From 4bcf57dc66ea50b45f556fc70a365f1db161603e Mon Sep 17 00:00:00 2001 From: Oliver Date: Wed, 22 Aug 2018 13:04:04 -0500 Subject: [PATCH] [stable/cockroachdb] Breakout ports to support Istio (#7269) * [stable/cockroachdb] Added support for node selector * Merge with charts/stable * [stable/cockroachdb] Added support for node selector * [stable/cockroachdb] Added support for node selector new chart stable/mysqldump (#4069) * new chart stable/mysqldump Helps the user backup mysql databases to a persistent volume * use chart.name from tpl, add app label * add app/chart fixes to mysqldump-cron.yaml * fix backoffLimit in wrong place. * exit gracefully if db host not specified Merge with charts/stable * Chart version bump * Added external and internal GRPC port as options. Also added options to customize service annotations. Need these for istio config. * Updated README to include values I added. Reformatted the table so it reads pretty in plaintext * cockroach chart version bump for istio work --- stable/cockroachdb/Chart.yaml | 2 +- stable/cockroachdb/README.md | 62 ++++++++++--------- stable/cockroachdb/templates/NOTES.txt | 8 +-- .../cockroachdb/templates/cluster-init.yaml | 2 +- .../templates/cockroachdb-networkpolicy.yaml | 15 ++++- .../templates/cockroachdb-statefulset.yaml | 45 +++++++++----- .../templates/tests/client-test.yaml | 2 +- stable/cockroachdb/values.yaml | 16 ++++- 8 files changed, 96 insertions(+), 56 deletions(-) diff --git a/stable/cockroachdb/Chart.yaml b/stable/cockroachdb/Chart.yaml index 42076ea5be..b9b79730e0 100755 --- a/stable/cockroachdb/Chart.yaml +++ b/stable/cockroachdb/Chart.yaml @@ -1,6 +1,6 @@ name: cockroachdb home: https://www.cockroachlabs.com -version: 1.2.2 +version: 1.2.3 appVersion: 2.0.5 description: CockroachDB is a scalable, survivable, strongly-consistent SQL database. icon: https://raw.githubusercontent.com/cockroachdb/cockroach/master/docs/media/cockroach_db.png diff --git a/stable/cockroachdb/README.md b/stable/cockroachdb/README.md index 51cffcec50..d8288cf0c5 100644 --- a/stable/cockroachdb/README.md +++ b/stable/cockroachdb/README.md @@ -41,34 +41,40 @@ one client certificate for the job that initializes the cluster (e.g. The following table lists the configurable parameters of the CockroachDB chart and their default values. -| Parameter | Description | Default | -| ----------------------------- | ------------------------------------------ | -------------------------------------------- | -| `Name` | Chart name | `cockroachdb` | -| `Image` | Container image name | `cockroachdb/cockroach` | -| `ImageTag` | Container image tag | `v2.0.5` | -| `ImagePullPolicy` | Container pull policy | `Always` | -| `Replicas` | k8s statefulset replicas | `3` | -| `MaxUnavailable` | k8s PodDisruptionBudget parameter | `1` | -| `Component` | k8s selector key | `cockroachdb` | -| `GrpcPort` | CockroachDB primary serving port | `26257` | -| `HttpPort` | CockroachDB HTTP port | `8080` | -| `Cpu` | Container requested cpu | `100m` | -| `Memory` | Container requested memory | `512Mi` | -| `Storage` | Persistent volume size | `1Gi` | -| `StorageClass` | Persistent volume class | `null` | -| `CacheSize` | Size of CockroachDB's in-memory cache | `25%` | -| `MaxSQLMemory` | Max memory to use processing SQL queries | `25%` | -| `ClusterDomain` | Cluster's default DNS domain | `cluster.local` | -| `NetworkPolicy.Enabled` | Enable NetworkPolicy | `false` | -| `NetworkPolicy.AllowExternal` | Don't require client label for connections | `true` | -| `Service.Type` | Public service type | `ClusterIP` | -| `PodManagementPolicy` | `OrderedReady` or `Parallel` pod creation/deletion order | `Parallel` | -| `UpdateStrategy.type` | allows setting of RollingUpdate strategy | `RollingUpdate` | -| `Secure.Enabled` | Whether to run securely using TLS certificates | `false` | -| `Secure.RequestCertsImage` | Image to use for requesting TLS certificates | `cockroachdb/cockroach-k8s-request-cert` | -| `Secure.RequestCertsImageTag` | Image tag to use for requesting TLS certificates | `0.3` | -| `Secure.ServiceAccount.Create` | Whether to create a new RBAC service account | `true` | -| `Secure.ServiceAccount.Name` | Name of RBAC service account to use | `` | +| Parameter | Description | Default | +| ------------------------------ | ------------------------------------------------ | ----------------------------------------- | +| `Name` | Chart name | `cockroachdb` | +| `Image` | Container image name | `cockroachdb/cockroach` | +| `ImageTag` | Container image tag | `v2.0.5` | +| `ImagePullPolicy` | Container pull policy | `Always` | +| `Replicas` | k8s statefulset replicas | `3` | +| `MaxUnavailable` | k8s PodDisruptionBudget parameter | `1` | +| `Component` | k8s selector key | `cockroachdb` | +| `ExternalGrpcPort` | CockroachDB primary serving port | `26257` | +| `ExternalGrpcName` | CockroachDB primary serving port name | `grpc` | +| `InternalGrpcPort` | CockroachDB inter-cockroachdb port | `26257` | +| `InternalGrpcName` | CockroachDB inter-cockroachdb port name | `grpc` | +| `InternalHttpPort` | CockroachDB HTTP port | `8080` | +| `ExternalHttpPort` | CockroachDB HTTP port on service | `8080` | +| `HttpName` | Name given to the http service port | `http` | +| `Cpu` | Container requested cpu | `100m` | +| `Memory` | Container requested memory | `512Mi` | +| `Storage` | Persistent volume size | `1Gi` | +| `StorageClass` | Persistent volume class | `null` | +| `CacheSize` | Size of CockroachDB's in-memory cache | `25%` | +| `MaxSQLMemory` | Max memory to use processing SQL queries | `25%` | +| `ClusterDomain` | Cluster's default DNS domain | `cluster.local` | +| `NetworkPolicy.Enabled` | Enable NetworkPolicy | `false` | +| `NetworkPolicy.AllowExternal` | Don't require client label for connections | `true` | +| `Service.Type` | Public service type | `ClusterIP` | +| `Service.Annotations` | Annotations to apply to the service | `{}` | +| `PodManagementPolicy` | `OrderedReady` or `Parallel` pod creation/deletion order | `Parallel` | +| `UpdateStrategy.type` | allows setting of RollingUpdate strategy | `RollingUpdate` | +| `Secure.Enabled` | Whether to run securely using TLS certificates | `false` | +| `Secure.RequestCertsImage` | Image to use for requesting TLS certificates | `cockroachdb/cockroach-k8s-request-cert` | +| `Secure.RequestCertsImageTag` | Image tag to use for requesting TLS certificates | `0.3` | +| `Secure.ServiceAccount.Create` | Whether to create a new RBAC service account | `true` | +| `Secure.ServiceAccount.Name` | Name of RBAC service account to use | `` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/stable/cockroachdb/templates/NOTES.txt b/stable/cockroachdb/templates/NOTES.txt index 6dc2c56f93..2747ad5c6b 100644 --- a/stable/cockroachdb/templates/NOTES.txt +++ b/stable/cockroachdb/templates/NOTES.txt @@ -1,4 +1,4 @@ -CockroachDB can be accessed via port 26257 (or whatever you set the GrpcPort +CockroachDB can be accessed via port {{ .Values.ExternalGrpcPort }} value to) at the following DNS name from within your cluster: {{ .Release.Name }}-public.{{ .Release.Namespace }}.svc.cluster.local @@ -30,12 +30,12 @@ will be able to connect to this cockroachdb cluster. Finally, to open up the CockroachDB admin UI, you can port-forward from your local machine into one of the instances in the cluster: - kubectl port-forward {{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-0 8080 + kubectl port-forward {{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-0 {{ .Values.InternalHttpPort }} {{- if not .Values.Secure.Enabled }} -Then you can access the admin UI at http://localhost:8080/ in your web browser. +Then you can access the admin UI at http://localhost:{{ .Values.InternalHttpPort }}/ in your web browser. {{- else }} -Then you can access the admin UI at https://localhost:8080/ in your web browser. +Then you can access the admin UI at https://localhost:{{ .Values.InternalHttpPort }}/ in your web browser. {{- end }} For more information on using CockroachDB, please see the project's docs at diff --git a/stable/cockroachdb/templates/cluster-init.yaml b/stable/cockroachdb/templates/cluster-init.yaml index ce7680b0bd..102b6ab684 100644 --- a/stable/cockroachdb/templates/cluster-init.yaml +++ b/stable/cockroachdb/templates/cluster-init.yaml @@ -53,7 +53,7 @@ spec: command: - "/bin/bash" - "-ecx" - - "until /cockroach/cockroach init {{ if .Values.Secure.Enabled }}--certs-dir=/cockroach-certs{{ else }}--insecure{{ end }} --host={{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-0.{{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}; do sleep 5; done" + - "until /cockroach/cockroach init {{ if .Values.Secure.Enabled }}--certs-dir=/cockroach-certs{{ else }}--insecure{{ end }} --host={{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-0.{{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }} --port {{ .Values.InternalGrpcPort }}; do sleep 5; done" restartPolicy: OnFailure {{- if .Values.Secure.Enabled }} volumes: diff --git a/stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml b/stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml index 0e9e09b87e..7785c90a24 100644 --- a/stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml +++ b/stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml @@ -15,7 +15,7 @@ spec: component: "{{.Release.Name}}-{{.Values.Component}}" ingress: - ports: - - port: {{ .Values.GrpcPort}} + - port: {{ .Values.ExternalGrpcPort}} {{- if not .Values.NetworkPolicy.AllowExternal }} from: # Allow clients to connect. @@ -27,10 +27,19 @@ spec: matchLabels: component: "{{.Release.Name}}-{{.Values.Component}}" {{- end }} + {{- if ne .Values.InternalGrpcPort .Values.ExternalGrpcPort }} + - ports: + - port: {{ .Values.InternalGrpcPort}} + from: + # Allow other cockroachdb's to connect to form cluster. + - podSelector: + matchLabels: + component: "{{.Release.Name}}-{{.Values.Component}}" + {{- end }} # Allow connections to admin UI. - ports: - - port: {{.Values.HttpPort}} + - port: {{.Values.ExternalHttpPort}} # Allow connections from Prometheus. - ports: - - port: 8080 + - port: {{.Values.ExternalHttpPort}} {{- end }} diff --git a/stable/cockroachdb/templates/cockroachdb-statefulset.yaml b/stable/cockroachdb/templates/cockroachdb-statefulset.yaml index 324bc72bf5..e55e05023c 100644 --- a/stable/cockroachdb/templates/cockroachdb-statefulset.yaml +++ b/stable/cockroachdb/templates/cockroachdb-statefulset.yaml @@ -91,6 +91,8 @@ metadata: # This service is meant to be used by clients of the database. It exposes a ClusterIP that will # automatically load balance connections to the different database pods. name: "{{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-public" + annotations: +{{ toYaml .Values.Service.annotations | indent 4 }} labels: heritage: {{ .Release.Service | quote }} release: {{ .Release.Name | quote }} @@ -101,13 +103,18 @@ spec: ports: # The main port, served by gRPC, serves Postgres-flavor SQL, internode # traffic and the cli. - - port: {{ .Values.GrpcPort }} - targetPort: {{ .Values.GrpcPort }} - name: grpc + - port: {{ .Values.ExternalGrpcPort }} + targetPort: {{ .Values.InternalGrpcPort }} + name: {{ .Values.ExternalGrpcName }} # The secondary port serves the UI as well as health and debug endpoints. - - port: {{ .Values.HttpPort }} - targetPort: {{ .Values.HttpPort }} - name: http + - port: {{ .Values.ExternalHttpPort }} + targetPort: {{ .Values.InternalHttpPort }} + name: {{ .Values.HttpName }} + {{- if ne .Values.InternalGrpcPort .Values.ExternalGrpcPort }} + - port: {{ .Values.InternalGrpcPort }} + targetPort: {{ .Values.InternalGrpcPort }} + name: {{ .Values.InternalGrpcName }} + {{- end }} selector: component: "{{ .Release.Name }}-{{ .Values.Component }}" --- @@ -133,15 +140,21 @@ metadata: # Enable automatic monitoring of all instances when Prometheus is running in the cluster. prometheus.io/scrape: "true" prometheus.io/path: "_status/vars" - prometheus.io/port: "8080" + prometheus.io/port: "{{ .Values.ExternalHttpPort }}" spec: ports: - - port: {{ .Values.GrpcPort }} - targetPort: {{ .Values.GrpcPort }} - name: grpc - - port: {{ .Values.HttpPort }} - targetPort: {{ .Values.HttpPort }} - name: http + - port: {{ .Values.ExternalGrpcPort }} + targetPort: {{ .Values.InternalGrpcPort }} + name: {{ .Values.ExternalGrpcName }} + # The secondary port serves the UI as well as health and debug endpoints. + - port: {{ .Values.ExternalHttpPort }} + targetPort: {{ .Values.InternalHttpPort }} + name: {{ .Values.HttpName }} + {{- if ne .Values.InternalGrpcPort .Values.ExternalGrpcPort }} + - port: {{ .Values.InternalGrpcPort }} + targetPort: {{ .Values.InternalGrpcPort }} + name: {{ .Values.InternalGrpcName }} + {{- end }} # We want all pods in the StatefulSet to have their addresses published for # the sake of the other CockroachDB pods even before they're ready, since they # have to be able to talk to each other in order to become ready. @@ -229,9 +242,9 @@ spec: image: "{{ .Values.Image }}:{{ .Values.ImageTag }}" imagePullPolicy: "{{ .Values.ImagePullPolicy }}" ports: - - containerPort: {{ .Values.GrpcPort }} + - containerPort: {{ .Values.InternalGrpcPort }} name: grpc - - containerPort: {{ .Values.HttpPort }} + - containerPort: {{ .Values.InternalHttpPort }} name: http livenessProbe: httpGet: @@ -271,7 +284,7 @@ spec: - "-ecx" # The use of qualified `hostname -f` is crucial: # Other nodes aren't able to look up the unqualified hostname. - - "exec /cockroach/cockroach start --logtostderr {{ if .Values.Secure.Enabled }}--certs-dir /cockroach/cockroach-certs{{ else }}--insecure{{ end }} --advertise-host $(hostname -f) --http-host 0.0.0.0 --cache {{ .Values.CacheSize }} --max-sql-memory {{ .Values.MaxSQLMemory }} --join ${STATEFULSET_NAME}-0.${STATEFULSET_NAME},${STATEFULSET_NAME}-1.${STATEFULSET_NAME},${STATEFULSET_NAME}-2.${STATEFULSET_NAME}" + - "exec /cockroach/cockroach start --logtostderr {{ if .Values.Secure.Enabled }}--certs-dir /cockroach/cockroach-certs{{ else }}--insecure{{ end }} --advertise-host $(hostname -f) --http-host 0.0.0.0 --http-port {{ .Values.InternalHttpPort }} --port {{ .Values.InternalGrpcPort }} --cache {{ .Values.CacheSize }} --max-sql-memory {{ .Values.MaxSQLMemory }} --join ${STATEFULSET_NAME}-0.${STATEFULSET_NAME}:{{ .Values.InternalGrpcPort }},${STATEFULSET_NAME}-1.${STATEFULSET_NAME}:{{ .Values.InternalGrpcPort }},${STATEFULSET_NAME}-2.${STATEFULSET_NAME}:{{ .Values.InternalGrpcPort }}" # No pre-stop hook is required, a SIGTERM plus some time is all that's # needed for graceful shutdown of a node. terminationGracePeriodSeconds: 60 diff --git a/stable/cockroachdb/templates/tests/client-test.yaml b/stable/cockroachdb/templates/tests/client-test.yaml index 1152671b96..a65e196b4e 100644 --- a/stable/cockroachdb/templates/tests/client-test.yaml +++ b/stable/cockroachdb/templates/tests/client-test.yaml @@ -20,7 +20,7 @@ spec: - "--host" - "{{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-public.{{ .Release.Namespace }}" - "--port" - - "{{ .Values.GrpcPort }}" + - "{{ .Values.ExternalGrpcPort }}" - "-e" - "SHOW DATABASES;" restartPolicy: Never diff --git a/stable/cockroachdb/values.yaml b/stable/cockroachdb/values.yaml index 2eb6cb929c..0f8a165257 100644 --- a/stable/cockroachdb/values.yaml +++ b/stable/cockroachdb/values.yaml @@ -10,8 +10,19 @@ ImagePullPolicy: "Always" Replicas: 3 MaxUnavailable: 1 Component: "cockroachdb" -GrpcPort: 26257 -HttpPort: 8080 + +# You can set a different external and internal GRPC port and service name. If using istio set InternalGrpcName to "cockroach" +InternalGrpcPort: 26257 +ExternalGrpcPort: 26257 + +# If the port numbers are different then then port names must be different as well. +InternalGrpcName: grpc +ExternalGrpcName: grpc + +InternalHttpPort: 8080 +ExternalHttpPort: 8080 +HttpName: http + # Uncomment the following resources definitions or pass them from command line # to control the cpu and memory resources allocated by the Kubernetes cluster Resources: {} @@ -35,6 +46,7 @@ NetworkPolicy: AllowExternal: true Service: type: ClusterIP + annotations: {} PodManagementPolicy: Parallel UpdateStrategy: type: RollingUpdate