""
|
||||
jmx: ""
|
||||
## @param metrics.configuration [string] Configure Cassandra-exporter with a custom config.yml file
|
||||
## ref: https://github.com/criteo/cassandra_exporter/blob/main/config.yml
|
||||
##
|
||||
configuration: |
|
||||
host: localhost:{{ .Values.containerPorts.jmx }}
|
||||
ssl: False
|
||||
user:
|
||||
password:
|
||||
listenPort: {{ .Values.metrics.containerPorts.http }}
|
||||
blacklist:
|
||||
# To profile the duration of jmx call you can start the program with the following options
|
||||
# > java -Dorg.slf4j.simpleLogger.defaultLogLevel=trace -jar cassandra_exporter.jar config.yml --oneshot
|
||||
#
|
||||
# To get intuition of what is done by cassandra when something is called you can look in cassandra
|
||||
# https://github.com/apache/cassandra/tree/trunk/src/java/org/apache/cassandra/metrics
|
||||
# Please avoid to scrape frequently those calls that are iterating over all sstables
|
||||
|
||||
# Unaccessible metrics (not enough privilege)
|
||||
- java:lang:memorypool:.*usagethreshold.*
|
||||
|
||||
# Leaf attributes not interesting for us but that are presents in many path
|
||||
- .*:999thpercentile
|
||||
- .*:95thpercentile
|
||||
- .*:fifteenminuterate
|
||||
- .*:fiveminuterate
|
||||
- .*:durationunit
|
||||
- .*:rateunit
|
||||
- .*:stddev
|
||||
- .*:meanrate
|
||||
- .*:mean
|
||||
- .*:min
|
||||
|
||||
# Path present in many metrics but uninterresting
|
||||
- .*:viewlockacquiretime:.*
|
||||
- .*:viewreadtime:.*
|
||||
- .*:cas[a-z]+latency:.*
|
||||
- .*:colupdatetimedeltahistogram:.*
|
||||
|
||||
# Mostly for RPC, do not scrap them
|
||||
- org:apache:cassandra:db:.*
|
||||
|
||||
# columnfamily is an alias for Table metrics
|
||||
# https://github.com/apache/cassandra/blob/8b3a60b9a7dbefeecc06bace617279612ec7092d/src/java/org/apache/cassandra/metrics/TableMetrics.java#L162
|
||||
- org:apache:cassandra:metrics:columnfamily:.*
|
||||
|
||||
# Should we export metrics for system keyspaces/tables ?
|
||||
- org:apache:cassandra:metrics:[^:]+:system[^:]*:.*
|
||||
|
||||
# Don't scrap us
|
||||
- com:criteo:nosql:cassandra:exporter:.*
|
||||
|
||||
maxScrapFrequencyInSec:
|
||||
50:
|
||||
- .*
|
||||
|
||||
# Refresh those metrics only every hour as it is costly for cassandra to retrieve them
|
||||
3600:
|
||||
- .*:snapshotssize:.*
|
||||
- .*:estimated.*
|
||||
- .*:totaldiskspaceused:.*
|
||||
## @section TLS/SSL parameters
|
||||
##
|
||||
|
||||
## TLS/SSL parameters
|
||||
## @param tls.internodeEncryption Set internode encryption
|
||||
## @param tls.clientEncryption Set client-server encryption
|
||||
## @param tls.autoGenerated Generate automatically self-signed TLS certificates. Currently only supports PEM certificates
|
||||
## @param tls.existingSecret Existing secret that contains Cassandra Keystore and truststore
|
||||
## @param tls.passwordsSecret Secret containing the Keystore and Truststore passwords if needed
|
||||
## @param tls.keystorePassword Password for the keystore, if needed.
|
||||
## @param tls.truststorePassword Password for the truststore, if needed.
|
||||
## @param tls.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if tls.resources is set (tls.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
## @param tls.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## @param tls.certificatesSecret Secret with the TLS certificates.
|
||||
## @param tls.tlsEncryptionSecretName Secret with the encryption of the TLS certificates
|
||||
##
|
||||
tls:
|
||||
internodeEncryption: none
|
||||
clientEncryption: false
|
||||
autoGenerated: false
|
||||
existingSecret: ""
|
||||
passwordsSecret: ""
|
||||
keystorePassword: ""
|
||||
truststorePassword: ""
|
||||
certificatesSecret: ""
|
||||
tlsEncryptionSecretName: ""
|
||||
resourcesPreset: "nano"
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
## choice for the user. This also increases chances charts run on environments with little
|
||||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
resources: {}
|
||||
28
compose/ansible.cfg
Normal file
28
compose/ansible.cfg
Normal file
@ -0,0 +1,28 @@
|
||||
[defaults]
|
||||
ansible_managed="Ansible managed"
|
||||
host_key_checking=false
|
||||
inventory=./inventory/hosts
|
||||
timeout = 60
|
||||
roles_path = ./roles/
|
||||
retry_files_enabled = False
|
||||
#log_path = ./logs/ansible.log
|
||||
become = True
|
||||
become_user = root
|
||||
become_method = sudo
|
||||
#vault_password_file = ~/.netdev_vault
|
||||
forks = 100
|
||||
pipelining = True
|
||||
#Gathered facts caching
|
||||
#gathering = smart
|
||||
#fact_caching = jsonfile
|
||||
#fact_caching_connection = ./.cache
|
||||
#Never expires
|
||||
fact_caching_timeout = 0
|
||||
#Profiler
|
||||
callbacks_enabled = timer, profile_tasks, profile_roles
|
||||
[ssh_connection]
|
||||
pipelining = True
|
||||
#Hold ssh ssh_connection
|
||||
#ssh_args = "-o ControlMaster=auto -o ControlPersist=15m"
|
||||
#Speed up files transfer
|
||||
transfer_method = piped
|
||||
1
compose/custom_inventory/group_vars/all/all.yaml
Normal file
1
compose/custom_inventory/group_vars/all/all.yaml
Normal file
@ -0,0 +1 @@
|
||||
domain_name: "co-work.ru"
|
||||
4
compose/custom_inventory/host_vars/cw-sya-reg-001/common.yml
Executable file
4
compose/custom_inventory/host_vars/cw-sya-reg-001/common.yml
Executable file
@ -0,0 +1,4 @@
|
||||
---
|
||||
#host_name: "cw-sya-reg-001"
|
||||
ansible_hostname: "docker.stage.co-work.local"
|
||||
ansible_host: "10.130.0.42"
|
||||
@ -0,0 +1,78 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
39643962356131303761633334643262366464336364326535653733613031303462623037313636
|
||||
6466646332613364346437626465613039383132313335330a623837393332353363316536653661
|
||||
64373039653131386432643162646534386130373335326630343339353665353639383337336230
|
||||
3166656431363264620a333563346663323035643538646435323263636462386237356164383561
|
||||
32613835616630643938356461646663363033613663373139643865303430613137376563313133
|
||||
64313664393633386138363837653966303039363231616461336466623236643564353830353764
|
||||
34663938343938626264393165313732333864356335303239626234613766616266393930633339
|
||||
61326633333034626639346662323939373366363735353936306130343534376362396561653730
|
||||
34666632353539366165353637326237636437373135353062373733366238386233353430623163
|
||||
61346132373935653431373033623937376465323763313065396162643138333262326366396333
|
||||
33653462633532656263303366646663313735376333303964396534333134333532343865313564
|
||||
61613830323234663938373863666563306332613737346639356630333738633563333733373066
|
||||
31323937636631616533643963386437386335383265663539356238396133376464613362653233
|
||||
39346566393833383265316461633433343666613033663433616237636364373863653766333062
|
||||
36643535653365363862643761393264346365373531656130383838363665636534303736353535
|
||||
61653465396264386263373365613066333035393633643030383462613665346636386161303963
|
||||
37326665333937653866613164383835363062623332323939376162336462653830333135353937
|
||||
38336364653662373838643666353236363064353563626666363630363733323530393766333535
|
||||
66366335353737653435303861303462336366623765333635643135393163656663666138653731
|
||||
61346365346561623162333231666435323664653132386162626333343966333938653336373565
|
||||
61663964643737656232633363336535653861616266346130303164333766333432663462356635
|
||||
66623836326163666463336437336135373865343462313134376534383963383461626462396362
|
||||
30613234633038626539323434306465383036613334626433343932383132306433646161366230
|
||||
39666465313530646536356265653264366237383136636466393164646535663164396663306531
|
||||
30346336393263363630633835383266623736633866336635643531326366346366386630383132
|
||||
66303566306233393238626465346331383630306238353734323739383536633535303134636666
|
||||
64393235643034633030656432386162396236323965356637666162303666336239343766666261
|
||||
63363336653733366166383865366164353064333965663364623435613430643261393330646163
|
||||
61326333376532356237356264363335383465666362623965663035356132633534643230306334
|
||||
61333037396637353239323837636238633137613035653034376330383934356237656133326138
|
||||
61383136326431343337656564356464363434623330356464643762643930363139613865323461
|
||||
33393439323836333164656365343134313166646235373263666438333936613465386530306634
|
||||
32306364356564376661343061363462313539623238363562373535616565333239356365663338
|
||||
30323362626136393335643238383930316266383362633865323965643133376331346638373865
|
||||
32663434623364326339336437383366386539373930663365376437613461376366326133663634
|
||||
38303861656464383866633732306366363633323165363438623462383838653130376136656139
|
||||
31343263393561616663376331366534636239386638633032366563626634346664626432363735
|
||||
30623133383234666537623237653132386364313562373833633138336362366537663633383830
|
||||
34313837653866333838373063623032383037653163313536646162653731623538636664623038
|
||||
37326664393435316134393636303133393364323361633731316465373964373365643738656339
|
||||
33343330613432613362336633323362366134666636376564353033333033653339336362623838
|
||||
66366435393564376666356265343365653130626336313132343234663465383630636662376532
|
||||
31656431373263666339623434333263363135383038636232623338623562343036653635646632
|
||||
30653663353835343633653434383362663830643030363164616163613839383133656533343632
|
||||
33373132326362636165616134643065323364623430353565643136313239353336663438656532
|
||||
39343236306565336430656339633338623731616637303834323363643834363665656433363432
|
||||
36346331383134623732363864663537343265323033643330383763313862326235363462353533
|
||||
36646233343562356534333839323763613836316435323163346235323862386164613935336137
|
||||
37306536613930343938373130366235376264323766313932646361623965376563386632303536
|
||||
61626462633262343035336537353762663930386266653363313535313433306539306465663235
|
||||
38333237656334313637386235613230356233646533363332383536663164626433303561396466
|
||||
39653662373933316461386639633362316264373230613562303966353165366636383738373962
|
||||
36386634323236623165303339663936613936313761313730346233313632373563643439396565
|
||||
37663035626434343965316230383465303732386437333039323239643537373035613632383039
|
||||
34666334383062363232333331653161343431373534633739363665333634343134633964646137
|
||||
37363333653939633232623838383430633135643732363166366538313331343063363131356438
|
||||
36666165313835316135386337303566613934343335313937313339633838363039356665373631
|
||||
63636565613439633961363562613632636330666637383538303062653965373034306164333637
|
||||
30313131353038383735346335376231623463646234626266313633643462373761333931366637
|
||||
32663232346530383835333466643230306238656638336231636131323061623566376331626635
|
||||
34363264363133376266343864333435356631366465666239326666386233626263373231363963
|
||||
32656634383966666533656662396635373732303036666664306266313362333362633466613864
|
||||
64376361376562343864653364383731386465386361383433386531323835646535663031656636
|
||||
65626561333434646665346466393439333437386239346665646464393738383939336238383037
|
||||
64643263303238326431326537373932336630363363386435383063376664323431363836346538
|
||||
33366437306666643965633833663033653962353731313435303635666539646633366639313135
|
||||
62393266303836386461653965333435303764336637663737356666333632613834303865633937
|
||||
38663338363231336430376537616436316661333636326130336136613436343166666338653733
|
||||
38366539383132353939373665313935623566323539356336613466336661316138373535303463
|
||||
33323165366261613434663465653364343362306632333466356662383361626565303834396661
|
||||
63313137376266666530313739663766323864323561666139623063636539646431393862613335
|
||||
38633331323161333961346133623666353934343038623566326237663362323832303738396264
|
||||
36623333316632376533353265613031353039343362333234613964613738393162383735653565
|
||||
30663266633637636230346237336338383439306638626537363763373364633837363464313439
|
||||
61343062356432623932393138616261663861373661303636343239366337326230643739313962
|
||||
32656232353362383031616266623534626233316164383232363537343837313662323736646136
|
||||
6439
|
||||
@ -0,0 +1,90 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
39663733323038363234363735323432656436633630376634333137363236373534633532373532
|
||||
6364623835383366363833386362656633373133613032650a313531306532306161333066396364
|
||||
30356364346362613932363732643335313361653137626462343663323938363962373939666230
|
||||
6466656531653464360a366135323161353466646461313762303535303266356238663866373835
|
||||
65623362383638326462343738646436363666396566346238313666326435623238636338363637
|
||||
66343766366139623238346135636437376436633531623666396132323236323361366661616166
|
||||
34386233613430323636313031323966306438626535366630346163343430663662633531373433
|
||||
62396536656635373634343332353038343136633330396332343365353631396434326266313332
|
||||
39626533393163313233366337633661623432653334666630363865306431623332393438316132
|
||||
66333130383166326336656565383266663835613137343537643265656263363031663333646265
|
||||
30376466356637613738666262313539363034653765346137316465613836613631303434353530
|
||||
37383761343162366430333539323130653664653134303739333033356464373837366433616265
|
||||
39333461313536386138346663313339306232353130386531303235633566376366343333333630
|
||||
33353238326439393531633437353966623337636538633735663038303837346134333864366332
|
||||
30653466376136366461663537393062646464373136356138623631663534383363366265373366
|
||||
36356362306239306331336337333864663631646232653164313936373362396232643730316236
|
||||
30333864316635323332323839373366623933386531643064626362303635373866653433616237
|
||||
65386237393036333934653066653237383934363165323535643265623833383830613365336465
|
||||
30626635656461356332393864646437363939633937353632646464393236373233306136623263
|
||||
38343261366664663561333638366165636330326162613661323562663239613435353966646562
|
||||
31306338653464373534356162376639396265633036633265643361626362333432636336373937
|
||||
62633664313639663939353632336666613332376263633933613537623131373966366139303731
|
||||
39623236313961663336303539626637623838646537306464333736306636636531353463636537
|
||||
63363865376631316337636236373563663636636564646665373566663534323339626237393133
|
||||
66396231393761303730366236313634336662613539636161623139636561373734306566336430
|
||||
32313938666434663231396165363733613464353930393939343536366631626465623035353033
|
||||
62646366623937643537383634616262316362316164653832396437356235623066356537623430
|
||||
32636462333330333464366634643736633937303837346238333635636430316363323230376537
|
||||
39333763626666643165613330303033343838616631353038636138336232303562643962303938
|
||||
62313762303861303539386333323031326338643665346630383938356362383738346163316563
|
||||
33353234653632383163383961363732393935396437623538623763353636643035396563343666
|
||||
30623631643731646337623062326562376665303764383135383361616365623132646138393664
|
||||
39636135366336653433393232373864356631663062366437663532666632353737366635346635
|
||||
63633363366565666132356366373461383339373036383532346636623837363831613338396333
|
||||
62626162393263313666616662623962356663666264373933663339363834653136633064333563
|
||||
33396432663830346563376561653364373637663539356564393462363432623731653533343637
|
||||
32376135356661363835663733636266393430383035613365656432393330326266353339383832
|
||||
37666162623738363538313132373034623234313733646532626162343931313066316436303036
|
||||
66363462333435393433666133643230316464646366633866356637396565643739643938633230
|
||||
33306264613738376361376630613932366234623739356564323137326566326233393230383532
|
||||
33613932323262616362616163383934313662343262646634626364353735643465343466366137
|
||||
34333162643965643361393031333836653334376236616634356665343534366230383263636638
|
||||
64333837333330316130356634613133636232396462393237313134656234616237666435656431
|
||||
61663938666533376433363531333663643266376164323163653537356532316462376330393434
|
||||
34333962323634643535383133353963323062303532623539613833366363323730646330343064
|
||||
37643136386164376434613531373438383331356661393637616630386161356339316130333861
|
||||
36343837636539636431303864646463666134663465363638323861316164653931323335343038
|
||||
63646264363132326234306566643336326564376134313739373938363835333264643539323834
|
||||
63363461323736306539663439626435353761643963346633396231336235316362343736383563
|
||||
63313938326561313264646536353232663635383164623733343962313733376539373830306366
|
||||
32363337303935623534386365353934353437356361366538353064663231356665306232386235
|
||||
65633837633438643431303935376535623439393931306566356538613363623333396161336531
|
||||
66653833616634623630656465363262326334666236393539303032646565353838643963646635
|
||||
64626533643432383137316165306662336562346537323066396638336266643033613836653034
|
||||
62373036373738626430343834633730326537656239343165386137623935363366373133393531
|
||||
33643565633038666438653235623039356665306130323635643230636133323536663635656630
|
||||
33333964633138666236623835633435313862326136343165353462363039663766633061663235
|
||||
32626539323264643536363666333238326362313333646235643064373863336334666432623361
|
||||
63316634313964633762613163313866373038623839383834643066313337386164636638323965
|
||||
36643661613965336366326663656536386436303038666235623836396333636265373837613036
|
||||
61333334656562323232656161316639393561333035383735393437346336393262663265343135
|
||||
38633330646265333733343337393833633964326139643966306130646663343432343638323035
|
||||
62383464333538633362316634643736643736393534373364323338623962636537383030336232
|
||||
37323637393735303531646165653563653365393665633337303762396136656166353836336436
|
||||
39643537633063626431363530616335393836653036363335333262616363623163396662383036
|
||||
36656533316164353530366639346132353731646332653938653636666463663661383864376464
|
||||
61316361373330633165363330643666313931326336303436323031386436646434613330366665
|
||||
66653731393638303139663230346536303937643461616366613738383862636634363435386133
|
||||
37663235663231343261336338373335616330626162363539313634346637373961613031306136
|
||||
33323866313634333131373864353862656362333536366465646435346565303636383362303634
|
||||
36356433623233363837316435636533363562663234336137333435363533626661666536376461
|
||||
32646464643130333930323537613063646635393534366462346539386131626139646562323134
|
||||
63613263333832366264343966383163393232636662646361643162323637653765643730613832
|
||||
31353665633262313065323064376536656433666563383834343139653939656639656339366362
|
||||
38666566323861666330636435363864346238363438343630306665666662663663393566366662
|
||||
65373763326432396334306265633936353234343265353936373837656362653963363065356264
|
||||
38343166346235333266353264633031343462373931616635306330636262646565653537316462
|
||||
66656563346633666464633461663533353831636238336232303161646336366134343066646337
|
||||
36663636626439383939336636383236663962393539633737396537353539666237646334616637
|
||||
36643335313239376138376634366232623037376138376161313737383562646366323632633866
|
||||
66333639313539653833316462653937386132323134346663346333383964336130333964633031
|
||||
39373663306161613339356636623630353336393366323139326538323539373630396531343435
|
||||
64313363663165643539323431383631343035656432663366643861343166616131613464613334
|
||||
30643638316431363865613862383339386431666164626264646533323136383734323730613433
|
||||
38626561363534333765333235343261616565383236363035663563316232363038386239303738
|
||||
35623165393566333837343862313961633238313938346632636166346430313631346130383134
|
||||
36353364393237333837393466653137356538613362613663326162666533393830613530666432
|
||||
37613835353739326162633737393538393965653266333637376536663631393838313561343235
|
||||
63323266653335643762373964366639343566383362393132643434336135333066
|
||||
18
compose/custom_inventory/hosts
Executable file
18
compose/custom_inventory/hosts
Executable file
@ -0,0 +1,18 @@
|
||||
[wireguard_servers]
|
||||
gt-demo-vpn ansible_host=10.212.0.13 #34.18.24.128
|
||||
gt-demo-reg ansible_host=10.212.0.7
|
||||
|
||||
[gemteam_demo]
|
||||
gt-demo-vpn ansible_host=10.212.0.13 #34.18.24.128
|
||||
gt-demo-dns ansible_host=10.212.0.4
|
||||
gt-demo-mon ansible_host=10.212.0.15
|
||||
gt-demo-ldap ansible_host=10.212.0.3
|
||||
gt-demo-iam ansible_host=10.212.0.5
|
||||
gt-demo-jfrog ansible_host=10.212.0.6
|
||||
gt-demo-reg ansible_host=10.212.0.7
|
||||
gt-demo-docker ansible_host=10.212.0.8
|
||||
gt-demo-jenkins-m ansible_host=10.212.0.9
|
||||
gt-demo-jenkins-w ansible_host=10.212.0.11
|
||||
gt-demo-store ansible_host=10.212.0.10
|
||||
gt-demo-livekit ansible_host=10.212.0.12
|
||||
gt-demo-front ansible_host=10.212.0.14
|
||||
8
compose/inventory/hosts
Normal file
8
compose/inventory/hosts
Normal file
@ -0,0 +1,8 @@
|
||||
[co-work_stage]
|
||||
cw-sya-ldap-001 ansible_host=10.130.0.16
|
||||
cw-sya-nfs-001 ansible_host=10.130.0.37
|
||||
cw-sya-store-001 ansible_host=10.130.0.12
|
||||
cw-sya-vpn-001 ansible_host=10.130.0.28
|
||||
cw-sya-iam-001 ansible_host=10.130.0.41
|
||||
cw-sya-reg-001 ansible_host=10.130.0.42
|
||||
|
||||
4
compose/playbooks/ca_server/README.md
Normal file
4
compose/playbooks/ca_server/README.md
Normal file
@ -0,0 +1,4 @@
|
||||
======================================================================
|
||||
Playbook information
|
||||
======================================================================
|
||||
Плейбук по установке и настройке Центра сертификации (OpenSSL)
|
||||
4
compose/playbooks/ca_server/ansible.cfg
Normal file
4
compose/playbooks/ca_server/ansible.cfg
Normal file
@ -0,0 +1,4 @@
|
||||
[defaults]
|
||||
ansible_managed="Ansible managed"
|
||||
host_key_checking=False
|
||||
inventory=inventory/hosts
|
||||
9
compose/playbooks/ca_server/defaults/main.yml
Normal file
9
compose/playbooks/ca_server/defaults/main.yml
Normal file
@ -0,0 +1,9 @@
|
||||
---
|
||||
# defaults vars
|
||||
# ansible_python_interpreter: "/usr/libexec/platform-python"
|
||||
ansible_ssh_pipelining: "true"
|
||||
ansible_user: "gem-admin"
|
||||
ansible_ssh_transfer_method: "piped"
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
|
||||
ansible_port: 22
|
||||
|
||||
5
compose/playbooks/ca_server/handlers/main.yml
Normal file
5
compose/playbooks/ca_server/handlers/main.yml
Normal file
@ -0,0 +1,5 @@
|
||||
---
|
||||
# handlers file
|
||||
|
||||
|
||||
|
||||
3
compose/playbooks/ca_server/inventory/hosts
Normal file
3
compose/playbooks/ca_server/inventory/hosts
Normal file
@ -0,0 +1,3 @@
|
||||
|
||||
[ca-host]
|
||||
cw-sya-ldap-001 ansible_host=10.130.0.16
|
||||
16
compose/playbooks/ca_server/main.yml
Normal file
16
compose/playbooks/ca_server/main.yml
Normal file
@ -0,0 +1,16 @@
|
||||
---
|
||||
# Установка центра сертификации
|
||||
- name: Install CA server
|
||||
hosts: cw-sya-ldap-001
|
||||
gather_facts: true
|
||||
become: true
|
||||
vars_files:
|
||||
- vars/base_conf.yml
|
||||
- vars/secret.yml
|
||||
- defaults/main.yml
|
||||
pre_tasks:
|
||||
- import_tasks: tasks/check_os_version.yml
|
||||
roles:
|
||||
- role: ca_install
|
||||
when: ansible_distribution == "Ubuntu"
|
||||
|
||||
4
compose/playbooks/ca_server/roles/ca_install/README.md
Normal file
4
compose/playbooks/ca_server/roles/ca_install/README.md
Normal file
@ -0,0 +1,4 @@
|
||||
======================================================================
|
||||
Role information
|
||||
======================================================================
|
||||
Установка CA (Центра сертификации)
|
||||
@ -0,0 +1,4 @@
|
||||
---
|
||||
# handlers file
|
||||
|
||||
|
||||
@ -0,0 +1,51 @@
|
||||
---
|
||||
# Настройка CA
|
||||
- name: Configure CA
|
||||
block:
|
||||
- name: Creates base directory
|
||||
ansible.builtin.file:
|
||||
path: "/opt/{{ item }}"
|
||||
state: directory
|
||||
loop:
|
||||
- CA
|
||||
- CA/service
|
||||
|
||||
- name: Check CA private key
|
||||
stat:
|
||||
path: /opt/CA/RootCA.key
|
||||
register: ca_key_result
|
||||
|
||||
- name: Create CA private key
|
||||
expect:
|
||||
command: /bin/bash -c 'openssl genpkey -algorithm RSA -out /opt/CA/RootCA.key -aes-128-cbc'
|
||||
responses:
|
||||
Enter PEM pass *: "{{ ca_password }}"
|
||||
Verifying *: "{{ ca_password }}"
|
||||
timeout: 300
|
||||
when: ca_key_result.stat.exists == false
|
||||
|
||||
- name: Check CA certificate
|
||||
stat:
|
||||
path: /opt/CA/RootCA.crt
|
||||
register: ca_crt_result
|
||||
|
||||
- name: Create CA certificate
|
||||
expect:
|
||||
command: "/bin/bash -c 'openssl req -x509 -new -key /opt/CA/RootCA.key -sha256 -days {{ ca_lifeday }} -out /opt/CA/RootCA.crt'"
|
||||
responses:
|
||||
Enter pass *: "{{ ca_password }}"
|
||||
Country *: "{{ ca_country }}"
|
||||
State *: "{{ ca_state }}"
|
||||
Locality *: "{{ ca_locality }}"
|
||||
Organization *: "{{ ca_organization }}"
|
||||
Organizational *: "{{ ca_organization }}"
|
||||
Common *: "{{ ca_domain }}"
|
||||
Email *: "admin@{{ ca_domain }}"
|
||||
timeout: 300
|
||||
when: ca_crt_result.stat.exists == false
|
||||
|
||||
- name: Create certificate template
|
||||
template:
|
||||
src: template.cnf.j2
|
||||
dest: /opt/CA/template.cnf
|
||||
register: template_updated
|
||||
@ -0,0 +1,45 @@
|
||||
---
|
||||
- name: Create wildcard service certificate
|
||||
block:
|
||||
- name: Check private KEY
|
||||
stat:
|
||||
path: /opt/CA/service/{{ crt_services }}.key
|
||||
register: key_result
|
||||
|
||||
- name: Create wildcard service KEY
|
||||
shell: |
|
||||
openssl genpkey -algorithm RSA -out /opt/CA/service/{{ crt_services }}.key
|
||||
when: key_result.stat.exists == false
|
||||
|
||||
- name: Check CSR
|
||||
stat:
|
||||
path: /opt/CA/service/{{ crt_services }}.csr
|
||||
register: csr_result
|
||||
|
||||
- name: Create wildcard service CSR
|
||||
expect:
|
||||
command: "/bin/bash -c 'openssl req -new -key /opt/CA/service/{{ crt_services }}.key -config /opt/CA/template.cnf -reqexts req_ext -out /opt/CA/service/{{ crt_services }}.csr'"
|
||||
responses:
|
||||
Country *: "{{ ca_country }}"
|
||||
State *: "{{ ca_state }}"
|
||||
Locality *: "{{ ca_locality }}"
|
||||
Organization *: "{{ ca_organization }}"
|
||||
Organizational *: "{{ ca_organization }}"
|
||||
Common *: "{{ ca_domain }}"
|
||||
Email *: "admin@{{ ca_domain }}"
|
||||
timeout: 300
|
||||
when: csr_result.stat.exists == false
|
||||
|
||||
- name: Check public CRT
|
||||
stat:
|
||||
path: /opt/CA/service/{{ crt_services }}.crt
|
||||
register: crt_result
|
||||
|
||||
- name: Create wildcard service CRT
|
||||
expect:
|
||||
command: "/bin/bash -c 'openssl x509 -req -days 730 -CA /opt/CA/RootCA.crt -CAkey /opt/CA/RootCA.key -extfile /opt/CA/template.cnf -extensions req_ext -in /opt/CA/service/{{ crt_services }}.csr -out /opt/CA/service/{{ crt_services }}.crt'"
|
||||
responses:
|
||||
Enter pass *: "{{ ca_password }}"
|
||||
when: crt_result.stat.exists == false
|
||||
|
||||
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
|
||||
# Настройка CA
|
||||
- name: Configure CA
|
||||
include_tasks: configure_ca.yml
|
||||
|
||||
- name: Create service certificate
|
||||
include_tasks: create_cert.yml
|
||||
@ -0,0 +1,22 @@
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = req_ext
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = {{ ca_country }}
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = {{ ca_state }}
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = {{ ca_locality }}
|
||||
organizationName = Organization Name (eg, company)
|
||||
organizationName_default = {{ ca_organization }}
|
||||
commonName = Common Name (eg, YOUR name or FQDN)
|
||||
commonName_max = 64
|
||||
commonName_default = *.{{ ca_domain }}
|
||||
[ req_ext ]
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
subjectAltName = @alt_names
|
||||
[alt_names]
|
||||
DNS.1 = *.{{ ca_domain }}
|
||||
@ -0,0 +1,2 @@
|
||||
---
|
||||
# vars file
|
||||
15
compose/playbooks/ca_server/tasks/check_os_version.yml
Normal file
15
compose/playbooks/ca_server/tasks/check_os_version.yml
Normal file
@ -0,0 +1,15 @@
|
||||
---
|
||||
# Проверка версии ОС
|
||||
- name: Check OS version
|
||||
block:
|
||||
# - name: DEBUG OS version
|
||||
# debug:
|
||||
# msg:
|
||||
# - "OS: {{ ansible_distribution }}"
|
||||
# - "Version: {{ ansible_distribution_version }}"
|
||||
# - "Major version: {{ ansible_distribution_major_version }}"
|
||||
|
||||
- name: OS version not supported
|
||||
fail:
|
||||
msg: "Operating system {{ ansible_distribution }} ver. {{ ansible_distribution_major_version }} not supported"
|
||||
when: ansible_distribution not in ['Ubuntu']
|
||||
10
compose/playbooks/ca_server/vars/base_conf.yml
Normal file
10
compose/playbooks/ca_server/vars/base_conf.yml
Normal file
@ -0,0 +1,10 @@
|
||||
---
|
||||
# Переменные конфигурации
|
||||
ca_domain: "stage.co-work.local" # Имя доменна
|
||||
ca_country: "RU" # Страна
|
||||
ca_locality: "Moscow"
|
||||
ca_state: "Moscow"
|
||||
ca_organization: "co-work_stage" # Имя организации
|
||||
ca_lifeday: "3650" # Срок жизни рутового сертификата
|
||||
crt_services: "wc" # Имя wildcard сертификата
|
||||
|
||||
10
compose/playbooks/ca_server/vars/secret.yml
Normal file
10
compose/playbooks/ca_server/vars/secret.yml
Normal file
@ -0,0 +1,10 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
32393233636236623437333934643231303835343237373436333735333939326635316636613433
|
||||
6137623638653763323232323831323537383561616361660a376136633637616165366362323065
|
||||
35336532623538336364636566633339316263653761383733643834633765313831333234663666
|
||||
6561343033383266660a363530616230396537623165326465326662353234383166356264306265
|
||||
61396233623233363933343932303733656630653633633938306230383933393433633266666133
|
||||
35313338326330636632346132336665636231313836393336346230303662356562363937303932
|
||||
31323466633735383738656264383066363231353561373635386461643865353235393661326435
|
||||
65353630383932613432376137376564623236623037623261663766356236363438383064663062
|
||||
3031
|
||||
4
compose/playbooks/dns_server/README.md
Normal file
4
compose/playbooks/dns_server/README.md
Normal file
@ -0,0 +1,4 @@
|
||||
======================================================================
|
||||
Playbook information
|
||||
======================================================================
|
||||
Плейбук по установке и настройке DNS сервера BIND
|
||||
4
compose/playbooks/dns_server/ansible.cfg
Normal file
4
compose/playbooks/dns_server/ansible.cfg
Normal file
@ -0,0 +1,4 @@
|
||||
[defaults]
|
||||
ansible_managed="Ansible managed"
|
||||
host_key_checking=False
|
||||
inventory=inventory/hosts
|
||||
9
compose/playbooks/dns_server/defaults/main.yml
Normal file
9
compose/playbooks/dns_server/defaults/main.yml
Normal file
@ -0,0 +1,9 @@
|
||||
---
|
||||
# defaults vars
|
||||
# ansible_python_interpreter: "/usr/libexec/platform-python"
|
||||
ansible_ssh_pipelining: "true"
|
||||
ansible_user: "gem-admin"
|
||||
ansible_ssh_transfer_method: "piped"
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
|
||||
ansible_port: 22
|
||||
|
||||
5
compose/playbooks/dns_server/handlers/main.yml
Normal file
5
compose/playbooks/dns_server/handlers/main.yml
Normal file
@ -0,0 +1,5 @@
|
||||
---
|
||||
# handlers file
|
||||
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user