Port of https://github.com/hazelcast/charts/pull/67 (#18104)

Signed-off-by: Rafal Leszko <rafal@hazelcast.com>

stable/hazelcast/Chart.yaml

@@ -1,5 +1,5 @@
 name: hazelcast
-version: 2.4.0
+version: 2.5.0
 appVersion: "3.12.3"
 tillerVersion: ">=2.7.2"
 kubeVersion: ">=1.9.0-0"

stable/hazelcast/README.adoc

@@ -111,6 +111,8 @@ into `+values.yaml+`) |`+{DEFAULT_HAZELCAST_YAML}+`
 
 |`+affinity+` | Hazelcast Node affinity |`+nil+`
 
+|`+tolerations+` | Hazelcast Node tolerations |`+nil+`
+
 |`+nodeSelector+` |Hazelcast Node labels for pod assignment |`+nil+`
 
 |`+hostPort+` |Port under which Hazelcast PODs are exposed on the host machines
@@ -221,6 +223,10 @@ provided, can be filled in the web interface |`+nil+`
 |`+mancenter.licenseKeySecretName+` |Kubernetes Secret Name, where Management
 Center License Key is stored (can be used instead of licenseKey) |`+nil+`
 
+|`+mancenter.affinity+` |Management Center Node affinity |`+nil+`
+
+|`+mancenter.tolerations+` |Management Center Node tolerations |`+nil+`
+
 |`+mancenter.nodeSelector+` |Hazelcast Management Center node labels for pod
 assignment |`+nil+`
 

stable/hazelcast/templates/mancenter-statefulset.yaml

@@ -39,9 +39,17 @@ spec:
       hostPID: false
       hostIPC: false
       securityContext:
-        runAsNonRoot: true
+        runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
         runAsUser: {{ .Values.securityContext.runAsUser }}
         fsGroup: {{ .Values.securityContext.fsGroup }}
+      {{- if .Values.mancenter.affinity }}
+      affinity:
+{{ toYaml .Values.mancenter.affinity | indent 8 }}
+      {{- end }}
+      {{- if .Values.mancenter.tolerations }}
+      tolerations:
+{{ toYaml .Values.mancenter.tolerations | indent 8 }}
+      {{- end }}
       containers:
       - name: {{ template "mancenter.fullname" . }}
         image: "{{ .Values.mancenter.image.repository }}:{{ .Values.mancenter.image.tag }}"
@@ -91,7 +99,7 @@ spec:
         serviceAccountName: {{ template "hazelcast.serviceAccountName" . }}
         {{- if .Values.securityContext.enabled }}
         securityContext:
-          runAsNonRoot: true
+          runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
           runAsUser: {{ .Values.securityContext.runAsUser }}
           privileged: false
           readOnlyRootFilesystem: false

stable/hazelcast/templates/statefulset.yaml

@@ -41,12 +41,16 @@ spec:
       hostPID: false
       hostIPC: false
       securityContext:
-        runAsNonRoot: true
+        runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
         runAsUser: {{ .Values.securityContext.runAsUser }}
         fsGroup: {{ .Values.securityContext.fsGroup }}
       {{- if .Values.affinity }}
       affinity:
 {{ toYaml .Values.affinity | indent 8 }}
+      {{- end }}
+      {{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 8 }}
       {{- end }}
       containers:
       - name: {{ template "hazelcast.fullname" . }}
@@ -104,7 +108,7 @@ spec:
           value: "-Dhazelcast.rest.enabled={{ .Values.hazelcast.rest }} -Dhazelcast.config=/data/hazelcast/hazelcast.yaml -DserviceName={{ template "hazelcast.serviceName" . }} -Dnamespace={{ .Release.Namespace }} -Dhazelcast.mancenter.enabled={{ .Values.mancenter.enabled }} -Dhazelcast.mancenter.url=http://{{ template "mancenter.fullname" . }}:{{ .Values.mancenter.service.port }}/hazelcast-mancenter {{ if .Values.gracefulShutdown.enabled }}-Dhazelcast.shutdownhook.policy=GRACEFUL -Dhazelcast.shutdownhook.enabled=true -Dhazelcast.graceful.shutdown.max.wait={{ .Values.gracefulShutdown.maxWaitSeconds }} {{ end }} {{ if .Values.metrics.enabled }}-Dhazelcast.jmx=true{{ end }} {{ .Values.hazelcast.javaOpts }}"
         {{- if .Values.securityContext.enabled }}
         securityContext:
-          runAsNonRoot: true
+          runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
           runAsUser: {{ .Values.securityContext.runAsUser }}
           privileged: false
           readOnlyRootFilesystem: true

stable/hazelcast/values.yaml

@@ -66,6 +66,9 @@ affinity:
 #          - hazelcast
 #      topologyKey: kubernetes.io/hostname
 
+# tolerations enable Hazelcast PODs to be able to run on nodes with taints
+# tolerations:
+
 # nodeSelector is an array of Hazelcast Node labels for POD assignments
 # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
 nodeSelector: {}
@@ -213,6 +216,12 @@ mancenter:
   # licenseKeySecretName is the name of the secret where the Hazelcast Management Center License Key is stored (can be used instead of licenseKey)
   # licenseKeySecretName:
 
+  # affinity specifies the Management Center affinity/anti-affinity of different pods
+  # affinity:
+
+  # tolerations enable Management Center POD to be able to run on nodes with taints
+  # tolerations:
+
   # nodeSelector is an array of Hazelcast Management Center Node labels for POD assignments
   # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
   nodeSelector: {}