chore(helm): Updating kafka chart
This commit is contained in:
rjshrjndrn
parent
74d6afc091
commit
0759ec2888
110 changed files with 9560 additions and 4406 deletions
0
scripts/helmcharts/databases/charts/kafka/.helmignore
Executable file → Normal file
0
scripts/helmcharts/databases/charts/kafka/.helmignore
Executable file → Normal file
9
scripts/helmcharts/databases/charts/kafka/Chart.lock
Normal file
9
scripts/helmcharts/databases/charts/kafka/Chart.lock
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
dependencies:
|
||||
- name: zookeeper
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 11.1.0
|
||||
- name: common
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 2.2.2
|
||||
digest: sha256:da099b68bc1deabb4998fd87b4141440f26dba1a14801a507c402247830e75ee
|
||||
generated: "2023-01-24T02:09:12.655952782Z"
|
||||
32
scripts/helmcharts/databases/charts/kafka/Chart.yaml
Executable file → Normal file
32
scripts/helmcharts/databases/charts/kafka/Chart.yaml
Executable file → Normal file
|
|
@ -1,11 +1,23 @@
|
|||
annotations:
|
||||
category: Infrastructure
|
||||
apiVersion: v1
|
||||
appVersion: 2.6.0
|
||||
description: Apache Kafka is a distributed streaming platform.
|
||||
engine: gotpl
|
||||
home: https://github.com/bitnami/charts/tree/master/bitnami/kafka
|
||||
icon: https://bitnami.com/assets/stacks/kafka/img/kafka-stack-110x117.png
|
||||
licenses: Apache-2.0
|
||||
apiVersion: v2
|
||||
appVersion: 3.3.2
|
||||
dependencies:
|
||||
- condition: zookeeper.enabled
|
||||
name: zookeeper
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 11.x.x
|
||||
- name: common
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
tags:
|
||||
- bitnami-common
|
||||
version: 2.x.x
|
||||
description: Apache Kafka is a distributed streaming platform designed to build real-time
|
||||
pipelines and can be used as a message broker or as a replacement for a log aggregation
|
||||
solution for big data applications.
|
||||
home: https://github.com/bitnami/charts/tree/main/bitnami/kafka
|
||||
icon: https://bitnami.com/assets/stacks/kafka/img/kafka-stack-220x234.png
|
||||
keywords:
|
||||
- kafka
|
||||
- zookeeper
|
||||
|
|
@ -13,10 +25,10 @@ keywords:
|
|||
- producer
|
||||
- consumer
|
||||
maintainers:
|
||||
- email: containers@bitnami.com
|
||||
name: Bitnami
|
||||
- name: Bitnami
|
||||
url: https://github.com/bitnami/charts
|
||||
name: kafka
|
||||
sources:
|
||||
- https://github.com/bitnami/bitnami-docker-kafka
|
||||
- https://github.com/bitnami/containers/tree/main/bitnami/kafka
|
||||
- https://kafka.apache.org/
|
||||
version: 11.8.6
|
||||
version: 20.0.6
|
||||
|
|
|
|||
1043
scripts/helmcharts/databases/charts/kafka/README.md
Executable file → Normal file
1043
scripts/helmcharts/databases/charts/kafka/README.md
Executable file → Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,22 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
annotations:
|
||||
category: Infrastructure
|
||||
apiVersion: v2
|
||||
appVersion: 2.2.2
|
||||
description: A Library Helm Chart for grouping common logic between bitnami charts.
|
||||
This chart is not deployable by itself.
|
||||
home: https://github.com/bitnami/charts/tree/main/bitnami/common
|
||||
icon: https://bitnami.com/downloads/logos/bitnami-mark.png
|
||||
keywords:
|
||||
- common
|
||||
- helper
|
||||
- template
|
||||
- function
|
||||
- bitnami
|
||||
maintainers:
|
||||
- name: Bitnami
|
||||
url: https://github.com/bitnami/charts
|
||||
name: common
|
||||
sources:
|
||||
- https://github.com/bitnami/charts
|
||||
- https://www.bitnami.com/
|
||||
type: library
|
||||
version: 2.2.2
|
||||
|
|
@ -0,0 +1,351 @@
|
|||
# Bitnami Common Library Chart
|
||||
|
||||
A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts.
|
||||
|
||||
## TL;DR
|
||||
|
||||
```yaml
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 1.x.x
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
```
|
||||
|
||||
```bash
|
||||
$ helm dependency update
|
||||
```
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
data:
|
||||
myvalue: "Hello World"
|
||||
```
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager.
|
||||
|
||||
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.2.0+
|
||||
|
||||
## Parameters
|
||||
|
||||
The following table lists the helpers available in the library which are scoped in different sections.
|
||||
|
||||
### Affinities
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-------------------------------|------------------------------------------------------|------------------------------------------------|
|
||||
| `common.affinities.nodes.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` |
|
||||
| `common.affinities.nodes.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` |
|
||||
| `common.affinities.pods.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` |
|
||||
| `common.affinities.pods.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` |
|
||||
| `common.affinities.topologyKey` | Return a topologyKey definition | `dict "topologyKey" "FOO"` |
|
||||
|
||||
### Capabilities
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|------------------------------------------------|------------------------------------------------------------------------------------------------|-------------------|
|
||||
| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context |
|
||||
| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context |
|
||||
| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context |
|
||||
| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context |
|
||||
| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context |
|
||||
| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context |
|
||||
| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context |
|
||||
| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for podsecuritypolicy. | `.` Chart context |
|
||||
| `common.capabilities.networkPolicy.apiVersion` | Return the appropriate apiVersion for networkpolicy. | `.` Chart context |
|
||||
| `common.capabilities.apiService.apiVersion` | Return the appropriate apiVersion for APIService. | `.` Chart context |
|
||||
| `common.capabilities.hpa.apiVersion` | Return the appropriate apiVersion for Horizontal Pod Autoscaler | `.` Chart context |
|
||||
| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context |
|
||||
|
||||
### Errors
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|
|
||||
| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` |
|
||||
|
||||
### Images
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
|
||||
| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. |
|
||||
| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` |
|
||||
| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` |
|
||||
|
||||
### Ingress
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences |
|
||||
| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context |
|
||||
| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context |
|
||||
| `common.ingress.certManagerRequest` | Prints "true" if required cert-manager annotations for TLS signed certificates are set in the Ingress annotations | `dict "annotations" .Values.path.to.the.ingress.annotations` |
|
||||
|
||||
### Labels
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------|-----------------------------------------------------------------------------|-------------------|
|
||||
| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context |
|
||||
| `common.labels.matchLabels` | Labels to use on `deploy.spec.selector.matchLabels` and `svc.spec.selector` | `.` Chart context |
|
||||
|
||||
### Names
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------------|-----------------------------------------------------------------------|-------------------|
|
||||
| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context |
|
||||
| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context |
|
||||
| `common.names.namespace` | Allow the release namespace to be overridden | `.` Chart context |
|
||||
| `common.names.fullname.namespace` | Create a fully qualified app name adding the installation's namespace | `.` Chart context |
|
||||
| `common.names.chart` | Chart name plus version | `.` Chart context |
|
||||
|
||||
### Secrets
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. |
|
||||
| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. |
|
||||
| `common.secrets.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. |
|
||||
| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` |
|
||||
|
||||
### Storage
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.storage.class` | Return the proper Storage Class | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. |
|
||||
|
||||
### TplValues
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` |
|
||||
|
||||
### Utils
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------|
|
||||
| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` |
|
||||
| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` |
|
||||
| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` |
|
||||
| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` |
|
||||
|
||||
### Validations
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) |
|
||||
| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) |
|
||||
| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. |
|
||||
| `common.validations.values.mysql.passwords` | This helper will ensure required password for MySQL are not empty. It returns a shared error for all the values. | `dict "secret" "mysql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mysql chart and the helper. |
|
||||
| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. |
|
||||
| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis® are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. |
|
||||
| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. |
|
||||
| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. |
|
||||
|
||||
### Warnings
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|------------------------------|----------------------------------|------------------------------------------------------------|
|
||||
| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. |
|
||||
|
||||
## Special input schemas
|
||||
|
||||
### ImageRoot
|
||||
|
||||
```yaml
|
||||
registry:
|
||||
type: string
|
||||
description: Docker registry where the image is located
|
||||
example: docker.io
|
||||
|
||||
repository:
|
||||
type: string
|
||||
description: Repository and image name
|
||||
example: bitnami/nginx
|
||||
|
||||
tag:
|
||||
type: string
|
||||
description: image tag
|
||||
example: 1.16.1-debian-10-r63
|
||||
|
||||
pullPolicy:
|
||||
type: string
|
||||
description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
|
||||
pullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: Optionally specify an array of imagePullSecrets (evaluated as templates).
|
||||
|
||||
debug:
|
||||
type: boolean
|
||||
description: Set to true if you would like to see extra information on logs
|
||||
example: false
|
||||
|
||||
## An instance would be:
|
||||
# registry: docker.io
|
||||
# repository: bitnami/nginx
|
||||
# tag: 1.16.1-debian-10-r63
|
||||
# pullPolicy: IfNotPresent
|
||||
# debug: false
|
||||
```
|
||||
|
||||
### Persistence
|
||||
|
||||
```yaml
|
||||
enabled:
|
||||
type: boolean
|
||||
description: Whether enable persistence.
|
||||
example: true
|
||||
|
||||
storageClass:
|
||||
type: string
|
||||
description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning.
|
||||
example: "-"
|
||||
|
||||
accessMode:
|
||||
type: string
|
||||
description: Access mode for the Persistent Volume Storage.
|
||||
example: ReadWriteOnce
|
||||
|
||||
size:
|
||||
type: string
|
||||
description: Size the Persistent Volume Storage.
|
||||
example: 8Gi
|
||||
|
||||
path:
|
||||
type: string
|
||||
description: Path to be persisted.
|
||||
example: /bitnami
|
||||
|
||||
## An instance would be:
|
||||
# enabled: true
|
||||
# storageClass: "-"
|
||||
# accessMode: ReadWriteOnce
|
||||
# size: 8Gi
|
||||
# path: /bitnami
|
||||
```
|
||||
|
||||
### ExistingSecret
|
||||
|
||||
```yaml
|
||||
name:
|
||||
type: string
|
||||
description: Name of the existing secret.
|
||||
example: mySecret
|
||||
keyMapping:
|
||||
description: Mapping between the expected key name and the name of the key in the existing secret.
|
||||
type: object
|
||||
|
||||
## An instance would be:
|
||||
# name: mySecret
|
||||
# keyMapping:
|
||||
# password: myPasswordKey
|
||||
```
|
||||
|
||||
#### Example of use
|
||||
|
||||
When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets.
|
||||
|
||||
```yaml
|
||||
# templates/secret.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "common.names.fullname" . }}
|
||||
type: Opaque
|
||||
data:
|
||||
password: {{ .Values.password | b64enc | quote }}
|
||||
|
||||
# templates/dpl.yaml
|
||||
---
|
||||
...
|
||||
env:
|
||||
- name: PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }}
|
||||
key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }}
|
||||
...
|
||||
|
||||
# values.yaml
|
||||
---
|
||||
name: mySecret
|
||||
keyMapping:
|
||||
password: myPasswordKey
|
||||
```
|
||||
|
||||
### ValidateValue
|
||||
|
||||
#### NOTES.txt
|
||||
|
||||
```console
|
||||
{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}}
|
||||
|
||||
{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||
```
|
||||
|
||||
If we force those values to be empty we will see some alerts
|
||||
|
||||
```console
|
||||
$ helm install test mychart --set path.to.value00="",path.to.value01=""
|
||||
'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value:
|
||||
|
||||
export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d)
|
||||
|
||||
'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value:
|
||||
|
||||
export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d)
|
||||
```
|
||||
|
||||
## Upgrading
|
||||
|
||||
### To 1.0.0
|
||||
|
||||
[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
|
||||
|
||||
**What changes were introduced in this major version?**
|
||||
|
||||
- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field.
|
||||
- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information.
|
||||
- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts
|
||||
|
||||
**Considerations when upgrading to this version**
|
||||
|
||||
- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues
|
||||
- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore
|
||||
- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3
|
||||
|
||||
**Useful links**
|
||||
|
||||
- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/
|
||||
- https://helm.sh/docs/topics/v2_v3_migration/
|
||||
- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/
|
||||
|
||||
## License
|
||||
|
||||
Copyright © 2022 Bitnami
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return a soft nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.soft" -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- preference:
|
||||
matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
weight: 1
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.hard" -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a nodeAffinity definition
|
||||
{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.nodes.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.nodes.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a topologyKey definition
|
||||
{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.topologyKey" -}}
|
||||
{{ .topologyKey | default "kubernetes.io/hostname" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a soft podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.soft" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
weight: 1
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.hard" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.pods.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.pods.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,154 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return the target Kubernetes version
|
||||
*/}}
|
||||
{{- define "common.capabilities.kubeVersion" -}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.kubeVersion }}
|
||||
{{- .Values.global.kubeVersion -}}
|
||||
{{- else }}
|
||||
{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
|
||||
{{- end -}}
|
||||
{{- else }}
|
||||
{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for poddisruptionbudget.
|
||||
*/}}
|
||||
{{- define "common.capabilities.policy.apiVersion" -}}
|
||||
{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "policy/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "policy/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for networkpolicy.
|
||||
*/}}
|
||||
{{- define "common.capabilities.networkPolicy.apiVersion" -}}
|
||||
{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for cronjob.
|
||||
*/}}
|
||||
{{- define "common.capabilities.cronjob.apiVersion" -}}
|
||||
{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "batch/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "batch/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for deployment.
|
||||
*/}}
|
||||
{{- define "common.capabilities.deployment.apiVersion" -}}
|
||||
{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for statefulset.
|
||||
*/}}
|
||||
{{- define "common.capabilities.statefulset.apiVersion" -}}
|
||||
{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "apps/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for ingress.
|
||||
*/}}
|
||||
{{- define "common.capabilities.ingress.apiVersion" -}}
|
||||
{{- if .Values.ingress -}}
|
||||
{{- if .Values.ingress.apiVersion -}}
|
||||
{{- .Values.ingress.apiVersion -}}
|
||||
{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "networking.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end }}
|
||||
{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "networking.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for RBAC resources.
|
||||
*/}}
|
||||
{{- define "common.capabilities.rbac.apiVersion" -}}
|
||||
{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "rbac.authorization.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "rbac.authorization.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for CRDs.
|
||||
*/}}
|
||||
{{- define "common.capabilities.crd.apiVersion" -}}
|
||||
{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "apiextensions.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apiextensions.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for APIService.
|
||||
*/}}
|
||||
{{- define "common.capabilities.apiService.apiVersion" -}}
|
||||
{{- if semverCompare "<1.10-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "apiregistration.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apiregistration.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for Horizontal Pod Autoscaler.
|
||||
*/}}
|
||||
{{- define "common.capabilities.hpa.apiVersion" -}}
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}}
|
||||
{{- if .beta2 -}}
|
||||
{{- print "autoscaling/v2beta2" -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v2beta1" -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v2" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if the used Helm version is 3.3+.
|
||||
A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure.
|
||||
This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error.
|
||||
**To be removed when the catalog's minimun Helm version is 3.3**
|
||||
*/}}
|
||||
{{- define "common.capabilities.supportsHelmVersion" -}}
|
||||
{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Through error when upgrading using empty passwords values that must not be empty.
|
||||
|
||||
Usage:
|
||||
{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}}
|
||||
{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }}
|
||||
|
||||
Required password params:
|
||||
- validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error.
|
||||
- context - Context - Required. Parent context.
|
||||
*/}}
|
||||
{{- define "common.errors.upgrade.passwords.empty" -}}
|
||||
{{- $validationErrors := join "" .validationErrors -}}
|
||||
{{- if and $validationErrors .context.Release.IsUpgrade -}}
|
||||
{{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}}
|
||||
{{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}}
|
||||
{{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}}
|
||||
{{- $errorString = print $errorString "\n%s" -}}
|
||||
{{- printf $errorString $validationErrors | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Return the proper image name
|
||||
{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }}
|
||||
*/}}
|
||||
{{- define "common.images.image" -}}
|
||||
{{- $registryName := .imageRoot.registry -}}
|
||||
{{- $repositoryName := .imageRoot.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $termination := .imageRoot.tag | toString -}}
|
||||
{{- if .global }}
|
||||
{{- if .global.imageRegistry }}
|
||||
{{- $registryName = .global.imageRegistry -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .imageRoot.digest }}
|
||||
{{- $separator = "@" -}}
|
||||
{{- $termination = .imageRoot.digest | toString -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
|
||||
{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
|
||||
*/}}
|
||||
{{- define "common.images.pullSecrets" -}}
|
||||
{{- $pullSecrets := list }}
|
||||
|
||||
{{- if .global }}
|
||||
{{- range .global.imagePullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range .images -}}
|
||||
{{- range .pullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not (empty $pullSecrets)) }}
|
||||
imagePullSecrets:
|
||||
{{- range $pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names evaluating values as templates
|
||||
{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.images.renderPullSecrets" -}}
|
||||
{{- $pullSecrets := list }}
|
||||
{{- $context := .context }}
|
||||
|
||||
{{- if $context.Values.global }}
|
||||
{{- range $context.Values.global.imagePullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range .images -}}
|
||||
{{- range .pullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not (empty $pullSecrets)) }}
|
||||
imagePullSecrets:
|
||||
{{- range $pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Generate backend entry that is compatible with all Kubernetes API versions.
|
||||
|
||||
Usage:
|
||||
{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }}
|
||||
|
||||
Params:
|
||||
- serviceName - String. Name of an existing service backend
|
||||
- servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer.
|
||||
- context - Dict - Required. The context for the template evaluation.
|
||||
*/}}
|
||||
{{- define "common.ingress.backend" -}}
|
||||
{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}}
|
||||
{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}}
|
||||
serviceName: {{ .serviceName }}
|
||||
servicePort: {{ .servicePort }}
|
||||
{{- else -}}
|
||||
service:
|
||||
name: {{ .serviceName }}
|
||||
port:
|
||||
{{- if typeIs "string" .servicePort }}
|
||||
name: {{ .servicePort }}
|
||||
{{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }}
|
||||
number: {{ .servicePort | int }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Print "true" if the API pathType field is supported
|
||||
Usage:
|
||||
{{ include "common.ingress.supportsPathType" . }}
|
||||
*/}}
|
||||
{{- define "common.ingress.supportsPathType" -}}
|
||||
{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}}
|
||||
{{- print "false" -}}
|
||||
{{- else -}}
|
||||
{{- print "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if the ingressClassname field is supported
|
||||
Usage:
|
||||
{{ include "common.ingress.supportsIngressClassname" . }}
|
||||
*/}}
|
||||
{{- define "common.ingress.supportsIngressClassname" -}}
|
||||
{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "false" -}}
|
||||
{{- else -}}
|
||||
{{- print "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if cert-manager required annotations for TLS signed
|
||||
certificates are set in the Ingress annotations
|
||||
Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
|
||||
Usage:
|
||||
{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }}
|
||||
*/}}
|
||||
{{- define "common.ingress.certManagerRequest" -}}
|
||||
{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Kubernetes standard labels
|
||||
*/}}
|
||||
{{- define "common.labels.standard" -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
helm.sh/chart: {{ include "common.names.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector
|
||||
*/}}
|
||||
{{- define "common.labels.matchLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "common.names.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "common.names.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "common.names.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified dependency name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
Usage:
|
||||
{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.names.dependency.fullname" -}}
|
||||
{{- if .chartValues.fullnameOverride -}}
|
||||
{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .chartName .chartValues.nameOverride -}}
|
||||
{{- if contains $name .context.Release.Name -}}
|
||||
{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
|
||||
*/}}
|
||||
{{- define "common.names.namespace" -}}
|
||||
{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a fully qualified app name adding the installation's namespace.
|
||||
*/}}
|
||||
{{- define "common.names.fullname.namespace" -}}
|
||||
{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,165 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Generate secret name.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }}
|
||||
|
||||
Params:
|
||||
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||
- defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment.
|
||||
- context - Dict - Required. The context for the template evaluation.
|
||||
*/}}
|
||||
{{- define "common.secrets.name" -}}
|
||||
{{- $name := (include "common.names.fullname" .context) -}}
|
||||
|
||||
{{- if .defaultNameSuffix -}}
|
||||
{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with .existingSecret -}}
|
||||
{{- if not (typeIs "string" .) -}}
|
||||
{{- with .name -}}
|
||||
{{- $name = . -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $name = . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- printf "%s" $name -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate secret key.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }}
|
||||
|
||||
Params:
|
||||
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||
- key - String - Required. Name of the key in the secret.
|
||||
*/}}
|
||||
{{- define "common.secrets.key" -}}
|
||||
{{- $key := .key -}}
|
||||
|
||||
{{- if .existingSecret -}}
|
||||
{{- if not (typeIs "string" .existingSecret) -}}
|
||||
{{- if .existingSecret.keyMapping -}}
|
||||
{{- $key = index .existingSecret.keyMapping $.key -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- printf "%s" $key -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate secret password or retrieve one if already created.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- key - String - Required - Name of the key in the secret.
|
||||
- providedValues - List<String> - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||
- length - int - Optional - Length of the generated random password.
|
||||
- strong - Boolean - Optional - Whether to add symbols to the generated random password.
|
||||
- chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart.
|
||||
- context - Context - Required - Parent context.
|
||||
|
||||
The order in which this function returns a secret password:
|
||||
1. Already existing 'Secret' resource
|
||||
(If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned)
|
||||
2. Password provided via the values.yaml
|
||||
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
|
||||
3. Randomly generated secret password
|
||||
(A new random secret password with the length specified in the 'length' parameter will be generated and returned)
|
||||
|
||||
*/}}
|
||||
{{- define "common.secrets.passwords.manage" -}}
|
||||
|
||||
{{- $password := "" }}
|
||||
{{- $subchart := "" }}
|
||||
{{- $chartName := default "" .chartName }}
|
||||
{{- $passwordLength := default 10 .length }}
|
||||
{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }}
|
||||
{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }}
|
||||
{{- if $secretData }}
|
||||
{{- if hasKey $secretData .key }}
|
||||
{{- $password = index $secretData .key | quote }}
|
||||
{{- else }}
|
||||
{{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}}
|
||||
{{- end -}}
|
||||
{{- else if $providedPasswordValue }}
|
||||
{{- $password = $providedPasswordValue | toString | b64enc | quote }}
|
||||
{{- else }}
|
||||
|
||||
{{- if .context.Values.enabled }}
|
||||
{{- $subchart = $chartName }}
|
||||
{{- end -}}
|
||||
|
||||
{{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}}
|
||||
{{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}}
|
||||
{{- $passwordValidationErrors := list $requiredPasswordError -}}
|
||||
{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}}
|
||||
|
||||
{{- if .strong }}
|
||||
{{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }}
|
||||
{{- $password = randAscii $passwordLength }}
|
||||
{{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }}
|
||||
{{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }}
|
||||
{{- else }}
|
||||
{{- $password = randAlphaNum $passwordLength | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $password -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Reuses the value from an existing secret, otherwise sets its value to a default value.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- key - String - Required - Name of the key in the secret.
|
||||
- defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||
- context - Context - Required - Parent context.
|
||||
|
||||
*/}}
|
||||
{{- define "common.secrets.lookup" -}}
|
||||
{{- $value := "" -}}
|
||||
{{- $defaultValue := required "\n'common.secrets.lookup': Argument 'defaultValue' missing or empty" .defaultValue -}}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}}
|
||||
{{- if and $secretData (hasKey $secretData .key) -}}
|
||||
{{- $value = index $secretData .key -}}
|
||||
{{- else -}}
|
||||
{{- $value = $defaultValue | toString | b64enc -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $value -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns whether a previous generated secret already exists
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- context - Context - Required - Parent context.
|
||||
*/}}
|
||||
{{- define "common.secrets.exists" -}}
|
||||
{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }}
|
||||
{{- if $secret }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Return the proper Storage Class
|
||||
{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }}
|
||||
*/}}
|
||||
{{- define "common.storage.class" -}}
|
||||
|
||||
{{- $storageClass := .persistence.storageClass -}}
|
||||
{{- if .global -}}
|
||||
{{- if .global.storageClass -}}
|
||||
{{- $storageClass = .global.storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $storageClass -}}
|
||||
{{- if (eq "-" $storageClass) -}}
|
||||
{{- printf "storageClassName: \"\"" -}}
|
||||
{{- else }}
|
||||
{{- printf "storageClassName: %s" $storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Renders a value that contains template.
|
||||
Usage:
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.tplvalues.render" -}}
|
||||
{{- if typeIs "string" .value }}
|
||||
{{- tpl .value .context }}
|
||||
{{- else }}
|
||||
{{- tpl (.value | toYaml) .context }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Print instructions to get a secret value.
|
||||
Usage:
|
||||
{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.secret.getvalue" -}}
|
||||
{{- $varname := include "common.utils.fieldToEnvVar" . -}}
|
||||
export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d)
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Build env var name given a field
|
||||
Usage:
|
||||
{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }}
|
||||
*/}}
|
||||
{{- define "common.utils.fieldToEnvVar" -}}
|
||||
{{- $fieldNameSplit := splitList "-" .field -}}
|
||||
{{- $upperCaseFieldNameSplit := list -}}
|
||||
|
||||
{{- range $fieldNameSplit -}}
|
||||
{{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ join "_" $upperCaseFieldNameSplit }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Gets a value from .Values given
|
||||
Usage:
|
||||
{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.getValueFromKey" -}}
|
||||
{{- $splitKey := splitList "." .key -}}
|
||||
{{- $value := "" -}}
|
||||
{{- $latestObj := $.context.Values -}}
|
||||
{{- range $splitKey -}}
|
||||
{{- if not $latestObj -}}
|
||||
{{- printf "please review the entire path of '%s' exists in values" $.key | fail -}}
|
||||
{{- end -}}
|
||||
{{- $value = ( index $latestObj . ) -}}
|
||||
{{- $latestObj = $value -}}
|
||||
{{- end -}}
|
||||
{{- printf "%v" (default "" $value) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns first .Values key with a defined value or first of the list if all non-defined
|
||||
Usage:
|
||||
{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.getKeyFromList" -}}
|
||||
{{- $key := first .keys -}}
|
||||
{{- $reverseKeys := reverse .keys }}
|
||||
{{- range $reverseKeys }}
|
||||
{{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }}
|
||||
{{- if $value -}}
|
||||
{{- $key = . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $key -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Warning about using rolling tag.
|
||||
Usage:
|
||||
{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }}
|
||||
*/}}
|
||||
{{- define "common.warnings.rollingTag" -}}
|
||||
|
||||
{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate Cassandra required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.cassandra.passwords" -}}
|
||||
{{- $existingSecret := include "common.cassandra.values.existingSecret" . -}}
|
||||
{{- $enabled := include "common.cassandra.values.enabled" . -}}
|
||||
{{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.cassandra.dbUser.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.dbUser.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled cassandra.
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.cassandra.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key dbUser
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.key.dbUser" -}}
|
||||
{{- if .subchart -}}
|
||||
cassandra.dbUser
|
||||
{{- else -}}
|
||||
dbUser
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,103 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate MariaDB required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.mariadb.passwords" -}}
|
||||
{{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}}
|
||||
{{- $enabled := include "common.mariadb.values.enabled" . -}}
|
||||
{{- $architecture := include "common.mariadb.values.architecture" . -}}
|
||||
{{- $authPrefix := include "common.mariadb.values.key.auth" . -}}
|
||||
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||
{{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||
|
||||
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||
{{- if not (empty $valueUsername) -}}
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (eq $architecture "replication") -}}
|
||||
{{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mariadb.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mariadb.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mariadb.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mariadb.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mariadb.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate MongoDB® required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.mongodb.passwords" -}}
|
||||
{{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}}
|
||||
{{- $enabled := include "common.mongodb.values.enabled" . -}}
|
||||
{{- $authPrefix := include "common.mongodb.values.key.auth" . -}}
|
||||
{{- $architecture := include "common.mongodb.values.architecture" . -}}
|
||||
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||
{{- $valueKeyDatabase := printf "%s.database" $authPrefix -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||
{{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}}
|
||||
{{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}}
|
||||
|
||||
{{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||
|
||||
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||
{{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }}
|
||||
{{- if and $valueUsername $valueDatabase -}}
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (eq $architecture "replicaset") -}}
|
||||
{{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mongodb.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mongodb.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mongodb.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mongodb.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mongodb.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,103 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate MySQL required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.mysql.passwords" -}}
|
||||
{{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}}
|
||||
{{- $enabled := include "common.mysql.values.enabled" . -}}
|
||||
{{- $architecture := include "common.mysql.values.architecture" . -}}
|
||||
{{- $authPrefix := include "common.mysql.values.key.auth" . -}}
|
||||
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||
{{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||
|
||||
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||
{{- if not (empty $valueUsername) -}}
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (eq $architecture "replication") -}}
|
||||
{{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mysql.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mysql.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mysql.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mysql.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mysql.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mysql.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,129 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate PostgreSQL required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.postgresql.passwords" -}}
|
||||
{{- $existingSecret := include "common.postgresql.values.existingSecret" . -}}
|
||||
{{- $enabled := include "common.postgresql.values.enabled" . -}}
|
||||
{{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}}
|
||||
{{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}}
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
{{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}}
|
||||
|
||||
{{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}}
|
||||
{{- if (eq $enabledReplication "true") -}}
|
||||
{{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to decide whether evaluate global values.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }}
|
||||
Params:
|
||||
- key - String - Required. Field to be evaluated within global, e.g: "existingSecret"
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.use.global" -}}
|
||||
{{- if .context.Values.global -}}
|
||||
{{- if .context.Values.global.postgresql -}}
|
||||
{{- index .context.Values.global.postgresql .key | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.existingSecret" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.existingSecret" -}}
|
||||
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}}
|
||||
|
||||
{{- if .subchart -}}
|
||||
{{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}}
|
||||
{{- else -}}
|
||||
{{- default (.context.Values.existingSecret | quote) $globalValue -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled postgresql.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.postgresql.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key postgressPassword.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.key.postgressPassword" -}}
|
||||
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}}
|
||||
|
||||
{{- if not $globalValue -}}
|
||||
{{- if .subchart -}}
|
||||
postgresql.postgresqlPassword
|
||||
{{- else -}}
|
||||
postgresqlPassword
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
global.postgresql.postgresqlPassword
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled.replication.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.enabled.replication" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.postgresql.replication.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" .context.Values.replication.enabled -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key replication.password.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.key.replicationPassword" -}}
|
||||
{{- if .subchart -}}
|
||||
postgresql.replication.password
|
||||
{{- else -}}
|
||||
replication.password
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate Redis® required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.redis.passwords" -}}
|
||||
{{- $enabled := include "common.redis.values.enabled" . -}}
|
||||
{{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}}
|
||||
{{- $standarizedVersion := include "common.redis.values.standarized.version" . }}
|
||||
|
||||
{{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }}
|
||||
{{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }}
|
||||
|
||||
{{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }}
|
||||
{{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}}
|
||||
{{- if eq $useAuth "true" -}}
|
||||
{{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled redis.
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.redis.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.redis.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right prefix path for the values
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.redis.values.keys.prefix" -}}
|
||||
{{- if .subchart -}}redis.{{- else -}}{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Checks whether the redis chart's includes the standarizations (version >= 14)
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.standarized.version" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.redis.values.standarized.version" -}}
|
||||
|
||||
{{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}}
|
||||
{{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }}
|
||||
|
||||
{{- if $standarizedAuthValues -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate values must not be empty.
|
||||
|
||||
Usage:
|
||||
{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}}
|
||||
{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||
|
||||
Validate value params:
|
||||
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||
*/}}
|
||||
{{- define "common.validations.values.multiple.empty" -}}
|
||||
{{- range .required -}}
|
||||
{{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate a value must not be empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }}
|
||||
|
||||
Validate value params:
|
||||
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||
- subchart - String - Optional - Name of the subchart that the validated password is part of.
|
||||
*/}}
|
||||
{{- define "common.validations.values.single.empty" -}}
|
||||
{{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }}
|
||||
{{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }}
|
||||
|
||||
{{- if not $value -}}
|
||||
{{- $varname := "my-value" -}}
|
||||
{{- $getCurrentValue := "" -}}
|
||||
{{- if and .secret .field -}}
|
||||
{{- $varname = include "common.utils.fieldToEnvVar" . -}}
|
||||
{{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}}
|
||||
{{- end -}}
|
||||
{{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
## bitnami/common
|
||||
## It is required by CI/CD tools and processes.
|
||||
## @skip exampleValue
|
||||
##
|
||||
exampleValue: common-chart
|
||||
0
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/.helmignore
Executable file → Normal file
0
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/.helmignore
Executable file → Normal file
|
|
@ -0,0 +1,6 @@
|
|||
dependencies:
|
||||
- name: common
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 2.2.2
|
||||
digest: sha256:49ca75cf23ba5eb7df4becef52580f98c8bd8194eb80368b9d7b875f6eefa8e5
|
||||
generated: "2023-01-06T05:12:14.420203052Z"
|
||||
30
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/Chart.yaml
Executable file → Normal file
30
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/Chart.yaml
Executable file → Normal file
|
|
@ -1,20 +1,26 @@
|
|||
annotations:
|
||||
category: Infrastructure
|
||||
apiVersion: v1
|
||||
appVersion: 3.6.2
|
||||
description: A centralized service for maintaining configuration information, naming,
|
||||
providing distributed synchronization, and providing group services for distributed
|
||||
applications.
|
||||
engine: gotpl
|
||||
home: https://github.com/bitnami/charts/tree/master/bitnami/zookeeper
|
||||
icon: https://bitnami.com/assets/stacks/zookeeper/img/zookeeper-stack-110x117.png
|
||||
licenses: |
|
||||
- Apache-2.0
|
||||
apiVersion: v2
|
||||
appVersion: 3.8.0
|
||||
dependencies:
|
||||
- name: common
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
tags:
|
||||
- bitnami-common
|
||||
version: 2.x.x
|
||||
description: Apache ZooKeeper provides a reliable, centralized register of configuration
|
||||
data and services for distributed applications.
|
||||
home: https://github.com/bitnami/charts/tree/main/bitnami/zookeeper
|
||||
icon: https://bitnami.com/assets/stacks/zookeeper/img/zookeeper-stack-220x234.png
|
||||
keywords:
|
||||
- zookeeper
|
||||
maintainers:
|
||||
- email: containers@bitnami.com
|
||||
name: Bitnami
|
||||
- name: Bitnami
|
||||
url: https://github.com/bitnami/charts
|
||||
name: zookeeper
|
||||
sources:
|
||||
- https://github.com/bitnami/bitnami-docker-zookeeper
|
||||
- https://github.com/bitnami/containers/tree/main/bitnami/zookeeper
|
||||
- https://zookeeper.apache.org/
|
||||
version: 5.21.9
|
||||
version: 11.1.0
|
||||
|
|
|
|||
548
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/README.md
Executable file → Normal file
548
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/README.md
Executable file → Normal file
|
|
@ -1,24 +1,30 @@
|
|||
# ZooKeeper
|
||||
<!--- app-name: Apache ZooKeeper -->
|
||||
|
||||
[ZooKeeper](https://zookeeper.apache.org/) is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. All of these kinds of services are used in some form or other by distributed applications.
|
||||
# Apache ZooKeeper packaged by Bitnami
|
||||
|
||||
Apache ZooKeeper provides a reliable, centralized register of configuration data and services for distributed applications.
|
||||
|
||||
[Overview of Apache ZooKeeper](https://zookeeper.apache.org)
|
||||
|
||||
Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.
|
||||
|
||||
## TL;DR
|
||||
|
||||
```console
|
||||
$ helm repo add bitnami https://charts.bitnami.com/bitnami
|
||||
$ helm install my-release bitnami/zookeeper
|
||||
$ helm repo add my-repo https://charts.bitnami.com/bitnami
|
||||
$ helm install my-release my-repo/zookeeper
|
||||
```
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a [ZooKeeper](https://github.com/bitnami/bitnami-docker-zookeeper) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
This chart bootstraps a [ZooKeeper](https://github.com/bitnami/containers/tree/main/bitnami/zookeeper) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications.
|
||||
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.12+
|
||||
- Helm 2.12+ or Helm 3.0-beta3+
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.2.0+
|
||||
- PV provisioner support in the underlying infrastructure
|
||||
|
||||
## Installing the Chart
|
||||
|
|
@ -26,8 +32,8 @@ Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment
|
|||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
$ helm repo add bitnami https://charts.bitnami.com/bitnami
|
||||
$ helm install my-release bitnami/zookeeper
|
||||
$ helm repo add my-repo https://charts.bitnami.com/bitnami
|
||||
$ helm install my-release my-repo/zookeeper
|
||||
```
|
||||
|
||||
These commands deploy ZooKeeper on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
|
||||
|
|
@ -46,206 +52,358 @@ The command removes all the Kubernetes components associated with the chart and
|
|||
|
||||
## Parameters
|
||||
|
||||
The following tables lists the configurable parameters of the ZooKeeper chart and their default values per section/component:
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------- | ----------------------------------------------- | ----- |
|
||||
| `global.imageRegistry` | Global Docker image registry | `""` |
|
||||
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
|
||||
| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` |
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `global.imageRegistry` | Global Docker image registry | `nil` |
|
||||
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `global.storageClass` | Global storage class for dynamic provisioning | `nil` |
|
||||
|
||||
### Common parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `nameOverride` | String to partially override zookeeper.fullname | `nil` |
|
||||
| `fullnameOverride` | String to fully override zookeeper.fullname | `nil` |
|
||||
| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `schedulerName` | Kubernetes pod scheduler registry | `nil` (use the default-scheduler) |
|
||||
| Name | Description | Value |
|
||||
| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- |
|
||||
| `kubeVersion` | Override Kubernetes version | `""` |
|
||||
| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` |
|
||||
| `fullnameOverride` | String to fully override common.names.fullname template | `""` |
|
||||
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
|
||||
| `extraDeploy` | Extra objects to deploy (evaluated as a template) | `[]` |
|
||||
| `commonLabels` | Add labels to all the deployed resources | `{}` |
|
||||
| `commonAnnotations` | Add annotations to all the deployed resources | `{}` |
|
||||
| `namespaceOverride` | Override namespace for ZooKeeper resources | `""` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the statefulset | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the statefulset | `["infinity"]` |
|
||||
|
||||
### Zookeeper chart parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `image.registry` | ZooKeeper image registry | `docker.io` |
|
||||
| `image.repository` | ZooKeeper Image name | `bitnami/zookeeper` |
|
||||
| `image.tag` | ZooKeeper Image tag | `{TAG_NAME}` |
|
||||
| `image.pullPolicy` | ZooKeeper image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `image.debug` | Specify if debug values should be set | `false` |
|
||||
| `tickTime` | Basic time unit in milliseconds used by ZooKeeper for heartbeats | `2000` |
|
||||
| `initLimit` | Time the ZooKeeper servers in quorum have to connect to a leader | `10` |
|
||||
| `syncLimit` | How far out of date a server can be from a leader | `5` |
|
||||
| `maxClientCnxns` | Number of concurrent connections that a single client may make to a single member | `60` |
|
||||
| `maxSessionTimeout` | Maximum session timeout in milliseconds that the server will allow the client to negotiate. | `40000` |
|
||||
| `autopurge.snapRetainCount` | Number of retains snapshots for autopurge | `3` |
|
||||
| `autopurge.purgeInterval` | The time interval in hours for which the purge task has to be triggered | `0` |
|
||||
| `fourlwCommandsWhitelist` | A list of comma separated Four Letter Words commands to use | `srvr, mntr` |
|
||||
| `listenOnAllIPs` | Allow Zookeeper to listen for connections from its peers on all available IP addresses. | `false` |
|
||||
| `allowAnonymousLogin` | Allow to accept connections from unauthenticated users | `yes` |
|
||||
| `auth.existingSecret` | Use existing secret (ignores previous password) | `nil` |
|
||||
| `auth.enabled` | Enable ZooKeeper auth | `false` |
|
||||
| `auth.clientUser` | User that will use ZooKeeper clients to auth | `nil` |
|
||||
| `auth.clientPassword` | Password that will use ZooKeeper clients to auth | `nil` |
|
||||
| `auth.serverUsers` | List of user to be created | `nil` |
|
||||
| `auth.serverPasswords` | List of passwords to assign to users when created | `nil` |
|
||||
| `heapSize` | Size in MB for the Java Heap options (Xmx and XMs) | `[]` |
|
||||
| `logLevel` | Log level of ZooKeeper server | `ERROR` |
|
||||
| `jvmFlags` | Default JVMFLAGS for the ZooKeeper process | `nil` |
|
||||
| `config` | Configure ZooKeeper with a custom zoo.conf file | `nil` |
|
||||
| `dataLogDir` | Data log directory | `""` |
|
||||
### ZooKeeper chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
|
||||
| `image.registry` | ZooKeeper image registry | `docker.io` |
|
||||
| `image.repository` | ZooKeeper image repository | `bitnami/zookeeper` |
|
||||
| `image.tag` | ZooKeeper image tag (immutable tags are recommended) | `3.8.0-debian-11-r74` |
|
||||
| `image.digest` | ZooKeeper image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `image.pullPolicy` | ZooKeeper image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `image.debug` | Specify if debug values should be set | `false` |
|
||||
| `auth.client.enabled` | Enable ZooKeeper client-server authentication. It uses SASL/Digest-MD5 | `false` |
|
||||
| `auth.client.clientUser` | User that will use ZooKeeper clients to auth | `""` |
|
||||
| `auth.client.clientPassword` | Password that will use ZooKeeper clients to auth | `""` |
|
||||
| `auth.client.serverUsers` | Comma, semicolon or whitespace separated list of user to be created | `""` |
|
||||
| `auth.client.serverPasswords` | Comma, semicolon or whitespace separated list of passwords to assign to users when created | `""` |
|
||||
| `auth.client.existingSecret` | Use existing secret (ignores previous passwords) | `""` |
|
||||
| `auth.quorum.enabled` | Enable ZooKeeper server-server authentication. It uses SASL/Digest-MD5 | `false` |
|
||||
| `auth.quorum.learnerUser` | User that the ZooKeeper quorumLearner will use to authenticate to quorumServers. | `""` |
|
||||
| `auth.quorum.learnerPassword` | Password that the ZooKeeper quorumLearner will use to authenticate to quorumServers. | `""` |
|
||||
| `auth.quorum.serverUsers` | Comma, semicolon or whitespace separated list of users for the quorumServers. | `""` |
|
||||
| `auth.quorum.serverPasswords` | Comma, semicolon or whitespace separated list of passwords to assign to users when created | `""` |
|
||||
| `auth.quorum.existingSecret` | Use existing secret (ignores previous passwords) | `""` |
|
||||
| `tickTime` | Basic time unit (in milliseconds) used by ZooKeeper for heartbeats | `2000` |
|
||||
| `initLimit` | ZooKeeper uses to limit the length of time the ZooKeeper servers in quorum have to connect to a leader | `10` |
|
||||
| `syncLimit` | How far out of date a server can be from a leader | `5` |
|
||||
| `preAllocSize` | Block size for transaction log file | `65536` |
|
||||
| `snapCount` | The number of transactions recorded in the transaction log before a snapshot can be taken (and the transaction log rolled) | `100000` |
|
||||
| `maxClientCnxns` | Limits the number of concurrent connections that a single client may make to a single member of the ZooKeeper ensemble | `60` |
|
||||
| `maxSessionTimeout` | Maximum session timeout (in milliseconds) that the server will allow the client to negotiate | `40000` |
|
||||
| `heapSize` | Size (in MB) for the Java Heap options (Xmx and Xms) | `1024` |
|
||||
| `fourlwCommandsWhitelist` | A list of comma separated Four Letter Words commands that can be executed | `srvr, mntr, ruok` |
|
||||
| `minServerId` | Minimal SERVER_ID value, nodes increment their IDs respectively | `1` |
|
||||
| `listenOnAllIPs` | Allow ZooKeeper to listen for connections from its peers on all available IP addresses | `false` |
|
||||
| `autopurge.snapRetainCount` | The most recent snapshots amount (and corresponding transaction logs) to retain | `3` |
|
||||
| `autopurge.purgeInterval` | The time interval (in hours) for which the purge task has to be triggered | `0` |
|
||||
| `logLevel` | Log level for the ZooKeeper server. ERROR by default | `ERROR` |
|
||||
| `jvmFlags` | Default JVM flags for the ZooKeeper process | `""` |
|
||||
| `dataLogDir` | Dedicated data log directory | `""` |
|
||||
| `configuration` | Configure ZooKeeper with a custom zoo.cfg file | `""` |
|
||||
| `existingConfigmap` | The name of an existing ConfigMap with your custom configuration for ZooKeeper | `""` |
|
||||
| `extraEnvVars` | Array with extra environment variables to add to ZooKeeper nodes | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for ZooKeeper nodes | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars for ZooKeeper nodes | `""` |
|
||||
| `command` | Override default container command (useful when using custom images) | `["/scripts/setup.sh"]` |
|
||||
| `args` | Override default container args (useful when using custom images) | `[]` |
|
||||
|
||||
|
||||
### Statefulset parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `replicaCount` | Number of ZooKeeper nodes | `1` |
|
||||
| `updateStrategy` | Update strategy for the statefulset | `RollingUpdate` |
|
||||
| `rollingUpdatePartition` | Partition update strategy | `nil` |
|
||||
| `podManagementPolicy` | Pod management policy | `Parallel` |
|
||||
| `podLabels` | ZooKeeper pod labels | `{}` (evaluated as a template) |
|
||||
| `podAnnotations` | ZooKeeper Pod annotations | `{}` (evaluated as a template) |
|
||||
| `affinity` | Affinity for pod assignment | `{}` (evaluated as a template) |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` (evaluated as a template) |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` (evaluated as a template) |
|
||||
| `priorityClassName` | Name of the existing priority class to be used by ZooKeeper pods | `""` |
|
||||
| `securityContext.enabled` | Enable security context (ZooKeeper master pod) | `true` |
|
||||
| `securityContext.fsGroup` | Group ID for the container (ZooKeeper master pod) | `1001` |
|
||||
| `securityContext.runAsUser` | User ID for the container (ZooKeeper master pod) | `1001` |
|
||||
| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` |
|
||||
| `livenessProbe` | Liveness probe configuration for ZooKeeper | Check `values.yaml` file |
|
||||
| `readinessProbe` | Readiness probe configuration for ZooKeeper | Check `values.yaml` file |
|
||||
| `extraVolumes` | Extra volumes | `nil` |
|
||||
| `extraVolumeMounts` | Mount extra volume(s) | `nil` |
|
||||
| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` |
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- |
|
||||
| `replicaCount` | Number of ZooKeeper nodes | `1` |
|
||||
| `containerPorts.client` | ZooKeeper client container port | `2181` |
|
||||
| `containerPorts.tls` | ZooKeeper TLS container port | `3181` |
|
||||
| `containerPorts.follower` | ZooKeeper follower container port | `2888` |
|
||||
| `containerPorts.election` | ZooKeeper election container port | `3888` |
|
||||
| `livenessProbe.enabled` | Enable livenessProbe on ZooKeeper containers | `true` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` |
|
||||
| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `livenessProbe.probeCommandTimeout` | Probe command timeout for livenessProbe | `2` |
|
||||
| `readinessProbe.enabled` | Enable readinessProbe on ZooKeeper containers | `true` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` |
|
||||
| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `readinessProbe.probeCommandTimeout` | Probe command timeout for readinessProbe | `2` |
|
||||
| `startupProbe.enabled` | Enable startupProbe on ZooKeeper containers | `false` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` |
|
||||
| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `lifecycleHooks` | for the ZooKeeper container(s) to automate configuration before or after startup | `{}` |
|
||||
| `resources.limits` | The resources limits for the ZooKeeper containers | `{}` |
|
||||
| `resources.requests.memory` | The requested memory for the ZooKeeper containers | `256Mi` |
|
||||
| `resources.requests.cpu` | The requested cpu for the ZooKeeper containers | `250m` |
|
||||
| `podSecurityContext.enabled` | Enabled ZooKeeper pods' Security Context | `true` |
|
||||
| `podSecurityContext.fsGroup` | Set ZooKeeper pod's Security Context fsGroup | `1001` |
|
||||
| `containerSecurityContext.enabled` | Enabled ZooKeeper containers' Security Context | `true` |
|
||||
| `containerSecurityContext.runAsUser` | Set ZooKeeper containers' Security Context runAsUser | `1001` |
|
||||
| `containerSecurityContext.runAsNonRoot` | Set ZooKeeper containers' Security Context runAsNonRoot | `true` |
|
||||
| `containerSecurityContext.allowPrivilegeEscalation` | Force the child process to be run as nonprivilege | `false` |
|
||||
| `hostAliases` | ZooKeeper pods host aliases | `[]` |
|
||||
| `podLabels` | Extra labels for ZooKeeper pods | `{}` |
|
||||
| `podAnnotations` | Annotations for ZooKeeper pods | `{}` |
|
||||
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `nodeAffinityPreset.key` | Node label key to match Ignored if `affinity` is set. | `""` |
|
||||
| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` |
|
||||
| `podManagementPolicy` | StatefulSet controller supports relax its ordering guarantees while preserving its uniqueness and identity guarantees. There are two valid pod management policies: `OrderedReady` and `Parallel` | `Parallel` |
|
||||
| `priorityClassName` | Name of the existing priority class to be used by ZooKeeper pods, priority class needs to be created beforehand | `""` |
|
||||
| `schedulerName` | Kubernetes pod scheduler registry | `""` |
|
||||
| `updateStrategy.type` | ZooKeeper statefulset strategy type | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate` | ZooKeeper statefulset rolling update configuration parameters | `{}` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes for the ZooKeeper pod(s) | `[]` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the ZooKeeper container(s) | `[]` |
|
||||
| `sidecars` | Add additional sidecar containers to the ZooKeeper pod(s) | `[]` |
|
||||
| `initContainers` | Add additional init containers to the ZooKeeper pod(s) | `[]` |
|
||||
| `pdb.create` | Deploy a pdb object for the ZooKeeper pod | `false` |
|
||||
| `pdb.minAvailable` | Minimum available ZooKeeper replicas | `""` |
|
||||
| `pdb.maxUnavailable` | Maximum unavailable ZooKeeper replicas | `1` |
|
||||
|
||||
### Exposure parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `service.type` | Kubernetes Service type | `ClusterIP` |
|
||||
| `service.port` | ZooKeeper port | `2181` |
|
||||
| `service.followerPort` | ZooKeeper follower port | `2888` |
|
||||
| `service.electionPort` | ZooKeeper election port | `3888` |
|
||||
| `service.publishNotReadyAddresses` | If the ZooKeeper headless service should publish DNS records for not ready pods | `true` |
|
||||
| `serviceAccount.create` | Enable creation of ServiceAccount for zookeeper pod | `false` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and `create` is `true`, a name is generated | Generated using the `zookeeper.fullname` template |
|
||||
| `service.tls.client_enable` | Enable tls for client connections | `false` |
|
||||
| `service.tls.quorum_enable` | Enable tls for quorum protocol | `false` |
|
||||
| `service.tls.disable_base_client_port` | Remove client port from service definitions. | `false` |
|
||||
| `service.tls.client_port` | Service port for tls client connections | `3181` |
|
||||
| `service.tls.client_keystore_path` | KeyStore file path. Refer to extraVolumes and extraVolumeMounts for mounting files into the pods | `/tls_key_store/key_store_file` |
|
||||
| `service.tls.client_keystore_password` | KeyStore password. You can use environment variables. | `nil` |
|
||||
| `service.tls.client_truststore_path` | TrustStore file path. Refer to extraVolumes and extraVolumeMounts for mounting files into the pods | `/tls_trust_store/trust_store_file` |
|
||||
| `service.tls.client_truststore_password` | TrustStore password. You can use environment variables. | `nil` |
|
||||
| `service.tls.quorum_keystore_path` | KeyStore file path. Refer to extraVolumes and extraVolumeMounts for mounting files into the pods | `/tls_key_store/key_store_file` |
|
||||
| `service.tls.quorum_keystore_password` | KeyStore password. You can use environment variables. | `nil` |
|
||||
| `service.tls.quorum_truststore_path` | TrustStore file path. Refer to extraVolumes and extraVolumeMounts for mounting files into the pods | `/tls_trust_store/trust_store_file` |
|
||||
| `service.tls.quorum_truststore_password` | TrustStore password. You can use environment variables. | `nil` |
|
||||
| `service.annotations` | Annotations for the Service | `{}` |
|
||||
| `service.headless.annotations` | Annotations for the Headless Service | `{}` |
|
||||
| `networkPolicy.enabled` | Enable NetworkPolicy | `false` |
|
||||
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
|
||||
### Traffic Exposure parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------- | --------------------------------------------------------------------------------------- | ----------- |
|
||||
| `service.type` | Kubernetes Service type | `ClusterIP` |
|
||||
| `service.ports.client` | ZooKeeper client service port | `2181` |
|
||||
| `service.ports.tls` | ZooKeeper TLS service port | `3181` |
|
||||
| `service.ports.follower` | ZooKeeper follower service port | `2888` |
|
||||
| `service.ports.election` | ZooKeeper election service port | `3888` |
|
||||
| `service.nodePorts.client` | Node port for clients | `""` |
|
||||
| `service.nodePorts.tls` | Node port for TLS | `""` |
|
||||
| `service.disableBaseClientPort` | Remove client port from service definitions. | `false` |
|
||||
| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` |
|
||||
| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `service.clusterIP` | ZooKeeper service Cluster IP | `""` |
|
||||
| `service.loadBalancerIP` | ZooKeeper service Load Balancer IP | `""` |
|
||||
| `service.loadBalancerSourceRanges` | ZooKeeper service Load Balancer sources | `[]` |
|
||||
| `service.externalTrafficPolicy` | ZooKeeper service external traffic policy | `Cluster` |
|
||||
| `service.annotations` | Additional custom annotations for ZooKeeper service | `{}` |
|
||||
| `service.extraPorts` | Extra ports to expose in the ZooKeeper service (normally used with the `sidecar` value) | `[]` |
|
||||
| `service.headless.annotations` | Annotations for the Headless Service | `{}` |
|
||||
| `service.headless.publishNotReadyAddresses` | If the ZooKeeper headless service should publish DNS records for not ready pods | `true` |
|
||||
| `service.headless.servicenameOverride` | String to partially override headless service name | `""` |
|
||||
| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `false` |
|
||||
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
|
||||
|
||||
|
||||
### Other Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------- | ---------------------------------------------------------------------- | ------- |
|
||||
| `serviceAccount.create` | Enable creation of ServiceAccount for ZooKeeper pod | `false` |
|
||||
| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `true` |
|
||||
| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
|
||||
|
||||
|
||||
### Persistence parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `persistence.enabled` | Enable Zookeeper data persistence using PVC | `true` |
|
||||
| `persistence.existingClaim` | Provide an existing `PersistentVolumeClaim` | `nil` (evaluated as a template) |
|
||||
| `persistence.storageClass` | PVC Storage Class for ZooKeeper data volume | `nil` |
|
||||
| `persistence.accessMode` | PVC Access Mode for ZooKeeper data volume | `ReadWriteOnce` |
|
||||
| `persistence.size` | PVC Storage Request for ZooKeeper data volume | `8Gi` |
|
||||
| `persistence.annotations` | Annotations for the PVC | `{}` (evaluated as a template) |
|
||||
| `persistence.dataLogDir.size` | PVC Storage Request for ZooKeeper's Data log directory | `8Gi` |
|
||||
| `persistence.dataLogDir.existingClaim` | Provide an existing `PersistentVolumeClaim` for Zookeeper's Data log directory | `nil` (evaluated as a template) |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------- | ------------------------------------------------------------------------------ | ------------------- |
|
||||
| `persistence.enabled` | Enable ZooKeeper data persistence using PVC. If false, use emptyDir | `true` |
|
||||
| `persistence.existingClaim` | Name of an existing PVC to use (only when deploying a single replica) | `""` |
|
||||
| `persistence.storageClass` | PVC Storage Class for ZooKeeper data volume | `""` |
|
||||
| `persistence.accessModes` | PVC Access modes | `["ReadWriteOnce"]` |
|
||||
| `persistence.size` | PVC Storage Request for ZooKeeper data volume | `8Gi` |
|
||||
| `persistence.annotations` | Annotations for the PVC | `{}` |
|
||||
| `persistence.labels` | Labels for the PVC | `{}` |
|
||||
| `persistence.selector` | Selector to match an existing Persistent Volume for ZooKeeper's data PVC | `{}` |
|
||||
| `persistence.dataLogDir.size` | PVC Storage Request for ZooKeeper's dedicated data log directory | `8Gi` |
|
||||
| `persistence.dataLogDir.existingClaim` | Provide an existing `PersistentVolumeClaim` for ZooKeeper's data log directory | `""` |
|
||||
| `persistence.dataLogDir.selector` | Selector to match an existing Persistent Volume for ZooKeeper's data log PVC | `{}` |
|
||||
|
||||
|
||||
### Volume Permissions parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume(s) mountpoint to `runAsUser:fsGroup` | `false` |
|
||||
| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` |
|
||||
| `volumePermissions.image.tag` | Init container volume-permissions image tag | `buster` |
|
||||
| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` |
|
||||
| `volumePermissions.resources` | Init container resource requests/limit | `nil` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume | `false` |
|
||||
| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` |
|
||||
| `volumePermissions.image.tag` | Init container volume-permissions image tag (immutable tags are recommended) | `11-debian-11-r69` |
|
||||
| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` |
|
||||
| `volumePermissions.image.pullSecrets` | Init container volume-permissions image pull secrets | `[]` |
|
||||
| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` |
|
||||
| `volumePermissions.resources.requests` | Init container volume-permissions resource requests | `{}` |
|
||||
| `volumePermissions.containerSecurityContext.enabled` | Enabled init container Security Context | `true` |
|
||||
| `volumePermissions.containerSecurityContext.runAsUser` | User ID for the init container | `0` |
|
||||
|
||||
|
||||
### Metrics parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|
|
||||
| `metrics.enabled` | Enable prometheus to access zookeeper metrics endpoint | `false` |
|
||||
| `metrics.containerPort` | Port where a Jetty server will expose Prometheus metrics | `9141` |
|
||||
| `metrics.service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) for Jetty server exposing Prometheus metrics | `ClusterIP` |
|
||||
| `metrics.service.port` | Prometheus metrics service port | `9141` |
|
||||
| `metrics.service.annotations` | Service annotations for Prometheus to auto-discover the metrics endpoint | `{prometheus.io/scrape: "true", prometheus.io/port: "9141"}` |
|
||||
| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` |
|
||||
| `metrics.serviceMonitor.namespace` | Namespace for the ServiceMonitor Resource | The Release Namespace |
|
||||
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `nil` (Prometheus Operator default value) |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `nil` (Prometheus Operator default value) |
|
||||
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `nil` |
|
||||
| `metrics.prometheusRule.enabled` | if `true`, creates a Prometheus Operator PrometheusRule (also requires `metrics.enabled` to be `true` and `metrics.prometheusRule.rules`) | `false` |
|
||||
| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource | The Release Namespace |
|
||||
| `metrics.prometheusRule.selector` | Prometheus instance selector labels | `nil` |
|
||||
| `metrics.prometheusRule.rules` | Prometheus Rule definitions (see values.yaml for examples) | `[]` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | ------------------------------------------------------------------------------------- | ----------- |
|
||||
| `metrics.enabled` | Enable Prometheus to access ZooKeeper metrics endpoint | `false` |
|
||||
| `metrics.containerPort` | ZooKeeper Prometheus Exporter container port | `9141` |
|
||||
| `metrics.service.type` | ZooKeeper Prometheus Exporter service type | `ClusterIP` |
|
||||
| `metrics.service.port` | ZooKeeper Prometheus Exporter service port | `9141` |
|
||||
| `metrics.service.annotations` | Annotations for Prometheus to auto-discover the metrics endpoint | `{}` |
|
||||
| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using Prometheus Operator | `false` |
|
||||
| `metrics.serviceMonitor.namespace` | Namespace for the ServiceMonitor Resource (defaults to the Release Namespace) | `""` |
|
||||
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` |
|
||||
| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` |
|
||||
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
|
||||
| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` |
|
||||
| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` |
|
||||
| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` |
|
||||
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` |
|
||||
| `metrics.prometheusRule.enabled` | Create a PrometheusRule for Prometheus Operator | `false` |
|
||||
| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource (defaults to the Release Namespace) | `""` |
|
||||
| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` |
|
||||
| `metrics.prometheusRule.rules` | PrometheusRule definitions | `[]` |
|
||||
|
||||
|
||||
### TLS/SSL parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
|
||||
| `tls.client.enabled` | Enable TLS for client connections | `false` |
|
||||
| `tls.client.auth` | SSL Client auth. Can be "none", "want" or "need". | `none` |
|
||||
| `tls.client.autoGenerated` | Generate automatically self-signed TLS certificates for ZooKeeper client communications | `false` |
|
||||
| `tls.client.existingSecret` | Name of the existing secret containing the TLS certificates for ZooKeeper client communications | `""` |
|
||||
| `tls.client.existingSecretKeystoreKey` | The secret key from the tls.client.existingSecret containing the Keystore. | `""` |
|
||||
| `tls.client.existingSecretTruststoreKey` | The secret key from the tls.client.existingSecret containing the Truststore. | `""` |
|
||||
| `tls.client.keystorePath` | Location of the KeyStore file used for Client connections | `/opt/bitnami/zookeeper/config/certs/client/zookeeper.keystore.jks` |
|
||||
| `tls.client.truststorePath` | Location of the TrustStore file used for Client connections | `/opt/bitnami/zookeeper/config/certs/client/zookeeper.truststore.jks` |
|
||||
| `tls.client.passwordsSecretName` | Existing secret containing Keystore and truststore passwords | `""` |
|
||||
| `tls.client.passwordsSecretKeystoreKey` | The secret key from the tls.client.passwordsSecretName containing the password for the Keystore. | `""` |
|
||||
| `tls.client.passwordsSecretTruststoreKey` | The secret key from the tls.client.passwordsSecretName containing the password for the Truststore. | `""` |
|
||||
| `tls.client.keystorePassword` | Password to access KeyStore if needed | `""` |
|
||||
| `tls.client.truststorePassword` | Password to access TrustStore if needed | `""` |
|
||||
| `tls.quorum.enabled` | Enable TLS for quorum protocol | `false` |
|
||||
| `tls.quorum.auth` | SSL Quorum Client auth. Can be "none", "want" or "need". | `none` |
|
||||
| `tls.quorum.autoGenerated` | Create self-signed TLS certificates. Currently only supports PEM certificates. | `false` |
|
||||
| `tls.quorum.existingSecret` | Name of the existing secret containing the TLS certificates for ZooKeeper quorum protocol | `""` |
|
||||
| `tls.quorum.existingSecretKeystoreKey` | The secret key from the tls.quorum.existingSecret containing the Keystore. | `""` |
|
||||
| `tls.quorum.existingSecretTruststoreKey` | The secret key from the tls.quorum.existingSecret containing the Truststore. | `""` |
|
||||
| `tls.quorum.keystorePath` | Location of the KeyStore file used for Quorum protocol | `/opt/bitnami/zookeeper/config/certs/quorum/zookeeper.keystore.jks` |
|
||||
| `tls.quorum.truststorePath` | Location of the TrustStore file used for Quorum protocol | `/opt/bitnami/zookeeper/config/certs/quorum/zookeeper.truststore.jks` |
|
||||
| `tls.quorum.passwordsSecretName` | Existing secret containing Keystore and truststore passwords | `""` |
|
||||
| `tls.quorum.passwordsSecretKeystoreKey` | The secret key from the tls.quorum.passwordsSecretName containing the password for the Keystore. | `""` |
|
||||
| `tls.quorum.passwordsSecretTruststoreKey` | The secret key from the tls.quorum.passwordsSecretName containing the password for the Truststore. | `""` |
|
||||
| `tls.quorum.keystorePassword` | Password to access KeyStore if needed | `""` |
|
||||
| `tls.quorum.truststorePassword` | Password to access TrustStore if needed | `""` |
|
||||
| `tls.resources.limits` | The resources limits for the TLS init container | `{}` |
|
||||
| `tls.resources.requests` | The requested resources for the TLS init container | `{}` |
|
||||
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
$ helm install my-release \
|
||||
--set auth.clientUser=newUser \
|
||||
bitnami/zookeeper
|
||||
my-repo/zookeeper
|
||||
```
|
||||
|
||||
The above command sets the ZooKeeper user to `newUser`.
|
||||
|
||||
> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
$ helm install my-release -f values.yaml bitnami/zookeeper
|
||||
$ helm install my-release -f values.yaml my-repo/zookeeper
|
||||
```
|
||||
|
||||
> **Tip**: You can use the default [values.yaml](values.yaml)
|
||||
|
||||
## Configuration and installation details
|
||||
|
||||
### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/)
|
||||
### [Rolling vs Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/)
|
||||
|
||||
It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.
|
||||
|
||||
Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.
|
||||
|
||||
### Production configuration
|
||||
### Configure log level
|
||||
|
||||
This chart includes a `values-production.yaml` file where you can find some parameters oriented to production configuration in comparison to the regular `values.yaml`. You can use this file instead of the default one.
|
||||
You can configure the ZooKeeper log level using the `ZOO_LOG_LEVEL` environment variable or the parameter `logLevel`. By default, it is set to `ERROR` because each use of the liveness probe and the readiness probe produces an `INFO` message on connection and a `WARN` message on disconnection, generating a high volume of noise in your logs.
|
||||
|
||||
- Number of ZooKeeper nodes:
|
||||
In order to remove that log noise so levels can be set to 'INFO', two changes must be made.
|
||||
|
||||
```diff
|
||||
- replicaCount: 1
|
||||
+ replicaCount: 3
|
||||
First, ensure that you are not getting metrics via the deprecated pattern of polling 'mntr' on the ZooKeeper client port. The preferred method of polling for Apache ZooKeeper metrics is the ZooKeeper metrics server. This is supported in this chart when setting `metrics.enabled` to `true`.
|
||||
|
||||
Second, to avoid the connection/disconnection messages from the probes, you can set custom values for these checks which direct them to the ZooKeeper Admin Server instead of the client port. By default, an Admin Server will be started that listens on `localhost` at port `8080`. The following is an example of this use of the Admin Server for probes:
|
||||
|
||||
```
|
||||
livenessProbe:
|
||||
enabled: false
|
||||
readinessProbe:
|
||||
enabled: false
|
||||
customLivenessProbe:
|
||||
exec:
|
||||
command: ['/bin/bash', '-c', 'curl -s -m 2 http://localhost:8080/commands/ruok | grep ruok']
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 6
|
||||
customReadinessProbe:
|
||||
exec:
|
||||
command: ['/bin/bash', '-c', 'curl -s -m 2 http://localhost:8080/commands/ruok | grep error | grep null']
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 6
|
||||
```
|
||||
|
||||
- Enable prometheus metrics:
|
||||
You can also set the log4j logging level and what log appenders are turned on, by using `ZOO_LOG4J_PROP` set inside of conf/log4j.properties as zookeeper.root.logger by default to
|
||||
|
||||
```diff
|
||||
- metrics.enabled: false
|
||||
+ metrics.enabled: true
|
||||
```console
|
||||
zookeeper.root.logger=INFO, CONSOLE
|
||||
```
|
||||
the available appender is
|
||||
|
||||
### Log level
|
||||
|
||||
You can configure the ZooKeeper log level using the `ZOO_LOG_LEVEL` environment variable. By default, it is set to `ERROR` because of each readiness probe produce an `INFO` message on connection and a `WARN` message on disconnection.
|
||||
- CONSOLE
|
||||
- ROLLINGFILE
|
||||
- RFAAUDIT
|
||||
- TRACEFILE
|
||||
|
||||
## Persistence
|
||||
|
||||
The [Bitnami ZooKeeper](https://github.com/bitnami/bitnami-docker-zookeeper) image stores the ZooKeeper data and configurations at the `/bitnami/zookeeper` path of the container.
|
||||
The [Bitnami ZooKeeper](https://github.com/bitnami/containers/tree/main/bitnami/zookeeper) image stores the ZooKeeper data and configurations at the `/bitnami/zookeeper` path of the container.
|
||||
|
||||
Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube.
|
||||
See the [Parameters](#parameters) section to configure the PVC or to disable persistence.
|
||||
Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Parameters](#parameters) section to configure the PVC or to disable persistence.
|
||||
|
||||
If you encounter errors when working with persistent volumes, refer to our [troubleshooting guide for persistent volumes](https://docs.bitnami.com/kubernetes/faq/troubleshooting/troubleshooting-persistence-volumes/).
|
||||
|
||||
### Adjust permissions of persistent volume mountpoint
|
||||
|
||||
|
|
@ -256,14 +414,76 @@ As an alternative, this chart supports using an initContainer to change the owne
|
|||
|
||||
You can enable this initContainer by setting `volumePermissions.enabled` to `true`.
|
||||
|
||||
### Data Log Directory
|
||||
### Configure the data log directory
|
||||
|
||||
You can use a dedicated device for logs (instead of using the data directory) to help avoiding competition between logging and snapshots. To do so, set the `dataLogDir` parameter with the path to be used for writing transaction logs. Alternatively, set this parameter with an empty string an it result in the log being written to the data directory (Zookeeper's default behavior).
|
||||
You can use a dedicated device for logs (instead of using the data directory) to help avoiding competition between logging and snaphots. To do so, set the `dataLogDir` parameter with the path to be used for writing transaction logs. Alternatively, set this parameter with an empty string and it will result in the log being written to the data directory (Zookeeper's default behavior).
|
||||
|
||||
When using a dedicated device for logs, you can use a PVC to persist the logs. To do so, set `persistence.enabled` to `true`. See the [Persistence Parameters](#persistence-parameters) section for more information.
|
||||
|
||||
### Set pod affinity
|
||||
|
||||
This chart allows you to set custom pod affinity using the `affinity` parameter. Find more information about pod affinity in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity).
|
||||
|
||||
As an alternative, you can use any of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
|
||||
|
||||
## Upgrading
|
||||
|
||||
### To 11.0.0
|
||||
|
||||
This major version removes `commonAnnotations` and `commonLabels` from `volumeClaimTemplates`. Now annotations and labels can be set in volume claims using `persistence.annotations` and `persistence.labels` values. If the previous deployment has already set `commonAnnotations` and/or `commonLabels` values, to ensure a clean upgrade from previous version without loosing data, please set `persistence.annotations` and/or `persistence.labels` values with the same content as the common values.
|
||||
|
||||
### To 10.0.0
|
||||
|
||||
This new version of the chart adds support for server-server authentication.
|
||||
The chart previously supported client-server authentication, to avoid confusion, the previous parameters have been renamed from `auth.*` to `auth.client.*`.
|
||||
|
||||
### To 9.0.0
|
||||
|
||||
This new version of the chart includes the new ZooKeeper major version 3.8.0. Upgrade compatibility is not guaranteed.
|
||||
|
||||
### To 8.0.0
|
||||
|
||||
This major release renames several values in this chart and adds missing features, in order to be inline with the rest of assets in the Bitnami charts repository.
|
||||
|
||||
Affected values:
|
||||
|
||||
- `allowAnonymousLogin` is deprecated.
|
||||
- `containerPort`, `tlsContainerPort`, `followerContainerPort` and `electionContainerPort` have been regrouped under the `containerPorts` map.
|
||||
- `service.port`, `service.tlsClientPort`, `service.followerPort`, and `service.electionPort` have been regrouped under the `service.ports` map.
|
||||
- `updateStrategy` (string) and `rollingUpdatePartition` are regrouped under the `updateStrategy` map.
|
||||
- `podDisruptionBudget.*` parameters are renamed to `pdb.*`.
|
||||
|
||||
### To 7.0.0
|
||||
|
||||
This new version renames the parameters used to configure TLS for both client and quorum.
|
||||
|
||||
- `service.tls.disable_base_client_port` is renamed to `service.disableBaseClientPort`
|
||||
- `service.tls.client_port` is renamed to `service.tlsClientPort`
|
||||
- `service.tls.client_enable` is renamed to `tls.client.enabled`
|
||||
- `service.tls.client_keystore_path` is renamed to `tls.client.keystorePath`
|
||||
- `service.tls.client_truststore_path` is renamed to `tls.client.truststorePath`
|
||||
- `service.tls.client_keystore_password` is renamed to `tls.client.keystorePassword`
|
||||
- `service.tls.client_truststore_password` is renamed to `tls.client.truststorePassword`
|
||||
- `service.tls.quorum_enable` is renamed to `tls.quorum.enabled`
|
||||
- `service.tls.quorum_keystore_path` is renamed to `tls.quorum.keystorePath`
|
||||
- `service.tls.quorum_truststore_path` is renamed to `tls.quorum.truststorePath`
|
||||
- `service.tls.quorum_keystore_password` is renamed to `tls.quorum.keystorePassword`
|
||||
- `service.tls.quorum_truststore_password` is renamed to `tls.quorum.truststorePassword`
|
||||
|
||||
### To 6.1.0
|
||||
|
||||
This version introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/main/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade.
|
||||
|
||||
### To 6.0.0
|
||||
|
||||
[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
|
||||
|
||||
[Learn more about this change and related upgrade considerations](https://docs.bitnami.com/kubernetes/infrastructure/zookeeper/administration/upgrade-helm3/).
|
||||
|
||||
### To 5.21.0
|
||||
|
||||
A couple of parameters related to Zookeeper metrics were renamed or disappeared in favor of new ones:
|
||||
|
|
@ -295,3 +515,19 @@ Use the workaround below to upgrade from versions previous to 1.0.0. The followi
|
|||
```console
|
||||
$ kubectl delete statefulset zookeeper-zookeeper --cascade=false
|
||||
```
|
||||
|
||||
## License
|
||||
|
||||
Copyright © 2022 Bitnami
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
annotations:
|
||||
category: Infrastructure
|
||||
apiVersion: v2
|
||||
appVersion: 2.2.2
|
||||
description: A Library Helm Chart for grouping common logic between bitnami charts.
|
||||
This chart is not deployable by itself.
|
||||
home: https://github.com/bitnami/charts/tree/main/bitnami/common
|
||||
icon: https://bitnami.com/downloads/logos/bitnami-mark.png
|
||||
keywords:
|
||||
- common
|
||||
- helper
|
||||
- template
|
||||
- function
|
||||
- bitnami
|
||||
maintainers:
|
||||
- name: Bitnami
|
||||
url: https://github.com/bitnami/charts
|
||||
name: common
|
||||
sources:
|
||||
- https://github.com/bitnami/charts
|
||||
- https://www.bitnami.com/
|
||||
type: library
|
||||
version: 2.2.2
|
||||
|
|
@ -0,0 +1,351 @@
|
|||
# Bitnami Common Library Chart
|
||||
|
||||
A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts.
|
||||
|
||||
## TL;DR
|
||||
|
||||
```yaml
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 1.x.x
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
```
|
||||
|
||||
```bash
|
||||
$ helm dependency update
|
||||
```
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
data:
|
||||
myvalue: "Hello World"
|
||||
```
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager.
|
||||
|
||||
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.2.0+
|
||||
|
||||
## Parameters
|
||||
|
||||
The following table lists the helpers available in the library which are scoped in different sections.
|
||||
|
||||
### Affinities
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-------------------------------|------------------------------------------------------|------------------------------------------------|
|
||||
| `common.affinities.nodes.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` |
|
||||
| `common.affinities.nodes.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` |
|
||||
| `common.affinities.pods.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` |
|
||||
| `common.affinities.pods.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` |
|
||||
| `common.affinities.topologyKey` | Return a topologyKey definition | `dict "topologyKey" "FOO"` |
|
||||
|
||||
### Capabilities
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|------------------------------------------------|------------------------------------------------------------------------------------------------|-------------------|
|
||||
| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context |
|
||||
| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context |
|
||||
| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context |
|
||||
| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context |
|
||||
| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context |
|
||||
| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context |
|
||||
| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context |
|
||||
| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for podsecuritypolicy. | `.` Chart context |
|
||||
| `common.capabilities.networkPolicy.apiVersion` | Return the appropriate apiVersion for networkpolicy. | `.` Chart context |
|
||||
| `common.capabilities.apiService.apiVersion` | Return the appropriate apiVersion for APIService. | `.` Chart context |
|
||||
| `common.capabilities.hpa.apiVersion` | Return the appropriate apiVersion for Horizontal Pod Autoscaler | `.` Chart context |
|
||||
| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context |
|
||||
|
||||
### Errors
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|
|
||||
| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` |
|
||||
|
||||
### Images
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
|
||||
| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. |
|
||||
| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` |
|
||||
| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` |
|
||||
|
||||
### Ingress
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences |
|
||||
| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context |
|
||||
| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context |
|
||||
| `common.ingress.certManagerRequest` | Prints "true" if required cert-manager annotations for TLS signed certificates are set in the Ingress annotations | `dict "annotations" .Values.path.to.the.ingress.annotations` |
|
||||
|
||||
### Labels
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------|-----------------------------------------------------------------------------|-------------------|
|
||||
| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context |
|
||||
| `common.labels.matchLabels` | Labels to use on `deploy.spec.selector.matchLabels` and `svc.spec.selector` | `.` Chart context |
|
||||
|
||||
### Names
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------------|-----------------------------------------------------------------------|-------------------|
|
||||
| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context |
|
||||
| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context |
|
||||
| `common.names.namespace` | Allow the release namespace to be overridden | `.` Chart context |
|
||||
| `common.names.fullname.namespace` | Create a fully qualified app name adding the installation's namespace | `.` Chart context |
|
||||
| `common.names.chart` | Chart name plus version | `.` Chart context |
|
||||
|
||||
### Secrets
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-----------------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. |
|
||||
| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. |
|
||||
| `common.secrets.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. |
|
||||
| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` |
|
||||
|
||||
### Storage
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.storage.class` | Return the proper Storage Class | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. |
|
||||
|
||||
### TplValues
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` |
|
||||
|
||||
### Utils
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------|
|
||||
| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` |
|
||||
| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` |
|
||||
| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` |
|
||||
| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` |
|
||||
|
||||
### Validations
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) |
|
||||
| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) |
|
||||
| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. |
|
||||
| `common.validations.values.mysql.passwords` | This helper will ensure required password for MySQL are not empty. It returns a shared error for all the values. | `dict "secret" "mysql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mysql chart and the helper. |
|
||||
| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. |
|
||||
| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis® are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. |
|
||||
| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. |
|
||||
| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. |
|
||||
|
||||
### Warnings
|
||||
|
||||
| Helper identifier | Description | Expected Input |
|
||||
|------------------------------|----------------------------------|------------------------------------------------------------|
|
||||
| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. |
|
||||
|
||||
## Special input schemas
|
||||
|
||||
### ImageRoot
|
||||
|
||||
```yaml
|
||||
registry:
|
||||
type: string
|
||||
description: Docker registry where the image is located
|
||||
example: docker.io
|
||||
|
||||
repository:
|
||||
type: string
|
||||
description: Repository and image name
|
||||
example: bitnami/nginx
|
||||
|
||||
tag:
|
||||
type: string
|
||||
description: image tag
|
||||
example: 1.16.1-debian-10-r63
|
||||
|
||||
pullPolicy:
|
||||
type: string
|
||||
description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
|
||||
pullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: Optionally specify an array of imagePullSecrets (evaluated as templates).
|
||||
|
||||
debug:
|
||||
type: boolean
|
||||
description: Set to true if you would like to see extra information on logs
|
||||
example: false
|
||||
|
||||
## An instance would be:
|
||||
# registry: docker.io
|
||||
# repository: bitnami/nginx
|
||||
# tag: 1.16.1-debian-10-r63
|
||||
# pullPolicy: IfNotPresent
|
||||
# debug: false
|
||||
```
|
||||
|
||||
### Persistence
|
||||
|
||||
```yaml
|
||||
enabled:
|
||||
type: boolean
|
||||
description: Whether enable persistence.
|
||||
example: true
|
||||
|
||||
storageClass:
|
||||
type: string
|
||||
description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning.
|
||||
example: "-"
|
||||
|
||||
accessMode:
|
||||
type: string
|
||||
description: Access mode for the Persistent Volume Storage.
|
||||
example: ReadWriteOnce
|
||||
|
||||
size:
|
||||
type: string
|
||||
description: Size the Persistent Volume Storage.
|
||||
example: 8Gi
|
||||
|
||||
path:
|
||||
type: string
|
||||
description: Path to be persisted.
|
||||
example: /bitnami
|
||||
|
||||
## An instance would be:
|
||||
# enabled: true
|
||||
# storageClass: "-"
|
||||
# accessMode: ReadWriteOnce
|
||||
# size: 8Gi
|
||||
# path: /bitnami
|
||||
```
|
||||
|
||||
### ExistingSecret
|
||||
|
||||
```yaml
|
||||
name:
|
||||
type: string
|
||||
description: Name of the existing secret.
|
||||
example: mySecret
|
||||
keyMapping:
|
||||
description: Mapping between the expected key name and the name of the key in the existing secret.
|
||||
type: object
|
||||
|
||||
## An instance would be:
|
||||
# name: mySecret
|
||||
# keyMapping:
|
||||
# password: myPasswordKey
|
||||
```
|
||||
|
||||
#### Example of use
|
||||
|
||||
When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets.
|
||||
|
||||
```yaml
|
||||
# templates/secret.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "common.names.fullname" . }}
|
||||
type: Opaque
|
||||
data:
|
||||
password: {{ .Values.password | b64enc | quote }}
|
||||
|
||||
# templates/dpl.yaml
|
||||
---
|
||||
...
|
||||
env:
|
||||
- name: PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }}
|
||||
key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }}
|
||||
...
|
||||
|
||||
# values.yaml
|
||||
---
|
||||
name: mySecret
|
||||
keyMapping:
|
||||
password: myPasswordKey
|
||||
```
|
||||
|
||||
### ValidateValue
|
||||
|
||||
#### NOTES.txt
|
||||
|
||||
```console
|
||||
{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}}
|
||||
|
||||
{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||
```
|
||||
|
||||
If we force those values to be empty we will see some alerts
|
||||
|
||||
```console
|
||||
$ helm install test mychart --set path.to.value00="",path.to.value01=""
|
||||
'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value:
|
||||
|
||||
export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d)
|
||||
|
||||
'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value:
|
||||
|
||||
export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d)
|
||||
```
|
||||
|
||||
## Upgrading
|
||||
|
||||
### To 1.0.0
|
||||
|
||||
[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
|
||||
|
||||
**What changes were introduced in this major version?**
|
||||
|
||||
- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field.
|
||||
- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information.
|
||||
- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts
|
||||
|
||||
**Considerations when upgrading to this version**
|
||||
|
||||
- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues
|
||||
- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore
|
||||
- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3
|
||||
|
||||
**Useful links**
|
||||
|
||||
- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/
|
||||
- https://helm.sh/docs/topics/v2_v3_migration/
|
||||
- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/
|
||||
|
||||
## License
|
||||
|
||||
Copyright © 2022 Bitnami
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return a soft nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.soft" -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- preference:
|
||||
matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
weight: 1
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.hard" -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a nodeAffinity definition
|
||||
{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.nodes.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.nodes.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a topologyKey definition
|
||||
{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.topologyKey" -}}
|
||||
{{ .topologyKey | default "kubernetes.io/hostname" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a soft podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.soft" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
weight: 1
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.hard" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.pods.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.pods.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,154 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return the target Kubernetes version
|
||||
*/}}
|
||||
{{- define "common.capabilities.kubeVersion" -}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.kubeVersion }}
|
||||
{{- .Values.global.kubeVersion -}}
|
||||
{{- else }}
|
||||
{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
|
||||
{{- end -}}
|
||||
{{- else }}
|
||||
{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for poddisruptionbudget.
|
||||
*/}}
|
||||
{{- define "common.capabilities.policy.apiVersion" -}}
|
||||
{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "policy/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "policy/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for networkpolicy.
|
||||
*/}}
|
||||
{{- define "common.capabilities.networkPolicy.apiVersion" -}}
|
||||
{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for cronjob.
|
||||
*/}}
|
||||
{{- define "common.capabilities.cronjob.apiVersion" -}}
|
||||
{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "batch/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "batch/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for deployment.
|
||||
*/}}
|
||||
{{- define "common.capabilities.deployment.apiVersion" -}}
|
||||
{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for statefulset.
|
||||
*/}}
|
||||
{{- define "common.capabilities.statefulset.apiVersion" -}}
|
||||
{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "apps/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for ingress.
|
||||
*/}}
|
||||
{{- define "common.capabilities.ingress.apiVersion" -}}
|
||||
{{- if .Values.ingress -}}
|
||||
{{- if .Values.ingress.apiVersion -}}
|
||||
{{- .Values.ingress.apiVersion -}}
|
||||
{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "networking.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end }}
|
||||
{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "networking.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for RBAC resources.
|
||||
*/}}
|
||||
{{- define "common.capabilities.rbac.apiVersion" -}}
|
||||
{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "rbac.authorization.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "rbac.authorization.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for CRDs.
|
||||
*/}}
|
||||
{{- define "common.capabilities.crd.apiVersion" -}}
|
||||
{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "apiextensions.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apiextensions.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for APIService.
|
||||
*/}}
|
||||
{{- define "common.capabilities.apiService.apiVersion" -}}
|
||||
{{- if semverCompare "<1.10-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "apiregistration.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "apiregistration.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for Horizontal Pod Autoscaler.
|
||||
*/}}
|
||||
{{- define "common.capabilities.hpa.apiVersion" -}}
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}}
|
||||
{{- if .beta2 -}}
|
||||
{{- print "autoscaling/v2beta2" -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v2beta1" -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v2" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if the used Helm version is 3.3+.
|
||||
A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure.
|
||||
This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error.
|
||||
**To be removed when the catalog's minimun Helm version is 3.3**
|
||||
*/}}
|
||||
{{- define "common.capabilities.supportsHelmVersion" -}}
|
||||
{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Through error when upgrading using empty passwords values that must not be empty.
|
||||
|
||||
Usage:
|
||||
{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}}
|
||||
{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }}
|
||||
|
||||
Required password params:
|
||||
- validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error.
|
||||
- context - Context - Required. Parent context.
|
||||
*/}}
|
||||
{{- define "common.errors.upgrade.passwords.empty" -}}
|
||||
{{- $validationErrors := join "" .validationErrors -}}
|
||||
{{- if and $validationErrors .context.Release.IsUpgrade -}}
|
||||
{{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}}
|
||||
{{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}}
|
||||
{{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}}
|
||||
{{- $errorString = print $errorString "\n%s" -}}
|
||||
{{- printf $errorString $validationErrors | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Return the proper image name
|
||||
{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }}
|
||||
*/}}
|
||||
{{- define "common.images.image" -}}
|
||||
{{- $registryName := .imageRoot.registry -}}
|
||||
{{- $repositoryName := .imageRoot.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $termination := .imageRoot.tag | toString -}}
|
||||
{{- if .global }}
|
||||
{{- if .global.imageRegistry }}
|
||||
{{- $registryName = .global.imageRegistry -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .imageRoot.digest }}
|
||||
{{- $separator = "@" -}}
|
||||
{{- $termination = .imageRoot.digest | toString -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
|
||||
{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
|
||||
*/}}
|
||||
{{- define "common.images.pullSecrets" -}}
|
||||
{{- $pullSecrets := list }}
|
||||
|
||||
{{- if .global }}
|
||||
{{- range .global.imagePullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range .images -}}
|
||||
{{- range .pullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not (empty $pullSecrets)) }}
|
||||
imagePullSecrets:
|
||||
{{- range $pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names evaluating values as templates
|
||||
{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.images.renderPullSecrets" -}}
|
||||
{{- $pullSecrets := list }}
|
||||
{{- $context := .context }}
|
||||
|
||||
{{- if $context.Values.global }}
|
||||
{{- range $context.Values.global.imagePullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range .images -}}
|
||||
{{- range .pullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not (empty $pullSecrets)) }}
|
||||
imagePullSecrets:
|
||||
{{- range $pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Generate backend entry that is compatible with all Kubernetes API versions.
|
||||
|
||||
Usage:
|
||||
{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }}
|
||||
|
||||
Params:
|
||||
- serviceName - String. Name of an existing service backend
|
||||
- servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer.
|
||||
- context - Dict - Required. The context for the template evaluation.
|
||||
*/}}
|
||||
{{- define "common.ingress.backend" -}}
|
||||
{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}}
|
||||
{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}}
|
||||
serviceName: {{ .serviceName }}
|
||||
servicePort: {{ .servicePort }}
|
||||
{{- else -}}
|
||||
service:
|
||||
name: {{ .serviceName }}
|
||||
port:
|
||||
{{- if typeIs "string" .servicePort }}
|
||||
name: {{ .servicePort }}
|
||||
{{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }}
|
||||
number: {{ .servicePort | int }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Print "true" if the API pathType field is supported
|
||||
Usage:
|
||||
{{ include "common.ingress.supportsPathType" . }}
|
||||
*/}}
|
||||
{{- define "common.ingress.supportsPathType" -}}
|
||||
{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}}
|
||||
{{- print "false" -}}
|
||||
{{- else -}}
|
||||
{{- print "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if the ingressClassname field is supported
|
||||
Usage:
|
||||
{{ include "common.ingress.supportsIngressClassname" . }}
|
||||
*/}}
|
||||
{{- define "common.ingress.supportsIngressClassname" -}}
|
||||
{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||
{{- print "false" -}}
|
||||
{{- else -}}
|
||||
{{- print "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if cert-manager required annotations for TLS signed
|
||||
certificates are set in the Ingress annotations
|
||||
Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
|
||||
Usage:
|
||||
{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }}
|
||||
*/}}
|
||||
{{- define "common.ingress.certManagerRequest" -}}
|
||||
{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Kubernetes standard labels
|
||||
*/}}
|
||||
{{- define "common.labels.standard" -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
helm.sh/chart: {{ include "common.names.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector
|
||||
*/}}
|
||||
{{- define "common.labels.matchLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "common.names.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "common.names.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "common.names.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified dependency name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
Usage:
|
||||
{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.names.dependency.fullname" -}}
|
||||
{{- if .chartValues.fullnameOverride -}}
|
||||
{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .chartName .chartValues.nameOverride -}}
|
||||
{{- if contains $name .context.Release.Name -}}
|
||||
{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
|
||||
*/}}
|
||||
{{- define "common.names.namespace" -}}
|
||||
{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a fully qualified app name adding the installation's namespace.
|
||||
*/}}
|
||||
{{- define "common.names.fullname.namespace" -}}
|
||||
{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,165 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Generate secret name.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }}
|
||||
|
||||
Params:
|
||||
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||
- defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment.
|
||||
- context - Dict - Required. The context for the template evaluation.
|
||||
*/}}
|
||||
{{- define "common.secrets.name" -}}
|
||||
{{- $name := (include "common.names.fullname" .context) -}}
|
||||
|
||||
{{- if .defaultNameSuffix -}}
|
||||
{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with .existingSecret -}}
|
||||
{{- if not (typeIs "string" .) -}}
|
||||
{{- with .name -}}
|
||||
{{- $name = . -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $name = . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- printf "%s" $name -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate secret key.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }}
|
||||
|
||||
Params:
|
||||
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||
- key - String - Required. Name of the key in the secret.
|
||||
*/}}
|
||||
{{- define "common.secrets.key" -}}
|
||||
{{- $key := .key -}}
|
||||
|
||||
{{- if .existingSecret -}}
|
||||
{{- if not (typeIs "string" .existingSecret) -}}
|
||||
{{- if .existingSecret.keyMapping -}}
|
||||
{{- $key = index .existingSecret.keyMapping $.key -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- printf "%s" $key -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate secret password or retrieve one if already created.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- key - String - Required - Name of the key in the secret.
|
||||
- providedValues - List<String> - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||
- length - int - Optional - Length of the generated random password.
|
||||
- strong - Boolean - Optional - Whether to add symbols to the generated random password.
|
||||
- chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart.
|
||||
- context - Context - Required - Parent context.
|
||||
|
||||
The order in which this function returns a secret password:
|
||||
1. Already existing 'Secret' resource
|
||||
(If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned)
|
||||
2. Password provided via the values.yaml
|
||||
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
|
||||
3. Randomly generated secret password
|
||||
(A new random secret password with the length specified in the 'length' parameter will be generated and returned)
|
||||
|
||||
*/}}
|
||||
{{- define "common.secrets.passwords.manage" -}}
|
||||
|
||||
{{- $password := "" }}
|
||||
{{- $subchart := "" }}
|
||||
{{- $chartName := default "" .chartName }}
|
||||
{{- $passwordLength := default 10 .length }}
|
||||
{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }}
|
||||
{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }}
|
||||
{{- if $secretData }}
|
||||
{{- if hasKey $secretData .key }}
|
||||
{{- $password = index $secretData .key | quote }}
|
||||
{{- else }}
|
||||
{{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}}
|
||||
{{- end -}}
|
||||
{{- else if $providedPasswordValue }}
|
||||
{{- $password = $providedPasswordValue | toString | b64enc | quote }}
|
||||
{{- else }}
|
||||
|
||||
{{- if .context.Values.enabled }}
|
||||
{{- $subchart = $chartName }}
|
||||
{{- end -}}
|
||||
|
||||
{{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}}
|
||||
{{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}}
|
||||
{{- $passwordValidationErrors := list $requiredPasswordError -}}
|
||||
{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}}
|
||||
|
||||
{{- if .strong }}
|
||||
{{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }}
|
||||
{{- $password = randAscii $passwordLength }}
|
||||
{{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }}
|
||||
{{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }}
|
||||
{{- else }}
|
||||
{{- $password = randAlphaNum $passwordLength | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $password -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Reuses the value from an existing secret, otherwise sets its value to a default value.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- key - String - Required - Name of the key in the secret.
|
||||
- defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||
- context - Context - Required - Parent context.
|
||||
|
||||
*/}}
|
||||
{{- define "common.secrets.lookup" -}}
|
||||
{{- $value := "" -}}
|
||||
{{- $defaultValue := required "\n'common.secrets.lookup': Argument 'defaultValue' missing or empty" .defaultValue -}}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}}
|
||||
{{- if and $secretData (hasKey $secretData .key) -}}
|
||||
{{- $value = index $secretData .key -}}
|
||||
{{- else -}}
|
||||
{{- $value = $defaultValue | toString | b64enc -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $value -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns whether a previous generated secret already exists
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- context - Context - Required - Parent context.
|
||||
*/}}
|
||||
{{- define "common.secrets.exists" -}}
|
||||
{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }}
|
||||
{{- if $secret }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Return the proper Storage Class
|
||||
{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }}
|
||||
*/}}
|
||||
{{- define "common.storage.class" -}}
|
||||
|
||||
{{- $storageClass := .persistence.storageClass -}}
|
||||
{{- if .global -}}
|
||||
{{- if .global.storageClass -}}
|
||||
{{- $storageClass = .global.storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if $storageClass -}}
|
||||
{{- if (eq "-" $storageClass) -}}
|
||||
{{- printf "storageClassName: \"\"" -}}
|
||||
{{- else }}
|
||||
{{- printf "storageClassName: %s" $storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Renders a value that contains template.
|
||||
Usage:
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.tplvalues.render" -}}
|
||||
{{- if typeIs "string" .value }}
|
||||
{{- tpl .value .context }}
|
||||
{{- else }}
|
||||
{{- tpl (.value | toYaml) .context }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Print instructions to get a secret value.
|
||||
Usage:
|
||||
{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.secret.getvalue" -}}
|
||||
{{- $varname := include "common.utils.fieldToEnvVar" . -}}
|
||||
export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d)
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Build env var name given a field
|
||||
Usage:
|
||||
{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }}
|
||||
*/}}
|
||||
{{- define "common.utils.fieldToEnvVar" -}}
|
||||
{{- $fieldNameSplit := splitList "-" .field -}}
|
||||
{{- $upperCaseFieldNameSplit := list -}}
|
||||
|
||||
{{- range $fieldNameSplit -}}
|
||||
{{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ join "_" $upperCaseFieldNameSplit }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Gets a value from .Values given
|
||||
Usage:
|
||||
{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.getValueFromKey" -}}
|
||||
{{- $splitKey := splitList "." .key -}}
|
||||
{{- $value := "" -}}
|
||||
{{- $latestObj := $.context.Values -}}
|
||||
{{- range $splitKey -}}
|
||||
{{- if not $latestObj -}}
|
||||
{{- printf "please review the entire path of '%s' exists in values" $.key | fail -}}
|
||||
{{- end -}}
|
||||
{{- $value = ( index $latestObj . ) -}}
|
||||
{{- $latestObj = $value -}}
|
||||
{{- end -}}
|
||||
{{- printf "%v" (default "" $value) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns first .Values key with a defined value or first of the list if all non-defined
|
||||
Usage:
|
||||
{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.utils.getKeyFromList" -}}
|
||||
{{- $key := first .keys -}}
|
||||
{{- $reverseKeys := reverse .keys }}
|
||||
{{- range $reverseKeys }}
|
||||
{{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }}
|
||||
{{- if $value -}}
|
||||
{{- $key = . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $key -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Warning about using rolling tag.
|
||||
Usage:
|
||||
{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }}
|
||||
*/}}
|
||||
{{- define "common.warnings.rollingTag" -}}
|
||||
|
||||
{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate Cassandra required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.cassandra.passwords" -}}
|
||||
{{- $existingSecret := include "common.cassandra.values.existingSecret" . -}}
|
||||
{{- $enabled := include "common.cassandra.values.enabled" . -}}
|
||||
{{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.cassandra.dbUser.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.dbUser.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled cassandra.
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.cassandra.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key dbUser
|
||||
|
||||
Usage:
|
||||
{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.cassandra.values.key.dbUser" -}}
|
||||
{{- if .subchart -}}
|
||||
cassandra.dbUser
|
||||
{{- else -}}
|
||||
dbUser
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,103 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate MariaDB required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.mariadb.passwords" -}}
|
||||
{{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}}
|
||||
{{- $enabled := include "common.mariadb.values.enabled" . -}}
|
||||
{{- $architecture := include "common.mariadb.values.architecture" . -}}
|
||||
{{- $authPrefix := include "common.mariadb.values.key.auth" . -}}
|
||||
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||
{{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||
|
||||
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||
{{- if not (empty $valueUsername) -}}
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (eq $architecture "replication") -}}
|
||||
{{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mariadb.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mariadb.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mariadb.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mariadb.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mariadb.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mariadb.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate MongoDB® required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.mongodb.passwords" -}}
|
||||
{{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}}
|
||||
{{- $enabled := include "common.mongodb.values.enabled" . -}}
|
||||
{{- $authPrefix := include "common.mongodb.values.key.auth" . -}}
|
||||
{{- $architecture := include "common.mongodb.values.architecture" . -}}
|
||||
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||
{{- $valueKeyDatabase := printf "%s.database" $authPrefix -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||
{{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}}
|
||||
{{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}}
|
||||
|
||||
{{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||
|
||||
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||
{{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }}
|
||||
{{- if and $valueUsername $valueDatabase -}}
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (eq $architecture "replicaset") -}}
|
||||
{{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mongodb.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mongodb.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mongodb.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mongodb.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mongodb.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mongodb.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,103 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate MySQL required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.mysql.passwords" -}}
|
||||
{{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}}
|
||||
{{- $enabled := include "common.mysql.values.enabled" . -}}
|
||||
{{- $architecture := include "common.mysql.values.architecture" . -}}
|
||||
{{- $authPrefix := include "common.mysql.values.key.auth" . -}}
|
||||
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||
{{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||
|
||||
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||
{{- if not (empty $valueUsername) -}}
|
||||
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (eq $architecture "replication") -}}
|
||||
{{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.auth.existingSecret" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mysql.auth.existingSecret | quote -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.auth.existingSecret | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled mysql.
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.mysql.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.mysql.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for architecture
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.architecture" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- .context.Values.mysql.architecture -}}
|
||||
{{- else -}}
|
||||
{{- .context.Values.architecture -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key auth
|
||||
|
||||
Usage:
|
||||
{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.mysql.values.key.auth" -}}
|
||||
{{- if .subchart -}}
|
||||
mysql.auth
|
||||
{{- else -}}
|
||||
auth
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,129 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate PostgreSQL required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.postgresql.passwords" -}}
|
||||
{{- $existingSecret := include "common.postgresql.values.existingSecret" . -}}
|
||||
{{- $enabled := include "common.postgresql.values.enabled" . -}}
|
||||
{{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}}
|
||||
{{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}}
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
{{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}}
|
||||
|
||||
{{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}}
|
||||
{{- if (eq $enabledReplication "true") -}}
|
||||
{{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to decide whether evaluate global values.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }}
|
||||
Params:
|
||||
- key - String - Required. Field to be evaluated within global, e.g: "existingSecret"
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.use.global" -}}
|
||||
{{- if .context.Values.global -}}
|
||||
{{- if .context.Values.global.postgresql -}}
|
||||
{{- index .context.Values.global.postgresql .key | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for existingSecret.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.existingSecret" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.existingSecret" -}}
|
||||
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}}
|
||||
|
||||
{{- if .subchart -}}
|
||||
{{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}}
|
||||
{{- else -}}
|
||||
{{- default (.context.Values.existingSecret | quote) $globalValue -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled postgresql.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.postgresql.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key postgressPassword.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.key.postgressPassword" -}}
|
||||
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}}
|
||||
|
||||
{{- if not $globalValue -}}
|
||||
{{- if .subchart -}}
|
||||
postgresql.postgresqlPassword
|
||||
{{- else -}}
|
||||
postgresqlPassword
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
global.postgresql.postgresqlPassword
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled.replication.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.enabled.replication" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.postgresql.replication.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" .context.Values.replication.enabled -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for the key replication.password.
|
||||
|
||||
Usage:
|
||||
{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.postgresql.values.key.replicationPassword" -}}
|
||||
{{- if .subchart -}}
|
||||
postgresql.replication.password
|
||||
{{- else -}}
|
||||
replication.password
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate Redis® required passwords are not empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||
Params:
|
||||
- secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret"
|
||||
- subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.validations.values.redis.passwords" -}}
|
||||
{{- $enabled := include "common.redis.values.enabled" . -}}
|
||||
{{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}}
|
||||
{{- $standarizedVersion := include "common.redis.values.standarized.version" . }}
|
||||
|
||||
{{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }}
|
||||
{{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }}
|
||||
|
||||
{{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }}
|
||||
{{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }}
|
||||
|
||||
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
|
||||
{{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}}
|
||||
{{- if eq $useAuth "true" -}}
|
||||
{{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right value for enabled redis.
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.enabled" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.redis.values.enabled" -}}
|
||||
{{- if .subchart -}}
|
||||
{{- printf "%v" .context.Values.redis.enabled -}}
|
||||
{{- else -}}
|
||||
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Auxiliary function to get the right prefix path for the values
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }}
|
||||
Params:
|
||||
- subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
|
||||
*/}}
|
||||
{{- define "common.redis.values.keys.prefix" -}}
|
||||
{{- if .subchart -}}redis.{{- else -}}{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Checks whether the redis chart's includes the standarizations (version >= 14)
|
||||
|
||||
Usage:
|
||||
{{ include "common.redis.values.standarized.version" (dict "context" $) }}
|
||||
*/}}
|
||||
{{- define "common.redis.values.standarized.version" -}}
|
||||
|
||||
{{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}}
|
||||
{{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }}
|
||||
|
||||
{{- if $standarizedAuthValues -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Validate values must not be empty.
|
||||
|
||||
Usage:
|
||||
{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}}
|
||||
{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}}
|
||||
{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||
|
||||
Validate value params:
|
||||
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||
*/}}
|
||||
{{- define "common.validations.values.multiple.empty" -}}
|
||||
{{- range .required -}}
|
||||
{{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate a value must not be empty.
|
||||
|
||||
Usage:
|
||||
{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }}
|
||||
|
||||
Validate value params:
|
||||
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||
- subchart - String - Optional - Name of the subchart that the validated password is part of.
|
||||
*/}}
|
||||
{{- define "common.validations.values.single.empty" -}}
|
||||
{{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }}
|
||||
{{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }}
|
||||
|
||||
{{- if not $value -}}
|
||||
{{- $varname := "my-value" -}}
|
||||
{{- $getCurrentValue := "" -}}
|
||||
{{- if and .secret .field -}}
|
||||
{{- $varname = include "common.utils.fieldToEnvVar" . -}}
|
||||
{{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}}
|
||||
{{- end -}}
|
||||
{{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
## bitnami/common
|
||||
## It is required by CI/CD tools and processes.
|
||||
## @skip exampleValue
|
||||
##
|
||||
exampleValue: common-chart
|
||||
63
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/NOTES.txt
Executable file → Normal file
63
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/NOTES.txt
Executable file → Normal file
|
|
@ -1,5 +1,8 @@
|
|||
{{- if contains .Values.service.type "LoadBalancer" }}
|
||||
{{- if not .Values.auth.clientPassword }}
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
{{- if and (not .Values.auth.client.enabled) (eq .Values.service.type "LoadBalancer") }}
|
||||
-------------------------------------------------------------------------------
|
||||
WARNING
|
||||
|
||||
|
|
@ -13,45 +16,61 @@
|
|||
|
||||
-------------------------------------------------------------------------------
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
ZooKeeper can be accessed via port 2181 on the following DNS name from within your cluster:
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||
|
||||
{{ template "zookeeper.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||
|
||||
Get the list of pods by executing:
|
||||
|
||||
kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||
|
||||
Access the pod you want to debug by executing
|
||||
|
||||
kubectl exec --namespace {{ .Release.Namespace }} -ti <NAME OF THE POD> -- bash
|
||||
|
||||
In order to replicate the container startup scripts execute this command:
|
||||
|
||||
/opt/bitnami/scripts/zookeeper/entrypoint.sh /opt/bitnami/scripts/zookeeper/run.sh
|
||||
|
||||
{{- else }}
|
||||
|
||||
ZooKeeper can be accessed via port {{ .Values.service.ports.client }} on the following DNS name from within your cluster:
|
||||
|
||||
{{ template "common.names.fullname" . }}.{{ template "zookeeper.namespace" . }}.svc.{{ .Values.clusterDomain }}
|
||||
|
||||
To connect to your ZooKeeper server run the following commands:
|
||||
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "zookeeper.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=zookeeper" -o jsonpath="{.items[0].metadata.name}")
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ template "zookeeper.namespace" . }} -l "app.kubernetes.io/name={{ template "common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=zookeeper" -o jsonpath="{.items[0].metadata.name}")
|
||||
kubectl exec -it $POD_NAME -- zkCli.sh
|
||||
|
||||
To connect to your ZooKeeper server from outside the cluster execute the following commands:
|
||||
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
{{- if eq .Values.service.type "NodePort" }}
|
||||
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "zookeeper.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ template "zookeeper.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
export NODE_PORT=$(kubectl get --namespace {{ template "zookeeper.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "common.names.fullname" . }})
|
||||
zkCli.sh $NODE_IP:$NODE_PORT
|
||||
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
{{- else if eq .Values.service.type "LoadBalancer" }}
|
||||
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "zookeeper.fullname" . }}'
|
||||
Watch the status with: 'kubectl get svc --namespace {{ template "zookeeper.namespace" . }} -w {{ template "common.names.fullname" . }}'
|
||||
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "zookeeper.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
zkCli.sh $SERVICE_IP:2181
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ template "zookeeper.namespace" . }} {{ template "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
|
||||
zkCli.sh $SERVICE_IP:{{ .Values.service.ports.client }}
|
||||
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
|
||||
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "zookeeper.fullname" . }} 2181:2181 &
|
||||
zkCli.sh 127.0.0.1:2181
|
||||
kubectl port-forward --namespace {{ template "zookeeper.namespace" . }} svc/{{ template "common.names.fullname" . }} {{ .Values.service.ports.client }}:{{ .Values.containerPorts.client }} &
|
||||
zkCli.sh 127.0.0.1:{{ .Values.service.ports.client }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
|
||||
WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- include "zookeeper.validateValues" . }}
|
||||
{{- include "zookeeper.checkRollingTags" . }}
|
||||
|
|
|
|||
469
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/_helpers.tpl
Executable file → Normal file
469
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/_helpers.tpl
Executable file → Normal file
|
|
@ -1,34 +1,43 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
Return the proper ZooKeeper image name
|
||||
*/}}
|
||||
{{- define "zookeeper.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- define "zookeeper.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "zookeeper.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- define "zookeeper.volumePermissions.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "zookeeper.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- define "zookeeper.imagePullSecrets" -}}
|
||||
{{- include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.volumePermissions.image) "global" .Values.global) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Check if there are rolling tags in the images
|
||||
*/}}
|
||||
{{- define "zookeeper.checkRollingTags" -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return ZooKeeper Namespace to use
|
||||
*/}}
|
||||
{{- define "zookeeper.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
|
|
@ -36,177 +45,317 @@ Create chart name and version as used by the chart label.
|
|||
*/}}
|
||||
{{- define "zookeeper.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "zookeeper.fullname" .) .Values.serviceAccount.name }}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Zookeeper image name
|
||||
Return the ZooKeeper client-server authentication credentials secret
|
||||
*/}}
|
||||
{{- define "zookeeper.image" -}}
|
||||
{{- $registryName := .Values.image.registry -}}
|
||||
{{- $repositoryName := .Values.image.repository -}}
|
||||
{{- $tag := .Values.image.tag | toString -}}
|
||||
{{- define "zookeeper.client.secretName" -}}
|
||||
{{- if .Values.auth.client.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.auth.client.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-client-auth" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
Return the ZooKeeper server-server authentication credentials secret
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- define "zookeeper.quorum.secretName" -}}
|
||||
{{- if .Values.auth.quorum.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.auth.quorum.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-quorum-auth" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a ZooKeeper client-server authentication credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "zookeeper.client.createSecret" -}}
|
||||
{{- if and .Values.auth.client.enabled (empty .Values.auth.client.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a ZooKeeper server-server authentication credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "zookeeper.quorum.createSecret" -}}
|
||||
{{- if and .Values.auth.quorum.enabled (empty .Values.auth.quorum.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the available value for certain key in an existing secret (if it exists),
|
||||
otherwise it generates a random value.
|
||||
*/}}
|
||||
{{- define "getValueFromSecret" }}
|
||||
{{- $len := (default 16 .Length) | int -}}
|
||||
{{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}}
|
||||
{{- if $obj }}
|
||||
{{- index $obj .Key | b64dec -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- randAlphaNum $len -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "zookeeper.imagePullSecrets" -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
|
||||
Also, we can not use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.volumePermissions.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.volumePermissions.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
Return the ZooKeeper configuration ConfigMap name
|
||||
*/}}
|
||||
{{- define "zookeeper.labels" -}}
|
||||
app.kubernetes.io/name: {{ include "zookeeper.name" . }}
|
||||
helm.sh/chart: {{ include "zookeeper.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Renders a value that contains template.
|
||||
Usage:
|
||||
{{ include "zookeeper.tplValue" ( dict "value" .Values.path.to.the.Value "context" $) }}
|
||||
*/}}
|
||||
{{- define "zookeeper.tplValue" -}}
|
||||
{{- if typeIs "string" .value }}
|
||||
{{- tpl .value .context }}
|
||||
{{- else }}
|
||||
{{- tpl (.value | toYaml) .context }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector
|
||||
*/}}
|
||||
{{- define "zookeeper.matchLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "zookeeper.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return ZooKeeper Client Password
|
||||
*/}}
|
||||
{{- define "zookeeper.clientPassword" -}}
|
||||
{{- if .Values.auth.clientPassword -}}
|
||||
{{- .Values.auth.clientPassword -}}
|
||||
{{- define "zookeeper.configmapName" -}}
|
||||
{{- if .Values.existingConfigmap -}}
|
||||
{{- printf "%s" (tpl .Values.existingConfigmap $) -}}
|
||||
{{- else -}}
|
||||
{{- randAlphaNum 10 -}}
|
||||
{{- printf "%s" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return ZooKeeper Servers Passwords
|
||||
Return true if a ConfigMap object should be created for ZooKeeper configuration
|
||||
*/}}
|
||||
{{- define "zookeeper.serverPasswords" -}}
|
||||
{{- if .Values.auth.serverPasswords -}}
|
||||
{{- .Values.auth.serverPasswords -}}
|
||||
{{- else -}}
|
||||
{{- randAlphaNum 10 -}}
|
||||
{{- define "zookeeper.createConfigmap" -}}
|
||||
{{- if and .Values.configuration (not .Values.existingConfigmap) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
Return true if a TLS secret should be created for ZooKeeper quorum
|
||||
*/}}
|
||||
{{- define "zookeeper.volumePermissions.image" -}}
|
||||
{{- $registryName := .Values.volumePermissions.image.registry -}}
|
||||
{{- $repositoryName := .Values.volumePermissions.image.repository -}}
|
||||
{{- $tag := .Values.volumePermissions.image.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- define "zookeeper.quorum.createTlsSecret" -}}
|
||||
{{- if and .Values.tls.quorum.enabled .Values.tls.quorum.autoGenerated (not .Values.tls.quorum.existingSecret) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Storage Class
|
||||
Return the secret containing ZooKeeper quorum TLS certificates
|
||||
*/}}
|
||||
{{- define "zookeeper.storageClass" -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
|
||||
*/}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.storageClass -}}
|
||||
{{- if (eq "-" .Values.global.storageClass) -}}
|
||||
{{- printf "storageClassName: \"\"" -}}
|
||||
{{- else }}
|
||||
{{- printf "storageClassName: %s" .Values.global.storageClass -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.persistence.storageClass -}}
|
||||
{{- if (eq "-" .Values.persistence.storageClass) -}}
|
||||
{{- printf "storageClassName: \"\"" -}}
|
||||
{{- else }}
|
||||
{{- printf "storageClassName: %s" .Values.persistence.storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- define "zookeeper.quorum.tlsSecretName" -}}
|
||||
{{- $secretName := .Values.tls.quorum.existingSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.persistence.storageClass -}}
|
||||
{{- if (eq "-" .Values.persistence.storageClass) -}}
|
||||
{{- printf "storageClassName: \"\"" -}}
|
||||
{{- else }}
|
||||
{{- printf "storageClassName: %s" .Values.persistence.storageClass -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s-quorum-crt" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret containing the Keystore and Truststore password should be created for ZooKeeper quorum
|
||||
*/}}
|
||||
{{- define "zookeeper.quorum.createTlsPasswordsSecret" -}}
|
||||
{{- if and .Values.tls.quorum.enabled (not .Values.tls.quorum.passwordsSecretName) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the name of the secret containing the Keystore and Truststore password
|
||||
*/}}
|
||||
{{- define "zookeeper.quorum.tlsPasswordsSecret" -}}
|
||||
{{- $secretName := .Values.tls.quorum.passwordsSecretName -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-quorum-tls-pass" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS secret should be created for ZooKeeper client
|
||||
*/}}
|
||||
{{- define "zookeeper.client.createTlsSecret" -}}
|
||||
{{- if and .Values.tls.client.enabled .Values.tls.client.autoGenerated (not .Values.tls.client.existingSecret) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the secret containing ZooKeeper client TLS certificates
|
||||
*/}}
|
||||
{{- define "zookeeper.client.tlsSecretName" -}}
|
||||
{{- $secretName := .Values.tls.client.existingSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-client-crt" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the quorum keystore key to be retrieved from tls.quorum.existingSecret.
|
||||
*/}}
|
||||
{{- define "zookeeper.quorum.tlsKeystoreKey" -}}
|
||||
{{- if and .Values.tls.quorum.existingSecret .Values.tls.quorum.existingSecretKeystoreKey -}}
|
||||
{{- printf "%s" .Values.tls.quorum.existingSecretKeystoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "zookeeper.keystore.jks" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the quorum truststore key to be retrieved from tls.quorum.existingSecret.
|
||||
*/}}
|
||||
{{- define "zookeeper.quorum.tlsTruststoreKey" -}}
|
||||
{{- if and .Values.tls.quorum.existingSecret .Values.tls.quorum.existingSecretTruststoreKey -}}
|
||||
{{- printf "%s" .Values.tls.quorum.existingSecretTruststoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "zookeeper.truststore.jks" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the client keystore key to be retrieved from tls.client.existingSecret.
|
||||
*/}}
|
||||
{{- define "zookeeper.client.tlsKeystoreKey" -}}
|
||||
{{- if and .Values.tls.client.existingSecret .Values.tls.client.existingSecretKeystoreKey -}}
|
||||
{{- printf "%s" .Values.tls.client.existingSecretKeystoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "zookeeper.keystore.jks" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the client truststore key to be retrieved from tls.client.existingSecret.
|
||||
*/}}
|
||||
{{- define "zookeeper.client.tlsTruststoreKey" -}}
|
||||
{{- if and .Values.tls.client.existingSecret .Values.tls.client.existingSecretTruststoreKey -}}
|
||||
{{- printf "%s" .Values.tls.client.existingSecretTruststoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "zookeeper.truststore.jks" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret containing the Keystore and Truststore password should be created for ZooKeeper client
|
||||
*/}}
|
||||
{{- define "zookeeper.client.createTlsPasswordsSecret" -}}
|
||||
{{- if and .Values.tls.client.enabled (not .Values.tls.client.passwordsSecretName) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the name of the secret containing the Keystore and Truststore password
|
||||
*/}}
|
||||
{{- define "zookeeper.client.tlsPasswordsSecret" -}}
|
||||
{{- $secretName := .Values.tls.client.passwordsSecretName -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-client-tls-pass" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the quorum keystore password key to be retrieved from tls.quorum.passwordSecretName.
|
||||
*/}}
|
||||
{{- define "zookeeper.quorum.tlsPasswordKeystoreKey" -}}
|
||||
{{- if and .Values.tls.quorum.passwordsSecretName .Values.tls.quorum.passwordsSecretKeystoreKey -}}
|
||||
{{- printf "%s" .Values.tls.quorum.passwordsSecretKeystoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "keystore-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the quorum truststore password key to be retrieved from tls.quorum.passwordSecretName.
|
||||
*/}}
|
||||
{{- define "zookeeper.quorum.tlsPasswordTruststoreKey" -}}
|
||||
{{- if and .Values.tls.quorum.passwordsSecretName .Values.tls.quorum.passwordsSecretTruststoreKey -}}
|
||||
{{- printf "%s" .Values.tls.quorum.passwordsSecretTruststoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "truststore-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the client keystore password key to be retrieved from tls.client.passwordSecretName.
|
||||
*/}}
|
||||
{{- define "zookeeper.client.tlsPasswordKeystoreKey" -}}
|
||||
{{- if and .Values.tls.client.passwordsSecretName .Values.tls.client.passwordsSecretKeystoreKey -}}
|
||||
{{- printf "%s" .Values.tls.client.passwordsSecretKeystoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "keystore-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the client truststore password key to be retrieved from tls.client.passwordSecretName.
|
||||
*/}}
|
||||
{{- define "zookeeper.client.tlsPasswordTruststoreKey" -}}
|
||||
{{- if and .Values.tls.client.passwordsSecretName .Values.tls.client.passwordsSecretTruststoreKey -}}
|
||||
{{- printf "%s" .Values.tls.client.passwordsSecretTruststoreKey -}}
|
||||
{{- else -}}
|
||||
{{- printf "truststore-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message.
|
||||
*/}}
|
||||
{{- define "zookeeper.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "zookeeper.validateValues.client.auth" .) -}}
|
||||
{{- $messages := append $messages (include "zookeeper.validateValues.quorum.auth" .) -}}
|
||||
{{- $messages := append $messages (include "zookeeper.validateValues.client.tls" .) -}}
|
||||
{{- $messages := append $messages (include "zookeeper.validateValues.quorum.tls" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate values of ZooKeeper - Authentication enabled
|
||||
*/}}
|
||||
{{- define "zookeeper.validateValues.client.auth" -}}
|
||||
{{- if and .Values.auth.client.enabled (not .Values.auth.client.existingSecret) (or (not .Values.auth.client.clientUser) (not .Values.auth.client.serverUsers)) }}
|
||||
zookeeper: auth.client.enabled
|
||||
In order to enable client-server authentication, you need to provide the list
|
||||
of users to be created and the user to use for clients authentication.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate values of ZooKeeper - Authentication enabled
|
||||
*/}}
|
||||
{{- define "zookeeper.validateValues.quorum.auth" -}}
|
||||
{{- if and .Values.auth.quorum.enabled (not .Values.auth.quorum.existingSecret) (or (not .Values.auth.quorum.learnerUser) (not .Values.auth.quorum.serverUsers)) }}
|
||||
zookeeper: auth.quorum.enabled
|
||||
In order to enable server-server authentication, you need to provide the list
|
||||
of users to be created and the user to use for quorum authentication.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate values of ZooKeeper - Client TLS enabled
|
||||
*/}}
|
||||
{{- define "zookeeper.validateValues.client.tls" -}}
|
||||
{{- if and .Values.tls.client.enabled (not .Values.tls.client.autoGenerated) (not .Values.tls.client.existingSecret) }}
|
||||
zookeeper: tls.client.enabled
|
||||
In order to enable Client TLS encryption, you also need to provide
|
||||
an existing secret containing the Keystore and Truststore or
|
||||
enable auto-generated certificates.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Validate values of ZooKeeper - Quorum TLS enabled
|
||||
*/}}
|
||||
{{- define "zookeeper.validateValues.quorum.tls" -}}
|
||||
{{- if and .Values.tls.quorum.enabled (not .Values.tls.quorum.autoGenerated) (not .Values.tls.quorum.existingSecret) }}
|
||||
zookeeper: tls.quorum.enabled
|
||||
In order to enable Quorum TLS, you also need to provide
|
||||
an existing secret containing the Keystore and Truststore or
|
||||
enable auto-generated certificates.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
|
|||
16
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/configmap.yaml
Executable file → Normal file
16
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/configmap.yaml
Executable file → Normal file
|
|
@ -1,17 +1,17 @@
|
|||
{{- if .Values.config }}
|
||||
{{- if (include "zookeeper.createConfigmap" .) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
zoo.cfg: |-
|
||||
{{ .Values.config | indent 4 }}
|
||||
{{- end -}}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.configuration "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
16
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/metrics-svc.yaml
Executable file → Normal file
16
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/metrics-svc.yaml
Executable file → Normal file
|
|
@ -2,20 +2,20 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}-metrics
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
name: {{ template "common.names.fullname" . }}-metrics
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.metrics.service.annotations .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.metrics.service.annotations }}
|
||||
{{ include "zookeeper.tplValue" ( dict "value" .Values.metrics.service.annotations "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.service.annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
|
|
@ -24,6 +24,6 @@ spec:
|
|||
- name: tcp-metrics
|
||||
port: {{ .Values.metrics.service.port }}
|
||||
targetPort: metrics
|
||||
selector: {{- include "zookeeper.matchLabels" . | nindent 4 }}
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- end }}
|
||||
|
|
|
|||
46
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/networkpolicy.yaml
Executable file → Normal file
46
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/networkpolicy.yaml
Executable file → Normal file
|
|
@ -1,43 +1,41 @@
|
|||
{{- if .Values.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "zookeeper.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels: {{- include "zookeeper.matchLabels" . | nindent 6 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
# Allow inbound connections to zookeeper
|
||||
# Allow inbound connections to ZooKeeper
|
||||
- ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
from:
|
||||
- port: {{ .Values.containerPorts.client }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- port: {{ .Values.metrics.containerPort }}
|
||||
{{- end }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ include "zookeeper.fullname" . }}-client: "true"
|
||||
{{ include "common.names.fullname" . }}-client: "true"
|
||||
- podSelector:
|
||||
matchLabels: {{- include "zookeeper.matchLabels" . | nindent 14 }}
|
||||
{{- else }}
|
||||
- podSelector:
|
||||
matchLabels: {}
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }}
|
||||
{{- end }}
|
||||
# Internal ports
|
||||
- ports: &intranodes_ports
|
||||
- port: {{ .Values.service.followerPort }}
|
||||
- port: {{ .Values.service.electionPort }}
|
||||
# Allow internal communications between nodes
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.follower }}
|
||||
- port: {{ .Values.containerPorts.election }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "zookeeper.matchLabels" . | nindent 14 }}
|
||||
egress:
|
||||
- ports: *intranodes_ports
|
||||
# Allow outbound connections from zookeeper nodes
|
||||
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,26 @@
|
|||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- if and .Values.pdb.create (gt $replicaCount 1) }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.pdb.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.pdb.maxUnavailable }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- end }}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- if gt $replicaCount 1 }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels: {{- include "zookeeper.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- toYaml .Values.podDisruptionBudget | nindent 2 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.rules }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
{{- if .Values.metrics.prometheusRule.namespace }}
|
||||
namespace: {{ .Values.metrics.prometheusRule.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.prometheusRule.additionalLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups:
|
||||
- name: {{ include "common.names.fullname" . }}
|
||||
rules: {{- toYaml .Values.metrics.prometheusRule.rules | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.rules }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ include "zookeeper.fullname" . }}
|
||||
{{- if .Values.metrics.prometheusRule.namespace }}
|
||||
namespace: {{ .Values.metrics.prometheusRule.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- range $key, $value := .Values.metrics.prometheusRule.selector }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups:
|
||||
- name: {{ include "zookeeper.fullname" . }}
|
||||
rules: {{- toYaml .Values.metrics.prometheusRule.rules | nindent 6 }}
|
||||
{{- end }}
|
||||
|
||||
|
|
@ -0,0 +1,102 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-scripts" (include "common.names.fullname" .) }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
init-certs.sh: |-
|
||||
#!/bin/bash
|
||||
|
||||
{{- if .Values.tls.client.enabled }}
|
||||
if [[ -f "/certs/client/tls.key" ]] && [[ -f "/certs/client/tls.crt" ]] && [[ -f "/certs/client/ca.crt" ]]; then
|
||||
if [[ -f "/opt/bitnami/zookeeper/config/certs/client/.initialized" ]]; then
|
||||
exit 0
|
||||
fi
|
||||
openssl pkcs12 -export -in "/certs/client/tls.crt" \
|
||||
-passout pass:"${ZOO_TLS_CLIENT_KEYSTORE_PASSWORD}" \
|
||||
-inkey "/certs/client/tls.key" \
|
||||
-out "/tmp/keystore.p12"
|
||||
keytool -importkeystore -srckeystore "/tmp/keystore.p12" \
|
||||
-srcstoretype PKCS12 \
|
||||
-srcstorepass "${ZOO_TLS_CLIENT_KEYSTORE_PASSWORD}" \
|
||||
-deststorepass "${ZOO_TLS_CLIENT_KEYSTORE_PASSWORD}" \
|
||||
-destkeystore "/opt/bitnami/zookeeper/config/certs/client/zookeeper.keystore.jks"
|
||||
rm "/tmp/keystore.p12"
|
||||
keytool -import -file "/certs/client/ca.crt" \
|
||||
-keystore "/opt/bitnami/zookeeper/config/certs/client/zookeeper.truststore.jks" \
|
||||
-storepass "${ZOO_TLS_CLIENT_TRUSTSTORE_PASSWORD}" \
|
||||
-noprompt
|
||||
touch /opt/bitnami/zookeeper/config/certs/client/.initialized
|
||||
{{- if .Values.tls.client.autoGenerated }}
|
||||
else
|
||||
echo "Couldn't find the expected PEM certificates! They are mandatory when Client encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- else }}
|
||||
elif [[ -f {{ printf "/certs/client/%s" (include "zookeeper.client.tlsTruststoreKey" .) | quote }} ]] && [[ -f {{ printf "/certs/client/%s" (include "zookeeper.client.tlsKeystoreKey" .) | quote }} ]]; then
|
||||
cp {{ printf "/certs/client/%s" (include "zookeeper.client.tlsTruststoreKey" .) | quote }} "/opt/bitnami/zookeeper/config/certs/client/zookeeper.truststore.jks"
|
||||
cp {{ printf "/certs/client/%s" (include "zookeeper.client.tlsKeystoreKey" .) | quote }} "/opt/bitnami/zookeeper/config/certs/client/zookeeper.keystore.jks"
|
||||
else
|
||||
echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when Client encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.quorum.enabled }}
|
||||
if [[ -f "/certs/quorum/tls.key" ]] && [[ -f "/certs/quorum/tls.crt" ]] && [[ -f "/certs/quorum/ca.crt" ]]; then
|
||||
openssl pkcs12 -export -in "/certs/quorum/tls.crt" \
|
||||
-passout pass:"${ZOO_TLS_QUORUM_KEYSTORE_PASSWORD}" \
|
||||
-inkey "/certs/quorum/tls.key" \
|
||||
-out "/tmp/keystore.p12"
|
||||
keytool -importkeystore -srckeystore "/tmp/keystore.p12" \
|
||||
-srcstoretype PKCS12 \
|
||||
-srcstorepass "${ZOO_TLS_QUORUM_KEYSTORE_PASSWORD}" \
|
||||
-deststorepass "${ZOO_TLS_QUORUM_KEYSTORE_PASSWORD}" \
|
||||
-destkeystore "/opt/bitnami/zookeeper/config/certs/quorum/zookeeper.keystore.jks"
|
||||
rm "/tmp/keystore.p12"
|
||||
keytool -import -file "/certs/quorum/ca.crt" \
|
||||
-keystore "/opt/bitnami/zookeeper/config/certs/quorum/zookeeper.truststore.jks" \
|
||||
-storepass "${ZOO_TLS_QUORUM_TRUSTSTORE_PASSWORD}" \
|
||||
-noprompt
|
||||
{{- if .Values.tls.quorum.autoGenerated }}
|
||||
else
|
||||
echo "Couldn't find the expected PEM certificates! They are mandatory when encryption Quorum via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- else }}
|
||||
elif [[ -f {{ printf "/certs/quorum/%s" (include "zookeeper.quorum.tlsTruststoreKey" .) | quote }} ]] && [[ -f {{ printf "/certs/quorum/%s" (include "zookeeper.quorum.tlsKeystoreKey" .) | quote }} ]]; then
|
||||
cp {{ printf "/certs/quorum/%s" (include "zookeeper.quorum.tlsTruststoreKey" .) | quote }} "/opt/bitnami/zookeeper/config/certs/quorum/zookeeper.truststore.jks"
|
||||
cp {{ printf "/certs/quorum/%s" (include "zookeeper.quorum.tlsKeystoreKey" .) | quote }} "/opt/bitnami/zookeeper/config/certs/quorum/zookeeper.keystore.jks"
|
||||
else
|
||||
echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when Quorum encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
setup.sh: |-
|
||||
#!/bin/bash
|
||||
|
||||
# Execute entrypoint as usual after obtaining ZOO_SERVER_ID
|
||||
# check ZOO_SERVER_ID in persistent volume via myid
|
||||
# if not present, set based on POD hostname
|
||||
if [[ -f "/bitnami/zookeeper/data/myid" ]]; then
|
||||
export ZOO_SERVER_ID="$(cat /bitnami/zookeeper/data/myid)"
|
||||
else
|
||||
HOSTNAME="$(hostname -s)"
|
||||
if [[ $HOSTNAME =~ (.*)-([0-9]+)$ ]]; then
|
||||
ORD=${BASH_REMATCH[2]}
|
||||
export ZOO_SERVER_ID="$((ORD + {{ .Values.minServerId }} ))"
|
||||
else
|
||||
echo "Failed to get index from hostname $HOST"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
exec /entrypoint.sh /run.sh
|
||||
75
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/secrets.yaml
Executable file → Normal file
75
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/secrets.yaml
Executable file → Normal file
|
|
@ -1,18 +1,77 @@
|
|||
{{- if and .Values.auth.enabled (not .Values.auth.existingSecret) -}}
|
||||
{{- if (include "zookeeper.client.createSecret" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
name: {{ printf "%s-client-auth" (include "common.names.fullname" .) }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
client-password: {{ include "zookeeper.clientPassword" . | b64enc | quote }}
|
||||
server-password: {{ include "zookeeper.serverPasswords" . | b64enc | quote }}
|
||||
client-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-client-auth" (include "common.names.fullname" .)) "key" "client-password" "providedValues" (list "auth.client.clientPassword") "context" $) }}
|
||||
server-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-client-auth" (include "common.names.fullname" .)) "key" "server-password" "providedValues" (list "auth.client.serverPasswords") "context" $) }}
|
||||
{{- end }}
|
||||
{{- if (include "zookeeper.quorum.createSecret" .) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-quorum-auth" (include "common.names.fullname" .) }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
quorum-learner-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-quorum-auth" (include "common.names.fullname" .)) "key" "quorum-learner-password" "providedValues" (list "auth.quorum.learnerPassword") "context" $) }}
|
||||
quorum-server-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-quorum-auth" (include "common.names.fullname" .)) "key" "quorum-server-password" "providedValues" (list "auth.quorum.serverPasswords") "context" $) }}
|
||||
{{- end }}
|
||||
{{- if (include "zookeeper.client.createTlsPasswordsSecret" .) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}-client-tls-pass
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
keystore-password: {{ default (randAlphaNum 10) .Values.tls.client.keystorePassword | b64enc | quote }}
|
||||
truststore-password: {{ default (randAlphaNum 10) .Values.tls.client.truststorePassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if (include "zookeeper.quorum.createTlsPasswordsSecret" .) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}-quorum-tls-pass
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
keystore-password: {{ default (randAlphaNum 10) .Values.tls.quorum.keystorePassword | b64enc | quote }}
|
||||
truststore-password: {{ default (randAlphaNum 10) .Values.tls.quorum.truststorePassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
|
|
|
|||
18
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/serviceaccount.yaml
Executable file → Normal file
18
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/serviceaccount.yaml
Executable file → Normal file
|
|
@ -3,13 +3,19 @@ apiVersion: v1
|
|||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "zookeeper.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
role: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.serviceAccount.annotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.serviceAccount.annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
|
|
|
|||
35
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/servicemonitor.yaml
Executable file → Normal file
35
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/servicemonitor.yaml
Executable file → Normal file
|
|
@ -2,27 +2,33 @@
|
|||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
{{- if .Values.metrics.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.metrics.serviceMonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- range $key, $value := .Values.metrics.serviceMonitor.selector }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.metrics.serviceMonitor.additionalLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.additionalLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "zookeeper.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: metrics
|
||||
endpoints:
|
||||
- port: tcp-metrics
|
||||
path: "/metrics"
|
||||
|
|
@ -32,7 +38,16 @@ spec:
|
|||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
- {{ template "zookeeper.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
|
|||
468
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/statefulset.yaml
Executable file → Normal file
468
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/statefulset.yaml
Executable file → Normal file
|
|
@ -1,81 +1,100 @@
|
|||
apiVersion: apps/v1
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
role: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceName: {{ template "zookeeper.fullname" . }}-headless
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
||||
updateStrategy:
|
||||
type: {{ .Values.updateStrategy }}
|
||||
{{- if (eq "Recreate" .Values.updateStrategy) }}
|
||||
rollingUpdate: null
|
||||
{{- else if .Values.rollingUpdatePartition }}
|
||||
rollingUpdate:
|
||||
partition: {{ .Values.rollingUpdatePartition }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "zookeeper.matchLabels" . | nindent 6 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
serviceName: {{ printf "%s-%s" (include "common.names.fullname" .) (default "headless" .Values.service.headless.servicenameOverride) | trunc 63 | trimSuffix "-" }}
|
||||
{{- if .Values.updateStrategy }}
|
||||
updateStrategy: {{- toYaml .Values.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- if .Values.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if (include "zookeeper.createConfigmap" .) }}
|
||||
checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if or (include "zookeeper.quorum.createSecret" .) (include "zookeeper.client.createSecret" .) (include "zookeeper.client.createTlsPasswordsSecret" .) (include "zookeeper.quorum.createTlsPasswordsSecret" .) }}
|
||||
checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if or (include "zookeeper.client.createTlsSecret" .) (include "zookeeper.quorum.createTlsSecret" .) }}
|
||||
checksum/tls-secrets: {{ include (print $.Template.BasePath "/tls-secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 8 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.podLabels }}
|
||||
{{- include "zookeeper.tplValue" (dict "value" .Values.podLabels "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.podLabels "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.podAnnotations }}
|
||||
annotations: {{- include "zookeeper.tplValue" ( dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
{{- include "zookeeper.imagePullSecrets" . | nindent 6 }}
|
||||
serviceAccountName: {{ template "zookeeper.serviceAccountName" . }}
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
{{- include "zookeeper.imagePullSecrets" . | nindent 6 }}
|
||||
{{- if .Values.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity: {{- include "zookeeper.tplValue" (dict "value" .Values.affinity "context" $) | nindent 8 }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "component" "zookeeper" "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "component" "zookeeper" "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector: {{- include "zookeeper.tplValue" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations: {{- include "zookeeper.tplValue" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
|
||||
- name: volume-permissions
|
||||
image: {{ template "zookeeper.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- chown
|
||||
- /bin/bash
|
||||
args:
|
||||
- -R
|
||||
- {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}
|
||||
- /bitnami/zookeeper
|
||||
{{- if .Values.dataLogDir }}
|
||||
- {{ .Values.dataLogDir }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
- -ec
|
||||
- |
|
||||
mkdir -p /bitnami/zookeeper
|
||||
chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} /bitnami/zookeeper
|
||||
find /bitnami/zookeeper -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}
|
||||
{{- if .Values.dataLogDir }}
|
||||
mkdir -p {{ .Values.dataLogDir }}
|
||||
chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ .Values.dataLogDir }}
|
||||
find {{ .Values.dataLogDir }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
|
|
@ -86,43 +105,106 @@ spec:
|
|||
- name: data-log
|
||||
mountPath: {{ .Values.dataLogDir }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.client.enabled .Values.tls.quorum.enabled }}
|
||||
- name: init-certs
|
||||
image: {{ include "zookeeper.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /scripts/init-certs.sh
|
||||
env:
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
{{- if or .Values.tls.client.passwordsSecretName (include "zookeeper.client.createTlsPasswordsSecret" .) }}
|
||||
- name: ZOO_TLS_CLIENT_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.client.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.client.tlsPasswordKeystoreKey" . }}
|
||||
- name: ZOO_TLS_CLIENT_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.client.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.client.tlsPasswordTruststoreKey" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.quorum.passwordsSecretName (include "zookeeper.quorum.createTlsPasswordsSecret" .) }}
|
||||
- name: ZOO_TLS_QUORUM_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.quorum.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.quorum.tlsPasswordKeystoreKey" . }}
|
||||
- name: ZOO_TLS_QUORUM_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.quorum.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.quorum.tlsPasswordTruststoreKey" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.resources }}
|
||||
resources: {{- toYaml .Values.tls.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts/init-certs.sh
|
||||
subPath: init-certs.sh
|
||||
{{- if or .Values.tls.client.enabled }}
|
||||
- name: client-certificates
|
||||
mountPath: /certs/client
|
||||
- name: client-shared-certs
|
||||
mountPath: /opt/bitnami/zookeeper/config/certs/client
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.quorum.enabled }}
|
||||
- name: quorum-certificates
|
||||
mountPath: /certs/quorum
|
||||
- name: quorum-shared-certs
|
||||
mountPath: /opt/bitnami/zookeeper/config/certs/quorum
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: zookeeper
|
||||
image: {{ template "zookeeper.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.securityContext.enabled }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
{{- if .Values.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- |
|
||||
# Execute entrypoint as usual after obtaining ZOO_SERVER_ID based on POD hostname
|
||||
HOSTNAME=`hostname -s`
|
||||
if [[ $HOSTNAME =~ (.*)-([0-9]+)$ ]]; then
|
||||
ORD=${BASH_REMATCH[2]}
|
||||
export ZOO_SERVER_ID=$((ORD+1))
|
||||
else
|
||||
echo "Failed to get index from hostname $HOST"
|
||||
exit 1
|
||||
fi
|
||||
exec /entrypoint.sh /run.sh
|
||||
{{- if .Values.resources }}
|
||||
resources: {{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: ZOO_DATA_LOG_DIR
|
||||
value: {{ .Values.dataLogDir | quote }}
|
||||
- name: ZOO_PORT_NUMBER
|
||||
value: {{ .Values.service.port | quote }}
|
||||
value: {{ .Values.containerPorts.client | quote }}
|
||||
- name: ZOO_TICK_TIME
|
||||
value: {{ .Values.tickTime | quote }}
|
||||
- name: ZOO_INIT_LIMIT
|
||||
value: {{ .Values.initLimit | quote }}
|
||||
- name: ZOO_SYNC_LIMIT
|
||||
value: {{ .Values.syncLimit | quote }}
|
||||
- name: ZOO_PRE_ALLOC_SIZE
|
||||
value: {{ .Values.preAllocSize | quote }}
|
||||
- name: ZOO_SNAPCOUNT
|
||||
value: {{ .Values.snapCount | quote }}
|
||||
- name: ZOO_MAX_CLIENT_CNXNS
|
||||
value: {{ .Values.maxClientCnxns | quote }}
|
||||
- name: ZOO_4LW_COMMANDS_WHITELIST
|
||||
|
|
@ -137,37 +219,56 @@ spec:
|
|||
value: {{ .Values.maxSessionTimeout | quote }}
|
||||
- name: ZOO_SERVERS
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- $followerPort := int .Values.service.followerPort }}
|
||||
{{- $electionPort := int .Values.service.electionPort }}
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $zookeeperFullname := include "zookeeper.fullname" . }}
|
||||
{{- $minServerId := int .Values.minServerId }}
|
||||
{{- $followerPort := int .Values.containerPorts.follower }}
|
||||
{{- $electionPort := int .Values.containerPorts.election }}
|
||||
{{- $releaseNamespace := include "zookeeper.namespace" . }}
|
||||
{{- $zookeeperFullname := include "common.names.fullname" . }}
|
||||
{{- $zookeeperHeadlessServiceName := printf "%s-%s" $zookeeperFullname "headless" | trunc 63 }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
value: {{ range $i, $e := until $replicaCount }}{{ $zookeeperFullname }}-{{ $e }}.{{ $zookeeperHeadlessServiceName }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $followerPort }}:{{ $electionPort }} {{ end }}
|
||||
value: {{ range $i, $e := until $replicaCount }}{{ $zookeeperFullname }}-{{ $e }}.{{ $zookeeperHeadlessServiceName }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $followerPort }}:{{ $electionPort }}::{{ add $e $minServerId }} {{ end }}
|
||||
- name: ZOO_ENABLE_AUTH
|
||||
value: {{ ternary "yes" "no" .Values.auth.enabled | quote }}
|
||||
{{- if .Values.auth.enabled }}
|
||||
value: {{ ternary "yes" "no" .Values.auth.client.enabled | quote }}
|
||||
{{- if .Values.auth.client.enabled }}
|
||||
- name: ZOO_CLIENT_USER
|
||||
value: {{ .Values.auth.clientUser | quote }}
|
||||
value: {{ .Values.auth.client.clientUser | quote }}
|
||||
- name: ZOO_CLIENT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ if .Values.auth.existingSecret }}{{ .Values.auth.existingSecret }}{{ else }}{{ template "zookeeper.fullname" . }}{{ end }}
|
||||
name: {{ include "zookeeper.client.secretName" . }}
|
||||
key: client-password
|
||||
- name: ZOO_SERVER_USERS
|
||||
value: {{ .Values.auth.serverUsers | quote }}
|
||||
value: {{ .Values.auth.client.serverUsers | quote }}
|
||||
- name: ZOO_SERVER_PASSWORDS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ if .Values.auth.existingSecret }}{{ .Values.auth.existingSecret }}{{ else }}{{ template "zookeeper.fullname" . }}{{ end }}
|
||||
name: {{ include "zookeeper.client.secretName" . }}
|
||||
key: server-password
|
||||
{{- end }}
|
||||
- name: ZOO_ENABLE_QUORUM_AUTH
|
||||
value: {{ ternary "yes" "no" .Values.auth.quorum.enabled | quote }}
|
||||
{{- if .Values.auth.quorum.enabled }}
|
||||
- name: ZOO_QUORUM_LEARNER_USER
|
||||
value: {{ .Values.auth.quorum.learnerUser | quote }}
|
||||
- name: ZOO_QUORUM_LEARNER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.quorum.secretName" . }}
|
||||
key: quorum-learner-password
|
||||
- name: ZOO_QUORUM_SERVER_USERS
|
||||
value: {{ .Values.auth.quorum.serverUsers | quote }}
|
||||
- name: ZOO_QUORUM_SERVER_PASSWORDS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.quorum.secretName" . }}
|
||||
key: quorum-server-password
|
||||
{{- end }}
|
||||
- name: ZOO_HEAP_SIZE
|
||||
value: {{ .Values.heapSize | quote }}
|
||||
- name: ZOO_LOG_LEVEL
|
||||
value: {{ .Values.logLevel | quote }}
|
||||
- name: ALLOW_ANONYMOUS_LOGIN
|
||||
value: {{ ternary "yes" "no" .Values.allowAnonymousLogin | quote }}
|
||||
value: {{ ternary "no" "yes" .Values.auth.client.enabled | quote }}
|
||||
{{- if .Values.jvmFlags }}
|
||||
- name: JVMFLAGS
|
||||
value: {{ .Values.jvmFlags | quote }}
|
||||
|
|
@ -178,103 +279,174 @@ spec:
|
|||
- name: ZOO_PROMETHEUS_METRICS_PORT_NUMBER
|
||||
value: {{ .Values.metrics.containerPort | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.tls.client_enable }}
|
||||
{{- if .Values.tls.client.enabled }}
|
||||
- name: ZOO_TLS_PORT_NUMBER
|
||||
value: {{ .Values.containerPorts.tls | quote }}
|
||||
- name: ZOO_TLS_CLIENT_ENABLE
|
||||
value: {{ .Values.service.tls.client_enable | quote }}
|
||||
value: {{ .Values.tls.client.enabled | quote }}
|
||||
- name: ZOO_TLS_CLIENT_AUTH
|
||||
value: {{ .Values.tls.client.auth | quote }}
|
||||
- name: ZOO_TLS_CLIENT_KEYSTORE_FILE
|
||||
value: {{ .Values.service.tls.client_keystore_path | quote }}
|
||||
- name: ZOO_TLS_CLIENT_KEYSTORE_PASSWORD
|
||||
value: {{ .Values.service.tls.client_keystore_password | quote }}
|
||||
value: {{ .Values.tls.client.keystorePath | quote }}
|
||||
- name: ZOO_TLS_CLIENT_TRUSTSTORE_FILE
|
||||
value: {{ .Values.service.tls.client_truststore_path | quote }}
|
||||
value: {{ .Values.tls.client.truststorePath | quote }}
|
||||
{{- if or .Values.tls.client.keystorePassword .Values.tls.client.passwordsSecretName .Values.tls.client.autoGenerated }}
|
||||
- name: ZOO_TLS_CLIENT_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.client.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.client.tlsPasswordKeystoreKey" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.client.truststorePassword .Values.tls.client.passwordsSecretName .Values.tls.client.autoGenerated }}
|
||||
- name: ZOO_TLS_CLIENT_TRUSTSTORE_PASSWORD
|
||||
value: {{ .Values.service.tls.client_truststore_password | quote }}
|
||||
{{ end }}
|
||||
{{- if .Values.service.tls.quorum_enable }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.client.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.client.tlsPasswordTruststoreKey" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.quorum.enabled }}
|
||||
- name: ZOO_TLS_QUORUM_ENABLE
|
||||
value: {{ .Values.service.tls.quorum_enable | quote }}
|
||||
value: {{ .Values.tls.quorum.enabled | quote }}
|
||||
- name: ZOO_TLS_QUORUM_CLIENT_AUTH
|
||||
value: {{ .Values.tls.quorum.auth | quote }}
|
||||
- name: ZOO_TLS_QUORUM_KEYSTORE_FILE
|
||||
value: {{ .Values.service.tls.quorum_keystore_path | quote }}
|
||||
- name: ZOO_TLS_QUORUM_KEYSTORE_PASSWORD
|
||||
value: {{ .Values.service.tls.quorum_keystore_password | quote }}
|
||||
value: {{ .Values.tls.quorum.keystorePath | quote }}
|
||||
- name: ZOO_TLS_QUORUM_TRUSTSTORE_FILE
|
||||
value: {{ .Values.service.tls.quorum_truststore_path | quote }}
|
||||
value: {{ .Values.tls.quorum.truststorePath | quote }}
|
||||
{{- if or .Values.tls.quorum.keystorePassword .Values.tls.quorum.passwordsSecretName .Values.tls.quorum.autoGenerated }}
|
||||
- name: ZOO_TLS_QUORUM_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.quorum.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.quorum.tlsPasswordKeystoreKey" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.tls.quorum.truststorePassword .Values.tls.quorum.passwordsSecretName .Values.tls.quorum.autoGenerated }}
|
||||
- name: ZOO_TLS_QUORUM_TRUSTSTORE_PASSWORD
|
||||
value: {{ .Values.service.tls.quorum_truststore_password | quote }}
|
||||
{{ end }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "zookeeper.quorum.tlsPasswordsSecret" . }}
|
||||
key: {{ include "zookeeper.quorum.tlsPasswordTruststoreKey" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
{{- if .Values.extraEnvVars }}
|
||||
{{- toYaml .Values.extraEnvVars | nindent 12 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{ if not .Values.service.tls.disable_base_client_port }}
|
||||
{{- if not .Values.service.disableBaseClientPort }}
|
||||
- name: client
|
||||
containerPort: {{ .Values.service.port }}
|
||||
{{ end }}
|
||||
{{ if .Values.service.tls.client_enable }}
|
||||
containerPort: {{ .Values.containerPorts.client }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.client.enabled }}
|
||||
- name: client-tls
|
||||
containerPort: {{ .Values.service.tls.client_port }}
|
||||
{{ end }}
|
||||
containerPort: {{ .Values.containerPorts.tls }}
|
||||
{{- end }}
|
||||
- name: follower
|
||||
containerPort: {{ .Values.service.followerPort }}
|
||||
containerPort: {{ .Values.containerPorts.follower }}
|
||||
- name: election
|
||||
containerPort: {{ .Values.service.electionPort }}
|
||||
containerPort: {{ .Values.containerPorts.election }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.containerPort }}
|
||||
{{- end }}
|
||||
{{- if .Values.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.livenessProbe "enabled" "probeCommandTimeout") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
{{- if not .Values.service.tls.disable_base_client_port }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.livenessProbe.probeCommandTimeout }} nc -w {{ .Values.livenessProbe.probeCommandTimeout }} localhost {{ .Values.service.port }} | grep imok']
|
||||
{{- if not .Values.service.disableBaseClientPort }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.livenessProbe.probeCommandTimeout }} nc -w {{ .Values.livenessProbe.probeCommandTimeout }} localhost {{ .Values.containerPorts.client }} | grep imok']
|
||||
{{- else if not .Values.tls.client.enabled }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.livenessProbe.probeCommandTimeout }} openssl s_client -quiet -crlf -connect localhost:{{ .Values.containerPorts.tls }} | grep imok']
|
||||
{{- else }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.livenessProbe.probeCommandTimeout }} openssl s_client -quiet -crlf -connect localhost:{{ .Values.service.tls.client_port }} | grep imok']
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.livenessProbe.probeCommandTimeout }} openssl s_client -quiet -crlf -connect localhost:{{ .Values.containerPorts.tls }} -cert {{ .Values.service.tls.client_cert_pem_path }} -key {{ .Values.service.tls.client_key_pem_path }} | grep imok']
|
||||
{{- end }}
|
||||
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
{{- if .Values.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readinessProbe "enabled" "probeCommandTimeout") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
{{- if not .Values.service.tls.disable_base_client_port }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.readinessProbe.probeCommandTimeout }} nc -w {{ .Values.readinessProbe.probeCommandTimeout }} localhost {{ .Values.service.port }} | grep imok']
|
||||
{{- if not .Values.service.disableBaseClientPort }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.readinessProbe.probeCommandTimeout }} nc -w {{ .Values.readinessProbe.probeCommandTimeout }} localhost {{ .Values.containerPorts.client }} | grep imok']
|
||||
{{- else if not .Values.tls.client.enabled }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.readinessProbe.probeCommandTimeout }} openssl s_client -quiet -crlf -connect localhost:{{ .Values.containerPorts.tls }} | grep imok']
|
||||
{{- else }}
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.readinessProbe.probeCommandTimeout }} openssl s_client -quiet -crlf -connect localhost:{{ .Values.service.tls.client_port }} | grep imok']
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout {{ .Values.readinessProbe.probeCommandTimeout }} openssl s_client -quiet -crlf -connect localhost:{{ .Values.containerPorts.tls }} -cert {{ .Values.service.tls.client_cert_pem_path }} -key {{ .Values.service.tls.client_key_pem_path }} | grep imok']
|
||||
{{- end }}
|
||||
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
{{- if not .Values.service.disableBaseClientPort }}
|
||||
port: client
|
||||
{{- else }}
|
||||
port: follower
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts/setup.sh
|
||||
subPath: setup.sh
|
||||
- name: data
|
||||
mountPath: /bitnami/zookeeper
|
||||
{{- if .Values.dataLogDir }}
|
||||
- name: data-log
|
||||
mountPath: {{ .Values.dataLogDir }}
|
||||
{{- end }}
|
||||
{{- if .Values.config }}
|
||||
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||
- name: config
|
||||
mountPath: /opt/bitnami/zookeeper/conf/zoo.cfg
|
||||
subPath: zoo.cfg
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- if .Values.tls.client.enabled }}
|
||||
- name: client-shared-certs
|
||||
mountPath: /opt/bitnami/zookeeper/config/certs/client
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.tls.quorum.enabled }}
|
||||
- name: quorum-shared-certs
|
||||
mountPath: /opt/bitnami/zookeeper/config/certs/quorum
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.extraVolumeMounts "context" $ ) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.config }}
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: {{ printf "%s-scripts" (include "common.names.fullname" .) }}
|
||||
defaultMode: 0755
|
||||
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
name: {{ include "zookeeper.configmapName" . }}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
- name: data
|
||||
|
|
@ -292,17 +464,35 @@ spec:
|
|||
- name: data-log
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- if .Values.tls.client.enabled }}
|
||||
- name: client-certificates
|
||||
secret:
|
||||
secretName: {{ include "zookeeper.client.tlsSecretName" . }}
|
||||
defaultMode: 256
|
||||
- name: client-shared-certs
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled (not (and .Values.persistence.existingClaim .Values.persistence.dataLogDir.existingClaim) )}}
|
||||
{{- if .Values.tls.quorum.enabled }}
|
||||
- name: quorum-certificates
|
||||
secret:
|
||||
secretName: {{ include "zookeeper.quorum.tlsSecretName" . }}
|
||||
defaultMode: 256
|
||||
- name: quorum-shared-certs
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled (not (and .Values.persistence.existingClaim .Values.persistence.dataLogDir.existingClaim) ) }}
|
||||
volumeClaimTemplates:
|
||||
{{- if not .Values.persistence.existingClaim }}
|
||||
{{- if not .Values.persistence.existingClaim }}
|
||||
- metadata:
|
||||
name: data
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.persistence.annotations }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
|
|
@ -312,14 +502,19 @@ spec:
|
|||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- include "zookeeper.storageClass" . | nindent 8 }}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- if .Values.persistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.persistence.dataLogDir.existingClaim) .Values.dataLogDir }}
|
||||
- metadata:
|
||||
name: data-log
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.persistence.annotations }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
|
|
@ -329,6 +524,9 @@ spec:
|
|||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.dataLogDir.size | quote }}
|
||||
{{- include "zookeeper.storageClass" . | nindent 8 }}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- if .Values.persistence.dataLogDir.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.dataLogDir.selector "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
36
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/svc-headless.yaml
Executable file → Normal file
36
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/svc-headless.yaml
Executable file → Normal file
|
|
@ -1,42 +1,42 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}-headless
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
name: {{ printf "%s-%s" (include "common.names.fullname" .) (default "headless" .Values.service.headless.servicenameOverride) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.commonAnnotations .Values.service.annotations }}
|
||||
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||
annotations:
|
||||
{{- if .Values.service.headless.annotations }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.service.headless.annotations "context" $ ) | nindent 4 }}\
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.service.headless.annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: {{ .Values.service.publishNotReadyAddresses }}
|
||||
publishNotReadyAddresses: {{ .Values.service.headless.publishNotReadyAddresses }}
|
||||
ports:
|
||||
{{ if not .Values.service.tls.disable_base_client_port }}
|
||||
{{- if not .Values.service.disableBaseClientPort }}
|
||||
- name: tcp-client
|
||||
port: 2181
|
||||
port: {{ .Values.service.ports.client }}
|
||||
targetPort: client
|
||||
{{ end }}
|
||||
{{ if .Values.service.tls.client_enable }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.client.enabled }}
|
||||
- name: tcp-client-tls
|
||||
port: {{ .Values.service.tls.client_port }}
|
||||
port: {{ .Values.service.ports.tls }}
|
||||
targetPort: client-tls
|
||||
{{ end }}
|
||||
- name: follower
|
||||
port: 2888
|
||||
{{- end }}
|
||||
- name: tcp-follower
|
||||
port: {{ .Values.service.ports.follower }}
|
||||
targetPort: follower
|
||||
- name: tcp-election
|
||||
port: 3888
|
||||
port: {{ .Values.service.ports.election }}
|
||||
targetPort: election
|
||||
selector: {{- include "zookeeper.matchLabels" . | nindent 4 }}
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
|
|
|
|||
63
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/svc.yaml
Executable file → Normal file
63
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/templates/svc.yaml
Executable file → Normal file
|
|
@ -1,40 +1,71 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "zookeeper.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "zookeeper.labels" . | nindent 4 }}
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.commonAnnotations .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- if .Values.service.annotations }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.service.annotations "context" $ ) | nindent 4 }}\
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.service.annotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "zookeeper.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.service.clusterIP }}
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
|
||||
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerSourceRanges)) }}
|
||||
loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{ if not .Values.service.tls.disable_base_client_port }}
|
||||
{{- if not .Values.service.disableBaseClientPort }}
|
||||
- name: tcp-client
|
||||
port: 2181
|
||||
port: {{ .Values.service.ports.client }}
|
||||
targetPort: client
|
||||
{{ end }}
|
||||
{{ if .Values.service.tls.client_enable }}
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.client)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.client }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.client.enabled }}
|
||||
- name: tcp-client-tls
|
||||
port: {{ .Values.service.tls.client_port }}
|
||||
port: {{ .Values.service.ports.tls }}
|
||||
targetPort: client-tls
|
||||
{{ end }}
|
||||
- name: follower
|
||||
port: 2888
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.tls)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.tls }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: tcp-follower
|
||||
port: {{ .Values.service.ports.follower }}
|
||||
targetPort: follower
|
||||
- name: tcp-election
|
||||
port: 3888
|
||||
port: {{ .Values.service.ports.election }}
|
||||
targetPort: election
|
||||
selector: {{- include "zookeeper.matchLabels" . | nindent 4 }}
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: zookeeper
|
||||
|
|
|
|||
|
|
@ -0,0 +1,55 @@
|
|||
{{- if (include "zookeeper.client.createTlsSecret" .) }}
|
||||
{{- $ca := genCA "zookeeper-client-ca" 365 }}
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $serviceName := include "common.names.fullname" . }}
|
||||
{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }}
|
||||
{{- $altNames := list (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) "127.0.0.1" "localhost" $fullname }}
|
||||
{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}-client-crt
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ $ca.Cert | b64enc | quote }}
|
||||
tls.crt: {{ $crt.Cert | b64enc | quote }}
|
||||
tls.key: {{ $crt.Key | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if (include "zookeeper.quorum.createTlsSecret" .) }}
|
||||
{{- $ca := genCA "zookeeper-quorum-ca" 365 }}
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $serviceName := include "common.names.fullname" . }}
|
||||
{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }}
|
||||
{{- $altNames := list (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname }}
|
||||
{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}-quorum-crt
|
||||
namespace: {{ template "zookeeper.namespace" . }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ $ca.Cert | b64enc | quote }}
|
||||
tls.crt: {{ $crt.Cert | b64enc | quote }}
|
||||
tls.key: {{ $crt.Key | b64enc | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -1,430 +0,0 @@
|
|||
## Global Docker image parameters
|
||||
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
|
||||
## Current available global Docker image parameters: imageRegistry and imagePullSecrets
|
||||
##
|
||||
# global:
|
||||
# imageRegistry: myRegistryName
|
||||
# imagePullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
# storageClass: myStorageClass
|
||||
|
||||
## Bitnami Zookeeper image version
|
||||
## ref: https://hub.docker.com/r/bitnami/zookeeper/tags/
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/zookeeper
|
||||
tag: 3.6.2-debian-10-r10
|
||||
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
## Set to true if you would like to see extra information on logs
|
||||
## It turns BASH and NAMI debugging in minideb
|
||||
## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
|
||||
##
|
||||
debug: false
|
||||
|
||||
## String to partially override zookeeper.fullname template (will maintain the release name)
|
||||
# nameOverride:
|
||||
|
||||
## String to fully override zookeeper.fullname template
|
||||
# fullnameOverride:
|
||||
|
||||
## Kubernetes Cluster Domain
|
||||
##
|
||||
clusterDomain: cluster.local
|
||||
|
||||
## Add labels to all the deployed resources
|
||||
##
|
||||
commonLabels: {}
|
||||
|
||||
## Add annotations to all the deployed resources
|
||||
##
|
||||
commonAnnotations: {}
|
||||
|
||||
## Init containers parameters:
|
||||
## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.
|
||||
##
|
||||
volumePermissions:
|
||||
enabled: false
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/minideb
|
||||
tag: buster
|
||||
pullPolicy: Always
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
resources: {}
|
||||
|
||||
## extraVolumes and extraVolumeMounts allows you to mount other volumes
|
||||
## Example Use Cases:
|
||||
## mount certificates to enable tls
|
||||
# extraVolumes:
|
||||
# - name: zookeeper-keystore
|
||||
# secret:
|
||||
# defaultMode: 288
|
||||
# secretName: zookeeper-keystore
|
||||
# - name: zookeeper-trustsore
|
||||
# secret:
|
||||
# defaultMode: 288
|
||||
# secretName: zookeeper-truststore
|
||||
# extraVolumeMounts:
|
||||
# - name: zookeeper-keystore
|
||||
# mountPath: /certs/keystore
|
||||
# readOnly: true
|
||||
# - name: zookeeper-truststore
|
||||
# mountPath: /certs/truststore
|
||||
# readOnly: true
|
||||
|
||||
|
||||
## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete
|
||||
## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets
|
||||
##
|
||||
updateStrategy: RollingUpdate
|
||||
|
||||
## Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions
|
||||
## The PDB will only be created if replicaCount is greater than 1
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions
|
||||
##
|
||||
podDisruptionBudget:
|
||||
maxUnavailable: 1
|
||||
|
||||
## Partition update strategy
|
||||
## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions
|
||||
##
|
||||
# rollingUpdatePartition:
|
||||
|
||||
## StatefulSet controller supports relax its ordering guarantees while preserving its uniqueness and identity guarantees. There are two valid pod management policies: OrderedReady and Parallel
|
||||
## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy
|
||||
##
|
||||
podManagementPolicy: Parallel
|
||||
|
||||
## Number of ZooKeeper nodes
|
||||
##
|
||||
replicaCount: 3
|
||||
|
||||
## Basic time unit in milliseconds used by ZooKeeper for heartbeats
|
||||
##
|
||||
tickTime: 2000
|
||||
|
||||
## ZooKeeper uses to limit the length of time the ZooKeeper servers in quorum have to connect to a leader
|
||||
##
|
||||
initLimit: 10
|
||||
|
||||
## How far out of date a server can be from a leader
|
||||
##
|
||||
syncLimit: 5
|
||||
|
||||
## Limits the number of concurrent connections that a single client may make to a single member of the ZooKeeper ensemble
|
||||
##
|
||||
maxClientCnxns: 60
|
||||
|
||||
## Maximum session timeout in milliseconds that the server will allow the client to negotiate. Defaults to 20 times the tickTime.
|
||||
##
|
||||
maxSessionTimeout: 40000
|
||||
|
||||
## A list of comma separated Four Letter Words commands to use
|
||||
##
|
||||
fourlwCommandsWhitelist: srvr, mntr, ruok
|
||||
|
||||
## Allow zookeeper to listen for peers on all IPs
|
||||
##
|
||||
listenOnAllIPs: false
|
||||
|
||||
## Allow to accept connections from unauthenticated users
|
||||
##
|
||||
allowAnonymousLogin: true
|
||||
|
||||
autopurge:
|
||||
## Retains the snapRetainCount most recent snapshots and the corresponding transaction logs and deletes the rest
|
||||
##
|
||||
snapRetainCount: 3
|
||||
## The time interval in hours for which the purge task has to be triggered. Set to a positive integer (1 and above) to enable the auto purging.
|
||||
##
|
||||
purgeInterval: 0
|
||||
|
||||
auth:
|
||||
## Use existing secret (ignores previous password)
|
||||
##
|
||||
# existingSecret:
|
||||
## Enable Zookeeper auth. It uses SASL/Digest-MD5
|
||||
##
|
||||
enabled: false
|
||||
## User that will use Zookeeper clients to auth
|
||||
##
|
||||
clientUser:
|
||||
## Password that will use Zookeeper clients to auth
|
||||
##
|
||||
clientPassword:
|
||||
## Comma, semicolon or whitespace separated list of user to be created. Specify them as a string, for example: "user1,user2,admin"
|
||||
##
|
||||
serverUsers:
|
||||
## Comma, semicolon or whitespace separated list of passwords to assign to users when created. Specify them as a string, for example: "pass4user1, pass4user2, pass4admin"
|
||||
##
|
||||
serverPasswords:
|
||||
|
||||
## Size in MB for the Java Heap options (Xmx and XMs). This env var is ignored if Xmx an Xms are configured via JVMFLAGS
|
||||
##
|
||||
heapSize: 1024
|
||||
|
||||
## Log level for the Zookeeper server. ERROR by default. Have in mind if you set it to INFO or WARN the ReadinessProve will produce a lot of logs.
|
||||
##
|
||||
logLevel: ERROR
|
||||
|
||||
## Data log directory. Specifying this option will direct zookeeper to write the transaction log to the dataLogDir rather than the dataDir.
|
||||
## This allows a dedicated log device to be used, and helps avoid competition between logging and snaphots.
|
||||
## Example:
|
||||
## dataLogDir: /bitnami/zookeeper/dataLog
|
||||
##
|
||||
dataLogDir: ""
|
||||
|
||||
## Default JVMFLAGS for the ZooKeeper process
|
||||
##
|
||||
# jvmFlags:
|
||||
|
||||
## Configure ZooKeeper with a custom zoo.cfg file
|
||||
##
|
||||
# config:
|
||||
|
||||
## Kubernetes configuration
|
||||
## For minikube, set this to NodePort, elsewhere use LoadBalancer
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 2181
|
||||
followerPort: 2888
|
||||
electionPort: 3888
|
||||
publishNotReadyAddresses: true
|
||||
tls:
|
||||
client_enable: true
|
||||
quorum_enable: true
|
||||
disable_base_client_port: true
|
||||
|
||||
client_port: 3181
|
||||
|
||||
client_keystore_path: /tls_key_store/key_store_file
|
||||
client_keystore_password: ""
|
||||
client_truststore_path: /tls_trust_store/trust_store_file
|
||||
client_truststore_password: ""
|
||||
|
||||
quorum_keystore_path: /tls_key_store/key_store_file
|
||||
quorum_keystore_password: ""
|
||||
quorum_truststore_path: /tls_trust_store/trust_store_file
|
||||
quorum_truststore_password: ""
|
||||
annotations: {}
|
||||
headless:
|
||||
annotations: {}
|
||||
|
||||
## Service account for Zookeeper to use.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
##
|
||||
serviceAccount:
|
||||
## Specifies whether a ServiceAccount should be created
|
||||
##
|
||||
create: false
|
||||
## The name of the ServiceAccount to use.
|
||||
## If not set and create is true, a name is generated using the zookeeper.fullname template
|
||||
# name:
|
||||
|
||||
## Zookeeper Pod Security Context
|
||||
securityContext:
|
||||
enabled: true
|
||||
fsGroup: 1001
|
||||
runAsUser: 1001
|
||||
|
||||
## Zookeeper data Persistent Volume Storage Class
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
persistence:
|
||||
enabled: true
|
||||
## A manually managed Persistent Volume and Claim
|
||||
## If defined, PVC must be created manually before volume will be bound
|
||||
## The value is evaluated as a template
|
||||
##
|
||||
# existingClaim:
|
||||
|
||||
# storageClass: "-"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 8Gi
|
||||
annotations: {}
|
||||
dataLogDir:
|
||||
size: 8Gi
|
||||
## A manually managed Persistent Volume and Claim
|
||||
## If defined, PVC must be created manually before volume will be bound
|
||||
## The value is evaluated as a template
|
||||
##
|
||||
# existingClaim:
|
||||
|
||||
## Node labels for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector: {}
|
||||
|
||||
## Tolerations for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
##
|
||||
tolerations: []
|
||||
|
||||
## Labels
|
||||
## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
podLabels: {}
|
||||
|
||||
## Annotations
|
||||
## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
podAnnotations: {}
|
||||
|
||||
## Name of the priority class to be used by zookeeper pods, priority class needs to be created beforehand
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
||||
priorityClassName: ""
|
||||
|
||||
## Affinity for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
##
|
||||
affinity: {}
|
||||
|
||||
## Scheduler name
|
||||
## https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
# schedulerName: stork
|
||||
|
||||
## Configure resource requests and limits
|
||||
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
|
||||
##
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
|
||||
## Configure extra options for liveness and readiness probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
probeCommandTimeout: 2
|
||||
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
probeCommandTimeout: 2
|
||||
|
||||
## Network policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## client label will have network access to the port Redis is listening
|
||||
## on. When true, zookeeper accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
|
||||
## Zookeeper Prometheus Exporter configuration
|
||||
##
|
||||
metrics:
|
||||
enabled: false
|
||||
|
||||
## Zookeeper Prometheus Exporter container port
|
||||
##
|
||||
containerPort: 9141
|
||||
|
||||
## Service configuration
|
||||
##
|
||||
service:
|
||||
## Zookeeper Prometheus Exporter service type
|
||||
##
|
||||
type: ClusterIP
|
||||
## Zookeeper Prometheus Exporter service port
|
||||
##
|
||||
port: 9141
|
||||
## Annotations for the Zookeeper Prometheus Exporter metrics service
|
||||
##
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "{{ .Values.metrics.service.port }}"
|
||||
prometheus.io/path: "/metrics"
|
||||
|
||||
## Prometheus Operator ServiceMonitor configuration
|
||||
##
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
## Namespace for the ServiceMonitor Resource (defaults to the Release Namespace)
|
||||
##
|
||||
namespace:
|
||||
|
||||
## Interval at which metrics should be scraped.
|
||||
## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint
|
||||
##
|
||||
# interval: 10s
|
||||
|
||||
## Timeout after which the scrape is ended
|
||||
## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint
|
||||
##
|
||||
# scrapeTimeout: 10s
|
||||
|
||||
## ServiceMonitor selector labels
|
||||
## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration
|
||||
##
|
||||
# selector:
|
||||
# prometheus: my-prometheus
|
||||
|
||||
## Prometheus Operator PrometheusRule configuration
|
||||
##
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
## Namespace for the PrometheusRule Resource (defaults to the Release Namespace)
|
||||
##
|
||||
namespace:
|
||||
|
||||
## PrometheusRule selector labels
|
||||
## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration
|
||||
##
|
||||
# selector:
|
||||
# prometheus: my-prometheus
|
||||
|
||||
## Some example rules.
|
||||
rules: []
|
||||
# - alert: ZookeeperSyncedFollowers
|
||||
# annotations:
|
||||
# message: The number of synced followers for the leader node in Zookeeper deployment my-release is less than 2. This usually means that some of the Zookeeper nodes aren't communicating properly. If it doesn't resolve itself you can try killing the pods (one by one).
|
||||
# expr: max(synced_followers{service="my-release-metrics"}) < 2
|
||||
# for: 5m
|
||||
# labels:
|
||||
# severity: critical
|
||||
# - alert: ZookeeperOutstandingRequests
|
||||
# annotations:
|
||||
# message: The number of outstanding requests for Zookeeper pod {{ $labels.pod }} is greater than 10. This can indicate a performance issue with the Pod or cluster a whole.
|
||||
# expr: outstanding_requests{service="my-release-metrics"} > 10
|
||||
# for: 5m
|
||||
# labels:
|
||||
# severity: critical
|
||||
1089
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/values.yaml
Executable file → Normal file
1089
scripts/helmcharts/databases/charts/kafka/charts/zookeeper/values.yaml
Executable file → Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -1,10 +0,0 @@
|
|||
# Java Key Stores
|
||||
|
||||
You can copy here your Java Key Stores (JKS) files so a secret is created including them. Remember to use a truststore (`kafka.truststore.jks`) and one keystore (`kafka.keystore.jks`) per Kafka broker you have in the cluster. For instance, if you have 3 brokers you need to copy here the following files:
|
||||
|
||||
- kafka.truststore.jks
|
||||
- kafka-0.keystore.jks
|
||||
- kafka-1.keystore.jks
|
||||
- kafka-2.keystore.jks
|
||||
|
||||
Find more info in [this section](https://github.com/bitnami/charts/tree/master/bitnami/kafka#enable-security-for-kafka-and-zookeeper) of the README.md file.
|
||||
|
|
@ -1,521 +0,0 @@
|
|||
---
|
||||
# Source: kafka/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kafka
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: kafka
|
||||
---
|
||||
# Source: kafka/templates/scripts-configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kafka-scripts
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
data:
|
||||
setup.sh: |-
|
||||
#!/bin/bash
|
||||
|
||||
ID="${MY_POD_NAME#"kafka-"}"
|
||||
export KAFKA_CFG_BROKER_ID="$ID"
|
||||
|
||||
exec /entrypoint.sh /run.sh
|
||||
---
|
||||
# Source: kafka/charts/zookeeper/templates/svc-headless.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kafka-zookeeper-headless
|
||||
namespace: db
|
||||
labels:
|
||||
app.kubernetes.io/name: zookeeper
|
||||
helm.sh/chart: zookeeper-5.21.9
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: zookeeper
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
|
||||
- name: tcp-client
|
||||
port: 2181
|
||||
targetPort: client
|
||||
|
||||
|
||||
- name: follower
|
||||
port: 2888
|
||||
targetPort: follower
|
||||
- name: tcp-election
|
||||
port: 3888
|
||||
targetPort: election
|
||||
selector:
|
||||
app.kubernetes.io/name: zookeeper
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: zookeeper
|
||||
---
|
||||
# Source: kafka/charts/zookeeper/templates/svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kafka-zookeeper
|
||||
namespace: db
|
||||
labels:
|
||||
app.kubernetes.io/name: zookeeper
|
||||
helm.sh/chart: zookeeper-5.21.9
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: zookeeper
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
|
||||
- name: tcp-client
|
||||
port: 2181
|
||||
targetPort: client
|
||||
|
||||
|
||||
- name: follower
|
||||
port: 2888
|
||||
targetPort: follower
|
||||
- name: tcp-election
|
||||
port: 3888
|
||||
targetPort: election
|
||||
selector:
|
||||
app.kubernetes.io/name: zookeeper
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: zookeeper
|
||||
---
|
||||
# Source: kafka/templates/kafka-metrics-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kafka-metrics
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: metrics
|
||||
annotations:
|
||||
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: '9308'
|
||||
prometheus.io/scrape: "true"
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http-metrics
|
||||
port: 9308
|
||||
protocol: TCP
|
||||
targetPort: metrics
|
||||
nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: metrics
|
||||
---
|
||||
# Source: kafka/templates/svc-headless.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kafka-headless
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: kafka
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: tcp-client
|
||||
port: 9092
|
||||
protocol: TCP
|
||||
targetPort: kafka-client
|
||||
- name: tcp-internal
|
||||
port: 9093
|
||||
protocol: TCP
|
||||
targetPort: kafka-internal
|
||||
selector:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: kafka
|
||||
---
|
||||
# Source: kafka/templates/svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kafka
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: kafka
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: tcp-client
|
||||
port: 9092
|
||||
protocol: TCP
|
||||
targetPort: kafka-client
|
||||
nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: kafka
|
||||
---
|
||||
# Source: kafka/templates/kafka-metrics-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: kafka-exporter
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: metrics
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: metrics
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: metrics
|
||||
spec:
|
||||
containers:
|
||||
- name: kafka-exporter
|
||||
image: docker.io/bitnami/kafka-exporter:1.2.0-debian-10-r220
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |
|
||||
read -r -a sasl_passwords <<< "$(tr ',;' ' ' <<< "${SASL_USER_PASSWORD}")"
|
||||
kafka_exporter \
|
||||
--kafka.server=kafka-0.kafka-headless.db.svc.cluster.local:9092 \
|
||||
--kafka.server=kafka-1.kafka-headless.db.svc.cluster.local:9092 \
|
||||
--web.listen-address=:9308
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9308
|
||||
resources:
|
||||
limits: {}
|
||||
requests: {}
|
||||
---
|
||||
# Source: kafka/charts/zookeeper/templates/statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: kafka-zookeeper
|
||||
namespace: db
|
||||
labels:
|
||||
app.kubernetes.io/name: zookeeper
|
||||
helm.sh/chart: zookeeper-5.21.9
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: zookeeper
|
||||
role: zookeeper
|
||||
spec:
|
||||
serviceName: kafka-zookeeper-headless
|
||||
replicas: 1
|
||||
podManagementPolicy: Parallel
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: zookeeper
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: zookeeper
|
||||
template:
|
||||
metadata:
|
||||
name: kafka-zookeeper
|
||||
labels:
|
||||
app.kubernetes.io/name: zookeeper
|
||||
helm.sh/chart: zookeeper-5.21.9
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: zookeeper
|
||||
spec:
|
||||
|
||||
serviceAccountName: default
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
containers:
|
||||
- name: zookeeper
|
||||
image: docker.io/bitnami/zookeeper:3.6.2-debian-10-r10
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
runAsUser: 1001
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- |
|
||||
# Execute entrypoint as usual after obtaining ZOO_SERVER_ID based on POD hostname
|
||||
HOSTNAME=`hostname -s`
|
||||
if [[ $HOSTNAME =~ (.*)-([0-9]+)$ ]]; then
|
||||
ORD=${BASH_REMATCH[2]}
|
||||
export ZOO_SERVER_ID=$((ORD+1))
|
||||
else
|
||||
echo "Failed to get index from hostname $HOST"
|
||||
exit 1
|
||||
fi
|
||||
exec /entrypoint.sh /run.sh
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
env:
|
||||
- name: ZOO_DATA_LOG_DIR
|
||||
value: ""
|
||||
- name: ZOO_PORT_NUMBER
|
||||
value: "2181"
|
||||
- name: ZOO_TICK_TIME
|
||||
value: "2000"
|
||||
- name: ZOO_INIT_LIMIT
|
||||
value: "10"
|
||||
- name: ZOO_SYNC_LIMIT
|
||||
value: "5"
|
||||
- name: ZOO_MAX_CLIENT_CNXNS
|
||||
value: "60"
|
||||
- name: ZOO_4LW_COMMANDS_WHITELIST
|
||||
value: "srvr, mntr, ruok"
|
||||
- name: ZOO_LISTEN_ALLIPS_ENABLED
|
||||
value: "no"
|
||||
- name: ZOO_AUTOPURGE_INTERVAL
|
||||
value: "0"
|
||||
- name: ZOO_AUTOPURGE_RETAIN_COUNT
|
||||
value: "3"
|
||||
- name: ZOO_MAX_SESSION_TIMEOUT
|
||||
value: "40000"
|
||||
- name: ZOO_SERVERS
|
||||
value: kafka-zookeeper-0.kafka-zookeeper-headless.db.svc.cluster.local:2888:3888
|
||||
- name: ZOO_ENABLE_AUTH
|
||||
value: "no"
|
||||
- name: ZOO_HEAP_SIZE
|
||||
value: "1024"
|
||||
- name: ZOO_LOG_LEVEL
|
||||
value: "ERROR"
|
||||
- name: ALLOW_ANONYMOUS_LOGIN
|
||||
value: "yes"
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
ports:
|
||||
|
||||
- name: client
|
||||
containerPort: 2181
|
||||
|
||||
|
||||
- name: follower
|
||||
containerPort: 2888
|
||||
- name: election
|
||||
containerPort: 3888
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout 2 nc -w 2 localhost 2181 | grep imok']
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 6
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ['/bin/bash', '-c', 'echo "ruok" | timeout 2 nc -w 2 localhost 2181 | grep imok']
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 6
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /bitnami/zookeeper
|
||||
volumes:
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
annotations:
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
---
|
||||
# Source: kafka/templates/statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: kafka
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: kafka
|
||||
spec:
|
||||
podManagementPolicy: Parallel
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/component: kafka
|
||||
serviceName: kafka-headless
|
||||
updateStrategy:
|
||||
type: "RollingUpdate"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: kafka
|
||||
helm.sh/chart: kafka-11.8.6
|
||||
app.kubernetes.io/instance: kafka
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: kafka
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
runAsUser: 1001
|
||||
serviceAccountName: kafka
|
||||
containers:
|
||||
- name: kafka
|
||||
image: docker.io/bitnami/kafka:2.6.0-debian-10-r30
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command:
|
||||
- /scripts/setup.sh
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: "false"
|
||||
- name: MY_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: KAFKA_CFG_ZOOKEEPER_CONNECT
|
||||
value: "kafka-zookeeper"
|
||||
- name: KAFKA_INTER_BROKER_LISTENER_NAME
|
||||
value: "INTERNAL"
|
||||
- name: KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP
|
||||
value: "INTERNAL:PLAINTEXT,CLIENT:PLAINTEXT"
|
||||
- name: KAFKA_CFG_LISTENERS
|
||||
value: "INTERNAL://:9093,CLIENT://:9092"
|
||||
- name: KAFKA_CFG_ADVERTISED_LISTENERS
|
||||
value: "INTERNAL://$(MY_POD_NAME).kafka-headless.db.svc.cluster.local:9093,CLIENT://$(MY_POD_NAME).kafka-headless.db.svc.cluster.local:9092"
|
||||
- name: ALLOW_PLAINTEXT_LISTENER
|
||||
value: "yes"
|
||||
- name: KAFKA_CFG_DELETE_TOPIC_ENABLE
|
||||
value: "false"
|
||||
- name: KAFKA_CFG_AUTO_CREATE_TOPICS_ENABLE
|
||||
value: "true"
|
||||
- name: KAFKA_HEAP_OPTS
|
||||
value: "-Xmx1024m -Xms1024m"
|
||||
- name: KAFKA_CFG_LOG_FLUSH_INTERVAL_MESSAGES
|
||||
value: "10000"
|
||||
- name: KAFKA_CFG_LOG_FLUSH_INTERVAL_MS
|
||||
value: "1000"
|
||||
- name: KAFKA_CFG_LOG_RETENTION_BYTES
|
||||
value: "1073741824"
|
||||
- name: KAFKA_CFG_LOG_RETENTION_CHECK_INTERVALS_MS
|
||||
value: "300000"
|
||||
- name: KAFKA_CFG_LOG_RETENTION_HOURS
|
||||
value: "168"
|
||||
- name: KAFKA_CFG_MESSAGE_MAX_BYTES
|
||||
value: "1000012"
|
||||
- name: KAFKA_CFG_LOG_SEGMENT_BYTES
|
||||
value: "1073741824"
|
||||
- name: KAFKA_CFG_LOG_DIRS
|
||||
value: "/bitnami/kafka/data"
|
||||
- name: KAFKA_CFG_DEFAULT_REPLICATION_FACTOR
|
||||
value: "1"
|
||||
- name: KAFKA_CFG_OFFSETS_TOPIC_REPLICATION_FACTOR
|
||||
value: "1"
|
||||
- name: KAFKA_CFG_TRANSACTION_STATE_LOG_REPLICATION_FACTOR
|
||||
value: "1"
|
||||
- name: KAFKA_CFG_TRANSACTION_STATE_LOG_MIN_ISR
|
||||
value: "1"
|
||||
- name: KAFKA_CFG_NUM_IO_THREADS
|
||||
value: "8"
|
||||
- name: KAFKA_CFG_NUM_NETWORK_THREADS
|
||||
value: "3"
|
||||
- name: KAFKA_CFG_NUM_PARTITIONS
|
||||
value: "1"
|
||||
- name: KAFKA_CFG_NUM_RECOVERY_THREADS_PER_DATA_DIR
|
||||
value: "1"
|
||||
- name: KAFKA_CFG_SOCKET_RECEIVE_BUFFER_BYTES
|
||||
value: "102400"
|
||||
- name: KAFKA_CFG_SOCKET_REQUEST_MAX_BYTES
|
||||
value: "104857600"
|
||||
- name: KAFKA_CFG_SOCKET_SEND_BUFFER_BYTES
|
||||
value: "102400"
|
||||
- name: KAFKA_CFG_ZOOKEEPER_CONNECTION_TIMEOUT_MS
|
||||
value: "6000"
|
||||
ports:
|
||||
- name: kafka-client
|
||||
containerPort: 9092
|
||||
- name: kafka-internal
|
||||
containerPort: 9093
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: kafka-client
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold:
|
||||
periodSeconds:
|
||||
successThreshold:
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: kafka-client
|
||||
initialDelaySeconds: 5
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
periodSeconds:
|
||||
successThreshold:
|
||||
resources:
|
||||
limits: {}
|
||||
requests: {}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /bitnami/kafka
|
||||
- name: scripts
|
||||
mountPath: /scripts/setup.sh
|
||||
subPath: setup.sh
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: kafka-scripts
|
||||
defaultMode: 0755
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
dependencies:
|
||||
- name: zookeeper
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 5.21.9
|
||||
digest: sha256:2f3c43ce02e3966648b8c89be121fe39537f62ea1d161ad908f51ddc90e4243e
|
||||
generated: "2020-09-29T07:43:56.483358254Z"
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
dependencies:
|
||||
- name: zookeeper
|
||||
version: 5.x.x
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
condition: zookeeper.enabled
|
||||
237
scripts/helmcharts/databases/charts/kafka/templates/NOTES.txt
Executable file → Normal file
237
scripts/helmcharts/databases/charts/kafka/templates/NOTES.txt
Executable file → Normal file
|
|
@ -1,43 +1,40 @@
|
|||
{{- $replicaCount := int .Values.replicaCount -}}
|
||||
{{- $releaseNamespace := .Release.Namespace -}}
|
||||
{{- $clusterDomain := .Values.clusterDomain -}}
|
||||
{{- $fullname := include "kafka.fullname" . -}}
|
||||
{{- $clientProtocol := include "kafka.listenerType" ( dict "protocol" .Values.auth.clientProtocol ) -}}
|
||||
{{- $servicePort := int .Values.service.port -}}
|
||||
{{- $loadBalancerIPListLength := len .Values.externalAccess.service.loadBalancerIPs -}}
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.externalAccess.autoDiscovery.enabled) (not (eq $replicaCount $loadBalancerIPListLength )) (eq .Values.externalAccess.service.type "LoadBalancer") }}
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
###############################################################################
|
||||
### ERROR: You enabled external access to Kafka brokers without specifying ###
|
||||
### the array of load balancer IPs for Kafka brokers. ###
|
||||
###############################################################################
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||
|
||||
This deployment will be incomplete until you configure the array of load balancer
|
||||
IPs for Kafka brokers. To complete your deployment follow the steps below:
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||
|
||||
1. Wait for the load balancer IPs (it may take a few minutes for them to be available):
|
||||
Get the list of pods by executing:
|
||||
|
||||
kubectl get svc --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "kafka.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -w
|
||||
kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||
|
||||
2. Obtain the load balancer IPs and upgrade your chart:
|
||||
Access the pod you want to debug by executing
|
||||
|
||||
{{- range $i, $e := until $replicaCount }}
|
||||
LOAD_BALANCER_IP_{{ add $i 1 }}="$(kubectl get svc --namespace {{ $releaseNamespace }} {{ $fullname }}-{{ $i }}-external -o jsonpath='{.status.loadBalancer.ingress[0].ip}')"
|
||||
{{- end }}
|
||||
kubectl exec --namespace {{ .Release.Namespace }} -ti <NAME OF THE POD> -- bash
|
||||
|
||||
3. Upgrade you chart:
|
||||
In order to replicate the container startup scripts execute this command:
|
||||
|
||||
helm upgrade {{ .Release.Name }} bitnami/{{ .Chart.Name }} \
|
||||
--set replicaCount={{ $replicaCount }} \
|
||||
--set externalAccess.enabled=true \
|
||||
{{- range $i, $e := until $replicaCount }}
|
||||
--set externalAccess.service.loadBalancerIPs[{{ $i }}]=$LOAD_BALANCER_IP_{{ add $i 1 }} \
|
||||
{{- end }}
|
||||
--set externalAccess.service.type=LoadBalancer
|
||||
/opt/bitnami/scripts/kafka/entrypoint.sh /opt/bitnami/scripts/kafka/run.sh
|
||||
|
||||
{{- else }}
|
||||
|
||||
{{- if and (or (eq .Values.service.type "LoadBalancer") .Values.externalAccess.enabled) (eq .Values.auth.clientProtocol "plaintext") }}
|
||||
{{- $replicaCount := int .Values.replicaCount -}}
|
||||
{{- $releaseNamespace := .Release.Namespace -}}
|
||||
{{- $clusterDomain := .Values.clusterDomain -}}
|
||||
{{- $fullname := include "common.names.fullname" . -}}
|
||||
{{- $clientProtocol := include "kafka.listenerType" (dict "protocol" .Values.auth.clientProtocol) -}}
|
||||
{{- $externalClientProtocol := include "kafka.listenerType" (dict "protocol" (include "kafka.externalClientProtocol" . )) -}}
|
||||
{{- $saslMechanisms := .Values.auth.sasl.mechanisms -}}
|
||||
{{- $tlsEndpointIdentificationAlgorithm := default "" .Values.auth.tls.endpointIdentificationAlgorithm -}}
|
||||
{{- $tlsPasswordSecret := printf "$(kubectl get secret %s --namespace %s -o jsonpath='{.data.password}' | base64 -d | cut -d , -f 1)" .Values.auth.tls.existingSecret $releaseNamespace -}}
|
||||
{{- $tlsPassword := ternary .Values.auth.tls.password $tlsPasswordSecret (eq .Values.auth.tls.existingSecret "") -}}
|
||||
{{- $servicePort := int .Values.service.ports.client -}}
|
||||
|
||||
{{- if and (or (eq .Values.service.type "LoadBalancer") .Values.externalAccess.enabled) (eq $externalClientProtocol "PLAINTEXT") }}
|
||||
---------------------------------------------------------------------------------------------
|
||||
WARNING
|
||||
|
||||
|
|
@ -64,57 +61,100 @@ Each Kafka broker can be accessed by producers via port {{ $servicePort }} on th
|
|||
{{- $brokerList = append $brokerList (printf "%s-%d.%s-headless.%s.svc.%s:%d" $fullname $i $fullname $releaseNamespace $clusterDomain $servicePort) }}
|
||||
{{- end }}
|
||||
{{ join "\n" $brokerList | nindent 4 }}
|
||||
|
||||
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
|
||||
You need to configure your Kafka client to access using SASL authentication. To do so, you need to create the 'kafka_jaas.conf' and 'client.properties' configuration files by executing these commands:
|
||||
You need to configure your Kafka client to access using SASL authentication. To do so, you need to create the 'kafka_jaas.conf' and 'client.properties' configuration files with the content below:
|
||||
|
||||
- kafka_jaas.conf:
|
||||
|
||||
cat > kafka_jaas.conf <<EOF
|
||||
KafkaClient {
|
||||
{{- if .Values.auth.saslMechanisms | regexFind "scram" }}
|
||||
{{- if $saslMechanisms | regexFind "scram" }}
|
||||
org.apache.kafka.common.security.scram.ScramLoginModule required
|
||||
{{- else }}
|
||||
org.apache.kafka.common.security.plain.PlainLoginModule required
|
||||
{{- end }}
|
||||
username="{{ index .Values.auth.jaas.clientUsers 0 }}"
|
||||
password="$(kubectl get secret {{ $fullname }}-jaas -n {{ $releaseNamespace }} -o jsonpath='{.data.client-passwords}' | base64 --decode | cut -d , -f 1)";
|
||||
username="{{ index .Values.auth.sasl.jaas.clientUsers 0 }}"
|
||||
password="$(kubectl get secret {{ $fullname }}-jaas --namespace {{ $releaseNamespace }} -o jsonpath='{.data.client-passwords}' | base64 -d | cut -d , -f 1)";
|
||||
};
|
||||
EOF
|
||||
|
||||
- client.properties:
|
||||
|
||||
cat > client.properties <<EOF
|
||||
security.protocol={{ $clientProtocol }}
|
||||
{{- if .Values.auth.saslMechanisms | regexFind "scram-sha-256" }}
|
||||
{{- if $saslMechanisms | regexFind "scram-sha-256" }}
|
||||
sasl.mechanism=SCRAM-SHA-256
|
||||
{{- else if .Values.auth.saslMechanisms | regexFind "scram-sha-512" }}
|
||||
{{- else if $saslMechanisms | regexFind "scram-sha-512" }}
|
||||
sasl.mechanism=SCRAM-SHA-512
|
||||
{{- else -}}
|
||||
{{- else }}
|
||||
sasl.mechanism=PLAIN
|
||||
{{- end }}
|
||||
{{- if eq .Values.auth.clientProtocol "sasl_tls" }}
|
||||
{{- if eq $clientProtocol "SASL_SSL" }}
|
||||
ssl.truststore.type={{ upper .Values.auth.tls.type }}
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
ssl.truststore.location=/tmp/kafka.truststore.jks
|
||||
{{- if .Values.auth.jksPassword }}
|
||||
ssl.truststore.password={{ .Values.auth.jksPassword }}
|
||||
{{- if not (empty $tlsPassword) }}
|
||||
ssl.truststore.password={{ $tlsPassword }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
ssl.truststore.certificates=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
{{- end }}
|
||||
{{- if eq $tlsEndpointIdentificationAlgorithm "" }}
|
||||
ssl.endpoint.identification.algorithm=
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- else if (include "kafka.client.tlsEncryption" .) }}
|
||||
|
||||
You need to configure your Kafka client to access using TLS authentication. To do so, you need to create the 'client.properties' configuration file with the content below:
|
||||
|
||||
security.protocol={{ $clientProtocol }}
|
||||
ssl.truststore.type={{ upper .Values.auth.tls.type }}
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
ssl.truststore.location=/tmp/kafka.truststore.{{ .Values.auth.tls.type }}
|
||||
{{- if not (empty $tlsPassword) }}
|
||||
ssl.truststore.password={{ $tlsPassword }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
ssl.truststore.certificates=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
{{- end }}
|
||||
{{- if eq .Values.auth.tlsEndpointIdentificationAlgorithm "" }}
|
||||
{{- if eq .Values.auth.clientProtocol "mtls" }}
|
||||
ssl.keystore.type={{ upper .Values.auth.tls.type }}
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
ssl.keystore.location=/tmp/client.keystore.jks
|
||||
{{- if not (empty $tlsPassword) }}
|
||||
ssl.keystore.password={{ $tlsPassword }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
ssl.keystore.key=-----BEGIN ENCRYPTED PRIVATE KEY----- \
|
||||
... \
|
||||
-----END ENCRYPTED PRIVATE KEY-----
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq $tlsEndpointIdentificationAlgorithm "" }}
|
||||
ssl.endpoint.identification.algorithm=
|
||||
{{- end }}
|
||||
EOF
|
||||
|
||||
{{- end }}
|
||||
|
||||
To create a pod that you can use as a Kafka client run the following commands:
|
||||
|
||||
kubectl run {{ $fullname }}-client --restart='Never' --image {{ template "kafka.image" . }} --namespace {{ $releaseNamespace }} --command -- sleep infinity
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
{{- if or (include "kafka.client.saslAuthentication" .) (include "kafka.client.tlsEncryption" .) }}
|
||||
kubectl cp --namespace {{ $releaseNamespace }} /path/to/client.properties {{ $fullname }}-client:/tmp/client.properties
|
||||
{{- end }}
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
kubectl cp --namespace {{ $releaseNamespace }} /path/to/kafka_jaas.conf {{ $fullname }}-client:/tmp/kafka_jaas.conf
|
||||
{{- if eq .Values.auth.clientProtocol "sasl_tls" }}
|
||||
{{- end }}
|
||||
{{- if and (include "kafka.client.tlsEncryption" .) (eq .Values.auth.tls.type "jks") }}
|
||||
kubectl cp --namespace {{ $releaseNamespace }} ./kafka.truststore.jks {{ $fullname }}-client:/tmp/kafka.truststore.jks
|
||||
{{- if eq .Values.auth.clientProtocol "mtls" }}
|
||||
kubectl cp --namespace {{ $releaseNamespace }} ./client.keystore.jks {{ $fullname }}-client:/tmp/client.keystore.jks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
kubectl exec --tty -i {{ $fullname }}-client --namespace {{ $releaseNamespace }} -- bash
|
||||
|
|
@ -124,14 +164,18 @@ To create a pod that you can use as a Kafka client run the following commands:
|
|||
|
||||
PRODUCER:
|
||||
kafka-console-producer.sh \
|
||||
{{ if (include "kafka.client.saslAuthentication" .) }}--producer.config /tmp/client.properties \{{ end }}
|
||||
{{- if or (include "kafka.client.saslAuthentication" .) (include "kafka.client.tlsEncryption" .) }}
|
||||
--producer.config /tmp/client.properties \
|
||||
{{- end }}
|
||||
--broker-list {{ join "," $brokerList }} \
|
||||
--topic test
|
||||
|
||||
CONSUMER:
|
||||
kafka-console-consumer.sh \
|
||||
{{ if (include "kafka.client.saslAuthentication" .) }}--consumer.config /tmp/client.properties \{{ end }}
|
||||
--bootstrap-server {{ $fullname }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ .Values.service.port }} \
|
||||
{{- if or (include "kafka.client.saslAuthentication" .) (include "kafka.client.tlsEncryption" .) }}
|
||||
--consumer.config /tmp/client.properties \
|
||||
{{- end }}
|
||||
--bootstrap-server {{ $fullname }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ .Values.service.ports.client }} \
|
||||
--topic test \
|
||||
--from-beginning
|
||||
|
||||
|
|
@ -171,8 +215,97 @@ To connect to your Kafka server from outside the cluster, follow the instruction
|
|||
|
||||
echo "$(kubectl get svc --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "kafka.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -o jsonpath='{.items[*].status.loadBalancer.ingress[0].ip}' | tr ' ' '\n')"
|
||||
|
||||
Kafka Brokers port: {{ .Values.externalAccess.service.port }}
|
||||
Kafka Brokers port: {{ .Values.externalAccess.service.ports.external }}
|
||||
|
||||
{{- else if eq "ClusterIP" .Values.externalAccess.service.type }}
|
||||
|
||||
Kafka brokers domain: Use your provided hostname to reach Kafka brokers, {{ .Values.externalAccess.service.domain }}
|
||||
|
||||
Kafka brokers port: You will have a different port for each Kafka broker starting at {{ .Values.externalAccess.service.ports.external }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- if not (eq $clientProtocol $externalClientProtocol) }}
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
|
||||
You need to configure your Kafka client to access using SASL authentication. To do so, you need to create the 'kafka_jaas.conf' and 'client.properties' configuration files with the content below:
|
||||
|
||||
- kafka_jaas.conf:
|
||||
|
||||
KafkaClient {
|
||||
{{- if $saslMechanisms | regexFind "scram" }}
|
||||
org.apache.kafka.common.security.scram.ScramLoginModule required
|
||||
{{- else }}
|
||||
org.apache.kafka.common.security.plain.PlainLoginModule required
|
||||
{{- end }}
|
||||
username="{{ index .Values.auth.sasl.jaas.clientUsers 0 }}"
|
||||
password="$(kubectl get secret {{ $fullname }}-jaas --namespace {{ $releaseNamespace }} -o jsonpath='{.data.client-passwords}' | base64 -d | cut -d , -f 1)";
|
||||
};
|
||||
|
||||
- client.properties:
|
||||
|
||||
security.protocol={{ $externalClientProtocol }}
|
||||
{{- if $saslMechanisms | regexFind "scram-sha-256" }}
|
||||
sasl.mechanism=SCRAM-SHA-256
|
||||
{{- else if $saslMechanisms | regexFind "scram-sha-512" }}
|
||||
sasl.mechanism=SCRAM-SHA-512
|
||||
{{- else }}
|
||||
sasl.mechanism=PLAIN
|
||||
{{- end }}
|
||||
{{- if eq $externalClientProtocol "SASL_SSL" }}
|
||||
ssl.truststore.type={{ upper .Values.auth.tls.type }}
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
ssl.truststore.location=/tmp/kafka.truststore.jks
|
||||
{{- if not (empty $tlsPassword) }}
|
||||
ssl.truststore.password={{ $tlsPassword }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
ssl.truststore.certificates=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
{{- end }}
|
||||
{{- if eq $tlsEndpointIdentificationAlgorithm "" }}
|
||||
ssl.endpoint.identification.algorithm=
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- else if (include "kafka.externalClient.tlsEncryption" .) }}
|
||||
|
||||
You need to configure your Kafka client to access using TLS authentication. To do so, you need to create the 'client.properties' configuration file with the content below:
|
||||
|
||||
security.protocol={{ $externalClientProtocol }}
|
||||
ssl.truststore.type={{ upper .Values.auth.tls.type }}
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
ssl.truststore.location=/tmp/kafka.truststore.{{ .Values.auth.tls.type }}
|
||||
{{- if not (empty $tlsPassword) }}
|
||||
ssl.truststore.password={{ $tlsPassword }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
ssl.truststore.certificates=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
{{- end }}
|
||||
{{- if eq .Values.auth.externalClientProtocol "mtls" }}
|
||||
ssl.keystore.type={{ upper .Values.auth.tls.type }}
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
ssl.keystore.location=/tmp/client.keystore.jks
|
||||
{{- if not (empty $tlsPassword) }}
|
||||
ssl.keystore.password={{ $tlsPassword }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
ssl.keystore.key=-----BEGIN ENCRYPTED PRIVATE KEY----- \
|
||||
... \
|
||||
-----END ENCRYPTED PRIVATE KEY-----
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq $tlsEndpointIdentificationAlgorithm "" }}
|
||||
ssl.endpoint.identification.algorithm=
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
467
scripts/helmcharts/databases/charts/kafka/templates/_helpers.tpl
Executable file → Normal file
467
scripts/helmcharts/databases/charts/kafka/templates/_helpers.tpl
Executable file → Normal file
|
|
@ -1,4 +1,5 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
|
|
@ -6,49 +7,6 @@ Expand the name of the chart.
|
|||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "kafka.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "kafka.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "kafka.labels" -}}
|
||||
app.kubernetes.io/name: {{ include "kafka.name" . }}
|
||||
helm.sh/chart: {{ include "kafka.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector
|
||||
*/}}
|
||||
{{- define "kafka.matchLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "kafka.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified zookeeper name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
|
|
@ -67,7 +25,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
|||
*/}}
|
||||
{{- define "kafka.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "kafka.fullname" .) .Values.serviceAccount.name }}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
|
|
@ -77,68 +35,39 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
|||
Return the proper Kafka image name
|
||||
*/}}
|
||||
{{- define "kafka.image" -}}
|
||||
{{- $registryName := .Values.image.registry -}}
|
||||
{{- $repositoryName := .Values.image.repository -}}
|
||||
{{- $tag := .Values.image.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container auto-discovery image)
|
||||
*/}}
|
||||
{{- define "kafka.externalAccess.autoDiscovery.image" -}}
|
||||
{{- $registryName := .Values.externalAccess.autoDiscovery.image.registry -}}
|
||||
{{- $repositoryName := .Values.externalAccess.autoDiscovery.image.repository -}}
|
||||
{{- $tag := .Values.externalAccess.autoDiscovery.image.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.externalAccess.autoDiscovery.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "kafka.volumePermissions.image" -}}
|
||||
{{- $registryName := .Values.volumePermissions.image.registry -}}
|
||||
{{- $repositoryName := .Values.volumePermissions.image.repository -}}
|
||||
{{- $tag := .Values.volumePermissions.image.tag | toString -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
Create a default fully qualified Kafka exporter name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- define "kafka.metrics.kafka.fullname" -}}
|
||||
{{- printf "%s-exporter" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for Kafka exporter pods
|
||||
*/}}
|
||||
{{- define "kafka.metrics.kafka.serviceAccountName" -}}
|
||||
{{- if .Values.metrics.kafka.serviceAccount.create -}}
|
||||
{{ default (include "kafka.metrics.kafka.fullname" .) .Values.metrics.kafka.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{ default "default" .Values.metrics.kafka.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
|
@ -146,99 +75,21 @@ Also, we can't use a single if because lazy evaluation is not an option
|
|||
Return the proper Kafka exporter image name
|
||||
*/}}
|
||||
{{- define "kafka.metrics.kafka.image" -}}
|
||||
{{- $registryName := .Values.metrics.kafka.image.registry -}}
|
||||
{{- $repositoryName := .Values.metrics.kafka.image.repository -}}
|
||||
{{- $tag := .Values.metrics.kafka.image.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.metrics.kafka.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper JMX exporter image name
|
||||
*/}}
|
||||
{{- define "kafka.metrics.jmx.image" -}}
|
||||
{{- $registryName := .Values.metrics.jmx.image.registry -}}
|
||||
{{- $repositoryName := .Values.metrics.jmx.image.repository -}}
|
||||
{{- $tag := .Values.metrics.jmx.image.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.metrics.jmx.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "kafka.imagePullSecrets" -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
|
||||
Also, we can not use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- else if or .Values.image.pullSecrets .Values.externalAccess.autoDiscovery.image.pullSecrets .Values.volumePermissions.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.externalAccess.autoDiscovery.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.volumePermissions.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.metrics.kafka.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.metrics.jmx.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- else if or .Values.image.pullSecrets .Values.externalAccess.autoDiscovery.image.pullSecrets .Values.volumePermissions.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.externalAccess.autoDiscovery.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.volumePermissions.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.metrics.kafka.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.metrics.jmx.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{ include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.externalAccess.autoDiscovery.image .Values.volumePermissions.image .Values.metrics.kafka.image .Values.metrics.jmx.image) "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
|
|
@ -296,12 +147,48 @@ Return true if authentication via SASL should be configured for inter-broker com
|
|||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS for client connections should be configured
|
||||
*/}}
|
||||
{{- define "kafka.client.tlsEncryption" -}}
|
||||
{{- $tlsProtocols := list "tls" "mtls" "sasl_tls" -}}
|
||||
{{- if (has .Values.auth.clientProtocol $tlsProtocols) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the configured value for the external client protocol, defaults to the same value as clientProtocol
|
||||
*/}}
|
||||
{{- define "kafka.externalClientProtocol" -}}
|
||||
{{- coalesce .Values.auth.externalClientProtocol .Values.auth.clientProtocol -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS for external client connections should be configured
|
||||
*/}}
|
||||
{{- define "kafka.externalClient.tlsEncryption" -}}
|
||||
{{- $tlsProtocols := list "tls" "mtls" "sasl_tls" -}}
|
||||
{{- if (has (include "kafka.externalClientProtocol" . ) $tlsProtocols) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS for inter broker communication connections should be configured
|
||||
*/}}
|
||||
{{- define "kafka.interBroker.tlsEncryption" -}}
|
||||
{{- $tlsProtocols := list "tls" "mtls" "sasl_tls" -}}
|
||||
{{- if (has .Values.auth.interBrokerProtocol $tlsProtocols) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS should be configured
|
||||
*/}}
|
||||
{{- define "kafka.tlsEncryption" -}}
|
||||
{{- $tlsProtocols := list "tls" "mtls" "sasl_tls" -}}
|
||||
{{- if or (has .Values.auth.clientProtocol $tlsProtocols) (has .Values.auth.interBrokerProtocol $tlsProtocols) -}}
|
||||
{{- if or (include "kafka.client.tlsEncryption" .) (include "kafka.interBroker.tlsEncryption" .) (include "kafka.externalClient.tlsEncryption" .) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -324,33 +211,29 @@ SASL_PLAINTEXT
|
|||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the SASL type
|
||||
Usage:
|
||||
{{ include "kafka.auth.saslMechanisms" ( dict "type" .Values.path.to.the.Value ) }}
|
||||
Return the protocol used with zookeeper
|
||||
*/}}
|
||||
{{- define "kafka.auth.saslMechanisms" -}}
|
||||
{{- $mechanisms := list -}}
|
||||
{{- if .type | regexFind "plain" -}}
|
||||
{{- $mechanisms = append $mechanisms "PLAIN" -}}
|
||||
{{- define "kafka.zookeeper.protocol" -}}
|
||||
{{- if and .Values.auth.zookeeper.tls.enabled .Values.zookeeper.auth.client.enabled .Values.auth.sasl.jaas.zookeeperUser -}}
|
||||
SASL_SSL
|
||||
{{- else if and .Values.auth.zookeeper.tls.enabled -}}
|
||||
SSL
|
||||
{{- else if and .Values.zookeeper.auth.client.enabled .Values.auth.sasl.jaas.zookeeperUser -}}
|
||||
SASL
|
||||
{{- else -}}
|
||||
PLAINTEXT
|
||||
{{- end -}}
|
||||
{{- if .type | regexFind "scram-sha-256" -}}
|
||||
{{- $mechanisms = append $mechanisms "SCRAM-SHA-256" -}}
|
||||
{{- end -}}
|
||||
{{- if .type | regexFind "scram-sha-512" -}}
|
||||
{{- $mechanisms = append $mechanisms "SCRAM-SHA-512" -}}
|
||||
{{- end -}}
|
||||
{{- $mechanisms = join "," $mechanisms -}}
|
||||
{{- printf "%s" $mechanisms -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka JAAS credentials secret
|
||||
*/}}
|
||||
{{- define "kafka.jaasSecretName" -}}
|
||||
{{- if .Values.auth.jaas.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.auth.jaas.existingSecret $) -}}
|
||||
{{- $secretName := .Values.auth.sasl.jaas.existingSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-jaas" (include "kafka.fullname" .) -}}
|
||||
{{- printf "%s-jaas" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
|
@ -358,27 +241,17 @@ Return the Kafka JAAS credentials secret
|
|||
Return true if a JAAS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.createJaasSecret" -}}
|
||||
{{- if and (or (include "kafka.client.saslAuthentication" .) (include "kafka.interBroker.saslAuthentication" .) .Values.auth.jaas.zookeeperUser) (not .Values.auth.jaas.existingSecret) -}}
|
||||
{{- $secretName := .Values.auth.sasl.jaas.existingSecret -}}
|
||||
{{- if and (or (include "kafka.client.saslAuthentication" .) (include "kafka.interBroker.saslAuthentication" .) (and .Values.zookeeper.auth.client.enabled .Values.auth.sasl.jaas.zookeeperUser)) (empty $secretName) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka JKS credentials secret
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.jksSecretName" -}}
|
||||
{{- if .Values.auth.jksSecret -}}
|
||||
{{- printf "%s" (tpl .Values.auth.jksSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-jks" (include "kafka.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a JAAS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.createJksSecret" -}}
|
||||
{{- if and (.Files.Glob "files/jks/*.jks") (not .Values.auth.jksSecret) }}
|
||||
{{- define "kafka.createTlsSecret" -}}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (empty .Values.auth.tls.existingSecrets) (eq .Values.auth.tls.type "pem") .Values.auth.tls.autoGenerated }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -390,7 +263,30 @@ Return the Kafka configuration configmap
|
|||
{{- if .Values.existingConfigmap -}}
|
||||
{{- printf "%s" (tpl .Values.existingConfigmap $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-configuration" (include "kafka.fullname" .) -}}
|
||||
{{- printf "%s-configuration" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Returns the secret name for the Kafka Provisioning client
|
||||
*/}}
|
||||
{{- define "kafka.client.passwordsSecretName" -}}
|
||||
{{- if .Values.provisioning.auth.tls.passwordsSecret -}}
|
||||
{{- printf "%s" (tpl .Values.provisioning.auth.tls.passwordsSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-client-secret" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for the Kafka Provisioning client
|
||||
*/}}
|
||||
{{- define "kafka.provisioning.serviceAccountName" -}}
|
||||
{{- if .Values.provisioning.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.provisioning.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.provisioning.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
|
@ -410,7 +306,7 @@ Return the Kafka log4j ConfigMap name.
|
|||
{{- if .Values.existingLog4jConfigMap -}}
|
||||
{{- printf "%s" (tpl .Values.existingLog4jConfigMap $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-log4j-configuration" (include "kafka.fullname" .) -}}
|
||||
{{- printf "%s-log4j-configuration" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
|
@ -423,6 +319,21 @@ Return true if a log4j ConfigMap object should be created.
|
|||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the SASL mechanism to use for the Kafka exporter to access Kafka
|
||||
The exporter uses a different nomenclature so we need to do this hack
|
||||
*/}}
|
||||
{{- define "kafka.metrics.kafka.saslMechanism" -}}
|
||||
{{- $saslMechanisms := .Values.auth.sasl.mechanisms }}
|
||||
{{- if contains "scram-sha-512" $saslMechanisms }}
|
||||
{{- print "scram-sha512" -}}
|
||||
{{- else if contains "scram-sha-256" $saslMechanisms }}
|
||||
{{- print "scram-sha256" -}}
|
||||
{{- else -}}
|
||||
{{- print "plain" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka configuration configmap
|
||||
*/}}
|
||||
|
|
@ -430,7 +341,7 @@ Return the Kafka configuration configmap
|
|||
{{- if .Values.metrics.jmx.existingConfigmap -}}
|
||||
{{- printf "%s" (tpl .Values.metrics.jmx.existingConfigmap $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-jmx-configuration" (include "kafka.fullname" .) -}}
|
||||
{{- printf "%s-jmx-configuration" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
|
@ -443,39 +354,15 @@ Return true if a configmap object should be created
|
|||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Renders a value that contains template.
|
||||
Usage:
|
||||
{{ include "kafka.tplValue" ( dict "value" .Values.path.to.the.Value "context" $) }}
|
||||
*/}}
|
||||
{{- define "kafka.tplValue" -}}
|
||||
{{- if typeIs "string" .value }}
|
||||
{{- tpl .value .context }}
|
||||
{{- else }}
|
||||
{{- tpl (.value | toYaml) .context }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Check if there are rolling tags in the images
|
||||
*/}}
|
||||
{{- define "kafka.checkRollingTags" -}}
|
||||
{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.externalAccess.autoDiscovery.image.repository) (not (.Values.externalAccess.autoDiscovery.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.externalAccess.autoDiscovery.image.repository }}:{{ .Values.externalAccess.autoDiscovery.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.metrics.kafka.image.repository) (not (.Values.metrics.kafka.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.metrics.kafka.image.repository }}:{{ .Values.metrics.kafka.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- if and (contains "bitnami/" .Values.metrics.jmx.image.repository) (not (.Values.metrics.jmx.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .Values.metrics.jmx.image.repository }}:{{ .Values.metrics.jmx.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
|
||||
{{- end }}
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.externalAccess.autoDiscovery.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.metrics.kafka.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.metrics.jmx.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
|
|
@ -485,10 +372,17 @@ Compile all warnings into a single message, and call fail.
|
|||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.authProtocols" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.nodePortListLength" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.domainSpecified" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceType" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessAutoDiscoveryRBAC" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.jksSecret" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessAutoDiscoveryIPsOrNames" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceList" (dict "element" "loadBalancerIPs" "context" .)) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceList" (dict "element" "loadBalancerNames" "context" .)) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceList" (dict "element" "loadBalancerAnnotations" "context" . )) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.saslMechanisms" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.tlsSecrets" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.tlsSecrets.length" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.tlsPasswords" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
|
|
@ -500,13 +394,13 @@ Compile all warnings into a single message, and call fail.
|
|||
{{/* Validate values of Kafka - Authentication protocols for Kafka */}}
|
||||
{{- define "kafka.validateValues.authProtocols" -}}
|
||||
{{- $authProtocols := list "plaintext" "tls" "mtls" "sasl" "sasl_tls" -}}
|
||||
{{- if or (not (has .Values.auth.clientProtocol $authProtocols)) (not (has .Values.auth.interBrokerProtocol $authProtocols)) -}}
|
||||
kafka: auth.clientProtocol auth.interBrokerProtocol
|
||||
{{- if or (not (has .Values.auth.clientProtocol $authProtocols)) (not (has .Values.auth.interBrokerProtocol $authProtocols)) (not (has (include "kafka.externalClientProtocol" . ) $authProtocols)) -}}
|
||||
kafka: auth.clientProtocol auth.externalClientProtocol auth.interBrokerProtocol
|
||||
Available authentication protocols are "plaintext", "tls", "mtls", "sasl" and "sasl_tls"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - number of replicas must be the same than NodePort list */}}
|
||||
{{/* Validate values of Kafka - number of replicas must be the same as NodePort list */}}
|
||||
{{- define "kafka.validateValues.nodePortListLength" -}}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- $nodePortListLength := len .Values.externalAccess.service.nodePorts }}
|
||||
|
|
@ -516,41 +410,100 @@ kafka: .Values.externalAccess.service.nodePorts
|
|||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - domain must be defined if external service type ClusterIP */}}
|
||||
{{- define "kafka.validateValues.domainSpecified" -}}
|
||||
{{- if and (eq .Values.externalAccess.service.type "ClusterIP") (eq .Values.externalAccess.service.domain "") -}}
|
||||
kafka: .Values.externalAccess.service.domain
|
||||
Domain must be specified if service type ClusterIP is set for external service
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - service type for external access */}}
|
||||
{{- define "kafka.validateValues.externalAccessServiceType" -}}
|
||||
{{- if and (not (eq .Values.externalAccess.service.type "NodePort")) (not (eq .Values.externalAccess.service.type "LoadBalancer")) -}}
|
||||
{{- if and (not (eq .Values.externalAccess.service.type "NodePort")) (not (eq .Values.externalAccess.service.type "LoadBalancer")) (not (eq .Values.externalAccess.service.type "ClusterIP")) -}}
|
||||
kafka: externalAccess.service.type
|
||||
Available servive type for external access are NodePort or LoadBalancer.
|
||||
Available service type for external access are NodePort, LoadBalancer or ClusterIP.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - RBAC should be enabled when autoDiscovery is enabled */}}
|
||||
{{- define "kafka.validateValues.externalAccessAutoDiscoveryRBAC" -}}
|
||||
{{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (not .Values.rbac.create )}}
|
||||
{{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (not .Values.rbac.create ) }}
|
||||
kafka: rbac.create
|
||||
By specifying "externalAccess.enabled=true" and "externalAccess.autoDiscovery.enabled=true"
|
||||
an initContainer will be used to autodetect the external IPs/ports by querying the
|
||||
an initContainer will be used to auto-detect the external IPs/ports by querying the
|
||||
K8s API. Please note this initContainer requires specific RBAC resources. You can create them
|
||||
by specifying "--set rbac.create=true".
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - A secret containing JKS files must be provided when TLS authentication is enabled */}}
|
||||
{{- define "kafka.validateValues.jksSecret" -}}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (not .Values.auth.jksSecret) (not (.Files.Glob "files/jks/*.jks")) }}
|
||||
kafka: auth.jksSecret
|
||||
A secret containing the Kafka JKS files is required when TLS encryption in enabled
|
||||
{{/* Validate values of Kafka - LoadBalancerIPs or LoadBalancerNames should be set when autoDiscovery is disabled */}}
|
||||
{{- define "kafka.validateValues.externalAccessAutoDiscoveryIPsOrNames" -}}
|
||||
{{- $loadBalancerNameListLength := len .Values.externalAccess.service.loadBalancerNames -}}
|
||||
{{- $loadBalancerIPListLength := len .Values.externalAccess.service.loadBalancerIPs -}}
|
||||
{{- if and .Values.externalAccess.enabled (eq .Values.externalAccess.service.type "LoadBalancer") (not .Values.externalAccess.autoDiscovery.enabled) (eq $loadBalancerNameListLength 0) (eq $loadBalancerIPListLength 0) }}
|
||||
kafka: externalAccess.service.loadBalancerNames or externalAccess.service.loadBalancerIPs
|
||||
By specifying "externalAccess.enabled=true", "externalAccess.autoDiscovery.enabled=false" and
|
||||
"externalAccess.service.type=LoadBalancer" at least one of externalAccess.service.loadBalancerNames
|
||||
or externalAccess.service.loadBalancerIPs must be set and the length of those arrays must be equal
|
||||
to the number of replicas.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - number of replicas must be the same as loadBalancerIPs list */}}
|
||||
{{- define "kafka.validateValues.externalAccessServiceList" -}}
|
||||
{{- $replicaCount := int .context.Values.replicaCount }}
|
||||
{{- $listLength := len (get .context.Values.externalAccess.service .element) -}}
|
||||
{{- if and .context.Values.externalAccess.enabled (not .context.Values.externalAccess.autoDiscovery.enabled) (eq .context.Values.externalAccess.service.type "LoadBalancer") (gt $listLength 0) (not (eq $replicaCount $listLength)) }}
|
||||
kafka: externalAccess.service.{{ .element }}
|
||||
Number of replicas and {{ .element }} array length must be the same. Currently: replicaCount = {{ $replicaCount }} and {{ .element }} = {{ $listLength }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - SASL mechanisms must be provided when using SASL */}}
|
||||
{{- define "kafka.validateValues.saslMechanisms" -}}
|
||||
{{- if and (or (.Values.auth.clientProtocol | regexFind "sasl") (.Values.auth.interBrokerProtocol | regexFind "sasl") .Values.auth.jaas.zookeeperUser) (not .Values.auth.saslMechanisms) }}
|
||||
kafka: auth.saslMechanisms
|
||||
{{- if and (or (.Values.auth.clientProtocol | regexFind "sasl") (.Values.auth.interBrokerProtocol | regexFind "sasl") (and .Values.zookeeper.auth.client.enabled .Values.auth.sasl.jaas.zookeeperUser)) (not .Values.auth.sasl.mechanisms) }}
|
||||
kafka: auth.sasl.mechanisms
|
||||
The SASL mechanisms are required when either auth.clientProtocol or auth.interBrokerProtocol use SASL or Zookeeper user is provided.
|
||||
{{- end }}
|
||||
{{- if not (contains .Values.auth.saslInterBrokerMechanism .Values.auth.saslMechanisms) }}
|
||||
kafka: auth.saslMechanisms
|
||||
auth.saslInterBrokerMechanism must be provided and it should be one of the specified mechanisms at auth.saslMechanisms
|
||||
{{- if not (contains .Values.auth.sasl.interBrokerMechanism .Values.auth.sasl.mechanisms) }}
|
||||
kafka: auth.sasl.mechanisms
|
||||
auth.sasl.interBrokerMechanism must be provided and it should be one of the specified mechanisms at auth.saslMechanisms
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - Secrets containing TLS certs must be provided when TLS authentication is enabled */}}
|
||||
{{- define "kafka.validateValues.tlsSecrets" -}}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (eq .Values.auth.tls.type "jks") (empty .Values.auth.tls.existingSecrets) }}
|
||||
kafka: auth.tls.existingSecrets
|
||||
A secret containing the Kafka JKS keystores and truststore is required
|
||||
when TLS encryption in enabled and TLS format is "JKS"
|
||||
{{- else if and (include "kafka.tlsEncryption" .) (eq .Values.auth.tls.type "pem") (empty .Values.auth.tls.existingSecrets) (not .Values.auth.tls.autoGenerated) }}
|
||||
kafka: auth.tls.existingSecrets
|
||||
A secret containing the Kafka TLS certificates and keys is required
|
||||
when TLS encryption in enabled and TLS format is "PEM"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - The number of secrets containing TLS certs should be equal to the number of replicas */}}
|
||||
{{- define "kafka.validateValues.tlsSecrets.length" -}}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (not (empty .Values.auth.tls.existingSecrets)) }}
|
||||
{{- $existingSecretsLength := len .Values.auth.tls.existingSecrets }}
|
||||
{{- if ne $replicaCount $existingSecretsLength }}
|
||||
kafka: .Values.auth.tls.existingSecrets
|
||||
Number of replicas and existingSecrets array length must be the same. Currently: replicaCount = {{ $replicaCount }} and existingSecrets = {{ $existingSecretsLength }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka provisioning - keyPasswordSecretKey, keystorePasswordSecretKey or truststorePasswordSecretKey must not be used without passwordsSecret */}}
|
||||
{{- define "kafka.validateValues.tlsPasswords" -}}
|
||||
{{- if and (include "kafka.client.tlsEncryption" .) (not .Values.auth.tls.passwordsSecret) }}
|
||||
{{- if or .Values.auth.tls.keyPasswordSecretKey .Values.auth.tls.keystorePasswordSecretKey .Values.auth.tls.truststorePasswordSecretKey }}
|
||||
kafka: auth.tls.keyPasswordSecretKey,auth.tls.keystorePasswordSecretKey,auth.tls.truststorePasswordSecretKey
|
||||
auth.tls.keyPasswordSecretKey,auth.tls.keystorePasswordSecretKey,auth.tls.truststorePasswordSecretKey
|
||||
must not be used without passwordsSecret setted.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
|
|||
9
scripts/helmcharts/databases/charts/kafka/templates/configmap.yaml
Executable file → Normal file
9
scripts/helmcharts/databases/charts/kafka/templates/configmap.yaml
Executable file → Normal file
|
|
@ -2,13 +2,14 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-configuration
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
name: {{ printf "%s-configuration" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
server.properties: |-
|
||||
|
|
|
|||
7
scripts/helmcharts/databases/charts/kafka/templates/extra-list.yaml
Executable file → Normal file
7
scripts/helmcharts/databases/charts/kafka/templates/extra-list.yaml
Executable file → Normal file
|
|
@ -1,5 +1,4 @@
|
|||
{{- if .Values.extraDeploy }}
|
||||
apiVersion: v1
|
||||
kind: List
|
||||
items: {{- include "kafka.tplValue" (dict "value" .Values.extraDeploy "context" $) | nindent 2 }}
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
|
|
|
|||
28
scripts/helmcharts/databases/charts/kafka/templates/jaas-secret.yaml
Executable file → Normal file
28
scripts/helmcharts/databases/charts/kafka/templates/jaas-secret.yaml
Executable file → Normal file
|
|
@ -2,31 +2,39 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-jaas
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
name: {{ printf "%s-jaas" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
{{- if .Values.auth.jaas.clientPasswords }}
|
||||
client-passwords: {{ join "," .Values.auth.jaas.clientPasswords | b64enc | quote }}
|
||||
{{- $clientUsers := .Values.auth.sasl.jaas.clientUsers }}
|
||||
{{- $clientPasswords := .Values.auth.sasl.jaas.clientPasswords }}
|
||||
{{- if $clientPasswords }}
|
||||
client-passwords: {{ join "," $clientPasswords | b64enc | quote }}
|
||||
system-user-password: {{ index $clientPasswords 0 | b64enc | quote }}
|
||||
{{- else }}
|
||||
{{- $passwords := list }}
|
||||
{{- range .Values.auth.jaas.clientUsers }}
|
||||
{{- range $clientUsers }}
|
||||
{{- $passwords = append $passwords (randAlphaNum 10) }}
|
||||
{{- end }}
|
||||
client-passwords: {{ join "," $passwords | b64enc | quote }}
|
||||
system-user-password: {{ index $passwords 0 | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth.jaas.zookeeperUser }}
|
||||
zookeeper-password: {{ ternary (randAlphaNum 10) .Values.auth.jaas.zookeeperPassword (empty .Values.auth.jaas.zookeeperPassword) | b64enc | quote }}
|
||||
{{- $zookeeperUser := .Values.auth.sasl.jaas.zookeeperUser }}
|
||||
{{- if and .Values.zookeeper.auth.client.enabled $zookeeperUser }}
|
||||
{{- $zookeeperPassword := .Values.auth.sasl.jaas.zookeeperPassword }}
|
||||
zookeeper-password: {{ default (randAlphaNum 10) $zookeeperPassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.interBroker.saslAuthentication" .) }}
|
||||
inter-broker-password: {{ ternary (randAlphaNum 10) .Values.auth.jaas.interBrokerPassword (empty .Values.auth.jaas.interBrokerPassword) | b64enc | quote }}
|
||||
{{- $interBrokerPassword := .Values.auth.sasl.jaas.interBrokerPassword }}
|
||||
inter-broker-password: {{ default (randAlphaNum 10) $interBrokerPassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -1,19 +0,0 @@
|
|||
{{- if (include "kafka.createJksSecret" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-jks
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- $root := . }}
|
||||
{{- range $path, $bytes := .Files.Glob "files/jks/*.jks" }}
|
||||
{{ base $path }}: {{ $root.Files.Get $path | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
15
scripts/helmcharts/databases/charts/kafka/templates/jmx-configmap.yaml
Executable file → Normal file
15
scripts/helmcharts/databases/charts/kafka/templates/jmx-configmap.yaml
Executable file → Normal file
|
|
@ -2,17 +2,19 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-jmx-configuration
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
name: {{ printf "%s-jmx-configuration" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
jmx-kafka-prometheus.yml: |-
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.metrics.jmx.config "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.jmx.config "context" $ ) | nindent 4 }}
|
||||
rules:
|
||||
- pattern: kafka.controller<type=(ControllerChannelManager), name=(QueueSize), broker-id=(\d+)><>(Value)
|
||||
name: kafka_controller_$1_$2_$4
|
||||
|
|
@ -56,4 +58,7 @@ data:
|
|||
labels:
|
||||
topic: $3
|
||||
partition: $4
|
||||
{{- if .Values.metrics.jmx.extraRules }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.jmx.extraRules "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
|
|||
35
scripts/helmcharts/databases/charts/kafka/templates/jmx-metrics-svc.yaml
Executable file → Normal file
35
scripts/helmcharts/databases/charts/kafka/templates/jmx-metrics-svc.yaml
Executable file → Normal file
|
|
@ -2,44 +2,33 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-jmx-metrics
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
name: {{ printf "%s-jmx-metrics" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.metrics.jmx.service.annotations .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.metrics.jmx.service.annotations }}
|
||||
{{ include "kafka.tplValue" ( dict "value" .Values.metrics.jmx.service.annotations "context" $) | nindent 4 }}
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.metrics.jmx.service.annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.metrics.jmx.service.type }}
|
||||
{{- if eq .Values.metrics.jmx.service.type "LoadBalancer" }}
|
||||
{{- if .Values.metrics.jmx.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.metrics.jmx.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{- toYaml .Values.metrics.jmx.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.metrics.jmx.service.type "ClusterIP") .Values.metrics.jmx.service.clusterIP }}
|
||||
type: ClusterIP
|
||||
sessionAffinity: {{ .Values.metrics.jmx.service.sessionAffinity }}
|
||||
{{- if .Values.metrics.jmx.service.clusterIP }}
|
||||
clusterIP: {{ .Values.metrics.jmx.service.clusterIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http-metrics
|
||||
port: {{ .Values.metrics.jmx.service.port }}
|
||||
port: {{ .Values.metrics.jmx.service.ports.metrics }}
|
||||
protocol: TCP
|
||||
targetPort: metrics
|
||||
{{- if and (or (eq .Values.metrics.jmx.service.type "NodePort") (eq .Values.metrics.jmx.service.type "LoadBalancer")) (not (empty .Values.metrics.jmx.service.nodePort)) }}
|
||||
nodePort: {{ .Values.metrics.jmx.service.nodePort }}
|
||||
{{- else if eq .Values.metrics.jmx.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
selector: {{- include "kafka.matchLabels" . | nindent 4 }}
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- end }}
|
||||
|
|
|
|||
142
scripts/helmcharts/databases/charts/kafka/templates/kafka-metrics-deployment.yaml
Executable file → Normal file
142
scripts/helmcharts/databases/charts/kafka/templates/kafka-metrics-deployment.yaml
Executable file → Normal file
|
|
@ -2,86 +2,170 @@
|
|||
{{- $replicaCount := int .Values.replicaCount -}}
|
||||
{{- $releaseNamespace := .Release.Namespace -}}
|
||||
{{- $clusterDomain := .Values.clusterDomain -}}
|
||||
{{- $fullname := include "kafka.fullname" . -}}
|
||||
{{- $servicePort := int .Values.service.port -}}
|
||||
apiVersion: apps/v1
|
||||
{{- $fullname := include "common.names.fullname" . -}}
|
||||
{{- $servicePort := int .Values.service.ports.client -}}
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-exporter
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
name: {{ include "kafka.metrics.kafka.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: cluster-metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels: {{- include "kafka.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: cluster-metrics
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "kafka.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
labels: {{- include "common.labels.standard" . | nindent 8 }}
|
||||
app.kubernetes.io/component: cluster-metrics
|
||||
{{- if .Values.metrics.kafka.podLabels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.podLabels "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.metrics.kafka.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "kafka.imagePullSecrets" . | indent 6 }}
|
||||
{{- include "kafka.imagePullSecrets" . | nindent 6 }}
|
||||
{{- if .Values.metrics.kafka.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.kafka.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.metrics.kafka.podAffinityPreset "component" "metrics" "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.metrics.kafka.podAntiAffinityPreset "component" "metrics" "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.metrics.kafka.nodeAffinityPreset.type "key" .Values.metrics.kafka.nodeAffinityPreset.key "values" .Values.metrics.kafka.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.kafka.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.priorityClassName }}
|
||||
priorityClassName: {{ .Values.metrics.kafka.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.schedulerName }}
|
||||
schedulerName: {{ .Values.metrics.kafka.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.metrics.kafka.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "kafka.metrics.kafka.serviceAccountName" . }}
|
||||
{{- if .Values.metrics.kafka.initContainers }}
|
||||
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kafka-exporter
|
||||
image: {{ include "kafka.metrics.kafka.image" . }}
|
||||
image: {{ include "kafka.metrics.kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.kafka.image.pullPolicy | quote }}
|
||||
{{- if .Values.metrics.kafka.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.metrics.kafka.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.kafka.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- bash
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.kafka.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args:
|
||||
- -ce
|
||||
- |
|
||||
read -r -a sasl_passwords <<< "$(tr ',;' ' ' <<< "${SASL_USER_PASSWORD}")"
|
||||
kafka_exporter \
|
||||
{{- range $i, $e := until $replicaCount }}
|
||||
--kafka.server={{ $fullname }}-{{ $i }}.{{ $fullname }}-headless.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $servicePort }} \
|
||||
{{- end }}
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
--sasl.enabled \
|
||||
--sasl.username="$SASL_USERNAME" \
|
||||
--sasl.password="${sasl_passwords[0]}" \
|
||||
--sasl.username=$SASL_USERNAME \
|
||||
--sasl.password=$SASL_USER_PASSWORD \
|
||||
--sasl.mechanism={{ include "kafka.metrics.kafka.saslMechanism" . }} \
|
||||
{{- end }}
|
||||
{{- if (include "kafka.tlsEncryption" .) }}
|
||||
{{- if (include "kafka.client.tlsEncryption" .) }}
|
||||
--tls.enabled \
|
||||
{{- if .Values.metrics.kafka.certificatesSecret }}
|
||||
--tls.ca-file="/opt/bitnami/kafka-exporter/certs/ca-file" \
|
||||
--tls.cert-file="/opt/bitnami/kafka-exporter/certs/cert-file" \
|
||||
--tls.key-file="/opt/bitnami/kafka-exporter/certs/key-file" \
|
||||
--tls.key-file=/opt/bitnami/kafka-exporter/certs/{{ .Values.metrics.kafka.tlsKey }} \
|
||||
--tls.cert-file=/opt/bitnami/kafka-exporter/certs/{{ .Values.metrics.kafka.tlsCert }} \
|
||||
{{- if .Values.metrics.kafka.tlsCaSecret }}
|
||||
--tls.ca-file=/opt/bitnami/kafka-exporter/cacert/{{ .Values.metrics.kafka.tlsCaCert }} \
|
||||
{{- else }}
|
||||
--tls.ca-file=/opt/bitnami/kafka-exporter/certs/{{ .Values.metrics.kafka.tlsCaCert }} \
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.metrics.kafka.extraFlags }}
|
||||
--{{ $key }}{{ if $value }}={{ $value }}{{ end }} \
|
||||
{{- end }}
|
||||
--web.listen-address=:9308
|
||||
--web.listen-address=:{{ .Values.metrics.kafka.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
{{- $clientUsers := .Values.auth.sasl.jaas.clientUsers }}
|
||||
env:
|
||||
- name: SASL_USERNAME
|
||||
value: {{ index .Values.auth.jaas.clientUsers 0 | quote }}
|
||||
value: {{ index $clientUsers 0 | quote }}
|
||||
- name: SASL_USER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.jaasSecretName" . }}
|
||||
key: client-passwords
|
||||
key: system-user-password
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9308
|
||||
containerPort: {{ .Values.metrics.kafka.containerPorts.metrics }}
|
||||
{{- if .Values.metrics.kafka.resources }}
|
||||
resources: {{ toYaml .Values.metrics.kafka.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and (include "kafka.tlsEncryption" .) .Values.metrics.kafka.certificatesSecret }}
|
||||
volumeMounts:
|
||||
{{- if .Values.metrics.kafka.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and (include "kafka.client.tlsEncryption" .) .Values.metrics.kafka.certificatesSecret }}
|
||||
- name: kafka-exporter-certificates
|
||||
mountPath: /opt/bitnami/kafka-exporter/certs/
|
||||
readOnly: true
|
||||
{{- if .Values.metrics.kafka.tlsCaSecret }}
|
||||
- name: kafka-exporter-ca-certificate
|
||||
mountPath: /opt/bitnami/kafka-exporter/cacert/
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.metrics.kafka.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.kafka.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and (include "kafka.client.tlsEncryption" .) .Values.metrics.kafka.certificatesSecret }}
|
||||
- name: kafka-exporter-certificates
|
||||
secret:
|
||||
secretName: {{ .Values.metrics.kafka.certificatesSecret }}
|
||||
defaultMode: 0440
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.tlsCaSecret }}
|
||||
- name: kafka-exporter-ca-certificate
|
||||
secret:
|
||||
secretName: {{ .Values.metrics.kafka.tlsCaSecret }}
|
||||
defaultMode: 0440
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,16 @@
|
|||
{{- if and .Values.metrics.kafka.enabled .Values.metrics.kafka.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kafka.metrics.kafka.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: cluster-metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.metrics.kafka.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
37
scripts/helmcharts/databases/charts/kafka/templates/kafka-metrics-svc.yaml
Executable file → Normal file
37
scripts/helmcharts/databases/charts/kafka/templates/kafka-metrics-svc.yaml
Executable file → Normal file
|
|
@ -2,44 +2,33 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-metrics
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
name: {{ printf "%s-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: cluster-metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.metrics.kafka.service.annotations .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.metrics.kafka.service.annotations }}
|
||||
{{ include "kafka.tplValue" ( dict "value" .Values.metrics.kafka.service.annotations "context" $) | nindent 4 }}
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.metrics.kafka.service.annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.metrics.kafka.service.type }}
|
||||
{{- if eq .Values.metrics.kafka.service.type "LoadBalancer" }}
|
||||
{{- if .Values.metrics.kafka.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.metrics.kafka.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{- toYaml .Values.metrics.kafka.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.metrics.kafka.service.type "ClusterIP") .Values.metrics.kafka.service.clusterIP }}
|
||||
type: ClusterIP
|
||||
sessionAffinity: {{ .Values.metrics.kafka.service.sessionAffinity }}
|
||||
{{- if .Values.metrics.kafka.service.clusterIP }}
|
||||
clusterIP: {{ .Values.metrics.kafka.service.clusterIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http-metrics
|
||||
port: {{ .Values.metrics.kafka.service.port }}
|
||||
port: {{ .Values.metrics.kafka.service.ports.metrics }}
|
||||
protocol: TCP
|
||||
targetPort: metrics
|
||||
{{- if and (or (eq .Values.metrics.kafka.service.type "NodePort") (eq .Values.metrics.kafka.service.type "LoadBalancer")) (not (empty .Values.metrics.kafka.service.nodePort)) }}
|
||||
nodePort: {{ .Values.metrics.kafka.service.nodePort }}
|
||||
{{- else if eq .Values.metrics.kafka.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
selector: {{- include "kafka.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: cluster-metrics
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,19 @@
|
|||
{{- if and .Values.provisioning.enabled (include "kafka.client.tlsEncryption" .) (not .Values.provisioning.auth.tls.passwordsSecret) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
truststore-password: {{ default "" .Values.provisioning.auth.tls.keystorePassword | b64enc | quote }}
|
||||
keystore-password: {{ default "" .Values.provisioning.auth.tls.truststorePassword | b64enc | quote }}
|
||||
key-password: {{ default "" .Values.provisioning.auth.tls.keyPassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{{- if .Values.provisioning.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kafka.provisioning.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.provisioning.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,260 @@
|
|||
{{- if .Values.provisioning.enabled }}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
kind: Job
|
||||
apiVersion: batch/v1
|
||||
metadata:
|
||||
name: {{ printf "%s-provisioning" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka-provisioning
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
helm.sh/hook: post-install,post-upgrade
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" . | nindent 8 }}
|
||||
app.kubernetes.io/component: kafka-provisioning
|
||||
{{- if .Values.provisioning.podLabels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.podLabels "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.provisioning.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "kafka.provisioning.serviceAccountName" . }}
|
||||
{{- include "kafka.imagePullSecrets" . | nindent 6 }}
|
||||
{{- if .Values.provisioning.schedulerName }}
|
||||
schedulerName: {{ .Values.provisioning.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.provisioning.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
terminationGracePeriodSeconds: 0
|
||||
{{- if .Values.provisioning.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.provisioning.initContainers .Values.provisioning.waitForKafka }}
|
||||
initContainers:
|
||||
{{- if .Values.provisioning.waitForKafka }}
|
||||
- name: wait-for-available-kafka
|
||||
image: {{ include "kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.provisioning.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.provisioning.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
wait-for-port \
|
||||
--host={{ include "common.names.fullname" . }} \
|
||||
--state=inuse \
|
||||
--timeout=120 \
|
||||
{{ .Values.service.ports.client | int64 }};
|
||||
echo "Kafka is available";
|
||||
{{- if .Values.provisioning.resources }}
|
||||
resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kafka-provisioning
|
||||
image: {{ include "kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.provisioning.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.provisioning.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.provisioning.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- /bin/bash
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.provisioning.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
echo "Configuring environment"
|
||||
. /opt/bitnami/scripts/libkafka.sh
|
||||
export CLIENT_CONF="${CLIENT_CONF:-/opt/bitnami/kafka/config/client.properties}"
|
||||
if [ ! -f "$CLIENT_CONF" ]; then
|
||||
touch $CLIENT_CONF
|
||||
|
||||
kafka_common_conf_set "$CLIENT_CONF" security.protocol {{ include "kafka.listenerType" ( dict "protocol" .Values.auth.clientProtocol ) | quote }}
|
||||
{{- if (include "kafka.client.tlsEncryption" .) }}
|
||||
kafka_common_conf_set "$CLIENT_CONF" ssl.keystore.type {{ upper .Values.provisioning.auth.tls.type | quote }}
|
||||
kafka_common_conf_set "$CLIENT_CONF" ssl.truststore.type {{ upper .Values.provisioning.auth.tls.type | quote }}
|
||||
! is_empty_value "$KAFKA_CLIENT_KEY_PASSWORD" && kafka_common_conf_set "$CLIENT_CONF" ssl.key.password "$KAFKA_CLIENT_KEY_PASSWORD"
|
||||
{{- if eq (upper .Values.provisioning.auth.tls.type) "PEM" }}
|
||||
file_to_multiline_property() {
|
||||
awk 'NR > 1{print line" \\"}{line=$0;}END{print $0" "}' <"${1:?missing file}"
|
||||
}
|
||||
kafka_common_conf_set "$CLIENT_CONF" ssl.keystore.key "$(file_to_multiline_property "/certs/{{ .Values.provisioning.auth.tls.key }}")"
|
||||
kafka_common_conf_set "$CLIENT_CONF" ssl.keystore.certificate.chain "$(file_to_multiline_property "/certs/{{ .Values.provisioning.auth.tls.caCert }}")"
|
||||
kafka_common_conf_set "$CLIENT_CONF" ssl.truststore.certificates "$(file_to_multiline_property "/certs/{{ .Values.provisioning.auth.tls.cert }}")"
|
||||
{{- else if eq (upper .Values.provisioning.auth.tls.type) "JKS" }}
|
||||
kafka_common_conf_set "$CLIENT_CONF" ssl.keystore.location "/certs/{{ .Values.provisioning.auth.tls.keystore }}"
|
||||
kafka_common_conf_set "$CLIENT_CONF" ssl.truststore.location "/certs/{{ .Values.provisioning.auth.tls.truststore }}"
|
||||
! is_empty_value "$KAFKA_CLIENT_KEYSTORE_PASSWORD" && kafka_common_conf_set "$CLIENT_CONF" ssl.keystore.password "$KAFKA_CLIENT_KEYSTORE_PASSWORD"
|
||||
! is_empty_value "$KAFKA_CLIENT_TRUSTSTORE_PASSWORD" && kafka_common_conf_set "$CLIENT_CONF" ssl.truststore.password "$KAFKA_CLIENT_TRUSTSTORE_PASSWORD"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
{{- if contains "plain" .Values.auth.sasl.mechanisms }}
|
||||
kafka_common_conf_set "$CLIENT_CONF" sasl.mechanism PLAIN
|
||||
kafka_common_conf_set "$CLIENT_CONF" sasl.jaas.config "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"$SASL_USERNAME\" password=\"$SASL_USER_PASSWORD\";"
|
||||
{{- else if contains "scram-sha-256" .Values.auth.sasl.mechanisms }}
|
||||
kafka_common_conf_set "$CLIENT_CONF" sasl.mechanism SCRAM-SHA-256
|
||||
kafka_common_conf_set "$CLIENT_CONF" sasl.jaas.config "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"$SASL_USERNAME\" password=\"$SASL_USER_PASSWORD\";"
|
||||
{{- else if contains "scram-sha-512" .Values.auth.sasl.mechanisms }}
|
||||
kafka_common_conf_set "$CLIENT_CONF" sasl.mechanism SCRAM-SHA-512
|
||||
kafka_common_conf_set "$CLIENT_CONF" sasl.jaas.config "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"$SASL_USERNAME\" password=\"$SASL_USER_PASSWORD\";"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
fi
|
||||
|
||||
echo "Running pre-provisioning script if any given"
|
||||
{{ .Values.provisioning.preScript | nindent 14 }}
|
||||
|
||||
kafka_provisioning_commands=(
|
||||
{{- range $topic := .Values.provisioning.topics }}
|
||||
"/opt/bitnami/kafka/bin/kafka-topics.sh \
|
||||
--create \
|
||||
--if-not-exists \
|
||||
--bootstrap-server ${KAFKA_SERVICE} \
|
||||
--replication-factor {{ $topic.replicationFactor | default $.Values.provisioning.replicationFactor }} \
|
||||
--partitions {{ $topic.partitions | default $.Values.provisioning.numPartitions }} \
|
||||
{{- range $name, $value := $topic.config }}
|
||||
--config {{ $name }}={{ $value }} \
|
||||
{{- end }}
|
||||
--command-config ${CLIENT_CONF} \
|
||||
--topic {{ $topic.name }}"
|
||||
{{- end }}
|
||||
{{- range $command := .Values.provisioning.extraProvisioningCommands }}
|
||||
{{- $command | quote | nindent 16 }}
|
||||
{{- end }}
|
||||
)
|
||||
|
||||
echo "Starting provisioning"
|
||||
for ((index=0; index < ${#kafka_provisioning_commands[@]}; index+={{ .Values.provisioning.parallel }}))
|
||||
do
|
||||
for j in $(seq ${index} $((${index}+{{ .Values.provisioning.parallel }}-1)))
|
||||
do
|
||||
${kafka_provisioning_commands[j]} & # Async command
|
||||
done
|
||||
wait # Wait the end of the jobs
|
||||
done
|
||||
|
||||
echo "Running post-provisioning script if any given"
|
||||
{{ .Values.provisioning.postScript | nindent 14 }}
|
||||
|
||||
echo "Provisioning succeeded"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
{{- if (include "kafka.client.tlsEncryption" .) }}
|
||||
- name: KAFKA_CLIENT_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
key: {{ .Values.provisioning.auth.tls.keyPasswordSecretKey }}
|
||||
- name: KAFKA_CLIENT_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
key: {{ .Values.provisioning.auth.tls.keystorePasswordSecretKey }}
|
||||
- name: KAFKA_CLIENT_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
key: {{ .Values.provisioning.auth.tls.truststorePasswordSecretKey }}
|
||||
{{- end }}
|
||||
- name: KAFKA_SERVICE
|
||||
value: {{ printf "%s:%d" (include "common.names.fullname" .) (.Values.service.ports.client | int64) }}
|
||||
{{- if (include "kafka.client.saslAuthentication" .) }}
|
||||
{{- $clientUsers := .Values.auth.sasl.jaas.clientUsers }}
|
||||
- name: SASL_USERNAME
|
||||
value: {{ index $clientUsers 0 | quote }}
|
||||
- name: SASL_USER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.jaasSecretName" . }}
|
||||
key: system-user-password
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.provisioning.extraEnvVarsCM .Values.provisioning.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.provisioning.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.provisioning.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.provisioning.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.resources }}
|
||||
resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if or .Values.log4j .Values.existingLog4jConfigMap }}
|
||||
- name: log4j-config
|
||||
mountPath: {{ .Values.persistence.mountPath }}/config/log4j.properties
|
||||
subPath: log4j.properties
|
||||
{{- end }}
|
||||
{{- if (include "kafka.client.tlsEncryption" .) }}
|
||||
{{- if not (empty .Values.provisioning.auth.tls.certificatesSecret) }}
|
||||
- name: kafka-client-certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if or .Values.log4j .Values.existingLog4jConfigMap }}
|
||||
- name: log4j-config
|
||||
configMap:
|
||||
name: {{ include "kafka.log4j.configMapName" . }}
|
||||
{{ end }}
|
||||
{{- if (include "kafka.client.tlsEncryption" .) }}
|
||||
{{- if not (empty .Values.provisioning.auth.tls.certificatesSecret) }}
|
||||
- name: kafka-client-certs
|
||||
secret:
|
||||
secretName: {{ .Values.provisioning.auth.tls.certificatesSecret }}
|
||||
defaultMode: 256
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
9
scripts/helmcharts/databases/charts/kafka/templates/log4j-configmap.yaml
Executable file → Normal file
9
scripts/helmcharts/databases/charts/kafka/templates/log4j-configmap.yaml
Executable file → Normal file
|
|
@ -3,14 +3,15 @@ apiVersion: v1
|
|||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "kafka.log4j.configMapName" . }}
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
log4j.properties: |-
|
||||
{{ .Values.log4j | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.log4j "context" $ ) | nindent 4 }}
|
||||
{{- end -}}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,22 @@
|
|||
{{- if and .Values.networkPolicy.enabled .Values.networkPolicy.egressRules.customRules }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-egress" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.egressRules.customRules "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
{{- if .Values.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-ingress" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
# Allow client connections
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.client }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- if .Values.networkPolicy.explicitNamespacesSelector }}
|
||||
namespaceSelector: {{- toYaml .Values.networkPolicy.explicitNamespacesSelector | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Allow communication inter-broker
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.internal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{- include "common.labels.matchLabels" . | nindent 14 }}
|
||||
# Allow External connection
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.external }}
|
||||
{{- if .Values.externalAccess.from }}
|
||||
from: {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.externalAccess.from "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.kafka.enabled }}
|
||||
# Allow prometheus scrapes
|
||||
- ports:
|
||||
- port: {{ .Values.metrics.kafka.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
13
scripts/helmcharts/databases/charts/kafka/templates/poddisruptionbudget.yaml
Executable file → Normal file
13
scripts/helmcharts/databases/charts/kafka/templates/poddisruptionbudget.yaml
Executable file → Normal file
|
|
@ -1,16 +1,17 @@
|
|||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- if and .Values.pdb.create (gt $replicaCount 1) }}
|
||||
apiVersion: {{ ternary "policy/v1" "policy/v1beta1" (semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version) }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pdb.minAvailable }}
|
||||
|
|
@ -20,6 +21,6 @@ spec:
|
|||
maxUnavailable: {{ .Values.pdb.maxUnavailable }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "kafka.matchLabels" . | nindent 6 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,20 @@
|
|||
{{- if and (or .Values.metrics.kafka.enabled .Values.metrics.jmx.enabled) .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.groups }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.prometheusRule.namespace }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.prometheusRule.labels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.labels "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.groups "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
11
scripts/helmcharts/databases/charts/kafka/templates/role.yaml
Executable file → Normal file
11
scripts/helmcharts/databases/charts/kafka/templates/role.yaml
Executable file → Normal file
|
|
@ -1,15 +1,16 @@
|
|||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
|
|||
15
scripts/helmcharts/databases/charts/kafka/templates/rolebinding.yaml
Executable file → Normal file
15
scripts/helmcharts/databases/charts/kafka/templates/rolebinding.yaml
Executable file → Normal file
|
|
@ -1,19 +1,20 @@
|
|||
{{- if and .Values.serviceAccount.create .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ template "kafka.fullname" . }}
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
|
|
|
|||
126
scripts/helmcharts/databases/charts/kafka/templates/scripts-configmap.yaml
Executable file → Normal file
126
scripts/helmcharts/databases/charts/kafka/templates/scripts-configmap.yaml
Executable file → Normal file
|
|
@ -1,20 +1,24 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-scripts
|
||||
labels: {{- include "kafka.labels" . | nindent 4 }}
|
||||
name: {{ printf "%s-scripts" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "kafka.tplValue" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "kafka.tplValue" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- $fullname := include "kafka.fullname" . }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $interBrokerPort := .Values.service.internalPort }}
|
||||
{{- $clientPort := .Values.service.port }}
|
||||
{{- $interBrokerPort := .Values.service.ports.internal }}
|
||||
{{- $clientPort := .Values.service.ports.client }}
|
||||
{{- $jksTruststoreSecret := .Values.auth.tls.jksTruststoreSecret -}}
|
||||
{{- $jksTruststore := .Values.auth.tls.jksTruststore -}}
|
||||
{{- $jksKeystoreSAN := .Values.auth.tls.jksKeystoreSAN -}}
|
||||
{{- if .Values.externalAccess.autoDiscovery.enabled }}
|
||||
auto-discovery.sh: |-
|
||||
#!/bin/bash
|
||||
|
|
@ -22,7 +26,7 @@ data:
|
|||
SVC_NAME="${MY_POD_NAME}-external"
|
||||
|
||||
{{- if eq .Values.externalAccess.service.type "LoadBalancer" }}
|
||||
# Auxiliar functions
|
||||
# Auxiliary functions
|
||||
retry_while() {
|
||||
local -r cmd="${1:?cmd is missing}"
|
||||
local -r retries="${2:-12}"
|
||||
|
|
@ -72,47 +76,127 @@ data:
|
|||
#!/bin/bash
|
||||
|
||||
ID="${MY_POD_NAME#"{{ $fullname }}-"}"
|
||||
export KAFKA_CFG_BROKER_ID="$ID"
|
||||
if [[ -f "{{ .Values.logsDirs | splitList "," | first }}/meta.properties" ]]; then
|
||||
export KAFKA_CFG_BROKER_ID="$(grep "broker.id" "{{ .Values.logsDirs | splitList "," | first }}/meta.properties" | awk -F '=' '{print $2}')"
|
||||
else
|
||||
export KAFKA_CFG_BROKER_ID="$((ID + {{ .Values.minBrokerId }}))"
|
||||
fi
|
||||
|
||||
{{- if eq .Values.brokerRackAssignment "aws-az" }}
|
||||
export KAFKA_CFG_BROKER_RACK=$(curl "http://169.254.169.254/latest/meta-data/placement/availability-zone-id")
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
# Configure external ip and port
|
||||
{{- if eq .Values.externalAccess.service.type "LoadBalancer" }}
|
||||
{{- if .Values.externalAccess.autoDiscovery.enabled }}
|
||||
export EXTERNAL_ACCESS_IP="$(<${SHARED_FILE})"
|
||||
export EXTERNAL_ACCESS_HOST="$(<${SHARED_FILE})"
|
||||
{{- else }}
|
||||
export EXTERNAL_ACCESS_IP=$(echo '{{ .Values.externalAccess.service.loadBalancerIPs }}' | tr -d '[]' | cut -d ' ' -f "$(($ID + 1))")
|
||||
export EXTERNAL_ACCESS_HOST=$(echo '{{ .Values.externalAccess.service.loadBalancerNames | default .Values.externalAccess.service.loadBalancerIPs }}' | tr -d '[]' | cut -d ' ' -f "$(($ID + 1))")
|
||||
{{- end }}
|
||||
export EXTERNAL_ACCESS_PORT={{ .Values.externalAccess.service.port }}
|
||||
export EXTERNAL_ACCESS_PORT={{ .Values.externalAccess.service.ports.external }}
|
||||
{{- else if eq .Values.externalAccess.service.type "NodePort" }}
|
||||
{{- if .Values.externalAccess.service.domain }}
|
||||
export EXTERNAL_ACCESS_IP={{ .Values.externalAccess.service.domain }}
|
||||
{{- if and .Values.externalAccess.service.usePodIPs .Values.externalAccess.autoDiscovery.enabled }}
|
||||
export EXTERNAL_ACCESS_HOST="${MY_POD_IP}"
|
||||
{{- else if or .Values.externalAccess.service.useHostIPs .Values.externalAccess.autoDiscovery.enabled }}
|
||||
export EXTERNAL_ACCESS_HOST="${HOST_IP}"
|
||||
{{- else if .Values.externalAccess.service.domain }}
|
||||
export EXTERNAL_ACCESS_HOST={{ .Values.externalAccess.service.domain }}
|
||||
{{- else }}
|
||||
export EXTERNAL_ACCESS_IP=$(curl -s https://ipinfo.io/ip)
|
||||
export EXTERNAL_ACCESS_HOST=$(curl -s https://ipinfo.io/ip)
|
||||
{{- end }}
|
||||
{{- if .Values.externalAccess.autoDiscovery.enabled }}
|
||||
export EXTERNAL_ACCESS_PORT="$(<${SHARED_FILE})"
|
||||
{{- else }}
|
||||
export EXTERNAL_ACCESS_PORT=$(echo '{{ .Values.externalAccess.service.nodePorts }}' | tr -d '[]' | cut -d ' ' -f "$(($ID + 1))")
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
export EXTERNAL_ACCESS_HOST={{ .Values.externalAccess.service.domain }}
|
||||
export EXTERNAL_ACCESS_PORT="$((ID + {{ .Values.externalAccess.service.ports.external }}))"
|
||||
{{- end }}
|
||||
|
||||
# Configure Kafka advertised listeners
|
||||
{{- if .Values.advertisedListeners }}
|
||||
export KAFKA_CFG_ADVERTISED_LISTENERS={{ .Values.advertisedListeners }}
|
||||
export KAFKA_CFG_ADVERTISED_LISTENERS={{ join "," .Values.advertisedListeners }}
|
||||
{{- else }}
|
||||
export KAFKA_CFG_ADVERTISED_LISTENERS="INTERNAL://${MY_POD_NAME}.{{ $fullname }}-headless.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $interBrokerPort }},CLIENT://${MY_POD_NAME}.{{ $fullname }}-headless.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $clientPort }},EXTERNAL://${EXTERNAL_ACCESS_IP}:${EXTERNAL_ACCESS_PORT}"
|
||||
export KAFKA_CFG_ADVERTISED_LISTENERS="INTERNAL://${MY_POD_NAME}.{{ $fullname }}-headless.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $interBrokerPort }},CLIENT://${MY_POD_NAME}.{{ $fullname }}-headless.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ $clientPort }},EXTERNAL://${EXTERNAL_ACCESS_HOST}:${EXTERNAL_ACCESS_PORT}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if (include "kafka.tlsEncryption" .) }}
|
||||
if [[ -f "/certs/kafka.truststore.jks" ]] && [[ -f "/certs/kafka-${ID}.keystore.jks" ]]; then
|
||||
mkdir -p /opt/bitnami/kafka/config/certs
|
||||
cp "/certs/kafka.truststore.jks" "/opt/bitnami/kafka/config/certs/kafka.truststore.jks"
|
||||
cp "/certs/kafka-${ID}.keystore.jks" "/opt/bitnami/kafka/config/certs/kafka.keystore.jks"
|
||||
mkdir -p /opt/bitnami/kafka/config/certs
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
{{- if not (empty .Values.auth.tls.existingSecrets) }}
|
||||
JKS_TRUSTSTORE={{ printf "/%s/%s" (ternary "certs-${ID}" "truststore" (empty $jksTruststoreSecret)) (default "kafka.truststore.jks" $jksTruststore) | quote }}
|
||||
JKS_KEYSTORE={{ printf "/certs-${ID}/%s" (default "kafka.keystore.jks" $jksKeystoreSAN) | quote }}
|
||||
{{- else }}
|
||||
JKS_TRUSTSTORE={{ printf "/%s/%s" (ternary "certs" "truststore" (empty $jksTruststoreSecret)) (default "kafka.truststore.jks" $jksTruststore) | quote }}
|
||||
JKS_KEYSTORE={{ printf "/certs/%s" (default "kafka-${ID}.keystore.jks" $jksKeystoreSAN) | quote }}
|
||||
{{- end }}
|
||||
if [[ -f "$JKS_TRUSTSTORE" ]] && [[ -f "$JKS_KEYSTORE" ]]; then
|
||||
cp "$JKS_TRUSTSTORE" "/opt/bitnami/kafka/config/certs/kafka.truststore.jks"
|
||||
cp "$JKS_KEYSTORE" "/opt/bitnami/kafka/config/certs/kafka.keystore.jks"
|
||||
else
|
||||
echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
export KAFKA_TLS_TRUSTSTORE_FILE="/opt/bitnami/kafka/config/certs/kafka.truststore.jks"
|
||||
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
|
||||
{{- if or (not (empty .Values.auth.tls.existingSecrets)) .Values.auth.tls.autoGenerated }}
|
||||
PEM_CA="/certs-${ID}/ca.crt"
|
||||
PEM_CERT="/certs-${ID}/tls.crt"
|
||||
PEM_KEY="/certs-${ID}/tls.key"
|
||||
{{- else }}
|
||||
PEM_CA="/certs/kafka.truststore.pem"
|
||||
PEM_CERT="/certs/kafka-${ID}.keystore.pem"
|
||||
PEM_KEY="/certs/kafka-${ID}.keystore.key"
|
||||
{{- end }}
|
||||
if [[ -f "$PEM_CERT" ]] && [[ -f "$PEM_KEY" ]]; then
|
||||
CERT_DIR="/opt/bitnami/kafka/config/certs"
|
||||
PEM_CA_LOCATION="${CERT_DIR}/kafka.truststore.pem"
|
||||
PEM_CERT_LOCATION="${CERT_DIR}/kafka.keystore.pem"
|
||||
{{- if .Values.auth.tls.pemChainIncluded }}
|
||||
cat $PEM_CERT | csplit - -s -z '/\-*END CERTIFICATE\-*/+1' '{*}' -f ${CERT_DIR}/xx
|
||||
FIND_CA_RESULT=$(find ${CERT_DIR} -not -name 'xx00' -name 'xx*')
|
||||
if [[ $(echo $FIND_CA_RESULT | wc -l) < 1 ]]; then
|
||||
echo "auth.tls.pemChainIncluded was set, but PEM chain only contained 1 cert"
|
||||
exit 1
|
||||
fi
|
||||
echo $FIND_CA_RESULT | sort | xargs cat >> "$PEM_CA_LOCATION"
|
||||
cat ${CERT_DIR}/xx00 > "$PEM_CERT_LOCATION"
|
||||
{{- else }}
|
||||
if [[ -f "$PEM_CA" ]]; then
|
||||
cp "$PEM_CA" "$PEM_CA_LOCATION"
|
||||
cp "$PEM_CERT" "$PEM_CERT_LOCATION"
|
||||
else
|
||||
echo "PEM_CA not provided, and auth.tls.pemChainIncluded was not true. One of these values must be set when using PEM type for TLS."
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
|
||||
# Ensure the key used PEM format with PKCS#8
|
||||
openssl pkcs8 -topk8 -nocrypt -in "$PEM_KEY" > "/opt/bitnami/kafka/config/certs/kafka.keystore.key"
|
||||
else
|
||||
echo "Couldn't find the expected PEM files! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
export KAFKA_TLS_TRUSTSTORE_FILE="/opt/bitnami/kafka/config/certs/kafka.truststore.pem"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
# Configure zookeeper client
|
||||
{{- if and (not (empty .Values.auth.zookeeper.tls.existingSecret)) .Values.auth.zookeeper.tls.enabled }}
|
||||
JKS_TRUSTSTORE={{ printf "/kafka-zookeeper-cert/%s" (.Values.auth.zookeeper.tls.existingSecretTruststoreKey) | quote }}
|
||||
JKS_KEYSTORE={{ printf "/kafka-zookeeper-cert/%s" (.Values.auth.zookeeper.tls.existingSecretKeystoreKey) | quote }}
|
||||
if [[ -f "$JKS_TRUSTSTORE" ]] && [[ -f "$JKS_KEYSTORE" ]]; then
|
||||
CERT_DIR="/opt/bitnami/kafka/config/certs"
|
||||
TRUSTSTORE_LOCATION="${CERT_DIR}/zookeeper.truststore.jks"
|
||||
cp "$JKS_TRUSTSTORE" "$TRUSTSTORE_LOCATION"
|
||||
cp "$JKS_KEYSTORE" "${CERT_DIR}/zookeeper.keystore.jks"
|
||||
export KAFKA_ZOOKEEPER_TLS_TRUSTSTORE_FILE="${TRUSTSTORE_LOCATION}"
|
||||
fi
|
||||
{{- end }}
|
||||
|
||||
exec /entrypoint.sh /run.sh
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Reference in a new issue