Remove Flink and Metabase manifests from the freeleaps-data-platform directory, including CRDs, RBAC configurations, deployments, and associated resources. This cleanup streamlines the project by eliminating unused components.
Signed-off-by: zhenyus <zhenyus@mathmast.com>
This commit is contained in:
zhenyus
parent
604af2dffb
commit
d90e0f2692
@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@ -0,0 +1,26 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
---
|
||||
apiVersion: v2
|
||||
name: flink-kubernetes-operator
|
||||
description: A Helm chart for the Apache Flink Kubernetes Operator
|
||||
type: application
|
||||
version: 1.12.1
|
||||
appVersion: 1.12.1
|
||||
icon: https://flink.apache.org/img/logo/png/50/color_50.png
|
||||
@ -0,0 +1,60 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
# Flink job/cluster related configs
|
||||
taskmanager.numberOfTaskSlots: 1
|
||||
parallelism.default: 1
|
||||
|
||||
# These parameters are required for Java 17 support.
|
||||
# Flink 1.18 uses env.java.opts.all, if a user supplies their own version of these opts in their FlinkDeployment the options below will be overridden.
|
||||
# env.java.default-opts.all is used for 1.19 onwards so users can supply their own opts.all in their Job deployments and have these appended.
|
||||
kubernetes.operator.default-configuration.flink-version.v1_18.env.java.opts.all: --add-exports=java.base/sun.net.util=ALL-UNNAMED --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED --add-exports=java.security.jgss/sun.security.krb5=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.text=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED
|
||||
kubernetes.operator.default-configuration.flink-version.v1_19+.env.java.default-opts.all: --add-exports=java.base/sun.net.util=ALL-UNNAMED --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED --add-exports=java.security.jgss/sun.security.krb5=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.text=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED
|
||||
|
||||
# Flink operator related configs
|
||||
# kubernetes.operator.reconcile.interval: 60 s
|
||||
# kubernetes.operator.reconcile.parallelism: 5
|
||||
# kubernetes.operator.flink.client.cancel.timeout: 1 min
|
||||
# kubernetes.operator.resource.cleanup.timeout: 60 s
|
||||
# kubernetes.operator.observer.rest-ready.delay: 10 s
|
||||
# kubernetes.operator.observer.progress-check.interval: 10 s
|
||||
# kubernetes.operator.observer.savepoint.trigger.grace-period: 10 s
|
||||
# kubernetes.operator.flink.client.timeout: 10 s
|
||||
# kubernetes.operator.deployment.rollback.enabled: false
|
||||
# kubernetes.operator.deployment.readiness.timeout: 5min
|
||||
# kubernetes.operator.user.artifacts.base.dir: /opt/flink/artifacts
|
||||
# kubernetes.operator.job.upgrade.ignore-pending-savepoint: false
|
||||
# kubernetes.operator.watched.namespaces: ns1,ns2
|
||||
# kubernetes.operator.label.selector: flink=enabled
|
||||
# kubernetes.operator.dynamic.namespaces.enabled: false
|
||||
# kubernetes.operator.retry.initial.interval: 5 s
|
||||
# kubernetes.operator.retry.interval.multiplier: 2
|
||||
# kubernetes.operator.retry.max.attempts: 10
|
||||
# kubernetes.operator.exception.stacktrace.enabled: false
|
||||
# kubernetes.operator.exception.stacktrace.max.length: 2048
|
||||
# kubernetes.operator.exception.field.max.length: 2048
|
||||
# kubernetes.operator.exception.throwable.list.max.count: 2
|
||||
# kubernetes.operator.exception.label.mapper: Job has already been submitted:duplicatedJobFound,Server returned HTTP response code:httpResponseCodeFound
|
||||
# kubernetes.operator.leader-election.enabled: false
|
||||
# kubernetes.operator.leader-election.lease-name: flink-operator-lease
|
||||
|
||||
# kubernetes.operator.snapshot.resource.enabled: true
|
||||
# kubernetes.operator.savepoint.dispose-on-delete: true
|
||||
|
||||
# kubernetes.operator.metrics.reporter.slf4j.factory.class: org.apache.flink.metrics.slf4j.Slf4jReporterFactory
|
||||
# kubernetes.operator.metrics.reporter.slf4j.interval: 5 MINUTE
|
||||
@ -0,0 +1,65 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
# This affects logging for both user code and Flink
|
||||
rootLogger.level = INFO
|
||||
rootLogger.appenderRef.console.ref = ConsoleAppender
|
||||
rootLogger.appenderRef.rolling.ref = RollingFileAppender
|
||||
|
||||
# Uncomment this if you want to _only_ change Flink's logging
|
||||
#logger.flink.name = org.apache.flink
|
||||
#logger.flink.level = INFO
|
||||
|
||||
# The following lines keep the log level of common libraries/connectors on
|
||||
# log level INFO. The root logger does not override this. You have to manually
|
||||
# change the log levels here.
|
||||
logger.akka.name = akka
|
||||
logger.akka.level = INFO
|
||||
logger.kafka.name= org.apache.kafka
|
||||
logger.kafka.level = INFO
|
||||
logger.hadoop.name = org.apache.hadoop
|
||||
logger.hadoop.level = INFO
|
||||
logger.zookeeper.name = org.apache.zookeeper
|
||||
logger.zookeeper.level = INFO
|
||||
|
||||
# Log all infos to the console
|
||||
appender.console.name = ConsoleAppender
|
||||
appender.console.type = CONSOLE
|
||||
appender.console.layout.type = PatternLayout
|
||||
appender.console.layout.pattern = %d{yyyy-MM-dd HH:mm:ss,SSS} %-5p %-60c %x - %m%n
|
||||
|
||||
# Log all infos in the given rolling file
|
||||
appender.rolling.name = RollingFileAppender
|
||||
appender.rolling.type = RollingFile
|
||||
appender.rolling.append = false
|
||||
appender.rolling.fileName = ${sys:log.file}
|
||||
appender.rolling.filePattern = ${sys:log.file}.%i
|
||||
appender.rolling.layout.type = PatternLayout
|
||||
appender.rolling.layout.pattern = %d{yyyy-MM-dd HH:mm:ss,SSS} %-5p %-60c %x - %m%n
|
||||
appender.rolling.policies.type = Policies
|
||||
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
|
||||
appender.rolling.policies.size.size=100MB
|
||||
appender.rolling.strategy.type = DefaultRolloverStrategy
|
||||
appender.rolling.strategy.max = 10
|
||||
|
||||
# Suppress the irrelevant (wrong) warnings from the Netty channel handler
|
||||
logger.netty.name = org.apache.flink.shaded.akka.org.jboss.netty.channel.DefaultChannelPipeline
|
||||
logger.netty.level = OFF
|
||||
|
||||
# The monitor interval in seconds to enable log4j automatic reconfiguration
|
||||
# monitorInterval = 30
|
||||
@ -0,0 +1,37 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
rootLogger.level = INFO
|
||||
rootLogger.appenderRef.console.ref = ConsoleAppender
|
||||
|
||||
# Log all infos to the console
|
||||
appender.console.name = ConsoleAppender
|
||||
appender.console.type = CONSOLE
|
||||
appender.console.layout.type = PatternLayout
|
||||
appender.console.layout.pattern = %style{%d}{yellow} %style{%-30c{1.}}{cyan} %highlight{[%-5level]%notEmpty{[%X{resource.namespace}/}%notEmpty{%X{resource.name}]} %msg%n%throwable}
|
||||
|
||||
# Do not log config loading
|
||||
logger.conf.name = org.apache.flink.configuration.GlobalConfiguration
|
||||
logger.conf.level = ERROR
|
||||
|
||||
# Avoid logging fallback key INFO messages
|
||||
logger.conf.name = org.apache.flink.configuration.Configuration
|
||||
logger.conf.level = ERROR
|
||||
|
||||
# The monitor interval in seconds to enable log4j automatic reconfiguration
|
||||
# monitorInterval = 30
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,273 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
# Generated by Fabric8 CRDGenerator, manual edits might get overwritten!
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: flinksessionjobs.flink.apache.org
|
||||
spec:
|
||||
group: flink.apache.org
|
||||
names:
|
||||
kind: FlinkSessionJob
|
||||
plural: flinksessionjobs
|
||||
shortNames:
|
||||
- sessionjob
|
||||
singular: flinksessionjob
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Last observed state of the job.
|
||||
jsonPath: .status.jobStatus.state
|
||||
name: Job Status
|
||||
priority: 0
|
||||
type: string
|
||||
- description: "Lifecycle state of the Flink resource (including being rolled\
|
||||
\ back, failed etc.)."
|
||||
jsonPath: .status.lifecycleState
|
||||
name: Lifecycle State
|
||||
priority: 0
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
deploymentName:
|
||||
type: string
|
||||
flinkConfiguration:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
job:
|
||||
properties:
|
||||
allowNonRestoredState:
|
||||
type: boolean
|
||||
args:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
autoscalerResetNonce:
|
||||
type: integer
|
||||
checkpointTriggerNonce:
|
||||
type: integer
|
||||
entryClass:
|
||||
type: string
|
||||
initialSavepointPath:
|
||||
type: string
|
||||
jarURI:
|
||||
type: string
|
||||
parallelism:
|
||||
type: integer
|
||||
savepointRedeployNonce:
|
||||
type: integer
|
||||
savepointTriggerNonce:
|
||||
type: integer
|
||||
state:
|
||||
enum:
|
||||
- running
|
||||
- suspended
|
||||
type: string
|
||||
upgradeMode:
|
||||
enum:
|
||||
- last-state
|
||||
- savepoint
|
||||
- stateless
|
||||
type: string
|
||||
type: object
|
||||
restartNonce:
|
||||
type: integer
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
error:
|
||||
type: string
|
||||
jobStatus:
|
||||
properties:
|
||||
checkpointInfo:
|
||||
properties:
|
||||
formatType:
|
||||
enum:
|
||||
- FULL
|
||||
- INCREMENTAL
|
||||
- UNKNOWN
|
||||
type: string
|
||||
lastCheckpoint:
|
||||
properties:
|
||||
formatType:
|
||||
enum:
|
||||
- FULL
|
||||
- INCREMENTAL
|
||||
- UNKNOWN
|
||||
type: string
|
||||
timeStamp:
|
||||
type: integer
|
||||
triggerNonce:
|
||||
type: integer
|
||||
triggerType:
|
||||
enum:
|
||||
- MANUAL
|
||||
- PERIODIC
|
||||
- UNKNOWN
|
||||
- UPGRADE
|
||||
type: string
|
||||
type: object
|
||||
lastPeriodicCheckpointTimestamp:
|
||||
type: integer
|
||||
triggerId:
|
||||
type: string
|
||||
triggerTimestamp:
|
||||
type: integer
|
||||
triggerType:
|
||||
enum:
|
||||
- MANUAL
|
||||
- PERIODIC
|
||||
- UNKNOWN
|
||||
- UPGRADE
|
||||
type: string
|
||||
type: object
|
||||
jobId:
|
||||
type: string
|
||||
jobName:
|
||||
type: string
|
||||
savepointInfo:
|
||||
properties:
|
||||
formatType:
|
||||
enum:
|
||||
- CANONICAL
|
||||
- NATIVE
|
||||
- UNKNOWN
|
||||
type: string
|
||||
lastPeriodicSavepointTimestamp:
|
||||
type: integer
|
||||
lastSavepoint:
|
||||
properties:
|
||||
formatType:
|
||||
enum:
|
||||
- CANONICAL
|
||||
- NATIVE
|
||||
- UNKNOWN
|
||||
type: string
|
||||
location:
|
||||
type: string
|
||||
timeStamp:
|
||||
type: integer
|
||||
triggerNonce:
|
||||
type: integer
|
||||
triggerType:
|
||||
enum:
|
||||
- MANUAL
|
||||
- PERIODIC
|
||||
- UNKNOWN
|
||||
- UPGRADE
|
||||
type: string
|
||||
type: object
|
||||
savepointHistory:
|
||||
items:
|
||||
properties:
|
||||
formatType:
|
||||
enum:
|
||||
- CANONICAL
|
||||
- NATIVE
|
||||
- UNKNOWN
|
||||
type: string
|
||||
location:
|
||||
type: string
|
||||
timeStamp:
|
||||
type: integer
|
||||
triggerNonce:
|
||||
type: integer
|
||||
triggerType:
|
||||
enum:
|
||||
- MANUAL
|
||||
- PERIODIC
|
||||
- UNKNOWN
|
||||
- UPGRADE
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
triggerId:
|
||||
type: string
|
||||
triggerTimestamp:
|
||||
type: integer
|
||||
triggerType:
|
||||
enum:
|
||||
- MANUAL
|
||||
- PERIODIC
|
||||
- UNKNOWN
|
||||
- UPGRADE
|
||||
type: string
|
||||
type: object
|
||||
startTime:
|
||||
type: string
|
||||
state:
|
||||
enum:
|
||||
- CANCELED
|
||||
- CANCELLING
|
||||
- CREATED
|
||||
- FAILED
|
||||
- FAILING
|
||||
- FINISHED
|
||||
- INITIALIZING
|
||||
- RECONCILING
|
||||
- RESTARTING
|
||||
- RUNNING
|
||||
- SUSPENDED
|
||||
type: string
|
||||
updateTime:
|
||||
type: string
|
||||
upgradeSavepointPath:
|
||||
type: string
|
||||
type: object
|
||||
lifecycleState:
|
||||
enum:
|
||||
- CREATED
|
||||
- DELETED
|
||||
- DELETING
|
||||
- DEPLOYED
|
||||
- FAILED
|
||||
- ROLLED_BACK
|
||||
- ROLLING_BACK
|
||||
- STABLE
|
||||
- SUSPENDED
|
||||
- UPGRADING
|
||||
type: string
|
||||
observedGeneration:
|
||||
type: integer
|
||||
reconciliationStatus:
|
||||
properties:
|
||||
lastReconciledSpec:
|
||||
type: string
|
||||
lastStableSpec:
|
||||
type: string
|
||||
reconciliationTimestamp:
|
||||
type: integer
|
||||
state:
|
||||
enum:
|
||||
- DEPLOYED
|
||||
- ROLLED_BACK
|
||||
- ROLLING_BACK
|
||||
- UPGRADING
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@ -0,0 +1,112 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
# Generated by Fabric8 CRDGenerator, manual edits might get overwritten!
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: flinkstatesnapshots.flink.apache.org
|
||||
spec:
|
||||
group: flink.apache.org
|
||||
names:
|
||||
kind: FlinkStateSnapshot
|
||||
plural: flinkstatesnapshots
|
||||
shortNames:
|
||||
- flinksnp
|
||||
singular: flinkstatesnapshot
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Final path of the snapshot.
|
||||
jsonPath: .status.path
|
||||
name: Path
|
||||
priority: 0
|
||||
type: string
|
||||
- description: Timestamp when the snapshot was last created/failed.
|
||||
jsonPath: .status.resultTimestamp
|
||||
name: Result Timestamp
|
||||
priority: 0
|
||||
type: string
|
||||
- description: Current state of the snapshot.
|
||||
jsonPath: .status.state
|
||||
name: Snapshot State
|
||||
priority: 0
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
backoffLimit:
|
||||
type: integer
|
||||
checkpoint:
|
||||
type: object
|
||||
jobReference:
|
||||
properties:
|
||||
kind:
|
||||
enum:
|
||||
- FlinkDeployment
|
||||
- FlinkSessionJob
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
savepoint:
|
||||
properties:
|
||||
alreadyExists:
|
||||
type: boolean
|
||||
disposeOnDelete:
|
||||
type: boolean
|
||||
formatType:
|
||||
enum:
|
||||
- CANONICAL
|
||||
- NATIVE
|
||||
- UNKNOWN
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
error:
|
||||
type: string
|
||||
failures:
|
||||
type: integer
|
||||
path:
|
||||
type: string
|
||||
resultTimestamp:
|
||||
type: string
|
||||
state:
|
||||
enum:
|
||||
- ABANDONED
|
||||
- COMPLETED
|
||||
- FAILED
|
||||
- IN_PROGRESS
|
||||
- TRIGGER_PENDING
|
||||
type: string
|
||||
triggerId:
|
||||
type: string
|
||||
triggerTimestamp:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@ -0,0 +1,197 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "flink-operator.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "flink-operator.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "flink-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "flink-operator.labels" -}}
|
||||
{{ include "flink-operator.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "flink-operator.chart" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "flink-operator.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "flink-operator.name" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the path of the operator image to use
|
||||
*/}}
|
||||
{{- define "flink-operator.imagePath" -}}
|
||||
{{- if .Values.image.digest }}
|
||||
{{- .Values.image.repository }}@{{ .Values.image.digest }}
|
||||
{{- else }}
|
||||
{{- .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the operator role to use
|
||||
*/}}
|
||||
{{- define "flink-operator.roleName" -}}
|
||||
{{- if .Values.rbac.operatorRole.create }}
|
||||
{{- default (include "flink-operator.fullname" .) .Values.rbac.operatorRole.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.rbac.operatorRole.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the operator role binding to use
|
||||
*/}}
|
||||
{{- define "flink-operator.roleBindingName" -}}
|
||||
{{- if .Values.rbac.operatorRoleBinding.create }}
|
||||
{{- default (include "flink-operator.fullname" .) .Values.rbac.operatorRoleBinding.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.rbac.operatorRoleBinding.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the job role to use
|
||||
*/}}
|
||||
{{- define "flink-operator.jobRoleName" -}}
|
||||
{{- if .Values.rbac.jobRoleBinding.create }}
|
||||
{{- default (include "flink-operator.fullname" .) .Values.rbac.jobRole.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.rbac.jobRole.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the job role to use
|
||||
*/}}
|
||||
{{- define "flink-operator.jobRoleBindingName" -}}
|
||||
{{- if .Values.rbac.jobRole.create }}
|
||||
{{- default (include "flink-operator.fullname" .) .Values.rbac.jobRoleBinding.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.rbac.jobRoleBinding.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Create the name of the operator service account to use
|
||||
*/}}
|
||||
{{- define "flink-operator.serviceAccountName" -}}
|
||||
{{- if .Values.operatorServiceAccount.create }}
|
||||
{{- default (include "flink-operator.fullname" .) .Values.operatorServiceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.operatorServiceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the job service account to use
|
||||
*/}}
|
||||
{{- define "flink-operator.jobServiceAccountName" -}}
|
||||
{{- if .Values.jobServiceAccount.create }}
|
||||
{{- default (include "flink-operator.fullname" .) .Values.jobServiceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.jobServiceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Determine role scope based on name
|
||||
*/}}
|
||||
{{- define "flink-operator.roleScope" -}}
|
||||
{{- if contains ":" .role }}
|
||||
{{- printf "ClusterRole" }}
|
||||
{{- else }}
|
||||
{{- printf "Role" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "flink-operator.validating-webhook-enabled" -}}
|
||||
{{- if hasKey .Values.webhook "validator" }}
|
||||
{{- if .Values.webhook.validator.create }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if or (.Values.webhook.create) }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "flink-operator.mutating-webhook-enabled" -}}
|
||||
{{- if hasKey .Values.webhook "mutator" }}
|
||||
{{- if .Values.webhook.mutator.create }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if or (.Values.webhook.create) }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "flink-operator.webhook-enabled" -}}
|
||||
{{- if or (eq (include "flink-operator.validating-webhook-enabled" .) "true") (eq (include "flink-operator.mutating-webhook-enabled" .) "true") }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,328 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "flink-operator.name" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
{{- if index (.Values.operatorPod) "labels" }}
|
||||
{{- with .Values.operatorPod.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicas }}
|
||||
strategy:
|
||||
{{- toYaml .Values.strategy | nindent 4 }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "flink-operator.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "flink-operator.selectorLabels" . | nindent 8 }}
|
||||
{{- if index (.Values.operatorPod) "labels" }}
|
||||
{{- with .Values.operatorPod.labels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
|
||||
{{- if index (.Values.operatorPod) "annotations" }}
|
||||
{{- with .Values.operatorPod.annotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.operatorPod.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- if .Values.operatorPod.nodeSelector }}
|
||||
nodeSelector: {{ toYaml .Values.operatorPod.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.operatorPod.affinity }}
|
||||
affinity: {{ toYaml .Values.operatorPod.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.operatorPod.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "flink-operator.serviceAccountName" . }}
|
||||
{{- if .Values.operatorPod.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{ toYaml .Values.operatorPod.topologySpreadConstraints | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.operatorPod.initContainers }}
|
||||
initContainers:
|
||||
{{- toYaml .Values.operatorPod.initContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ include "flink-operator.imagePath" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["/docker-entrypoint.sh", "operator"]
|
||||
ports:
|
||||
{{- if .Values.metrics.port }}
|
||||
- containerPort: {{ .Values.metrics.port }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if index .Values "operatorHealth" }}
|
||||
- containerPort: {{ .Values.operatorHealth.port }}
|
||||
name: health-port
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
env:
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: OPERATOR_NAME
|
||||
value: {{ include "flink-operator.name" . }}
|
||||
- name: FLINK_CONF_DIR
|
||||
value: /opt/flink/conf
|
||||
- name: FLINK_PLUGINS_DIR
|
||||
value: /opt/flink/plugins
|
||||
- name: LOG_CONFIG
|
||||
value: {{ .Values.jvmArgs.logConfig }}
|
||||
- name: JVM_ARGS
|
||||
value: {{ .Values.jvmArgs.operator }}
|
||||
{{- if .Values.tls.create }}
|
||||
- name: OPERATOR_KEYSTORE_PATH
|
||||
value: /opt/flink/tls-cert/keystore.jks
|
||||
- name: OPERATOR_TRUSTSTORE_PATH
|
||||
value: /opt/flink/tls-cert/truststore.jks
|
||||
- name: OPERATOR_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- toYaml .Values.tls.secretKeyRef | nindent 18 }}
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- with .Values.operatorPod.env }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.operatorPod.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.operatorPod.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.operatorSecurityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: flink-operator-config-volume
|
||||
mountPath: /opt/flink/conf
|
||||
{{- if .Values.operatorVolumeMounts.create }}
|
||||
{{- toYaml .Values.operatorVolumeMounts.data | nindent 12 }}
|
||||
{{- else }}
|
||||
- name: flink-artifacts-volume
|
||||
mountPath: /opt/flink/artifacts
|
||||
{{- end }}
|
||||
{{- if .Values.tls.create }}
|
||||
- name: flink-operator-cert-secret
|
||||
mountPath: /opt/flink/tls-cert
|
||||
{{- end }}
|
||||
{{- if and (index .Values "operatorHealth") (index .Values.operatorHealth "livenessProbe") }}
|
||||
livenessProbe:
|
||||
{{- toYaml .Values.operatorHealth.livenessProbe | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: health-port
|
||||
{{- end }}
|
||||
{{- if and (index .Values "operatorHealth") (index .Values.operatorHealth "startupProbe") }}
|
||||
startupProbe:
|
||||
{{- toYaml .Values.operatorHealth.startupProbe | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: health-port
|
||||
{{- end }}
|
||||
{{- if .Values.postStart }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
{{- toYaml .Values.postStart | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
|
||||
- name: flink-webhook
|
||||
image: {{ include "flink-operator.imagePath" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["/docker-entrypoint.sh", "webhook"]
|
||||
env:
|
||||
- name: WEBHOOK_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.webhook.keystore.useDefaultPassword }}
|
||||
name: flink-operator-webhook-secret
|
||||
key: password
|
||||
{{- else }}
|
||||
{{- with .Values.webhook.keystore.passwordSecretRef }}
|
||||
{{- toYaml . | nindent 18 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: WEBHOOK_KEYSTORE_FILE
|
||||
value: "/certs/keystore.p12"
|
||||
- name: WEBHOOK_KEYSTORE_TYPE
|
||||
value: "pkcs12"
|
||||
- name: WEBHOOK_SERVER_PORT
|
||||
value: "9443"
|
||||
- name: LOG_CONFIG
|
||||
value: {{ .Values.jvmArgs.logConfig }}
|
||||
- name: JVM_ARGS
|
||||
value: {{ .Values.jvmArgs.webhook }}
|
||||
- name: FLINK_CONF_DIR
|
||||
value: /opt/flink/conf
|
||||
- name: FLINK_PLUGINS_DIR
|
||||
value: /opt/flink/plugins
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- with .Values.operatorPod.webhook.container.env }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.operatorPod.webhook.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.webhookSecurityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: keystore
|
||||
mountPath: "/certs"
|
||||
readOnly: true
|
||||
- name: flink-operator-config-volume
|
||||
mountPath: /opt/flink/conf
|
||||
{{- end }}
|
||||
{{- if .Values.operatorPod.sidecarContainers }}
|
||||
{{- toYaml .Values.operatorPod.sidecarContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if index (.Values.operatorPod) "dnsPolicy" }}
|
||||
dnsPolicy: {{ .Values.operatorPod.dnsPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if index (.Values.operatorPod) "dnsConfig" }}
|
||||
dnsConfig:
|
||||
{{- with .Values.operatorPod.dnsConfig }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: flink-operator-config-volume
|
||||
configMap:
|
||||
name: flink-operator-config
|
||||
items:
|
||||
{{- if hasKey .Values.defaultConfiguration "flink-conf.yaml" }}
|
||||
- key: flink-conf.yaml
|
||||
path: flink-conf.yaml
|
||||
{{- else }}
|
||||
- key: config.yaml
|
||||
path: config.yaml
|
||||
{{- end }}
|
||||
- key: log4j-operator.properties
|
||||
path: log4j-operator.properties
|
||||
- key: log4j-console.properties
|
||||
path: log4j-console.properties
|
||||
{{- if .Values.operatorVolumes.create }}
|
||||
{{- toYaml .Values.operatorVolumes.data | nindent 8 }}
|
||||
{{- else }}
|
||||
- name: flink-artifacts-volume
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
|
||||
- name: keystore
|
||||
secret:
|
||||
secretName: webhook-server-cert
|
||||
items:
|
||||
- key: keystore.p12
|
||||
path: keystore.p12
|
||||
{{- end }}
|
||||
{{- if .Values.tls.create }}
|
||||
- name: flink-operator-cert-secret
|
||||
secret:
|
||||
secretName: {{ .Values.tls.secretName }}
|
||||
optional: true
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.defaultConfiguration.create }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: flink-operator-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
data:
|
||||
config.yaml: |+
|
||||
{{- if .Values.defaultConfiguration.append }}
|
||||
{{- $.Files.Get "conf/flink-conf.yaml" | nindent 4 -}}
|
||||
{{- end }}
|
||||
{{- if hasKey (.Values.defaultConfiguration) "config.yaml" }}
|
||||
{{- index (.Values.defaultConfiguration) "config.yaml" | nindent 4 -}}
|
||||
{{- end }}
|
||||
{{- if .Values.watchNamespaces }}
|
||||
kubernetes.operator.watched.namespaces: {{ join "," .Values.watchNamespaces }}
|
||||
{{- end }}
|
||||
{{- if index .Values "operatorHealth" }}
|
||||
kubernetes.operator.health.probe.enabled: true
|
||||
kubernetes.operator.health.probe.port: {{ .Values.operatorHealth.port }}
|
||||
{{- end }}
|
||||
flink-conf.yaml: |+
|
||||
{{- if .Values.defaultConfiguration.append }}
|
||||
{{- $.Files.Get "conf/flink-conf.yaml" | nindent 4 -}}
|
||||
{{- end }}
|
||||
{{- if hasKey (.Values.defaultConfiguration) "flink-conf.yaml" }}
|
||||
{{- index (.Values.defaultConfiguration) "flink-conf.yaml" | nindent 4 -}}
|
||||
{{- end }}
|
||||
{{- if .Values.watchNamespaces }}
|
||||
kubernetes.operator.watched.namespaces: {{ join "," .Values.watchNamespaces }}
|
||||
{{- end }}
|
||||
{{- if index .Values "operatorHealth" }}
|
||||
kubernetes.operator.health.probe.enabled: true
|
||||
kubernetes.operator.health.probe.port: {{ .Values.operatorHealth.port }}
|
||||
{{- end }}
|
||||
log4j-operator.properties: |+
|
||||
{{- if .Values.defaultConfiguration.append }}
|
||||
{{- $.Files.Get "conf/log4j-operator.properties" | nindent 4 -}}
|
||||
{{- end }}
|
||||
{{- if index (.Values.defaultConfiguration) "log4j-operator.properties" }}
|
||||
{{- index (.Values.defaultConfiguration) "log4j-operator.properties" | nindent 4 -}}
|
||||
{{- end }}
|
||||
log4j-console.properties: |+
|
||||
{{- if .Values.defaultConfiguration.append }}
|
||||
{{- $.Files.Get "conf/log4j-console.properties" | nindent 4 -}}
|
||||
{{- end }}
|
||||
{{- if index (.Values.defaultConfiguration) "log4j-console.properties" }}
|
||||
{{- index (.Values.defaultConfiguration) "log4j-console.properties" | nindent 4 -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,351 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
{{/*
|
||||
RBAC rules used to create the operator (cluster)role based on the scope
|
||||
*/}}
|
||||
{{- define "flink-operator.rbacRules" }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- deletecollection
|
||||
{{- if .Values.rbac.nodesRule.create }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- deployments/finalizers
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments/scale
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- deployments
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- flink.apache.org
|
||||
resources:
|
||||
- flinkdeployments
|
||||
- flinkdeployments/finalizers
|
||||
- flinksessionjobs
|
||||
- flinksessionjobs/finalizers
|
||||
- flinkstatesnapshots
|
||||
- flinkstatesnapshots/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- flink.apache.org
|
||||
resources:
|
||||
- flinkdeployments/status
|
||||
- flinksessionjobs/status
|
||||
- flinkstatesnapshots/status
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
RBAC rules used to create the job (cluster)role based on the scope
|
||||
*/}}
|
||||
{{- define "flink-operator.jobRbacRules" }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
{{- if .Values.rbac.create }}
|
||||
---
|
||||
{{/*
|
||||
Namespaced scoped RBAC.
|
||||
*/}}
|
||||
{{- if .Values.watchNamespaces }}
|
||||
{{- range .Values.watchNamespaces }}
|
||||
{{- if $.Values.rbac.operatorRole.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "flink-operator.roleName" $ }}
|
||||
namespace: {{ . }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" $ | nindent 4 }}
|
||||
{{- template "flink-operator.rbacRules" $ }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if $.Values.rbac.jobRole.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "flink-operator.jobRoleName" $ }}
|
||||
namespace: {{ . }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" $ | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- template "flink-operator.jobRbacRules" $ }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if $.Values.rbac.operatorRoleBinding.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "flink-operator.roleBindingName" $ }}
|
||||
namespace: {{ . }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
kind: {{ $role := include "flink-operator.roleName" $ }}{{ include "flink-operator.roleScope" (dict "role" $role)}}
|
||||
name: {{ include "flink-operator.roleName" $ }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flink-operator.serviceAccountName" $ }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if $.Values.rbac.jobRoleBinding.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "flink-operator.jobRoleBindingName" $ }}
|
||||
namespace: {{ . }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" $ | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/resource-policy": keep
|
||||
roleRef:
|
||||
kind: {{ $role := include "flink-operator.jobRoleName" $ }}{{ include "flink-operator.roleScope" (dict "role" $role)}}
|
||||
name: {{ include "flink-operator.jobRoleName" $ }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flink-operator.jobServiceAccountName" $ }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{/*
|
||||
Give operator the ability to operate on leases in the release namespace
|
||||
*/}}
|
||||
{{- if and .Values.rbac.operatorRole.create (not (has .Release.Namespace .Values.watchNamespaces)) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "flink-operator.roleName" $ }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
{{- end }}
|
||||
---
|
||||
{{- if and .Values.rbac.operatorRole.create (not (has .Release.Namespace .Values.watchNamespaces)) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "flink-operator.roleBindingName" $ }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "flink-operator.roleName" $ }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flink-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
{{ else }}
|
||||
{{/*
|
||||
Cluster scoped RBAC.
|
||||
*/}}
|
||||
---
|
||||
{{- if .Values.rbac.operatorRole.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "flink-operator.roleName" $ }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
{{- template "flink-operator.rbacRules" $ }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.rbac.jobRole.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "flink-operator.jobRoleName" $ }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- template "flink-operator.jobRbacRules" $ }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.rbac.operatorRoleBinding.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "flink-operator.roleBindingName" $ }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ include "flink-operator.roleName" $ }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flink-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.rbac.jobRoleBinding.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "flink-operator.jobRoleBindingName" $ }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/resource-policy": keep
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "flink-operator.jobRoleName" $ }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flink-operator.jobServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,70 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
---
|
||||
{{- if .Values.operatorServiceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "flink-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.operatorServiceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.jobServiceAccount.create -}}
|
||||
{{/*
|
||||
Create job service accounts for all watched namespaces.
|
||||
*/}}
|
||||
{{- if .Values.watchNamespaces }}
|
||||
{{- range .Values.watchNamespaces }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "flink-operator.jobServiceAccountName" $ }}
|
||||
namespace: {{ . }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.jobServiceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{/*
|
||||
Create the job service account for the operator namespace, it is to be added for other namespaces manually
|
||||
(or via specifying them in watchNamespaces).
|
||||
*/}}
|
||||
{{- else}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "flink-operator.jobServiceAccountName" $ }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flink-operator.labels" $ | nindent 4 }}
|
||||
{{- with .Values.jobServiceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,157 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
---
|
||||
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: flink-operator-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.webhook.serviceLabels }}
|
||||
labels:
|
||||
{{- range $key, $value := .Values.webhook.serviceLabels }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 9443
|
||||
selector:
|
||||
app.kubernetes.io/name: {{ include "flink-operator.name" . }}
|
||||
---
|
||||
{{- if .Values.webhook.keystore.useDefaultPassword }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: flink-operator-webhook-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
type: Opaque
|
||||
data:
|
||||
password: cGFzc3dvcmQxMjM0
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: flink-operator-serving-cert
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
dnsNames:
|
||||
- flink-operator-webhook-service.{{ .Release.Namespace }}.svc
|
||||
- flink-operator-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
|
||||
keystores:
|
||||
pkcs12:
|
||||
create: true
|
||||
passwordSecretRef:
|
||||
{{- if .Values.webhook.keystore.useDefaultPassword }}
|
||||
name: flink-operator-webhook-secret
|
||||
key: password
|
||||
{{- else }}
|
||||
{{- with .Values.webhook.keystore.passwordSecretRef }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
issuerRef:
|
||||
kind: Issuer
|
||||
name: flink-operator-selfsigned-issuer
|
||||
commonName: FlinkDeployment Validator
|
||||
secretName: webhook-server-cert
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: flink-operator-selfsigned-issuer
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
{{- end }}
|
||||
{{- if eq (include "flink-operator.validating-webhook-enabled" .) "true" }}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/flink-operator-serving-cert
|
||||
name: flink-operator-{{ .Release.Namespace }}-webhook-configuration
|
||||
webhooks:
|
||||
- name: validationwebhook.flink.apache.org
|
||||
admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: flink-operator-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate
|
||||
failurePolicy: Fail
|
||||
rules:
|
||||
- apiGroups: ["flink.apache.org"]
|
||||
apiVersions: ["*"]
|
||||
scope: "Namespaced"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- flinkdeployments
|
||||
- flinksessionjobs
|
||||
- flinkstatesnapshots
|
||||
sideEffects: None
|
||||
{{- if .Values.watchNamespaces }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: In
|
||||
values: [{{- range .Values.watchNamespaces }}{{ . | quote }},{{- end}}]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (include "flink-operator.mutating-webhook-enabled" .) "true" }}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/flink-operator-serving-cert
|
||||
name: flink-operator-{{ .Release.Namespace }}-webhook-configuration
|
||||
webhooks:
|
||||
- name: mutationwebhook.flink.apache.org
|
||||
admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: flink-operator-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /mutate
|
||||
failurePolicy: Fail
|
||||
rules:
|
||||
- apiGroups: ["flink.apache.org"]
|
||||
apiVersions: ["*"]
|
||||
scope: "Namespaced"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- flinksessionjobs
|
||||
- flinkdeployments
|
||||
sideEffects: None
|
||||
{{- if .Values.watchNamespaces }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: In
|
||||
values: [{{- range .Values.watchNamespaces }}{{ . | quote }},{{- end}}]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,219 @@
|
||||
################################################################################
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
################################################################################
|
||||
|
||||
---
|
||||
|
||||
# List of kubernetes namespaces to watch for FlinkDeployment changes, empty means all namespaces.
|
||||
# When enabled RBAC is only created for said namespaces, otherwise it is done for the cluster scope.
|
||||
# watchNamespaces: ["flink"]
|
||||
|
||||
image:
|
||||
repository: ghcr.io/apache/flink-kubernetes-operator
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0315e91"
|
||||
# If image digest is set then it takes precedence and the image tag will be ignored
|
||||
# digest: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
# Replicas must be 1 unless operator leader election is configured
|
||||
replicas: 1
|
||||
|
||||
# Strategy type must be Recreate unless leader election is configured
|
||||
strategy:
|
||||
type: Recreate
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
# kubernetes.rest-service.exposed.type: NodePort requires
|
||||
# list permission for nodes at the cluster scope.
|
||||
# Set create to true if you are using NodePort type.
|
||||
nodesRule:
|
||||
create: false
|
||||
operatorRole:
|
||||
create: true
|
||||
name: "flink-operator"
|
||||
operatorRoleBinding:
|
||||
create: true
|
||||
name: "flink-operator-role-binding"
|
||||
jobRole:
|
||||
create: true
|
||||
name: "flink"
|
||||
jobRoleBinding:
|
||||
create: true
|
||||
name: "flink-role-binding"
|
||||
|
||||
operatorPod:
|
||||
priorityClassName: null
|
||||
annotations: {}
|
||||
labels: {}
|
||||
# The env variables only apply to the operator container in the operator pod
|
||||
# TODO: consider making this pod level env variables
|
||||
env:
|
||||
# - name: ""
|
||||
# value: ""
|
||||
# - name: ""
|
||||
# valueFrom:
|
||||
# configMapKeyRef:
|
||||
# name: ""
|
||||
# key: ""
|
||||
# dnsPolicy: ""
|
||||
# dnsConfig: {}
|
||||
# Node labels and affinity for operator pod assignment
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
envFrom:
|
||||
# - configMapRef:
|
||||
# name: ""
|
||||
nodeSelector: {}
|
||||
|
||||
affinity: {}
|
||||
# Node tolerations for operator pod assignment
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
|
||||
tolerations: []
|
||||
# Topology spread constrains
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
|
||||
topologySpreadConstraints: []
|
||||
resources: {}
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: "250m"
|
||||
# memory: "512Mi"
|
||||
# requests:
|
||||
# cpu: "250m"
|
||||
# memory: "512Mi"
|
||||
webhook:
|
||||
resources: {}
|
||||
container:
|
||||
env:
|
||||
# - name: ""
|
||||
# value: ""
|
||||
# optional init containers for operator pod
|
||||
initContainers: []
|
||||
|
||||
# optional extra containers for operator pod
|
||||
sidecarContainers: []
|
||||
|
||||
operatorServiceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
name: "flink-operator"
|
||||
|
||||
jobServiceAccount:
|
||||
create: true
|
||||
annotations:
|
||||
"helm.sh/resource-policy": keep
|
||||
name: "flink"
|
||||
|
||||
operatorVolumeMounts:
|
||||
create: false
|
||||
data:
|
||||
- name: flink-artifacts
|
||||
mountPath: /opt/flink/artifacts
|
||||
|
||||
operatorVolumes:
|
||||
create: false
|
||||
data:
|
||||
- name: flink-artifacts
|
||||
hostPath:
|
||||
path: /tmp/flink/artifacts
|
||||
type: DirectoryOrCreate
|
||||
# - name: flink-artifacts
|
||||
# persistentVolumeClaim:
|
||||
# claimName: flink-artifacts
|
||||
|
||||
podSecurityContext:
|
||||
runAsUser: 9999
|
||||
runAsGroup: 9999
|
||||
# fsGroup: 9999
|
||||
|
||||
operatorSecurityContext: {}
|
||||
|
||||
webhookSecurityContext: {}
|
||||
|
||||
webhook:
|
||||
create: true
|
||||
# validator:
|
||||
# create: true
|
||||
# mutator:
|
||||
# create: true
|
||||
keystore:
|
||||
useDefaultPassword: true
|
||||
# passwordSecretRef:
|
||||
# name: jks-password-secret
|
||||
# key: password-key
|
||||
serviceLabels: {}
|
||||
|
||||
defaultConfiguration:
|
||||
# If set to true, creates ConfigMaps/VolumeMounts. If set to false, no configuration will be created.
|
||||
# All below fields will be ignored if create is set to false.
|
||||
create: true
|
||||
# If set to true,
|
||||
# (1) loads the built-in default configuration
|
||||
# (2) appends the below flink-conf and logging configuration overrides
|
||||
# If set to false, loads just the overrides as in (2).
|
||||
# This option has not effect, if create is equal to false.
|
||||
append: true
|
||||
flink-conf.yaml: |+
|
||||
# Flink Config Overrides
|
||||
kubernetes.operator.metrics.reporter.slf4j.factory.class: org.apache.flink.metrics.slf4j.Slf4jReporterFactory
|
||||
kubernetes.operator.metrics.reporter.slf4j.interval: 5 MINUTE
|
||||
|
||||
kubernetes.operator.reconcile.interval: 15 s
|
||||
kubernetes.operator.observer.progress-check.interval: 5 s
|
||||
log4j-operator.properties: |+
|
||||
# Flink Operator Logging Overrides
|
||||
# rootLogger.level = DEBUG
|
||||
# logger.operator.name= org.apache.flink.kubernetes.operator
|
||||
# logger.operator.level = DEBUG
|
||||
log4j-console.properties: |+
|
||||
# Flink Deployment Logging Overrides
|
||||
# rootLogger.level = DEBUG
|
||||
|
||||
# (Optional) Exposes metrics port on the container if defined
|
||||
metrics:
|
||||
port:
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
# Set the jvm start up options for webhook and operator
|
||||
jvmArgs:
|
||||
webhook: ""
|
||||
operator: ""
|
||||
logConfig: "-Dlog4j.configurationFile=/opt/flink/conf/log4j-operator.properties"
|
||||
|
||||
# Configure health probes for the operator
|
||||
operatorHealth:
|
||||
port: 8085
|
||||
livenessProbe:
|
||||
periodSeconds: 10
|
||||
initialDelaySeconds: 30
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
periodSeconds: 10
|
||||
|
||||
# Set postStart hook of the main container
|
||||
postStart: {}
|
||||
|
||||
# Configuration for tls
|
||||
tls:
|
||||
create: false
|
||||
secretName: flink-operator-cert
|
||||
secretKeyRef:
|
||||
name: operator-certificate-password
|
||||
key: password
|
||||
@ -1,235 +0,0 @@
|
||||
# Flink High Availability Cluster Deployment
|
||||
|
||||
## Overview
|
||||
This project uses Apache Flink Kubernetes Operator to deploy a high availability Flink cluster with persistent storage and automatic failover capabilities.
|
||||
|
||||
## Component Architecture
|
||||
- **JobManager**: 2 replicas with high availability configuration
|
||||
- **TaskManager**: 3 replicas for distributed processing
|
||||
- **High Availability**: Kubernetes-based HA with persistent storage
|
||||
- **Checkpointing**: Persistent checkpoints and savepoints storage
|
||||
|
||||
## File Description
|
||||
|
||||
### 1. flink-operator-v2.yaml
|
||||
Flink Kubernetes Operator deployment configuration:
|
||||
- Operator deployment in `flink-system` namespace
|
||||
- RBAC configuration for cluster-wide permissions
|
||||
- Health checks and resource limits
|
||||
- Enhanced CRD definitions with additional printer columns
|
||||
|
||||
### 2. flink-crd.yaml
|
||||
Custom Resource Definitions for Flink:
|
||||
- FlinkDeployment CRD
|
||||
- FlinkSessionJob CRD
|
||||
- Required for Flink Operator to function
|
||||
|
||||
### 3. ha-flink-cluster-v2.yaml
|
||||
Production-ready HA Flink cluster configuration:
|
||||
- 2 JobManager replicas with HA enabled
|
||||
- 3 TaskManager replicas with anti-affinity rules
|
||||
- Persistent storage for HA data, checkpoints, and savepoints
|
||||
- Memory and CPU resource allocation
|
||||
- Exponential delay restart strategy
|
||||
- Proper volume mounts and storage configuration
|
||||
|
||||
### 4. simple-ha-flink-cluster.yaml
|
||||
Simplified HA Flink cluster configuration:
|
||||
- Uses ephemeral storage to avoid PVC binding issues
|
||||
- Basic HA configuration for testing and development
|
||||
- Minimal resource requirements
|
||||
- Recommended for development and testing
|
||||
|
||||
### 5. flink-storage.yaml
|
||||
Storage and RBAC configuration:
|
||||
- PersistentVolumeClaims for HA data, checkpoints, and savepoints
|
||||
- ServiceAccount and RBAC permissions for Flink cluster
|
||||
- Azure Disk storage class configuration with correct access modes
|
||||
|
||||
### 6. flink-rbac.yaml
|
||||
Enhanced RBAC configuration:
|
||||
- Complete permissions for Flink HA functionality
|
||||
- Both namespace-level and cluster-level permissions
|
||||
- Includes watch permissions for HA operations
|
||||
|
||||
## Deployment Steps
|
||||
|
||||
### 1. Install Flink Operator
|
||||
```bash
|
||||
# Apply Flink Operator configuration
|
||||
kubectl apply -f flink-operator-v2.yaml
|
||||
|
||||
# Verify operator installation
|
||||
kubectl get pods -n flink-system
|
||||
```
|
||||
|
||||
### 2. Create Storage Resources (Optional - for production)
|
||||
```bash
|
||||
# Apply storage configuration
|
||||
kubectl apply -f flink-storage.yaml
|
||||
|
||||
# Verify PVC creation
|
||||
kubectl get pvc -n freeleaps-data-platform
|
||||
```
|
||||
|
||||
### 3. Deploy HA Flink Cluster
|
||||
```bash
|
||||
# Option A: Deploy with persistent storage (production)
|
||||
kubectl apply -f ha-flink-cluster-v2.yaml
|
||||
|
||||
# Option B: Deploy with ephemeral storage (development/testing)
|
||||
kubectl apply -f simple-ha-flink-cluster.yaml
|
||||
|
||||
# Check deployment status
|
||||
kubectl get flinkdeployments -n freeleaps-data-platform
|
||||
kubectl get pods -n freeleaps-data-platform -l app=flink
|
||||
```
|
||||
|
||||
## High Availability Features
|
||||
- **JobManager HA**: 2 JobManager replicas with Kubernetes-based leader election
|
||||
- **Persistent State**: Checkpoints and savepoints stored on persistent volumes
|
||||
- **Automatic Failover**: Exponential delay restart strategy with backoff
|
||||
- **Pod Anti-affinity**: Ensures components are distributed across different nodes
|
||||
- **Storage Persistence**: HA data, checkpoints, and savepoints persist across restarts
|
||||
|
||||
## Network Configuration
|
||||
- **JobManager**: Port 8081 (Web UI), 6123 (RPC), 6124 (Blob Server)
|
||||
- **TaskManager**: Port 6121 (Data), 6122 (RPC), 6126 (Metrics)
|
||||
- **Service Type**: ClusterIP for internal communication
|
||||
|
||||
## Storage Configuration
|
||||
- **HA Data**: 10Gi for high availability metadata
|
||||
- **Checkpoints**: 20Gi for application checkpoints
|
||||
- **Savepoints**: 20Gi for manual savepoints
|
||||
- **Storage Class**: azure-disk-std-ssd-lrs
|
||||
- **Access Mode**: ReadWriteOnce (Azure Disk limitation)
|
||||
|
||||
## Monitoring and Operations
|
||||
- **Health Checks**: Built-in readiness and liveness probes
|
||||
- **Web UI**: Accessible through JobManager service
|
||||
- **Metrics**: Exposed on port 8080 for Prometheus collection
|
||||
- **Logging**: Centralized logging through Kubernetes
|
||||
|
||||
## Configuration Details
|
||||
|
||||
### High Availability Settings
|
||||
- **Type**: kubernetes (native Kubernetes HA)
|
||||
- **Storage**: Persistent volume for HA metadata
|
||||
- **Cluster ID**: ha-flink-cluster-v2
|
||||
|
||||
### Checkpointing Configuration
|
||||
- **Interval**: 60 seconds
|
||||
- **Timeout**: 10 minutes
|
||||
- **Min Pause**: 5 seconds
|
||||
- **Backend**: Filesystem with persistent storage
|
||||
|
||||
### Resource Allocation
|
||||
- **JobManager**: 0.5 CPU, 1024MB memory (HA), 1.0 CPU, 1024MB memory (Simple)
|
||||
- **TaskManager**: 0.5 CPU, 2048MB memory (HA), 2.0 CPU, 2048MB memory (Simple)
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues and Solutions
|
||||
|
||||
#### 1. PVC Binding Issues
|
||||
```bash
|
||||
# Check PVC status
|
||||
kubectl get pvc -n freeleaps-data-platform
|
||||
|
||||
# PVC stuck in Pending state - usually due to:
|
||||
# - Insufficient storage quota
|
||||
# - Wrong access mode (ReadWriteMany not supported by Azure Disk)
|
||||
# - Storage class not available
|
||||
|
||||
# Solution: Use ReadWriteOnce access mode or ephemeral storage
|
||||
```
|
||||
|
||||
#### 2. Pod CrashLoopBackOff
|
||||
```bash
|
||||
# Check pod status
|
||||
kubectl get pods -n freeleaps-data-platform -l app=flink
|
||||
|
||||
# Check pod logs
|
||||
kubectl logs <pod-name> -n freeleaps-data-platform
|
||||
|
||||
# Check pod events
|
||||
kubectl describe pod <pod-name> -n freeleaps-data-platform
|
||||
```
|
||||
|
||||
#### 3. ServiceAccount Issues
|
||||
```bash
|
||||
# Verify ServiceAccount exists
|
||||
kubectl get serviceaccount -n freeleaps-data-platform
|
||||
|
||||
# Check RBAC permissions
|
||||
kubectl get rolebinding -n freeleaps-data-platform
|
||||
```
|
||||
|
||||
#### 4. Storage Path Issues
|
||||
```bash
|
||||
# Ensure storage paths match volume mounts
|
||||
# For persistent storage: /opt/flink/ha-data, /opt/flink/checkpoints
|
||||
# For ephemeral storage: /tmp/flink/ha-data, /tmp/flink/checkpoints
|
||||
```
|
||||
|
||||
### Diagnostic Commands
|
||||
```bash
|
||||
# Check Flink Operator logs
|
||||
kubectl logs -n flink-system -l app.kubernetes.io/name=flink-kubernetes-operator
|
||||
|
||||
# Check Flink cluster status
|
||||
kubectl describe flinkdeployment <cluster-name> -n freeleaps-data-platform
|
||||
|
||||
# Check pod events
|
||||
kubectl get events -n freeleaps-data-platform --sort-by='.lastTimestamp'
|
||||
|
||||
# Check storage status
|
||||
kubectl get pvc -n freeleaps-data-platform
|
||||
kubectl describe pvc <pvc-name> -n freeleaps-data-platform
|
||||
|
||||
# Check operator status
|
||||
kubectl get pods -n flink-system
|
||||
kubectl logs -n flink-system deployment/flink-kubernetes-operator
|
||||
```
|
||||
|
||||
## Important Notes
|
||||
1. **Storage Limitations**: Azure Disk storage class only supports ReadWriteOnce access mode
|
||||
2. **ServiceAccount**: Ensure the correct ServiceAccount is specified in cluster configuration
|
||||
3. **Resource Requirements**: Verify cluster has enough CPU/memory for all replicas
|
||||
4. **Network Policies**: May need adjustment for inter-pod communication
|
||||
5. **Ephemeral vs Persistent**: Use ephemeral storage for development/testing, persistent for production
|
||||
|
||||
## Quick Start (Recommended for Testing)
|
||||
```bash
|
||||
# 1. Deploy operator
|
||||
kubectl apply -f flink-operator-v2.yaml
|
||||
|
||||
# 2. Wait for operator to be ready
|
||||
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=flink-kubernetes-operator -n flink-system
|
||||
|
||||
# 3. Deploy simple HA cluster (no persistent storage)
|
||||
kubectl apply -f simple-ha-flink-cluster.yaml
|
||||
|
||||
# 4. Monitor deployment
|
||||
kubectl get flinkdeployments -n freeleaps-data-platform
|
||||
kubectl get pods -n freeleaps-data-platform -l app=flink
|
||||
```
|
||||
|
||||
## Production Deployment
|
||||
```bash
|
||||
# 1. Deploy operator
|
||||
kubectl apply -f flink-operator-v2.yaml
|
||||
|
||||
# 2. Deploy storage resources
|
||||
kubectl apply -f flink-storage.yaml
|
||||
|
||||
# 3. Deploy production HA cluster
|
||||
kubectl apply -f ha-flink-cluster-v2.yaml
|
||||
|
||||
# 4. Monitor deployment
|
||||
kubectl get flinkdeployments -n freeleaps-data-platform
|
||||
kubectl get pods -n freeleaps-data-platform -l app=flink
|
||||
```
|
||||
|
||||
|
||||
|
||||
@ -1,43 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: flinkdeployments.flink.apache.org
|
||||
spec:
|
||||
group: flink.apache.org
|
||||
versions:
|
||||
- name: v1beta1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
subresources:
|
||||
status: {}
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: flinkdeployments
|
||||
singular: flinkdeployment
|
||||
kind: FlinkDeployment
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: flinksessionjobs.flink.apache.org
|
||||
spec:
|
||||
group: flink.apache.org
|
||||
versions:
|
||||
- name: v1beta1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
subresources:
|
||||
status: {}
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: flinksessionjobs
|
||||
singular: flinksessionjob
|
||||
kind: FlinkSessionJob
|
||||
@ -1,298 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: flinkdeployments.flink.apache.org
|
||||
spec:
|
||||
group: flink.apache.org
|
||||
names:
|
||||
kind: FlinkDeployment
|
||||
listKind: FlinkDeploymentList
|
||||
plural: flinkdeployments
|
||||
singular: flinkdeployment
|
||||
shortNames:
|
||||
- fd
|
||||
- flinkdeploy
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Job Status
|
||||
type: string
|
||||
jsonPath: .status.jobStatus
|
||||
- name: Flink Version
|
||||
type: string
|
||||
jsonPath: .spec.flinkVersion
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: flinksessionjobs.flink.apache.org
|
||||
spec:
|
||||
group: flink.apache.org
|
||||
names:
|
||||
kind: FlinkSessionJob
|
||||
listKind: FlinkSessionJobList
|
||||
plural: flinksessionjobs
|
||||
singular: flinksessionjob
|
||||
shortNames:
|
||||
- fsj
|
||||
- flinksessionjob
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Job Status
|
||||
type: string
|
||||
jsonPath: .status.jobStatus
|
||||
- name: Flink Deployment
|
||||
type: string
|
||||
jsonPath: .spec.deploymentName
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: flink-system
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: flink-kubernetes-operator
|
||||
namespace: flink-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: flink-kubernetes-operator
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumeclaims
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- jobs
|
||||
- cronjobs
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- flink.apache.org
|
||||
resources:
|
||||
- flinkdeployments
|
||||
- flinkdeployments/status
|
||||
- flinksessionjobs
|
||||
- flinksessionjobs/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: flink-kubernetes-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: flink-kubernetes-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: flink-kubernetes-operator
|
||||
namespace: flink-system
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: flink-kubernetes-operator
|
||||
namespace: flink-system
|
||||
labels:
|
||||
app: flink-kubernetes-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: flink-kubernetes-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: flink-kubernetes-operator
|
||||
spec:
|
||||
serviceAccountName: flink-kubernetes-operator
|
||||
containers:
|
||||
- name: flink-kubernetes-operator
|
||||
image: apache/flink-kubernetes-operator:1.8.0
|
||||
command: ["/docker-entrypoint.sh"]
|
||||
args: ["operator"]
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: OPERATOR_NAME
|
||||
value: flink-kubernetes-operator
|
||||
- name: LEADER_ELECTION_ID
|
||||
value: flink-kubernetes-operator
|
||||
- name: LEADER_ELECTION_NAMESPACE
|
||||
value: flink-system
|
||||
ports:
|
||||
- containerPort: 8085
|
||||
name: metrics
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8085
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8085
|
||||
@ -1,66 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: flink
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: flink
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: flink-role
|
||||
namespace: freeleaps-data-platform
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "secrets", "services", "pods", "events", "endpoints"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: flink-role-binding
|
||||
namespace: freeleaps-data-platform
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: flink-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: flink
|
||||
namespace: freeleaps-data-platform
|
||||
---
|
||||
# Additional permissions for HA functionality
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: flink-ha-cluster-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "secrets", "services", "pods", "events", "endpoints"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: flink-ha-cluster-role-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: flink-ha-cluster-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: flink
|
||||
namespace: freeleaps-data-platform
|
||||
@ -1,82 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: ha-flink-ha-data
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: flink
|
||||
component: ha-storage
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
storageClassName: azure-disk-std-ssd-lrs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: ha-flink-checkpoints
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: flink
|
||||
component: checkpoint-storage
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
storageClassName: azure-disk-std-ssd-lrs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: ha-flink-savepoints
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: flink
|
||||
component: savepoint-storage
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
storageClassName: azure-disk-std-ssd-lrs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: flink
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: flink
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: flink-role
|
||||
namespace: freeleaps-data-platform
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "secrets", "services", "pods"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: flink-role-binding
|
||||
namespace: freeleaps-data-platform
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: flink-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: flink
|
||||
namespace: freeleaps-data-platform
|
||||
@ -1,94 +0,0 @@
|
||||
apiVersion: flink.apache.org/v1beta1
|
||||
kind: FlinkDeployment
|
||||
metadata:
|
||||
name: ha-flink-cluster-v2
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: flink
|
||||
component: streaming
|
||||
cluster-type: ha
|
||||
spec:
|
||||
flinkVersion: v1_19
|
||||
image: flink:1.19.0
|
||||
flinkConfiguration:
|
||||
# High Availability Configuration
|
||||
high-availability.type: kubernetes
|
||||
high-availability.storageDir: file:///opt/flink/ha-data
|
||||
# Checkpointing Configuration
|
||||
state.backend.type: filesystem
|
||||
state.checkpoints.dir: file:///opt/flink/checkpoints
|
||||
state.savepoints.dir: file:///opt/flink/savepoints
|
||||
execution.checkpointing.interval: 60s
|
||||
execution.checkpointing.min-pause: 5s
|
||||
execution.checkpointing.timeout: 10min
|
||||
# JobManager Configuration
|
||||
jobmanager.rpc.address: ha-flink-cluster-v2-jobmanager
|
||||
jobmanager.rpc.port: "6123"
|
||||
jobmanager.bind-host: "0.0.0.0"
|
||||
# REST Configuration
|
||||
rest.address: ha-flink-cluster-v2-jobmanager
|
||||
rest.port: "8081"
|
||||
rest.bind-address: "0.0.0.0"
|
||||
# Blob Server Configuration
|
||||
blob.server.port: "6124"
|
||||
# TaskManager Configuration
|
||||
taskmanager.numberOfTaskSlots: "2"
|
||||
# Memory Configuration
|
||||
taskmanager.memory.process.size: 2048m
|
||||
jobmanager.memory.process.size: 1024m
|
||||
# Restart Strategy
|
||||
restart-strategy.type: exponential-delay
|
||||
restart-strategy.exponential-delay.initial-backoff: 10s
|
||||
restart-strategy.exponential-delay.max-backoff: 2min
|
||||
restart-strategy.exponential-delay.backoff-multiplier: "2.0"
|
||||
restart-strategy.exponential-delay.reset-backoff-threshold: 10min
|
||||
restart-strategy.exponential-delay.jitter-factor: "0.1"
|
||||
serviceAccount: flink
|
||||
jobManager:
|
||||
replicas: 2
|
||||
resource:
|
||||
memory: "1024m"
|
||||
cpu: 0.5
|
||||
podTemplate:
|
||||
spec:
|
||||
containers:
|
||||
- name: flink-main-container
|
||||
volumeMounts:
|
||||
- name: ha-data
|
||||
mountPath: /opt/flink/ha-data
|
||||
- name: checkpoints
|
||||
mountPath: /opt/flink/checkpoints
|
||||
- name: savepoints
|
||||
mountPath: /opt/flink/savepoints
|
||||
volumes:
|
||||
- name: ha-data
|
||||
persistentVolumeClaim:
|
||||
claimName: ha-flink-ha-data
|
||||
- name: checkpoints
|
||||
persistentVolumeClaim:
|
||||
claimName: ha-flink-checkpoints
|
||||
- name: savepoints
|
||||
persistentVolumeClaim:
|
||||
claimName: ha-flink-savepoints
|
||||
taskManager:
|
||||
replicas: 3
|
||||
resource:
|
||||
memory: "2048m"
|
||||
cpu: 0.5
|
||||
podTemplate:
|
||||
spec:
|
||||
containers:
|
||||
- name: flink-main-container
|
||||
volumeMounts:
|
||||
- name: checkpoints
|
||||
mountPath: /opt/flink/checkpoints
|
||||
- name: savepoints
|
||||
mountPath: /opt/flink/savepoints
|
||||
volumes:
|
||||
- name: checkpoints
|
||||
persistentVolumeClaim:
|
||||
claimName: ha-flink-checkpoints
|
||||
- name: savepoints
|
||||
persistentVolumeClaim:
|
||||
claimName: ha-flink-savepoints
|
||||
|
||||
@ -1,46 +0,0 @@
|
||||
apiVersion: flink.apache.org/v1beta1
|
||||
kind: FlinkDeployment
|
||||
metadata:
|
||||
name: simple-ha-flink-cluster
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: flink
|
||||
component: streaming
|
||||
cluster-type: simple-ha
|
||||
spec:
|
||||
flinkVersion: v1_18
|
||||
image: flink:1.18
|
||||
flinkConfiguration:
|
||||
# Basic Configuration
|
||||
taskmanager.numberOfTaskSlots: "2"
|
||||
# High Availability Configuration (using ephemeral storage)
|
||||
high-availability.type: kubernetes
|
||||
high-availability.storageDir: file:///tmp/flink/ha-data
|
||||
# Checkpointing Configuration (using ephemeral storage)
|
||||
state.backend.type: filesystem
|
||||
state.checkpoints.dir: file:///tmp/flink/checkpoints
|
||||
state.savepoints.dir: file:///tmp/flink/savepoints
|
||||
execution.checkpointing.interval: 60s
|
||||
execution.checkpointing.min-pause: 5s
|
||||
execution.checkpointing.timeout: 10min
|
||||
# Memory Configuration
|
||||
taskmanager.memory.process.size: 2048m
|
||||
jobmanager.memory.process.size: 1024m
|
||||
# Restart Strategy
|
||||
restart-strategy.type: exponential-delay
|
||||
restart-strategy.exponential-delay.initial-backoff: 10s
|
||||
restart-strategy.exponential-delay.max-backoff: 2min
|
||||
restart-strategy.exponential-delay.backoff-multiplier: "2.0"
|
||||
restart-strategy.exponential-delay.reset-backoff-threshold: 10min
|
||||
restart-strategy.exponential-delay.jitter-factor: "0.1"
|
||||
serviceAccount: flink
|
||||
jobManager:
|
||||
replicas: 2
|
||||
resource:
|
||||
memory: "1024m"
|
||||
cpu: 1.0
|
||||
taskManager:
|
||||
replicas: 3
|
||||
resource:
|
||||
memory: "2048m"
|
||||
cpu: 2.0
|
||||
@ -1,897 +0,0 @@
|
||||
# Copyright Broadcom, Inc. All Rights Reserved.
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## @section Global parameters
|
||||
## Global Docker image parameters
|
||||
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
|
||||
## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
|
||||
##
|
||||
|
||||
## @param global.imageRegistry Global Docker image registry
|
||||
## @param global.imagePullSecrets Global Docker registry secret names as an array
|
||||
## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)
|
||||
## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead
|
||||
##
|
||||
global:
|
||||
imageRegistry: ""
|
||||
## E.g.
|
||||
## imagePullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
imagePullSecrets: []
|
||||
defaultStorageClass: ""
|
||||
storageClass: "azure-disk-std-lrs"
|
||||
## Security parameters
|
||||
##
|
||||
security:
|
||||
## @param global.security.allowInsecureImages Allows skipping image verification
|
||||
allowInsecureImages: false
|
||||
## Compatibility adaptations for Kubernetes platforms
|
||||
##
|
||||
compatibility:
|
||||
## Compatibility adaptations for Openshift
|
||||
##
|
||||
openshift:
|
||||
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
|
||||
##
|
||||
adaptSecurityContext: auto
|
||||
## @section Common parameters
|
||||
##
|
||||
|
||||
## @param nameOverride String to partially override common.names.fullname
|
||||
##
|
||||
nameOverride: ""
|
||||
## @param fullnameOverride String to fully override common.names.fullname
|
||||
##
|
||||
fullnameOverride: ""
|
||||
## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)
|
||||
##
|
||||
kubeVersion: ""
|
||||
## @param commonLabels Labels to add to all deployed objects (sub-charts are not considered)
|
||||
##
|
||||
commonLabels: {}
|
||||
## @param commonAnnotations Annotations to add to all deployed objects
|
||||
##
|
||||
commonAnnotations: {}
|
||||
## @param clusterDomain Default Kubernetes cluster domain
|
||||
##
|
||||
clusterDomain: freeleaps.cluster
|
||||
## @param extraDeploy Array of extra objects to deploy with the release
|
||||
##
|
||||
extraDeploy: []
|
||||
## Enable diagnostic mode in the deployment
|
||||
##
|
||||
diagnosticMode:
|
||||
## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
|
||||
##
|
||||
enabled: false
|
||||
## @param diagnosticMode.command Command to override all containers in the deployment
|
||||
##
|
||||
command:
|
||||
- sleep
|
||||
## @param diagnosticMode.args Args to override all containers in the deployment
|
||||
##
|
||||
args:
|
||||
- infinity
|
||||
## @section Apache Flink parameters
|
||||
##
|
||||
|
||||
## Bitnami Apache Flink image
|
||||
## ref: https://hub.docker.com/r/bitnami/flink/tags/
|
||||
## @param image.registry [default: REGISTRY_NAME] Apache Flink image registry
|
||||
## @param image.repository [default: REPOSITORY_NAME/flink] Apache Flink image repository
|
||||
## @skip image.tag Apache Flink image tag (immutable tags are recommended)
|
||||
## @param image.digest Apache Flink image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||||
## @param image.pullPolicy image pull policy
|
||||
## @param image.pullSecrets Apache Flink image pull secrets
|
||||
## @param image.debug Enable image debug mode
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/flink
|
||||
tag: 2.0.0-debian-12-r7
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## e.g:
|
||||
## pullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
pullSecrets: []
|
||||
## Enable debug mode
|
||||
##
|
||||
debug: false
|
||||
## @section Jobmanager deployment parameters
|
||||
##
|
||||
jobmanager:
|
||||
## @param jobmanager.command Command for running the container (set to default if not set). Use array form
|
||||
##
|
||||
command: []
|
||||
## @param jobmanager.args Args for running the container (set to default if not set). Use array form
|
||||
##
|
||||
args: []
|
||||
## @param jobmanager.lifecycleHooks [object] Override default etcd container hooks
|
||||
##
|
||||
lifecycleHooks: {}
|
||||
## @param jobmanager.automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @param jobmanager.hostAliases Set pod host aliases
|
||||
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
|
||||
##
|
||||
hostAliases: []
|
||||
## @param jobmanager.extraEnvVars Extra environment variables to be set on flink container
|
||||
## For example:
|
||||
## - name: FOO
|
||||
## value: BAR
|
||||
##
|
||||
extraEnvVars: []
|
||||
## @param jobmanager.extraEnvVarsCM Name of existing ConfigMap containing extra env vars
|
||||
##
|
||||
extraEnvVarsCM: ""
|
||||
## @param jobmanager.extraEnvVarsSecret Name of existing Secret containing extra env vars
|
||||
##
|
||||
extraEnvVarsSecret: ""
|
||||
## @param jobmanager.replicaCount Number of Apache Flink Jobmanager replicas
|
||||
##
|
||||
replicaCount: 1
|
||||
## Configure extra options for container's liveness, readiness and startup probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
|
||||
## @param jobmanager.livenessProbe.enabled Enable livenessProbe on Jobmanager nodes
|
||||
## @param jobmanager.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param jobmanager.livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
## @param jobmanager.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||||
## @param jobmanager.livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||||
## @param jobmanager.livenessProbe.successThreshold Success threshold for livenessProbe
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
## @param jobmanager.startupProbe.enabled Enable startupProbe on Jobmanager containers
|
||||
## @param jobmanager.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||
## @param jobmanager.startupProbe.periodSeconds Period seconds for startupProbe
|
||||
## @param jobmanager.startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||
## @param jobmanager.startupProbe.failureThreshold Failure threshold for startupProbe
|
||||
## @param jobmanager.startupProbe.successThreshold Success threshold for startupProbe
|
||||
##
|
||||
startupProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 15
|
||||
successThreshold: 1
|
||||
## @param jobmanager.readinessProbe.enabled Enable readinessProbe
|
||||
## @param jobmanager.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param jobmanager.readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param jobmanager.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param jobmanager.readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
## @param jobmanager.readinessProbe.successThreshold Success threshold for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 15
|
||||
successThreshold: 1
|
||||
## @param jobmanager.customLivenessProbe Custom livenessProbe that overrides the default one
|
||||
##
|
||||
customLivenessProbe: {}
|
||||
## @param jobmanager.customStartupProbe [object] Override default startup probe
|
||||
##
|
||||
customStartupProbe: {}
|
||||
## @param jobmanager.customReadinessProbe [object] Override default readiness probe
|
||||
##
|
||||
customReadinessProbe: {}
|
||||
## Apache Flink pods' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## Minimum memory for development is 4GB and 2 CPU cores
|
||||
## Minimum memory for production is 8GB and 4 CPU cores
|
||||
## ref: http://docs.datastax.com/en/archived/flink/2.0/flink/architecture/architecturePlanningHardware_c.html
|
||||
##
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
## choice for the user. This also increases chances charts run on environments with little
|
||||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
## @param jobmanager.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if jobmanager.resources is set (jobmanager.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
# resourcesPreset: "small"
|
||||
## @param jobmanager.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 2Gi
|
||||
## @param jobmanager.extraVolumeMounts Optionally specify extra list of additional volumeMounts for flink container
|
||||
##
|
||||
extraVolumeMounts: []
|
||||
## Container ports to expose
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
containerPorts:
|
||||
## @param jobmanager.containerPorts.rpc Port for RPC
|
||||
##
|
||||
rpc: 6123
|
||||
## @param jobmanager.containerPorts.http Port for http UI
|
||||
##
|
||||
http: 8081
|
||||
## @param jobmanager.containerPorts.blob Port for blob server
|
||||
##
|
||||
blob: 6124
|
||||
## Apache Flink jobmanager.service parameters
|
||||
##
|
||||
service:
|
||||
## @param jobmanager.service.type Apache Flink service type
|
||||
##
|
||||
type: ClusterIP
|
||||
## Ports to expose
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
ports:
|
||||
## @param jobmanager.service.ports.rpc Port for RPC
|
||||
##
|
||||
rpc: 6123
|
||||
## @param jobmanager.service.ports.http Port for http UI
|
||||
##
|
||||
http: 8081
|
||||
## @param jobmanager.service.ports.blob Port for blob server
|
||||
## Due the Apache Flink specificities this port should match the jobmanager.containerPorts.blob port. The taskmanager should be
|
||||
## able to communicate with the jobmanager through the port jobmanager indicates to the taskmanager, being the jobmanager not aware of the service port.
|
||||
blob: 6124
|
||||
## Node ports to expose
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
nodePorts:
|
||||
## @param jobmanager.service.nodePorts.rpc Node port for RPC
|
||||
##
|
||||
rpc: ""
|
||||
## @param jobmanager.service.nodePorts.http Node port for http UI
|
||||
##
|
||||
http: ""
|
||||
## @param jobmanager.service.nodePorts.blob Port for blob server
|
||||
##
|
||||
blob: ""
|
||||
## @param jobmanager.service.extraPorts Extra ports to expose in the service (normally used with the `sidecar` value)
|
||||
##
|
||||
extraPorts: []
|
||||
## @param jobmanager.service.loadBalancerIP LoadBalancerIP if service type is `LoadBalancer`
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
##
|
||||
loadBalancerIP: ""
|
||||
## @param jobmanager.service.loadBalancerSourceRanges Service Load Balancer sources
|
||||
## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
|
||||
## e.g:
|
||||
## loadBalancerSourceRanges:
|
||||
## - 10.10.10.0/24
|
||||
##
|
||||
loadBalancerSourceRanges: []
|
||||
## @param jobmanager.service.clusterIP Service Cluster IP
|
||||
## e.g.:
|
||||
## clusterIP: None
|
||||
##
|
||||
clusterIP: ""
|
||||
## @param jobmanager.service.externalTrafficPolicy Service external traffic policy
|
||||
## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
##
|
||||
externalTrafficPolicy: Cluster
|
||||
## @param jobmanager.service.annotations Provide any additional annotations which may be required.
|
||||
## This can be used to set the LoadBalancer service type to internal only.
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
##
|
||||
annotations: {}
|
||||
## @param jobmanager.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"
|
||||
## If "ClientIP", consecutive client requests will be directed to the same Pod
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
|
||||
##
|
||||
sessionAffinity: None
|
||||
## @param jobmanager.service.sessionAffinityConfig Additional settings for the sessionAffinity
|
||||
## sessionAffinityConfig:
|
||||
## clientIP:
|
||||
## timeoutSeconds: 300
|
||||
##
|
||||
sessionAffinityConfig: {}
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param jobmanager.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param jobmanager.networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param jobmanager.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param jobmanager.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param jobmanager.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param jobmanager.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param jobmanager.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
## Apache Flink Jobmanager serviceAccount parameters
|
||||
##
|
||||
serviceAccount:
|
||||
## @param jobmanager.serviceAccount.create Enables ServiceAccount
|
||||
##
|
||||
create: true
|
||||
## @param jobmanager.serviceAccount.name ServiceAccount name
|
||||
##
|
||||
name: ""
|
||||
## @param jobmanager.serviceAccount.annotations Annotations to add to all deployed objects
|
||||
##
|
||||
annotations: {}
|
||||
## @param jobmanager.serviceAccount.automountServiceAccountToken Automount API credentials for a service account.
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## Pod security context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param jobmanager.podSecurityContext.enabled Enabled Apache Flink pods' Security Context
|
||||
## @param jobmanager.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
|
||||
## @param jobmanager.podSecurityContext.sysctls Set kernel settings using the sysctl interface
|
||||
## @param jobmanager.podSecurityContext.supplementalGroups Set filesystem extra groups
|
||||
## @param jobmanager.podSecurityContext.fsGroup Set Apache Flink pod's Security Context fsGroup
|
||||
##
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroupChangePolicy: Always
|
||||
sysctls: []
|
||||
supplementalGroups: []
|
||||
fsGroup: 1001
|
||||
## Configure Container Security Context (only main container)
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param jobmanager.containerSecurityContext.enabled Enabled Apache Flink containers' Security Context
|
||||
## @param jobmanager.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||||
## @param jobmanager.containerSecurityContext.runAsUser Set Apache Flink container's Security Context runAsUser
|
||||
## @param jobmanager.containerSecurityContext.runAsGroup Set Apache Flink container's Security Context runAsGroup
|
||||
## @param jobmanager.containerSecurityContext.runAsNonRoot Force the container to be run as non root
|
||||
## @param jobmanager.containerSecurityContext.allowPrivilegeEscalation Allows privilege escalation
|
||||
## @param jobmanager.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
|
||||
## @param jobmanager.containerSecurityContext.privileged Set primary container's Security Context privileged
|
||||
## @param jobmanager.containerSecurityContext.capabilities.drop List of capabilities to be dropped
|
||||
## @param jobmanager.containerSecurityContext.seccompProfile.type Rules specifying actions to take based on the requested syscall
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
## @param jobmanager.podAnnotations Additional pod annotations
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
##
|
||||
podAnnotations: {}
|
||||
## @param jobmanager.podLabels Additional pod labels
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
##
|
||||
podLabels: {}
|
||||
## @param jobmanager.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAffinityPreset: ""
|
||||
## @param jobmanager.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAntiAffinityPreset: soft
|
||||
## Node affinity preset
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
|
||||
##
|
||||
nodeAffinityPreset:
|
||||
## @param jobmanager.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
##
|
||||
type: ""
|
||||
## @param jobmanager.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set
|
||||
##
|
||||
key: ""
|
||||
## @param jobmanager.nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set
|
||||
## E.g.
|
||||
## values:
|
||||
## - e2e-az1
|
||||
## - e2e-az2
|
||||
##
|
||||
values: []
|
||||
## @param jobmanager.priorityClassName Server priorityClassName
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
||||
##
|
||||
priorityClassName: ""
|
||||
## @param jobmanager.affinity Affinity for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
## NOTE: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
|
||||
##
|
||||
affinity: {}
|
||||
## @param jobmanager.nodeSelector Node labels for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## @param jobmanager.tolerations Tolerations for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
##
|
||||
tolerations: []
|
||||
## @param jobmanager.topologySpreadConstraints Topology Spread Constraints for pod assignment
|
||||
## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## The value is evaluated as a template
|
||||
##
|
||||
topologySpreadConstraints: []
|
||||
## @param jobmanager.schedulerName Alternative scheduler
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
## @param jobmanager.updateStrategy.type Apache Flink jobmanager deployment strategy type
|
||||
## @param jobmanager.updateStrategy.rollingUpdate [object,nullable] Apache Flink jobmanager deployment rolling update configuration parameters
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
|
||||
##
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate: null
|
||||
## @param jobmanager.extraVolumes Optionally specify extra list of additional volumes for flink container
|
||||
##
|
||||
extraVolumes: []
|
||||
## @param jobmanager.initContainers Add additional init containers to the flink pods
|
||||
##
|
||||
initContainers: []
|
||||
## @param jobmanager.sidecars Add additional sidecar containers to the flink pods
|
||||
##
|
||||
sidecars: []
|
||||
|
||||
## @param jobmanager.pdb.create Enable/disable a Pod Disruption Budget creation
|
||||
## @param jobmanager.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled
|
||||
## @param jobmanager.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable.Defaults to `1` if both `secondary.pdb.minAvailable` and `secondary.pdb.maxUnavailable` are empty.
|
||||
##
|
||||
pdb:
|
||||
create: true
|
||||
minAvailable: ""
|
||||
maxUnavailable: ""
|
||||
## @section TaskManager deployment parameters
|
||||
##
|
||||
taskmanager:
|
||||
## @param taskmanager.command Command for running the container (set to default if not set). Use array form
|
||||
##
|
||||
command: []
|
||||
## @param taskmanager.args Args for running the container (set to default if not set). Use array form
|
||||
##
|
||||
args: []
|
||||
## @param taskmanager.lifecycleHooks [object] Override default etcd container hooks
|
||||
##
|
||||
lifecycleHooks: {}
|
||||
## @param taskmanager.automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @param taskmanager.hostAliases Set pod host aliases
|
||||
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
|
||||
##
|
||||
hostAliases: []
|
||||
## @param taskmanager.extraEnvVars Extra environment variables to be set on flink container
|
||||
## For example:
|
||||
## - name: FOO
|
||||
## value: BAR
|
||||
##
|
||||
extraEnvVars: []
|
||||
## @param taskmanager.extraEnvVarsCM Name of existing ConfigMap containing extra env vars
|
||||
##
|
||||
extraEnvVarsCM: ""
|
||||
## @param taskmanager.extraEnvVarsSecret Name of existing Secret containing extra env vars
|
||||
##
|
||||
extraEnvVarsSecret: ""
|
||||
## @param taskmanager.replicaCount Number of Apache Flink replicas
|
||||
##
|
||||
replicaCount: 1
|
||||
## Configure extra options for container's liveness, readiness and startup probes
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
|
||||
## @param taskmanager.livenessProbe.enabled Enable livenessProbe on taskmanager nodes
|
||||
## @param taskmanager.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param taskmanager.livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
## @param taskmanager.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||||
## @param taskmanager.livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||||
## @param taskmanager.livenessProbe.successThreshold Success threshold for livenessProbe
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
## @param taskmanager.startupProbe.enabled Enable startupProbe on taskmanager containers
|
||||
## @param taskmanager.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||
## @param taskmanager.startupProbe.periodSeconds Period seconds for startupProbe
|
||||
## @param taskmanager.startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||
## @param taskmanager.startupProbe.failureThreshold Failure threshold for startupProbe
|
||||
## @param taskmanager.startupProbe.successThreshold Success threshold for startupProbe
|
||||
##
|
||||
startupProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 15
|
||||
successThreshold: 1
|
||||
## @param taskmanager.readinessProbe.enabled Enable readinessProbe
|
||||
## @param taskmanager.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param taskmanager.readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param taskmanager.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param taskmanager.readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
## @param taskmanager.readinessProbe.successThreshold Success threshold for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 15
|
||||
successThreshold: 1
|
||||
## @param taskmanager.customLivenessProbe Custom livenessProbe that overrides the default one
|
||||
##
|
||||
customLivenessProbe: {}
|
||||
## @param taskmanager.customStartupProbe [object] Override default startup probe
|
||||
##
|
||||
customStartupProbe: {}
|
||||
## @param taskmanager.customReadinessProbe [object] Override default readiness probe
|
||||
##
|
||||
customReadinessProbe: {}
|
||||
## Apache Flink pods' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## Minimum memory for development is 4GB and 2 CPU cores
|
||||
## Minimum memory for production is 8GB and 4 CPU cores
|
||||
## ref: http://docs.datastax.com/en/archived/flink/2.0/flink/architecture/architecturePlanningHardware_c.html
|
||||
##
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
## choice for the user. This also increases chances charts run on environments with little
|
||||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
## @param taskmanager.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if taskmanager.resources is set (taskmanager.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
# resourcesPreset: "small"
|
||||
## @param taskmanager.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 2Gi
|
||||
## @param taskmanager.extraVolumeMounts Optionally specify extra list of additional volumeMounts for flink container
|
||||
##
|
||||
extraVolumeMounts: []
|
||||
## Container ports to expose
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
## @param taskmanager.containerPorts.data data exchange port
|
||||
## @param taskmanager.containerPorts.rpc Port for RPC
|
||||
## @param taskmanager.containerPorts.internalMetrics Port for internal metrics query service
|
||||
##
|
||||
containerPorts:
|
||||
data: 6121
|
||||
rpc: 6122
|
||||
internalMetrics: 6126
|
||||
## Apache Flink taskmanager.service parameters
|
||||
##
|
||||
service:
|
||||
## @param taskmanager.service.type Apache Flink service type
|
||||
##
|
||||
type: ClusterIP
|
||||
## Ports to expose
|
||||
## @param taskmanager.service.ports.data data exchange port
|
||||
## @param taskmanager.service.ports.rpc Port for RPC
|
||||
## @param taskmanager.service.ports.internalMetrics Port for internal metrics query service
|
||||
##
|
||||
ports:
|
||||
data: 6121
|
||||
rpc: 6122
|
||||
internalMetrics: 6126
|
||||
## Node ports to expose
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
## @param taskmanager.service.nodePorts.data data exchange port
|
||||
## @param taskmanager.service.nodePorts.rpc Port for RPC
|
||||
## @param taskmanager.service.nodePorts.internalMetrics Port for internal metrics query service
|
||||
##
|
||||
nodePorts:
|
||||
data: ""
|
||||
rpc: ""
|
||||
internalMetrics: ""
|
||||
## @param taskmanager.service.extraPorts Extra ports to expose in the service (normally used with the `sidecar` value)
|
||||
##
|
||||
extraPorts: []
|
||||
## @param taskmanager.service.loadBalancerIP LoadBalancerIP if service type is `LoadBalancer`
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
##
|
||||
loadBalancerIP: ""
|
||||
## @param taskmanager.service.loadBalancerSourceRanges Service Load Balancer sources
|
||||
## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
|
||||
## e.g:
|
||||
## loadBalancerSourceRanges:
|
||||
## - 10.10.10.0/24
|
||||
##
|
||||
loadBalancerSourceRanges: []
|
||||
## @param taskmanager.service.clusterIP Service Cluster IP
|
||||
## e.g.:
|
||||
## clusterIP: None
|
||||
##
|
||||
clusterIP: ""
|
||||
## @param taskmanager.service.externalTrafficPolicy Service external traffic policy
|
||||
## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
##
|
||||
externalTrafficPolicy: Cluster
|
||||
## @param taskmanager.service.annotations Provide any additional annotations which may be required.
|
||||
## This can be used to set the LoadBalancer service type to internal only.
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
##
|
||||
annotations: {}
|
||||
## @param taskmanager.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"
|
||||
## If "ClientIP", consecutive client requests will be directed to the same Pod
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
|
||||
##
|
||||
sessionAffinity: None
|
||||
## @param taskmanager.service.sessionAffinityConfig Additional settings for the sessionAffinity
|
||||
## sessionAffinityConfig:
|
||||
## clientIP:
|
||||
## timeoutSeconds: 300
|
||||
##
|
||||
sessionAffinityConfig: {}
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param taskmanager.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param taskmanager.networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param taskmanager.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param taskmanager.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param taskmanager.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param taskmanager.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param taskmanager.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
## Apache Flink taskmanager serviceAccount parameters
|
||||
##
|
||||
serviceAccount:
|
||||
## @param taskmanager.serviceAccount.create Enables ServiceAccount
|
||||
##
|
||||
create: true
|
||||
## @param taskmanager.serviceAccount.name ServiceAccount name
|
||||
##
|
||||
name: ""
|
||||
## @param taskmanager.serviceAccount.annotations Annotations to add to all deployed objects
|
||||
##
|
||||
annotations: {}
|
||||
## @param taskmanager.serviceAccount.automountServiceAccountToken Automount API credentials for a service account.
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## Pod security context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param taskmanager.podSecurityContext.enabled Enabled Apache Flink pods' Security Context
|
||||
## @param taskmanager.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
|
||||
## @param taskmanager.podSecurityContext.sysctls Set kernel settings using the sysctl interface
|
||||
## @param taskmanager.podSecurityContext.supplementalGroups Set filesystem extra groups
|
||||
## @param taskmanager.podSecurityContext.fsGroup Set Apache Flink pod's Security Context fsGroup
|
||||
##
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroupChangePolicy: Always
|
||||
sysctls: []
|
||||
supplementalGroups: []
|
||||
fsGroup: 1001
|
||||
## Configure Container Security Context (only main container)
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param taskmanager.containerSecurityContext.enabled Enabled Apache Flink containers' Security Context
|
||||
## @param taskmanager.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||||
## @param taskmanager.containerSecurityContext.runAsUser Set Apache Flink container's Security Context runAsUser
|
||||
## @param taskmanager.containerSecurityContext.runAsGroup Set Apache Flink container's Security Context runAsGroup
|
||||
## @param taskmanager.containerSecurityContext.runAsNonRoot Force the container to be run as non root
|
||||
## @param taskmanager.containerSecurityContext.privileged Set primary container's Security Context privileged
|
||||
## @param taskmanager.containerSecurityContext.allowPrivilegeEscalation Allows privilege escalation
|
||||
## @param taskmanager.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
|
||||
## @param taskmanager.containerSecurityContext.capabilities.drop List of capabilities to be dropped
|
||||
## @param taskmanager.containerSecurityContext.seccompProfile.type Rules specifying actions to take based on the requested syscall
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
## @param taskmanager.podAnnotations Additional pod annotations
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
##
|
||||
podAnnotations: {}
|
||||
## @param taskmanager.podLabels Additional pod labels
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
##
|
||||
podLabels: {}
|
||||
## @param taskmanager.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAffinityPreset: ""
|
||||
## @param taskmanager.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAntiAffinityPreset: soft
|
||||
## Node affinity preset
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
|
||||
##
|
||||
nodeAffinityPreset:
|
||||
## @param taskmanager.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
##
|
||||
type: ""
|
||||
## @param taskmanager.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set
|
||||
##
|
||||
key: ""
|
||||
## @param taskmanager.nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set
|
||||
## E.g.
|
||||
## values:
|
||||
## - e2e-az1
|
||||
## - e2e-az2
|
||||
##
|
||||
values: []
|
||||
## @param taskmanager.priorityClassName Server priorityClassName
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
||||
##
|
||||
priorityClassName: ""
|
||||
## @param taskmanager.affinity Affinity for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
## NOTE: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
|
||||
##
|
||||
affinity: {}
|
||||
## @param taskmanager.nodeSelector Node labels for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## @param taskmanager.tolerations Tolerations for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
##
|
||||
tolerations: []
|
||||
## @param taskmanager.topologySpreadConstraints Topology Spread Constraints for pod assignment
|
||||
## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## The value is evaluated as a template
|
||||
##
|
||||
topologySpreadConstraints: []
|
||||
## @param taskmanager.schedulerName Alternative scheduler
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
## @param taskmanager.podManagementPolicy Pod management policy for the Apache Flink taskmanager statefulset
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
|
||||
##
|
||||
podManagementPolicy: Parallel
|
||||
## @param taskmanager.updateStrategy.type Apache Flink taskmanager statefulset strategy type
|
||||
## @param taskmanager.updateStrategy.rollingUpdate [object,nullable] Apache Flink taskmanager statefulset rolling update configuration parameters
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
|
||||
##
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate: null
|
||||
## @param taskmanager.extraVolumes Optionally specify extra list of additional volumes for flink container
|
||||
##
|
||||
extraVolumes: []
|
||||
## @param taskmanager.initContainers Add additional init containers to the flink pods
|
||||
##
|
||||
initContainers: []
|
||||
## @param taskmanager.sidecars Add additional sidecar containers to the flink pods
|
||||
##
|
||||
sidecars: []
|
||||
## @param taskmanager.pdb.create Enable/disable a Pod Disruption Budget creation
|
||||
## @param taskmanager.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled
|
||||
## @param taskmanager.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable.Defaults to `1` if both `secondary.pdb.minAvailable` and `secondary.pdb.maxUnavailable` are empty.
|
||||
##
|
||||
pdb:
|
||||
create: true
|
||||
minAvailable: ""
|
||||
maxUnavailable: ""
|
||||
21
cluster/manifests/freeleaps-data-platform/kafbat/config.yaml
Normal file
21
cluster/manifests/freeleaps-data-platform/kafbat/config.yaml
Normal file
@ -0,0 +1,21 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kafbat-config
|
||||
namespace: freeleaps-data-platform
|
||||
data:
|
||||
config.yml: |
|
||||
kafka:
|
||||
clusters:
|
||||
- name: freeleaps-kafka-cluster
|
||||
bootstrap-servers: freeleaps-kafka-cluster-kafka-bootstrap.freeleaps-data-platform.svc.freeleaps.cluster:9092
|
||||
properties:
|
||||
security.protocol: SASL_PLAINTEXT
|
||||
sasl.mechanism: SCRAM-SHA-512
|
||||
sasl.jaas.config: 'org.apache.kafka.common.security.scram.ScramLoginModule required username="kafbat-agent" password="lUL2Ay9twljpMMNC2mdwMacK9PoPkMGv";'
|
||||
schemaRegistry: http://schema-registry.freeleaps-data-platform.svc.freeleaps.cluster:8081
|
||||
auth: disabled
|
||||
management:
|
||||
health:
|
||||
ldap:
|
||||
enabled: false
|
||||
@ -0,0 +1,48 @@
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: KafkaUser
|
||||
metadata:
|
||||
name: kafbat-agent
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
strimzi.io/cluster: freeleaps-kafka-cluster
|
||||
spec:
|
||||
authentication:
|
||||
type: scram-sha-512
|
||||
authorization:
|
||||
type: simple
|
||||
acls:
|
||||
- resource:
|
||||
type: topic
|
||||
name: "*"
|
||||
patternType: literal
|
||||
host: "*"
|
||||
operations:
|
||||
- Read
|
||||
- resource:
|
||||
type: topic
|
||||
name: "*"
|
||||
patternType: literal
|
||||
host: "*"
|
||||
operations:
|
||||
- DescribeConfigs
|
||||
- resource:
|
||||
type: group
|
||||
name: "*"
|
||||
patternType: literal
|
||||
host: "*"
|
||||
operations:
|
||||
- Describe
|
||||
- resource:
|
||||
type: cluster
|
||||
name: "*"
|
||||
patternType: literal
|
||||
host: "*"
|
||||
operations:
|
||||
- Describe
|
||||
- resource:
|
||||
type: cluster
|
||||
name: "*"
|
||||
patternType: literal
|
||||
host: "*"
|
||||
operations:
|
||||
- DescribeConfigs
|
||||
@ -0,0 +1,106 @@
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: KafkaNodePool
|
||||
metadata:
|
||||
name: freeleaps-kafka-cluster-controllers
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
strimzi.io/cluster: freeleaps-kafka-cluster
|
||||
spec:
|
||||
replicas: 3
|
||||
roles:
|
||||
- controller
|
||||
storage:
|
||||
type: jbod
|
||||
volumes:
|
||||
- id: 0
|
||||
type: persistent-claim
|
||||
size: 25Gi
|
||||
deleteClaim: false
|
||||
kraftMetadata: shared
|
||||
class: azure-disk-std-ssd-lrs
|
||||
---
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: KafkaNodePool
|
||||
metadata:
|
||||
name: freeleaps-kafka-cluster-brokers
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
strimzi.io/cluster: freeleaps-kafka-cluster
|
||||
spec:
|
||||
replicas: 3
|
||||
roles:
|
||||
- broker
|
||||
storage:
|
||||
type: jbod
|
||||
volumes:
|
||||
- id: 0
|
||||
type: persistent-claim
|
||||
size: 25Gi
|
||||
deleteClaim: false
|
||||
kraftMetadata: shared
|
||||
class: azure-disk-std-ssd-lrs
|
||||
---
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: Kafka
|
||||
metadata:
|
||||
name: freeleaps-kafka-cluster
|
||||
namespace: freeleaps-data-platform
|
||||
annotations:
|
||||
strimzi.io/node-pools: enabled
|
||||
strimzi.io/kraft: enabled
|
||||
spec:
|
||||
kafka:
|
||||
version: 4.0.0
|
||||
metadataVersion: 4.0-IV3
|
||||
listeners:
|
||||
- name: plain
|
||||
port: 9092
|
||||
type: internal
|
||||
tls: false
|
||||
authentication:
|
||||
type: scram-sha-512
|
||||
- name: tls
|
||||
port: 9093
|
||||
type: internal
|
||||
tls: true
|
||||
config:
|
||||
offsets.topic.replication.factor: 1
|
||||
transaction.state.log.replication.factor: 1
|
||||
transaction.state.log.min.isr: 1
|
||||
default.replication.factor: 1
|
||||
min.insync.replicas: 1
|
||||
authorization:
|
||||
type: simple
|
||||
superUsers:
|
||||
- freeleaps-user
|
||||
entityOperator:
|
||||
topicOperator: {}
|
||||
userOperator: {}
|
||||
---
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: KafkaUser
|
||||
metadata:
|
||||
name: freeleaps-user
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
strimzi.io/cluster: freeleaps-kafka-cluster
|
||||
spec:
|
||||
authentication:
|
||||
type: scram-sha-512
|
||||
authorization:
|
||||
type: simple
|
||||
acls:
|
||||
- resource:
|
||||
type: topic
|
||||
name: "*"
|
||||
patternType: literal
|
||||
host: "*"
|
||||
operations:
|
||||
- All
|
||||
- resource:
|
||||
type: group
|
||||
name: "*"
|
||||
patternType: literal
|
||||
operations:
|
||||
- All
|
||||
host: "*"
|
||||
@ -1,90 +0,0 @@
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: Kafka
|
||||
metadata:
|
||||
name: kafka-cluster
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
app: kafka
|
||||
component: messaging
|
||||
spec:
|
||||
kafka:
|
||||
version: 3.8.0
|
||||
replicas: 3
|
||||
listeners:
|
||||
- name: plain
|
||||
port: 9092
|
||||
type: internal
|
||||
tls: false
|
||||
authentication:
|
||||
type: scram-sha-512
|
||||
- name: tls
|
||||
port: 9093
|
||||
type: internal
|
||||
tls: true
|
||||
authentication:
|
||||
type: tls
|
||||
config:
|
||||
offsets.topic.replication.factor: 3
|
||||
transaction.state.log.replication.factor: 3
|
||||
transaction.state.log.min.isr: 2
|
||||
default.replication.factor: 3
|
||||
min.insync.replicas: 2
|
||||
inter.broker.protocol.version: "3.8"
|
||||
log.retention.hours: 168 # 7 days
|
||||
log.segment.bytes: 1073741824 # 1GB
|
||||
num.partitions: 8
|
||||
log.retention.check.interval.ms: 300000
|
||||
storage:
|
||||
type: persistent-claim
|
||||
size: 20Gi
|
||||
deleteClaim: false
|
||||
zookeeper:
|
||||
replicas: 3
|
||||
storage:
|
||||
type: persistent-claim
|
||||
size: 10Gi
|
||||
deleteClaim: false
|
||||
entityOperator:
|
||||
topicOperator: {}
|
||||
userOperator: {}
|
||||
---
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: KafkaTopic
|
||||
metadata:
|
||||
name: system-events
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
strimzi.io/cluster: kafka-cluster
|
||||
spec:
|
||||
partitions: 3
|
||||
replicas: 3
|
||||
config:
|
||||
retention.ms: 604800000 # 7 days
|
||||
segment.bytes: 1073741824 # 1GB
|
||||
cleanup.policy: delete
|
||||
---
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: KafkaUser
|
||||
metadata:
|
||||
name: freeleaps-user
|
||||
namespace: freeleaps-data-platform
|
||||
labels:
|
||||
strimzi.io/cluster: kafka-cluster
|
||||
spec:
|
||||
authentication:
|
||||
type: scram-sha-512
|
||||
authorization:
|
||||
type: simple
|
||||
acls:
|
||||
- resource:
|
||||
type: topic
|
||||
name: "*"
|
||||
patternType: literal
|
||||
operation: All
|
||||
host: "*"
|
||||
- resource:
|
||||
type: group
|
||||
name: "*"
|
||||
patternType: literal
|
||||
operation: All
|
||||
host: "*"
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,126 +0,0 @@
|
||||
# Metabase Deployment
|
||||
|
||||
## Overview
|
||||
This directory contains Kubernetes manifests for deploying Metabase, a business intelligence and analytics platform, along with its PostgreSQL database.
|
||||
|
||||
## Components
|
||||
|
||||
### 1. metabase-postgres.yaml
|
||||
PostgreSQL database deployment:
|
||||
- Persistent storage for data
|
||||
- ConfigMap for database configuration
|
||||
- Secret for database password
|
||||
- Service for internal communication
|
||||
|
||||
### 2. metabase-deployment.yaml
|
||||
Metabase application deployment:
|
||||
- Metabase container with latest image
|
||||
- Persistent storage for application data
|
||||
- Environment variables for database connection
|
||||
- Health checks and resource limits
|
||||
- Service for internal communication
|
||||
|
||||
### 3. metabase-ingress.yaml
|
||||
Ingress configuration for external access:
|
||||
- Nginx ingress class
|
||||
- Multiple host support (metabase.freeleaps.cluster, metabase.local)
|
||||
- SSL redirect disabled for development
|
||||
|
||||
## Deployment Steps
|
||||
|
||||
### 1. Deploy PostgreSQL Database
|
||||
```bash
|
||||
kubectl apply -f metabase-postgres.yaml
|
||||
```
|
||||
|
||||
### 2. Wait for PostgreSQL to be Ready
|
||||
```bash
|
||||
kubectl wait --for=condition=ready pod -l app=metabase-postgres -n metabase --timeout=300s
|
||||
```
|
||||
|
||||
### 3. Deploy Metabase Application
|
||||
```bash
|
||||
kubectl apply -f metabase-deployment.yaml
|
||||
```
|
||||
|
||||
### 4. Deploy Ingress (Optional)
|
||||
```bash
|
||||
kubectl apply -f metabase-ingress.yaml
|
||||
```
|
||||
|
||||
### 5. Monitor Deployment
|
||||
```bash
|
||||
kubectl get pods -n metabase
|
||||
kubectl get services -n metabase
|
||||
kubectl get ingress -n metabase
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Database Connection
|
||||
- **Type**: PostgreSQL
|
||||
- **Host**: metabase-postgres
|
||||
- **Port**: 5432
|
||||
- **Database**: metabase
|
||||
- **User**: metabase
|
||||
- **Password**: metabasepassword
|
||||
|
||||
### Storage
|
||||
- **Metabase Data**: 10Gi persistent storage
|
||||
- **PostgreSQL Data**: 5Gi persistent storage
|
||||
- **Storage Class**: azure-disk-std-ssd-lrs
|
||||
|
||||
### Resources
|
||||
- **Metabase**: 512Mi-1Gi memory, 250m-500m CPU
|
||||
- **PostgreSQL**: 256Mi-512Mi memory, 250m-500m CPU
|
||||
|
||||
## Access
|
||||
|
||||
### Internal Access
|
||||
- **Metabase**: http://metabase.metabase.svc.cluster.local:3000
|
||||
- **PostgreSQL**: metabase-postgres.metabase.svc.cluster.local:5432
|
||||
|
||||
### External Access (with Ingress)
|
||||
- **Primary**: http://metabase.freeleaps.cluster
|
||||
- **Alternative**: http://metabase.local
|
||||
|
||||
## Initial Setup
|
||||
|
||||
1. **First Access**: Navigate to the Metabase URL
|
||||
2. **Setup Wizard**: Follow the initial setup wizard
|
||||
3. **Database Connection**: Use the internal PostgreSQL connection
|
||||
4. **Admin User**: Create the first admin user
|
||||
5. **Data Sources**: Connect to your data sources
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Check Pod Status
|
||||
```bash
|
||||
kubectl get pods -n metabase
|
||||
kubectl describe pod <pod-name> -n metabase
|
||||
```
|
||||
|
||||
### Check Logs
|
||||
```bash
|
||||
kubectl logs <pod-name> -n metabase
|
||||
kubectl logs <pod-name> -n metabase -c postgres # for PostgreSQL
|
||||
```
|
||||
|
||||
### Check Services
|
||||
```bash
|
||||
kubectl get services -n metabase
|
||||
kubectl describe service metabase -n metabase
|
||||
```
|
||||
|
||||
### Check Storage
|
||||
```bash
|
||||
kubectl get pvc -n metabase
|
||||
kubectl describe pvc metabase-data -n metabase
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
- **Initial Startup**: Metabase may take 2-3 minutes to start up on first deployment
|
||||
- **Database**: Ensure PostgreSQL is fully ready before deploying Metabase
|
||||
- **Storage**: Both Metabase and PostgreSQL use persistent storage for data persistence
|
||||
- **Security**: Default password is base64 encoded, consider changing for production use
|
||||
@ -0,0 +1,13 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: metabase-mathmast-dot-com
|
||||
namespace: freeleaps-data-platform
|
||||
spec:
|
||||
commonName: metabase.mathmast.com
|
||||
dnsNames:
|
||||
- metabase.mathmast.com
|
||||
issuerRef:
|
||||
name: mathmast-dot-com
|
||||
kind: ClusterIssuer
|
||||
secretName: metabase-mathmast-dot-com-tls
|
||||
@ -1,145 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: metabase
|
||||
labels:
|
||||
name: metabase
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: metabase
|
||||
namespace: metabase
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: metabase-data
|
||||
namespace: metabase
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
storageClassName: azure-disk-std-ssd-lrs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: metabase-config
|
||||
namespace: metabase
|
||||
data:
|
||||
MB_DB_TYPE: "postgres"
|
||||
MB_DB_DBNAME: "metabase"
|
||||
MB_DB_PORT: "5432"
|
||||
MB_DB_USER: "metabase"
|
||||
MB_DB_HOST: "metabase-postgres"
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: metabase
|
||||
namespace: metabase
|
||||
labels:
|
||||
app: metabase
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: metabase
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: metabase
|
||||
spec:
|
||||
serviceAccountName: metabase
|
||||
containers:
|
||||
- name: metabase
|
||||
image: metabase/metabase:latest
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
env:
|
||||
- name: MB_DB_TYPE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: metabase-config
|
||||
key: MB_DB_TYPE
|
||||
- name: MB_DB_DBNAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: metabase-config
|
||||
key: MB_DB_DBNAME
|
||||
- name: MB_DB_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: metabase-config
|
||||
key: MB_DB_PORT
|
||||
- name: MB_DB_USER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: metabase-config
|
||||
key: MB_DB_USER
|
||||
- name: MB_DB_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: metabase-config
|
||||
key: MB_DB_HOST
|
||||
- name: MB_DB_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: metabase-db-secret
|
||||
key: password
|
||||
volumeMounts:
|
||||
- name: metabase-data
|
||||
mountPath: /metabase-data
|
||||
resources:
|
||||
requests:
|
||||
memory: "512Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "1Gi"
|
||||
cpu: "500m"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3000
|
||||
initialDelaySeconds: 120
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3000
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
volumes:
|
||||
- name: metabase-data
|
||||
persistentVolumeClaim:
|
||||
claimName: metabase-data
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: metabase
|
||||
namespace: metabase
|
||||
labels:
|
||||
app: metabase
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 3000
|
||||
targetPort: 3000
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
app: metabase
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: metabase-db-secret
|
||||
namespace: metabase
|
||||
type: Opaque
|
||||
data:
|
||||
password: bWV0YWJhc2VwYXNzd29yZA== # metabasepassword in base64
|
||||
@ -1,32 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: metabase-ingress
|
||||
namespace: metabase
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
|
||||
spec:
|
||||
rules:
|
||||
- host: metabase.freeleaps.cluster
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: metabase
|
||||
port:
|
||||
number: 3000
|
||||
- host: metabase.local
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: metabase
|
||||
port:
|
||||
number: 3000
|
||||
@ -1,119 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: metabase-postgres-data
|
||||
namespace: metabase
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: azure-disk-std-ssd-lrs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: metabase-postgres-config
|
||||
namespace: metabase
|
||||
data:
|
||||
POSTGRES_DB: "metabase"
|
||||
POSTGRES_USER: "metabase"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: metabase-postgres-secret
|
||||
namespace: metabase
|
||||
type: Opaque
|
||||
data:
|
||||
POSTGRES_PASSWORD: bWV0YWJhc2VwYXNzd29yZA== # metabasepassword in base64
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: metabase-postgres
|
||||
namespace: metabase
|
||||
labels:
|
||||
app: metabase-postgres
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: metabase-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: metabase-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: postgres:15
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
env:
|
||||
- name: POSTGRES_DB
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: metabase-postgres-config
|
||||
key: POSTGRES_DB
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: metabase-postgres-config
|
||||
key: POSTGRES_USER
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: metabase-postgres-secret
|
||||
key: POSTGRES_PASSWORD
|
||||
- name: PGDATA
|
||||
value: "/var/lib/postgresql/data/pgdata"
|
||||
volumeMounts:
|
||||
- name: postgres-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- metabase
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- metabase
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: postgres-data
|
||||
persistentVolumeClaim:
|
||||
claimName: metabase-postgres-data
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: metabase-postgres
|
||||
namespace: metabase
|
||||
labels:
|
||||
app: metabase-postgres
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 5432
|
||||
targetPort: 5432
|
||||
protocol: TCP
|
||||
name: postgres
|
||||
selector:
|
||||
app: metabase-postgres
|
||||
361
cluster/manifests/freeleaps-data-platform/metabase/values.yaml
Normal file
361
cluster/manifests/freeleaps-data-platform/metabase/values.yaml
Normal file
@ -0,0 +1,361 @@
|
||||
replicaCount: 1
|
||||
|
||||
hpa:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 6
|
||||
targetCPUUtilizationPercentage: 80
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# Adding host aliases to the metabase deployment
|
||||
hostAliases: []
|
||||
# - ip: "127.0.0.1"
|
||||
# hostnames:
|
||||
# - "foo.local"
|
||||
# - "bar.local"
|
||||
|
||||
pdb:
|
||||
create: false
|
||||
minAvailable: 1
|
||||
maxUnavailable: ""
|
||||
|
||||
deploymentAnnotations: {}
|
||||
deploymentLabels: {}
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
podSecurityContext: {}
|
||||
image:
|
||||
repository: metabase/metabase
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: ""
|
||||
command: []
|
||||
pullPolicy: IfNotPresent
|
||||
pullSecrets: []
|
||||
|
||||
## String to fully override metabase.fullname template
|
||||
##
|
||||
# fullnameOverride:
|
||||
|
||||
# Config Jetty web server
|
||||
listen:
|
||||
host: "0.0.0.0"
|
||||
port: 3000
|
||||
|
||||
monitoring:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
port: 9191
|
||||
|
||||
ssl:
|
||||
# If you have an ssl certificate and would prefer to have Metabase run over HTTPS
|
||||
enabled: false
|
||||
# port: 8443
|
||||
# keyStore: |-
|
||||
# << JKS KEY STORE >>
|
||||
# keyStorePassword: storepass
|
||||
jetty:
|
||||
# maxThreads: 254
|
||||
# minThreads: 8
|
||||
# maxQueued: -1
|
||||
# maxIdleTime: 60000
|
||||
|
||||
# Backend database
|
||||
database:
|
||||
# Database type (h2 / mysql / postgres), default: h2
|
||||
type: h2
|
||||
# if h2 is used, the persistentVolume and pvc are used to store the database. Only for non-production environments.
|
||||
persistence:
|
||||
type: pvc
|
||||
enabled: true
|
||||
storageClassName: azure-disk-std-lrs
|
||||
## (Optional) Use this to bind the claim to an existing PersistentVolume (PV) by name.
|
||||
volumeName: ""
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 15Gi
|
||||
# annotations: {}
|
||||
finalizers:
|
||||
- kubernetes.io/pvc-protection
|
||||
# selectorLabels: {}
|
||||
## Sub-directory of the PV to mount. Can be templated.
|
||||
# subPath: ""
|
||||
## Name of an existing PVC. Can be templated.
|
||||
# existingClaim:
|
||||
## Extra labels to apply to a PVC.
|
||||
extraPvcLabels: {}
|
||||
disableWarning: false
|
||||
|
||||
## If 'lookupVolumeName' is set to true, Helm will attempt to retrieve
|
||||
## the current value of 'spec.volumeName' and incorporate it into the template.
|
||||
lookupVolumeName: true
|
||||
## Specify file to store H2 database. You will also have to back this with a volume (cf. extraVolume and extraVolumeMounts)!
|
||||
# file:
|
||||
# encryptionKey: << YOUR ENCRYPTION KEY OR LEAVE BLANK AND USE EXISTING SECRET >>
|
||||
## Only need when you use mysql / postgres
|
||||
# host:
|
||||
# port:
|
||||
# dbname:
|
||||
# username:
|
||||
# password:
|
||||
## Alternatively, use a connection URI for full configurability. Example for SSL enabled Postgres.
|
||||
# connectionURI: postgres://<host>:<port>/<database>?user=<username>&password=<password>&ssl=true&sslfactory=org.postgresql.ssl.NonValidatingFactory
|
||||
## If a secret with the database credentials already exists, use the following values:
|
||||
# existingSecret:
|
||||
# existingSecretUsernameKey:
|
||||
# existingSecretPasswordKey:
|
||||
# existingSecretConnectionURIKey:
|
||||
# existingSecretEncryptionKeyKey:
|
||||
# existingSecretPortKey:
|
||||
# existingSecretHostKey:
|
||||
# existingSecretDatabaseNameKey:
|
||||
## One or more Google Cloud SQL database instances can be made available to Metabase via the *Cloud SQL Auth proxy*.
|
||||
## These can be used for Metabase's internal database (by specifying `host: localhost` and the port above), or as
|
||||
## additional databases (configured at Admin → Databases). Workload Identity should be used for authentication, so
|
||||
## that when `serviceAccount.create=true`, `serviceAccount.annotations` should contain:
|
||||
## iam.gke.io/gcp-service-account: your-gsa@email
|
||||
## Ref: https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine
|
||||
googleCloudSQL:
|
||||
## Found in Cloud Console "Cloud SQL Instance details" or using `gcloud sql instances describe INSTANCE_ID`
|
||||
## example format: $project:$region:$instance=tcp:$port
|
||||
## Each connection must have a unique TCP port.
|
||||
instanceConnectionNames: []
|
||||
## Option to use a specific version of the *Cloud SQL Auth proxy* sidecar image.
|
||||
## ref: https://console.cloud.google.com/gcr/images/cloudsql-docker/GLOBAL/gce-proxy
|
||||
# sidecarImageTag: latest
|
||||
## ref: https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine#running_the_as_a_sidecar
|
||||
resources: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
password:
|
||||
# Changing Metabase password complexity:
|
||||
# weak: no character constraints
|
||||
# normal: at least 1 digit (default)
|
||||
# strong: minimum 8 characters w/ 2 lowercase, 2 uppercase, 1 digit, and 1 special character
|
||||
complexity: normal
|
||||
length: 6
|
||||
|
||||
timeZone: UTC
|
||||
emojiLogging: true
|
||||
colorLogging: true
|
||||
javaOpts: -Xmx1024m -Xms512m
|
||||
# pluginsDirectory: /plugins
|
||||
siteUrl: https://metabase.mathmast.com
|
||||
|
||||
session:
|
||||
{}
|
||||
# maxSessionAge:
|
||||
# sessionCookies:
|
||||
# cookieSameSite:
|
||||
|
||||
# specify init containers, e.g. for module download
|
||||
extraInitContainers: []
|
||||
# - name: download-modules
|
||||
# image: "curlimages/curl:7.70.0"
|
||||
# imagePullPolicy: "IfNotPresent"
|
||||
# volumeMounts:
|
||||
# - name: plugins
|
||||
# mountPath: /plugins
|
||||
# workingDir: /plugins
|
||||
# command:
|
||||
# - "/bin/sh"
|
||||
# - "-ec"
|
||||
# - |
|
||||
# curl -Lso /plugins/athena.metabase-driver.jar \
|
||||
# https://github.com/dacort/metabase-athena-driver/releases/download/v1.1.0/athena.metabase-driver.jar
|
||||
|
||||
extraVolumeMounts: []
|
||||
# - name: plugins
|
||||
# mountPath: /plugins
|
||||
# readOnly: false
|
||||
|
||||
extraVolumes: []
|
||||
# - name: plugins
|
||||
# emptyDir: {}
|
||||
|
||||
livenessProbe:
|
||||
path: /api/health
|
||||
initialDelaySeconds: 120
|
||||
timeoutSeconds: 30
|
||||
failureThreshold: 6
|
||||
|
||||
readinessProbe:
|
||||
path: /api/health
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 3
|
||||
periodSeconds: 5
|
||||
|
||||
service:
|
||||
name: metabase
|
||||
type: ClusterIP
|
||||
externalPort: 80
|
||||
internalPort: 3000
|
||||
# Used to fix NodePort when service.type: NodePort.
|
||||
nodePort:
|
||||
annotations:
|
||||
{}
|
||||
# Used to add custom annotations to the Service.
|
||||
# service.beta.kubernetes.io/aws-load-balancer-internal: "0.0.0.0/0"
|
||||
labels:
|
||||
{}
|
||||
# Used to add custom labels to the Service.
|
||||
loadBalancerSourceRanges: {}
|
||||
# Used to configure a static IP address
|
||||
loadBalancerIP:
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
# The ingress class name, if you use multiple ingress controllers:
|
||||
className: nginx
|
||||
# Used to create Ingress record (should used with service.type: ClusterIP).
|
||||
hosts:
|
||||
- "metabase.mathmast.com"
|
||||
# - metabase.domain.com
|
||||
# The ingress path. Useful to host metabase on a subpath, such as `/metabase`.
|
||||
path: /
|
||||
pathType: Prefix
|
||||
labels:
|
||||
# Used to add custom labels to the Ingress
|
||||
# Useful if for example you have multiple Ingress controllers and want your Ingress controllers to bind to specific Ingresses
|
||||
# traffic: internal
|
||||
annotations:
|
||||
{}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
tls:
|
||||
# Secrets must be manually created in the namespace.
|
||||
- secretName: metabase-mathmast-dot-com-tls
|
||||
hosts:
|
||||
- metabase.mathmast.com
|
||||
|
||||
route:
|
||||
enabled: false
|
||||
annotations:
|
||||
{}
|
||||
# haproxy.router.openshift.io/timeout: "60s"
|
||||
# host: ""
|
||||
path: ""
|
||||
wildcardPolicy: "None"
|
||||
tls:
|
||||
{}
|
||||
# termination: "Edge"
|
||||
# insecureEdgeTerminationPolicy: "Redirect"
|
||||
# key: ""
|
||||
# certificate: ""
|
||||
# caCertificate: ""
|
||||
# destinationCACertificate: ""
|
||||
|
||||
# A custom log4j2.xml file can be provided using a multiline YAML string.
|
||||
# See https://github.com/metabase/metabase/blob/master/resources/log4j2.xml
|
||||
#
|
||||
# log4j2XML:
|
||||
|
||||
# DEPRECATED; A custom log4j.properties file can be provided using a multiline YAML string.
|
||||
# See https://github.com/metabase/metabase/blob/master/resources/log4j.properties
|
||||
#
|
||||
# log4jProperties:
|
||||
|
||||
# The deployment strategy to use
|
||||
# https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec
|
||||
# strategy:
|
||||
# type: "Recreate"
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: false
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
# autoMount is deprecated in favor of automountServiceAccountToken
|
||||
# If you want to disable auto mount of Service Account Token then you can set the value to false;
|
||||
# https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting
|
||||
automountServiceAccountToken: false
|
||||
|
||||
resources:
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: "0.5"
|
||||
memory: 512Mi
|
||||
|
||||
# You can also opt out of automounting API credentials for a particular Pod;
|
||||
# https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting
|
||||
automountServiceAccountToken: true
|
||||
|
||||
## Node labels for pod assignment
|
||||
## ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
#
|
||||
nodeSelector: {}
|
||||
|
||||
## Tolerations for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
##
|
||||
tolerations: []
|
||||
|
||||
## Affinity for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
##
|
||||
affinity: {}
|
||||
|
||||
## Spread Constraints for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
topologySpreadConstraints: []
|
||||
|
||||
## PriorityClass for pod assignment
|
||||
## ref:
|
||||
## https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority
|
||||
## priorityClass: ""
|
||||
|
||||
## AWS Security Group Policy (EKS)
|
||||
## ref: https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html
|
||||
##
|
||||
awsEKS:
|
||||
sgp:
|
||||
enabled: false
|
||||
# AWS Security Group IDs to attach to the pod
|
||||
# sgIds:
|
||||
# - sg-abc123
|
||||
# - sg-xyz456
|
||||
|
||||
extraEnv: []
|
||||
# - name: MB_CHECK_FOR_UPDATES
|
||||
# value: false
|
||||
# - name: MB_ADMIN_EMAIL
|
||||
# valueFrom:
|
||||
# configMapKeyRef:
|
||||
# name: metabase
|
||||
# key: email
|
||||
|
||||
envFrom:
|
||||
[]
|
||||
# - type: secret
|
||||
# name: metabase-secret
|
||||
# - type: configMap
|
||||
# name: metabase-cm
|
||||
|
||||
securityContext: {}
|
||||
|
||||
sidecars:
|
||||
[]
|
||||
# - name: busybox
|
||||
# image: busybox
|
||||
# ports:
|
||||
# - containerPort: 80
|
||||
# name: http
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 100Mi
|
||||
# cpu: 10m
|
||||
# limits:
|
||||
# memory: 100Mi
|
||||
# cpu: 10m
|
||||
# command: ["/bin/sh"]
|
||||
# args: ["-c", "while true; do echo hello; sleep 10;done"]
|
||||
@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: schema-registry-kafka-auth
|
||||
namespace: freeleaps-data-platform
|
||||
type: Opaque
|
||||
data:
|
||||
# Password for freeleaps-user (base64 encoded: xzjo1UdA7xs9d3DDHZ0NgaRoBwdhxyBE)
|
||||
client-passwords: eHpqbzFVZEE3eHM5ZDNEREhaME5nYVJvQndkaHh5QkU=
|
||||
@ -0,0 +1,788 @@
|
||||
# Copyright Broadcom, Inc. All Rights Reserved.
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## @section Global parameters
|
||||
## Global Docker image parameters
|
||||
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
|
||||
## Current available global Docker image parameters: imageRegistry and imagePullSecrets
|
||||
## @param global.imageRegistry Global Docker image registry
|
||||
## @param global.imagePullSecrets Global Docker registry secret names as an array
|
||||
## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)
|
||||
##
|
||||
global:
|
||||
imageRegistry: ""
|
||||
## e.g.
|
||||
## imagePullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
imagePullSecrets: []
|
||||
defaultStorageClass: ""
|
||||
## Security parameters
|
||||
##
|
||||
security:
|
||||
## @param global.security.allowInsecureImages Allows skipping image verification
|
||||
allowInsecureImages: false
|
||||
## Compatibility adaptations for Kubernetes platforms
|
||||
##
|
||||
compatibility:
|
||||
## Compatibility adaptations for Openshift
|
||||
##
|
||||
openshift:
|
||||
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
|
||||
##
|
||||
adaptSecurityContext: auto
|
||||
## @param kubeVersion Override Kubernetes version
|
||||
##
|
||||
kubeVersion: ""
|
||||
## @section Common parameters
|
||||
## @param nameOverride String to partially override common.names.fullname template with a string (will prepend the release name)
|
||||
##
|
||||
nameOverride: ""
|
||||
## @param fullnameOverride String to fully override common.names.fullname template with a string
|
||||
##
|
||||
fullnameOverride: ""
|
||||
## @param namespaceOverride String to fully override common.names.namespace
|
||||
##
|
||||
namespaceOverride: ""
|
||||
## @param commonLabels Labels to add to all deployed objects
|
||||
##
|
||||
commonLabels: {}
|
||||
## @param commonAnnotations Annotations to add to all deployed objects
|
||||
##
|
||||
commonAnnotations: {}
|
||||
## @param clusterDomain Kubernetes cluster domain name
|
||||
##
|
||||
clusterDomain: freeleaps.cluster
|
||||
## @param extraDeploy Array of extra objects to deploy with the release
|
||||
##
|
||||
extraDeploy: []
|
||||
## @param usePasswordFiles Mount credentials as files instead of using environment variables
|
||||
##
|
||||
usePasswordFiles: true
|
||||
## Enable diagnostic mode in the deployment
|
||||
##
|
||||
diagnosticMode:
|
||||
## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
|
||||
##
|
||||
enabled: false
|
||||
## @param diagnosticMode.command Command to override all containers in the deployment
|
||||
##
|
||||
command:
|
||||
- sleep
|
||||
## @param diagnosticMode.args Args to override all containers in the deployment
|
||||
##
|
||||
args:
|
||||
- infinity
|
||||
## @section Schema Registry parameters
|
||||
## Bitnami Schema Registry image
|
||||
## ref: https://hub.docker.com/r/bitnami/schema-registry/tags/
|
||||
## @param image.registry [default: REGISTRY_NAME] Schema Registry image registry
|
||||
## @param image.repository [default: REPOSITORY_NAME/schema-registry] Schema Registry image repository
|
||||
## @skip image.tag Schema Registry image tag (immutable tags are recommended)
|
||||
## @param image.digest Schema Registry image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||||
## @param image.pullPolicy Schema Registry image pull policy
|
||||
## @param image.pullSecrets Schema Registry image pull secrets
|
||||
## @param image.debug Enable image debug mode
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/schema-registry
|
||||
tag: 8.0.0-debian-12-r4
|
||||
digest: ""
|
||||
## ref: http://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## e.g:
|
||||
## pullSecrets:
|
||||
## - myRegistryKeySecretName
|
||||
##
|
||||
pullSecrets: []
|
||||
## Set to true if you would like to see extra information on logs
|
||||
##
|
||||
debug: false
|
||||
## @param command Override default container command (useful when using custom images)
|
||||
##
|
||||
command: []
|
||||
## @param args Override default container args (useful when using custom images)
|
||||
##
|
||||
args: []
|
||||
## @param automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @param hostAliases Schema Registry pods host aliases
|
||||
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
|
||||
##
|
||||
hostAliases: []
|
||||
## @param podLabels Extra labels for Schema Registry pods
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
##
|
||||
podLabels: {}
|
||||
## @param configuration Specify content for schema-registry.properties. Auto-generated based on other parameters when not specified
|
||||
##
|
||||
## e.g:
|
||||
## configuration: |-
|
||||
## listeners = http://0.0.0.0:8081
|
||||
## kafkastore.bootstrap.servers = protocol://broker_hostname:port
|
||||
## host.name = schema-registry
|
||||
## kafkastore.topic = _schemas
|
||||
## inter.instance.protocol = http
|
||||
## avro.compatibility.level = backward
|
||||
## debug = false
|
||||
##
|
||||
configuration: {}
|
||||
## @param existingConfigmap Name of existing ConfigMap with Schema Registry configuration
|
||||
## NOTE: When it's set the configuration parameter is ignored
|
||||
##
|
||||
existingConfigmap: ""
|
||||
## @param log4j Schema Registry Log4J Configuration (optional)
|
||||
## Overwrites default log4j.properties file
|
||||
##
|
||||
log4j: {}
|
||||
## @param existingLog4jConfigMap Name of existing ConfigMap containing a custom log4j.properties file.
|
||||
## NOTE: When it's set the log4j is ignored
|
||||
##
|
||||
existingLog4jConfigMap: ""
|
||||
## Authentication parameteres
|
||||
## https://github.com/bitnami/bitnami-docker-kafka#security
|
||||
##
|
||||
auth:
|
||||
## TLS parameters to be used when a listener uses HTTPS
|
||||
##
|
||||
tls:
|
||||
## @param auth.tls.enabled Enable TLS configuration to provide to be used when a listener uses HTTPS
|
||||
##
|
||||
enabled: false
|
||||
## @param auth.tls.jksSecret Existing secret containing the truststore and one keystore per Schema Registry replica
|
||||
##
|
||||
## Create this secret following the steps below:
|
||||
## 1) Generate your trustore and keystore files. Helpful script: https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh
|
||||
## 2) Rename your truststore to `schema-registry.truststore.jks`.
|
||||
## 3) Rename your keystores to `schema-registry-X.keystore.jks` where X is the ID of each Schema Registry replica
|
||||
## 4) Run the command below where SECRET_NAME is the name of the secret you want to create:
|
||||
## kubectl create secret generic SECRET_NAME --from-file=./schema-registry.truststore.jks --from-file=./schema-registry-0.keystore.jks --from-file=./schema-registry-1.keystore.jks ...
|
||||
##
|
||||
jksSecret: ""
|
||||
## @param auth.tls.keystorePassword Password to access the keystore when it's password-protected
|
||||
##
|
||||
keystorePassword: ""
|
||||
## @param auth.tls.truststorePassword Password to access the truststore when it's password-protected
|
||||
##
|
||||
truststorePassword: ""
|
||||
## @param auth.tls.clientAuthentication Client authentication configuration.
|
||||
## Valid options: NONE, REQUESTED, over REQUIRED
|
||||
##
|
||||
clientAuthentication: NONE
|
||||
## Parameters to configure authentication with kafka brokers
|
||||
##
|
||||
kafka:
|
||||
## @param auth.kafka.jksSecret Existing secret containing the truststore and one keystore per Schema Registry replica
|
||||
##
|
||||
## Create this secret following the steps below:
|
||||
## 1) Generate your trustore and keystore files. Helpful script: https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh
|
||||
## 2) Rename your truststore to `kafka.truststore.jks`.
|
||||
## 3) Rename your keystores to `kafka-X.keystore.jks` where X is the ID of each Schema Registry replica
|
||||
## 4) Run the command below where SECRET_NAME is the name of the secret you want to create:
|
||||
## kubectl create secret generic SECRET_NAME --from-file=./kafka.truststore.jks --from-file=./kafka-0.keystore.jks --from-file=./kafka-1.keystore.jks ...
|
||||
##
|
||||
jksSecret: ""
|
||||
## @param auth.kafka.tlsEndpointIdentificationAlgorithm The endpoint identification algorithm used validate brokers hostnames
|
||||
## Disable server hostname verification by setting it to an empty string
|
||||
## See: https://docs.confluent.io/current/kafka/authentication_ssl.html#optional-settings
|
||||
##
|
||||
tlsEndpointIdentificationAlgorithm: https
|
||||
## @param auth.kafka.keystorePassword Password to access the keystore when it's password-protected
|
||||
##
|
||||
keystorePassword: ""
|
||||
## @param auth.kafka.truststorePassword Password to access the truststore when it's password-protected
|
||||
##
|
||||
truststorePassword: ""
|
||||
## @param auth.kafka.saslMechanism Mechanism that schema registry will use to connect to kafka. Allowed: PLAIN, SCRAM-SHA-256, SCRAM-SHA-512
|
||||
##
|
||||
saslMechanism: SCRAM-SHA-512
|
||||
## @param listeners Comma-separated list of listeners that listen for API requests over either HTTP or HTTPS
|
||||
##
|
||||
listeners: http://0.0.0.0:8081
|
||||
## @param avroCompatibilityLevel Avro compatibility type
|
||||
## Valid options: none, backward, backward_transitive, forward, forward_transitive, full, or full_transitive
|
||||
##
|
||||
avroCompatibilityLevel: backward
|
||||
## @param extraEnvVars Extra environment variables to be set on Schema Registry container
|
||||
## e.g:
|
||||
## extraEnvVars:
|
||||
## - name: FOO
|
||||
## value: BAR
|
||||
##
|
||||
extraEnvVars: []
|
||||
## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars
|
||||
##
|
||||
extraEnvVarsCM: ""
|
||||
## @param extraEnvVarsSecret Name of existing Secret containing extra env vars
|
||||
##
|
||||
extraEnvVarsSecret: ""
|
||||
## @section Schema Registry statefulset parameters
|
||||
## @param replicaCount Number of Schema Registry replicas to deploy.
|
||||
##
|
||||
replicaCount: 1
|
||||
## @param updateStrategy.type Schema Registry statefulset strategy type
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
|
||||
##
|
||||
updateStrategy:
|
||||
## StrategyType
|
||||
## Can be set to RollingUpdate or OnDelete
|
||||
##
|
||||
type: RollingUpdate
|
||||
## Node affinity preset
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
|
||||
##
|
||||
nodeAffinityPreset:
|
||||
## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
##
|
||||
type: ""
|
||||
## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set
|
||||
##
|
||||
key: ""
|
||||
## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set
|
||||
## E.g.
|
||||
## values:
|
||||
## - e2e-az1
|
||||
## - e2e-az2
|
||||
##
|
||||
values: []
|
||||
## @param affinity Affinity for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
##
|
||||
affinity: {}
|
||||
## @param nodeSelector Node labels for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## @param tolerations Tolerations for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
##
|
||||
tolerations: []
|
||||
## @param podManagementPolicy Statefulset Pod management policy, it needs to be Parallel to be able to complete the cluster join
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
|
||||
##
|
||||
podManagementPolicy: OrderedReady
|
||||
## @param podAnnotations Annotations for Schema Registry pods
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
##
|
||||
podAnnotations: {}
|
||||
## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAffinityPreset: ""
|
||||
## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||||
##
|
||||
podAntiAffinityPreset: soft
|
||||
## @param priorityClassName Schema Registry pod priority class name
|
||||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/
|
||||
##
|
||||
priorityClassName: ""
|
||||
## @param topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods
|
||||
##
|
||||
topologySpreadConstraints: {}
|
||||
## @param schedulerName Name of the k8s scheduler (other than default) for Schema Registry pods
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
## @param terminationGracePeriodSeconds Seconds Redmine pod needs to terminate gracefully
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
|
||||
##
|
||||
terminationGracePeriodSeconds: ""
|
||||
## @param lifecycleHooks for the Schema Registry container(s) to automate configuration before or after startup
|
||||
##
|
||||
lifecycleHooks: {}
|
||||
## Schema Registry pods' Security Context.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param podSecurityContext.enabled Enabled Controller pods' Security Context
|
||||
## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
|
||||
## @param podSecurityContext.supplementalGroups Set filesystem extra groups
|
||||
## @param podSecurityContext.fsGroup Set Controller pod's Security Context fsGroup
|
||||
## @param podSecurityContext.sysctls sysctl settings of the Schema Registry pods
|
||||
##
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
fsGroup: 1001
|
||||
## sysctl settings
|
||||
## Example:
|
||||
## sysctls:
|
||||
## - name: net.core.somaxconn
|
||||
## value: "10000"
|
||||
##
|
||||
sysctls: []
|
||||
## Schema Registry containers' Security Context (only main container).
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param containerSecurityContext.enabled Enabled containers' Security Context
|
||||
## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||||
## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser
|
||||
## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
|
||||
## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
|
||||
## @param containerSecurityContext.privileged Set container's Security Context privileged
|
||||
## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
|
||||
## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
|
||||
## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped
|
||||
## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
## Schema Registry containers' resource requests and limits.
|
||||
## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||||
## choice for the user. This also increases chances charts run on environments with little
|
||||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "small"
|
||||
## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
## Schema Registry pods' liveness and readiness probes. Evaluated as a template.
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
|
||||
## @param livenessProbe.enabled Enable livenessProbe
|
||||
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||||
## @param livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||||
## @param livenessProbe.successThreshold Success threshold for livenessProbe
|
||||
##
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 1
|
||||
periodSeconds: 20
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
## @param readinessProbe.enabled Enable readinessProbe
|
||||
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
## @param readinessProbe.successThreshold Success threshold for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 1
|
||||
periodSeconds: 20
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
## @param startupProbe.enabled Enable startupProbe
|
||||
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||
## @param startupProbe.periodSeconds Period seconds for startupProbe
|
||||
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||
## @param startupProbe.failureThreshold Failure threshold for startupProbe
|
||||
## @param startupProbe.successThreshold Success threshold for startupProbe
|
||||
##
|
||||
startupProbe:
|
||||
enabled: false
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 1
|
||||
periodSeconds: 5
|
||||
failureThreshold: 20
|
||||
successThreshold: 1
|
||||
## @param customLivenessProbe Custom livenessProbe that overrides the default one
|
||||
##
|
||||
customLivenessProbe: {}
|
||||
## @param customReadinessProbe Custom readinessProbe that overrides the default one
|
||||
##
|
||||
customReadinessProbe: {}
|
||||
## @param customStartupProbe Custom startupProbe that overrides the default one
|
||||
##
|
||||
customStartupProbe: {}
|
||||
## @param extraVolumes Optionally specify extra list of additional volumes for schema-registry pods
|
||||
## e.g:
|
||||
## extraVolumes:
|
||||
## - name: avro-properties
|
||||
## configMap:
|
||||
## name: avro-properties
|
||||
##
|
||||
extraVolumes: []
|
||||
## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for schema-registry container(s)
|
||||
## e.g:
|
||||
## extraVolumeMounts:
|
||||
## - name: avro-properties
|
||||
## mountPath: /bitnami/schema-registry/etc/schema-registry/connect-avro-standalone.properties
|
||||
## subPath: connect-avro-standalone.properties
|
||||
##
|
||||
extraVolumeMounts: []
|
||||
## @param initContainers Add additional init containers to the Schema Registry pods.
|
||||
## e.g:
|
||||
## initContainers:
|
||||
## - name: your-image-name
|
||||
## image: your-image
|
||||
## imagePullPolicy: Always
|
||||
## ports:
|
||||
## - name: portname
|
||||
## containerPort: 1234
|
||||
##
|
||||
initContainers: []
|
||||
## @param sidecars Add additional sidecar containers to the Schema Registry pods.
|
||||
## e.g:
|
||||
## sidecars:
|
||||
## - name: your-image-name
|
||||
## image: your-image
|
||||
## imagePullPolicy: Always
|
||||
## ports:
|
||||
## - name: portname
|
||||
## containerPort: 1234
|
||||
##
|
||||
sidecars: []
|
||||
## Schema Registry Pod Disruption Budget configuration
|
||||
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
|
||||
## @param pdb.create Enable/disable a Pod Disruption Budget creation
|
||||
## @param pdb.minAvailable Minimum number/percentage of pods that must still be available after the eviction
|
||||
## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable after the eviction. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty.
|
||||
##
|
||||
pdb:
|
||||
create: true
|
||||
minAvailable: ""
|
||||
maxUnavailable: ""
|
||||
## Schema Registry Autoscaling parameters.
|
||||
## @param autoscaling.enabled Enable autoscaling for replicas
|
||||
## @param autoscaling.minReplicas Minimum number of replicas
|
||||
## @param autoscaling.maxReplicas Maximum number of replicas
|
||||
## @param autoscaling.targetCPU Target CPU utilization percentage
|
||||
## @param autoscaling.targetMemory Target Memory utilization percentage
|
||||
##
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 11
|
||||
targetCPU: ""
|
||||
targetMemory: ""
|
||||
## @param autoscaling.customPodMetrics allows you to set a list of custom metrics to trigger the scaling.
|
||||
## e.g:
|
||||
## customPodMetrics:
|
||||
## - name: "requests_per_second"
|
||||
## averageValue: "2000m"
|
||||
customPodMetrics: []
|
||||
## @section Exposure Parameters
|
||||
## Schema Registry Service paramaters.
|
||||
##
|
||||
service:
|
||||
## @param service.type Kubernetes service type
|
||||
##
|
||||
type: ClusterIP
|
||||
## @param service.ports.http Service HTTP port
|
||||
##
|
||||
ports:
|
||||
http: 8081
|
||||
## @param service.nodePorts.http Service HTTP node port
|
||||
## Specify the nodePort value for the LoadBalancer and NodePort service types.
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
##
|
||||
nodePorts:
|
||||
http: ""
|
||||
## @param service.clusterIP Schema Registry service clusterIP IP
|
||||
## e.g:
|
||||
## clusterIP: None
|
||||
##
|
||||
clusterIP: ""
|
||||
## @param service.externalTrafficPolicy Enable client source IP preservation
|
||||
## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
##
|
||||
externalTrafficPolicy: Cluster
|
||||
## @param service.loadBalancerIP loadBalancerIP if service type is LoadBalancer
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
##
|
||||
loadBalancerIP: ""
|
||||
## @param service.loadBalancerSourceRanges Address that are allowed when service is LoadBalancer
|
||||
## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
|
||||
## e.g:
|
||||
## loadBalancerSourceRanges:
|
||||
## - 10.10.10.0/24
|
||||
##
|
||||
loadBalancerSourceRanges: []
|
||||
## @param service.annotations Annotations for Schema Registry service
|
||||
##
|
||||
annotations: {}
|
||||
## @param service.labels Labels for Schema Registry service
|
||||
##
|
||||
labels: {}
|
||||
## @param service.extraPorts Extra ports to expose in Schema Registry service (normally used with the `sidecars` value)
|
||||
##
|
||||
extraPorts: []
|
||||
## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin
|
||||
## Values: ClientIP or None
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/
|
||||
##
|
||||
sessionAffinity: None
|
||||
## @param service.sessionAffinityConfig Additional settings for the sessionAffinity
|
||||
## sessionAffinityConfig:
|
||||
## clientIP:
|
||||
## timeoutSeconds: 300
|
||||
##
|
||||
sessionAffinityConfig: {}
|
||||
## Headless service properties
|
||||
##
|
||||
headless:
|
||||
## @param service.headless.annotations Annotations for the headless service.
|
||||
##
|
||||
annotations: {}
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: false
|
||||
## @param networkPolicy.allowExternal Don't require client label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## client label will have network access to the ports the application is listening
|
||||
## on. When true, the app will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
## Configure the ingress resource that allows you to access Schema Registry
|
||||
##
|
||||
ingress:
|
||||
## @param ingress.enabled Enable ingress record generation for Schema Registry
|
||||
##
|
||||
enabled: false
|
||||
## @param ingress.pathType Ingress path type
|
||||
##
|
||||
pathType: ImplementationSpecific
|
||||
## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)
|
||||
##
|
||||
apiVersion: ""
|
||||
## @param ingress.hostname Default host for the ingress record
|
||||
##
|
||||
hostname: schema-registry.local
|
||||
## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
|
||||
## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .
|
||||
## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
|
||||
##
|
||||
ingressClassName: ""
|
||||
## @param ingress.path Default path for the ingress record
|
||||
## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers
|
||||
##
|
||||
path: /
|
||||
## @param ingress.annotations Additional custom annotations for the ingress record
|
||||
## NOTE: If `ingress.certManager=true`, annotation `kubernetes.io/tls-acme: "true"` will automatically be added
|
||||
##
|
||||
## For a full list of possible ingress annotations, please see
|
||||
## ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md
|
||||
##
|
||||
annotations: {}
|
||||
## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter
|
||||
## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`
|
||||
## You can:
|
||||
## - Use the `ingress.secrets` parameter to create this TLS secret
|
||||
## - Relay on cert-manager to create it by setting `ingress.certManager=true`
|
||||
## - Relay on Helm to create self-signed certificates by setting `ingress.tls=true` and `ingress.certManager=false`
|
||||
##
|
||||
tls: false
|
||||
## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
|
||||
##
|
||||
selfSigned: false
|
||||
## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record
|
||||
## e.g:
|
||||
## extraHosts:
|
||||
## - name: schema-registry.local
|
||||
## path: /
|
||||
##
|
||||
extraHosts: []
|
||||
## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host
|
||||
## e.g:
|
||||
## extraPaths:
|
||||
## - path: /*
|
||||
## backend:
|
||||
## serviceName: ssl-redirect
|
||||
## servicePort: use-annotation
|
||||
##
|
||||
extraPaths: []
|
||||
## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
|
||||
## e.g:
|
||||
## extraTls:
|
||||
## - hosts:
|
||||
## - schema-registry.local
|
||||
## secretName: schema-registry.local-tls
|
||||
##
|
||||
extraTls: []
|
||||
## @param ingress.secrets Custom TLS certificates as secrets
|
||||
## NOTE: 'key' and 'certificate' are expected in PEM format
|
||||
## NOTE: 'name' should line up with a 'secretName' set further up
|
||||
## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
|
||||
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
|
||||
## It is also possible to create and manage the certificates outside of this helm chart
|
||||
## Please see README.md for more information
|
||||
## e.g:
|
||||
## secrets:
|
||||
## - name: schema-registry.local-tls
|
||||
## key: |-
|
||||
## -----BEGIN RSA PRIVATE KEY-----
|
||||
## ...
|
||||
## -----END RSA PRIVATE KEY-----
|
||||
## certificate: |-
|
||||
## -----BEGIN CERTIFICATE-----
|
||||
## ...
|
||||
## -----END CERTIFICATE-----
|
||||
##
|
||||
secrets: []
|
||||
## @param ingress.extraRules Additional rules to be covered with this ingress record
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
|
||||
## e.g:
|
||||
## extraRules:
|
||||
## - host: schema-registry.local
|
||||
## http:
|
||||
## path: /
|
||||
## backend:
|
||||
## service:
|
||||
## name: schema-registry
|
||||
## port:
|
||||
## name: http
|
||||
##
|
||||
extraRules: []
|
||||
## @section RBAC parameters
|
||||
## Schema Registry pods ServiceAccount.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
##
|
||||
serviceAccount:
|
||||
## @param serviceAccount.create Enable the creation of a ServiceAccount for Schema Registry pods
|
||||
##
|
||||
create: true
|
||||
## @param serviceAccount.name Name of the created ServiceAccount to use
|
||||
## If not set and create is true, a name is generated using the schema-registry.fullname template
|
||||
##
|
||||
name: ""
|
||||
## @param serviceAccount.annotations Additional Service Account annotations (evaluated as a template)
|
||||
##
|
||||
annotations: {}
|
||||
## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @section Kafka chart parameters
|
||||
##
|
||||
## Kafka chart configuration
|
||||
## For information about these parameters, refer to:
|
||||
## https://github.com/bitnami/charts/blob/main/bitnami/kafka/values.yaml
|
||||
##
|
||||
kafka:
|
||||
## @param kafka.enabled Enable/disable Kafka chart installation
|
||||
##
|
||||
enabled: false
|
||||
## @param kafka.controller.replicaCount Number of Kafka controller-eligible (controller+broker) nodes
|
||||
##
|
||||
controller:
|
||||
replicaCount: 1
|
||||
## @param kafka.listeners.client.protocol Authentication protocol for communications with clients. Allowed protocols: `PLAINTEXT`, `SASL_PLAINTEXT`, `SASL_SSL`, `SSL`
|
||||
##
|
||||
listeners:
|
||||
client:
|
||||
protocol: "PLAINTEXT"
|
||||
## @param kafka.service.ports.client Kafka svc port for client connections
|
||||
##
|
||||
service:
|
||||
ports:
|
||||
client: 9092
|
||||
## @param kafka.overrideConfiguration [object] Kafka common configuration override
|
||||
##
|
||||
overrideConfiguration:
|
||||
offsets.topic.replication.factor: 1
|
||||
## @param kafka.sasl.client.users Comma-separated list of usernames for Kafka client listener when SASL is enabled
|
||||
## @param kafka.sasl.client.passwords Comma-separated list of passwords for client listener when SASL is enabled, must match the number of client.users
|
||||
##
|
||||
sasl:
|
||||
client:
|
||||
users:
|
||||
- user
|
||||
passwords: ""
|
||||
##
|
||||
## External Kafka Configuration
|
||||
## All of these values are only used when kafka.enabled is set to false
|
||||
##
|
||||
externalKafka:
|
||||
## @param externalKafka.brokers Array of Kafka brokers to connect to. Format: protocol://broker_hostname:port
|
||||
##
|
||||
brokers:
|
||||
- SASL_PLAINTEXT://freeleaps-kafka-cluster-kafka-bootstrap.freeleaps-data-platform.svc.freeleaps.cluster:9092
|
||||
## @param externalKafka.listener.protocol Kafka listener protocol. Allowed protocols: PLAINTEXT, SASL_PLAINTEXT, SASL_SSL and SSL
|
||||
##
|
||||
listener:
|
||||
protocol: SASL_PLAINTEXT
|
||||
## Authentication parameters
|
||||
## @param externalKafka.sasl.user User for SASL authentication
|
||||
## @param externalKafka.sasl.password Password for SASL authentication
|
||||
## @param externalKafka.sasl.existingSecret Name of the existing secret containing a password for SASL authentication (under the key named "client-passwords")
|
||||
##
|
||||
sasl:
|
||||
user: freeleaps-user
|
||||
password: ""
|
||||
existingSecret: "schema-registry-kafka-auth"
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,21 +0,0 @@
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: zookeeper-vpa
|
||||
namespace: freeleaps-data-platform
|
||||
spec:
|
||||
resourcePolicy:
|
||||
containerPolicies:
|
||||
- containerName: '*'
|
||||
controlledResources:
|
||||
- cpu
|
||||
- memory
|
||||
maxAllowed:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
targetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
name: zookeeper
|
||||
updatePolicy:
|
||||
updateMode: "Auto"
|
||||
@ -14,3 +14,5 @@ grafana,https://grafana.github.io/helm-charts,force-update
|
||||
fluent,https://fluent.github.io/helm-charts,force-update
|
||||
pinot,https://raw.githubusercontent.com/apache/pinot/master/helm,force-update
|
||||
starrocks,https://starrocks.github.io/starrocks-kubernetes-operator,force-update
|
||||
kafbat-ui,https://kafbat.github.io/helm-charts,force-update
|
||||
pmint93,https://pmint93.github.io/helm-charts,force-update
|
||||
|
||||
Loading…
Reference in New Issue
Block a user