From 73e71f41d3ccd313f0f2145f3a11995e36ae9378 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Leszko?= Date: Fri, 18 Oct 2019 12:49:58 +0200 Subject: [PATCH] Port of https://github.com/hazelcast/charts/pull/67 (#18104) Signed-off-by: Rafal Leszko --- stable/hazelcast/Chart.yaml | 2 +- stable/hazelcast/README.adoc | 6 ++++++ .../hazelcast/templates/mancenter-statefulset.yaml | 12 ++++++++++-- stable/hazelcast/templates/statefulset.yaml | 8 ++++++-- stable/hazelcast/values.yaml | 9 +++++++++ 5 files changed, 32 insertions(+), 5 deletions(-) diff --git a/stable/hazelcast/Chart.yaml b/stable/hazelcast/Chart.yaml index 8f3b6af7d9..616ea135ce 100644 --- a/stable/hazelcast/Chart.yaml +++ b/stable/hazelcast/Chart.yaml @@ -1,5 +1,5 @@ name: hazelcast -version: 2.4.0 +version: 2.5.0 appVersion: "3.12.3" tillerVersion: ">=2.7.2" kubeVersion: ">=1.9.0-0" diff --git a/stable/hazelcast/README.adoc b/stable/hazelcast/README.adoc index b3d6ff08a6..01ddd02997 100644 --- a/stable/hazelcast/README.adoc +++ b/stable/hazelcast/README.adoc @@ -111,6 +111,8 @@ into `+values.yaml+`) |`+{DEFAULT_HAZELCAST_YAML}+` |`+affinity+` | Hazelcast Node affinity |`+nil+` +|`+tolerations+` | Hazelcast Node tolerations |`+nil+` + |`+nodeSelector+` |Hazelcast Node labels for pod assignment |`+nil+` |`+hostPort+` |Port under which Hazelcast PODs are exposed on the host machines @@ -221,6 +223,10 @@ provided, can be filled in the web interface |`+nil+` |`+mancenter.licenseKeySecretName+` |Kubernetes Secret Name, where Management Center License Key is stored (can be used instead of licenseKey) |`+nil+` +|`+mancenter.affinity+` |Management Center Node affinity |`+nil+` + +|`+mancenter.tolerations+` |Management Center Node tolerations |`+nil+` + |`+mancenter.nodeSelector+` |Hazelcast Management Center node labels for pod assignment |`+nil+` diff --git a/stable/hazelcast/templates/mancenter-statefulset.yaml b/stable/hazelcast/templates/mancenter-statefulset.yaml index 0738708bf6..701d6d0f8d 100644 --- a/stable/hazelcast/templates/mancenter-statefulset.yaml +++ b/stable/hazelcast/templates/mancenter-statefulset.yaml @@ -39,9 +39,17 @@ spec: hostPID: false hostIPC: false securityContext: - runAsNonRoot: true + runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} fsGroup: {{ .Values.securityContext.fsGroup }} + {{- if .Values.mancenter.affinity }} + affinity: +{{ toYaml .Values.mancenter.affinity | indent 8 }} + {{- end }} + {{- if .Values.mancenter.tolerations }} + tolerations: +{{ toYaml .Values.mancenter.tolerations | indent 8 }} + {{- end }} containers: - name: {{ template "mancenter.fullname" . }} image: "{{ .Values.mancenter.image.repository }}:{{ .Values.mancenter.image.tag }}" @@ -91,7 +99,7 @@ spec: serviceAccountName: {{ template "hazelcast.serviceAccountName" . }} {{- if .Values.securityContext.enabled }} securityContext: - runAsNonRoot: true + runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} privileged: false readOnlyRootFilesystem: false diff --git a/stable/hazelcast/templates/statefulset.yaml b/stable/hazelcast/templates/statefulset.yaml index 4f52763858..7e4f2e69f1 100644 --- a/stable/hazelcast/templates/statefulset.yaml +++ b/stable/hazelcast/templates/statefulset.yaml @@ -41,12 +41,16 @@ spec: hostPID: false hostIPC: false securityContext: - runAsNonRoot: true + runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} fsGroup: {{ .Values.securityContext.fsGroup }} {{- if .Values.affinity }} affinity: {{ toYaml .Values.affinity | indent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} {{- end }} containers: - name: {{ template "hazelcast.fullname" . }} @@ -104,7 +108,7 @@ spec: value: "-Dhazelcast.rest.enabled={{ .Values.hazelcast.rest }} -Dhazelcast.config=/data/hazelcast/hazelcast.yaml -DserviceName={{ template "hazelcast.serviceName" . }} -Dnamespace={{ .Release.Namespace }} -Dhazelcast.mancenter.enabled={{ .Values.mancenter.enabled }} -Dhazelcast.mancenter.url=http://{{ template "mancenter.fullname" . }}:{{ .Values.mancenter.service.port }}/hazelcast-mancenter {{ if .Values.gracefulShutdown.enabled }}-Dhazelcast.shutdownhook.policy=GRACEFUL -Dhazelcast.shutdownhook.enabled=true -Dhazelcast.graceful.shutdown.max.wait={{ .Values.gracefulShutdown.maxWaitSeconds }} {{ end }} {{ if .Values.metrics.enabled }}-Dhazelcast.jmx=true{{ end }} {{ .Values.hazelcast.javaOpts }}" {{- if .Values.securityContext.enabled }} securityContext: - runAsNonRoot: true + runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} privileged: false readOnlyRootFilesystem: true diff --git a/stable/hazelcast/values.yaml b/stable/hazelcast/values.yaml index 4edd5f6c6c..f619b70483 100644 --- a/stable/hazelcast/values.yaml +++ b/stable/hazelcast/values.yaml @@ -66,6 +66,9 @@ affinity: # - hazelcast # topologyKey: kubernetes.io/hostname +# tolerations enable Hazelcast PODs to be able to run on nodes with taints +# tolerations: + # nodeSelector is an array of Hazelcast Node labels for POD assignments # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector nodeSelector: {} @@ -213,6 +216,12 @@ mancenter: # licenseKeySecretName is the name of the secret where the Hazelcast Management Center License Key is stored (can be used instead of licenseKey) # licenseKeySecretName: + # affinity specifies the Management Center affinity/anti-affinity of different pods + # affinity: + + # tolerations enable Management Center POD to be able to run on nodes with taints + # tolerations: + # nodeSelector is an array of Hazelcast Management Center Node labels for POD assignments # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector nodeSelector: {}