diff --git a/stable/hazelcast-jet/Chart.yaml b/stable/hazelcast-jet/Chart.yaml index 10b48bccea..22a2be55d0 100644 --- a/stable/hazelcast-jet/Chart.yaml +++ b/stable/hazelcast-jet/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: hazelcast-jet -version: 1.1.1 -appVersion: "3.0" +version: 1.2.0 +appVersion: "3.1" description: Hazelcast Jet is an application embeddable, distributed computing engine built on top of Hazelcast In-Memory Data Grid (IMDG). With Hazelcast IMDG providing storage functionality, Hazelcast Jet performs parallel execution to enable data-intensive applications to operate in near real-time. keywords: - hazelcast diff --git a/stable/hazelcast-jet/README.md b/stable/hazelcast-jet/README.md index 06d7c787d3..01ae3b618f 100644 --- a/stable/hazelcast-jet/README.md +++ b/stable/hazelcast-jet/README.md @@ -80,7 +80,13 @@ The following table lists the configurable parameters of the Hazelcast chart and | `rbac.create` | Enable installing RBAC Role authorization | `true` | | `serviceAccount.create` | Enable installing Service Account | `true` | | `serviceAccount.name` | Name of Service Account, if not set, the name is generated using the fullname template | `nil` | - +| `securityContext.enabled` | Enables Security Context for Hazelcast Jet | `true` | +| `securityContext.runAsUser` | User ID used to run the Hazelcast Jet containers | `1001` | +| `securityContext.fsGroup` | Group ID associated with the Hazelcast Jet container | `1001` | +| `metrics.enabled` | Turn on and off JMX Prometheus metrics available at `/metrics` | `false` | +| `metrics.service.type` | Type of the metrics service | `ClusterIP` | +| `metrics.service.port` | Port of the `/metrics` endpoint and the metrics service | `8080` | +| `metrics.service.annotations` | Annotations for the Prometheus discovery | | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, ```bash diff --git a/stable/hazelcast-jet/templates/NOTES.txt b/stable/hazelcast-jet/templates/NOTES.txt index 41ff67a54e..503046981a 100644 --- a/stable/hazelcast-jet/templates/NOTES.txt +++ b/stable/hazelcast-jet/templates/NOTES.txt @@ -3,36 +3,36 @@ ------------------------------------------------------------------------------- To access Hazelcast Jet within the Kubernetes cluster: -- Use Hazelcast Client with Kubernetes Discovery Strategy pointing to DNS: {{ template "hazelcast-jet.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local. Read more at: https://github.com/hazelcast/hazelcast-kubernetes. +- Use Hazelcast Jet Client with Kubernetes Discovery Strategy. Read more at: https://github.com/hazelcast/hazelcast-kubernetes. {{- if .Values.jet.rest }} - Use REST healtcheck endpoint: - $ curl http://{{ template "hazelcast-jet.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:5701/hazelcast/health + $ curl http://{{ template "hazelcast-jet.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/hazelcast/health {{- end }} ------------------------------------------------------------------------------- -To access Hazelcast from outside the Kubernetes cluster: +To access Hazelcast Jet from outside the Kubernetes cluster: -- Use Hazelcast Client with Smart Routing disabled: +- Use Hazelcast Jet Client with Smart Routing disabled: {{- if contains "LoadBalancer" .Values.service.type }} *) Check service external IP: $ export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "hazelcast-jet.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') - *) In Hazelcast Client configuration: + *) In Hazelcast Jet Client configuration: clientConfig.getNetworkConfig().setSmartRouting(false); clientConfig.getNetworkConfig().addAddress("$SERVICE_IP:{{ .Values.service.port }}"); {{- else if contains "ClusterIP" .Values.service.type }} *) Forward port from POD: - $ export POD=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "hazelcast-jet.name" . }}" -o jsonpath="{.items[0].metadata.name}") - $ kubectl port-forward --namespace {{ .Release.Namespace }} $POD 5701:5701 - *) In Hazelcast Client configure: + $ export POD=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "hazelcast-jet.name" . }}" -o jsonpath="{.items[0].metadata.name}") + $ kubectl port-forward --namespace {{ .Release.Namespace }} $POD 5701:{{ .Values.service.port }} + *) In Hazelcast Jet Client configure: clientConfig.getNetworkConfig().setSmartRouting(false); clientConfig.getNetworkConfig().addAddress("127.0.0.1:5701"); {{- else if contains "NodePort" .Values.service.type }} *) Check Node IP and Port: $ export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") $ export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "hazelcast-jet.fullname" . }}) - *) In Hazelcast Client configure: + *) In Hazelcast Jet Client configure: clientConfig.getNetworkConfig().setSmartRouting(false); clientConfig.getNetworkConfig().addAddress("$NODE_IP:$NODE_PORT"); {{- end }} @@ -47,8 +47,8 @@ To access Hazelcast from outside the Kubernetes cluster: $ curl http://$SERVICE_IP:{{ .Values.service.port }}/hazelcast/health {{- else if contains "ClusterIP" .Values.service.type }} *) Forward port from POD: - $ export POD=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "hazelcast-jet.name" . }}" -o jsonpath="{.items[0].metadata.name}") - $ kubectl port-forward --namespace {{ .Release.Namespace }} $POD 5701:5701 + $ export POD=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "hazelcast-jet.name" . }}" -o jsonpath="{.items[0].metadata.name}") + $ kubectl port-forward --namespace {{ .Release.Namespace }} $POD 5701:{{ .Values.service.port }} *) Get health info: $ curl http://127.0.0.1:5701/hazelcast/health {{- else if contains "NodePort" .Values.service.type }} diff --git a/stable/hazelcast-jet/templates/_helpers.tpl b/stable/hazelcast-jet/templates/_helpers.tpl index 54acdd2115..90fee52cdd 100644 --- a/stable/hazelcast-jet/templates/_helpers.tpl +++ b/stable/hazelcast-jet/templates/_helpers.tpl @@ -25,10 +25,10 @@ If release name contains chart name it will be used as a full name. {{- end -}} {{/* -Create chart name and version as used by the chart label. +Create chart name as used by the chart label. */}} {{- define "hazelcast-jet.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- printf "%s" .Chart.Name | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* diff --git a/stable/hazelcast-jet/templates/config.yaml b/stable/hazelcast-jet/templates/config.yaml index d44e8abd76..62c2710fca 100644 --- a/stable/hazelcast-jet/templates/config.yaml +++ b/stable/hazelcast-jet/templates/config.yaml @@ -4,10 +4,10 @@ kind: ConfigMap metadata: name: {{ template "hazelcast-jet.fullname" . }}-configuration labels: - app: {{ template "hazelcast-jet.name" . }} - chart: {{ template "hazelcast-jet.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" data: {{- range $key, $val := .Values.jet.configurationFiles }} {{ $key }}: |- diff --git a/stable/hazelcast-jet/templates/metrics-service.yaml b/stable/hazelcast-jet/templates/metrics-service.yaml new file mode 100644 index 0000000000..dc018a4e87 --- /dev/null +++ b/stable/hazelcast-jet/templates/metrics-service.yaml @@ -0,0 +1,23 @@ +{{- if .Values.metrics.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "hazelcast-jet.fullname" . }}-metrics + labels: + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + annotations: +{{ toYaml .Values.metrics.service.annotations | indent 4 }} +spec: + type: {{ .Values.metrics.service.type }} + selector: + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + ports: + - protocol: TCP + port: {{ .Values.metrics.service.port }} + targetPort: metrics + name: metrics +{{- end }} diff --git a/stable/hazelcast-jet/templates/role.yaml b/stable/hazelcast-jet/templates/role.yaml index ab7ea83895..bd276c9342 100644 --- a/stable/hazelcast-jet/templates/role.yaml +++ b/stable/hazelcast-jet/templates/role.yaml @@ -1,18 +1,20 @@ {{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1 -kind: Role +kind: ClusterRole metadata: name: {{ template "hazelcast-jet.fullname" . }} labels: - app: {{ template "hazelcast-jet.name" . }} - chart: {{ template "hazelcast-jet.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" rules: - apiGroups: - "" resources: - endpoints + - pods + - nodes verbs: - get - list diff --git a/stable/hazelcast-jet/templates/rolebinding.yaml b/stable/hazelcast-jet/templates/rolebinding.yaml index 0d9eafcbdb..75c44a341a 100644 --- a/stable/hazelcast-jet/templates/rolebinding.yaml +++ b/stable/hazelcast-jet/templates/rolebinding.yaml @@ -1,16 +1,16 @@ {{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding +kind: ClusterRoleBinding metadata: name: {{ template "hazelcast-jet.fullname" . }} labels: - app: {{ template "hazelcast-jet.name" . }} - chart: {{ template "hazelcast-jet.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" roleRef: apiGroup: rbac.authorization.k8s.io - kind: Role + kind: ClusterRole name: {{ template "hazelcast-jet.fullname" . }} subjects: - kind: ServiceAccount diff --git a/stable/hazelcast-jet/templates/service.yaml b/stable/hazelcast-jet/templates/service.yaml index 807c91430d..cc6beb56f8 100644 --- a/stable/hazelcast-jet/templates/service.yaml +++ b/stable/hazelcast-jet/templates/service.yaml @@ -3,18 +3,18 @@ kind: Service metadata: name: {{ template "hazelcast-jet.fullname" . }} labels: - app: {{ template "hazelcast-jet.name" . }} - chart: {{ template "hazelcast-jet.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" spec: type: {{ .Values.service.type }} {{- if .Values.service.clusterIP }} clusterIP: {{ .Values.service.clusterIP }} {{- end }} selector: - app: {{ template "hazelcast-jet.name" . }} - release: "{{ .Release.Name }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" ports: - protocol: TCP port: {{ .Values.service.port }} diff --git a/stable/hazelcast-jet/templates/serviceaccount.yaml b/stable/hazelcast-jet/templates/serviceaccount.yaml index 8b131ac523..48a369b0fc 100644 --- a/stable/hazelcast-jet/templates/serviceaccount.yaml +++ b/stable/hazelcast-jet/templates/serviceaccount.yaml @@ -4,8 +4,8 @@ kind: ServiceAccount metadata: name: {{ template "hazelcast-jet.serviceAccountName" . }} labels: - app: {{ template "hazelcast-jet.name" . }} - chart: {{ template "hazelcast-jet.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" {{- end -}} diff --git a/stable/hazelcast-jet/templates/statefulset.yaml b/stable/hazelcast-jet/templates/statefulset.yaml index dfc9aa4c3d..faeaf91383 100644 --- a/stable/hazelcast-jet/templates/statefulset.yaml +++ b/stable/hazelcast-jet/templates/statefulset.yaml @@ -3,21 +3,28 @@ kind: StatefulSet metadata: name: {{ template "hazelcast-jet.fullname" . }} labels: - app: {{ template "hazelcast-jet.name" . }} - chart: {{ template "hazelcast-jet.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" spec: + serviceName: {{ template "hazelcast-jet.fullname" . }} replicas: {{ .Values.cluster.memberCount }} selector: matchLabels: - app: {{ template "hazelcast-jet.name" . }} - release: "{{ .Release.Name }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + role: hazelcast-jet template: metadata: labels: - app: {{ template "hazelcast-jet.name" . }} - release: "{{ .Release.Name }}" + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + role: hazelcast-jet spec: {{- if .Values.image.pullSecrets }} imagePullSecrets: @@ -41,6 +48,10 @@ spec: ports: - name: hazelcast-jet containerPort: 5701 + {{- if .Values.metrics.enabled }} + - name: metrics + containerPort: {{ .Values.metrics.service.port }} + {{- end }} {{- if .Values.livenessProbe.enabled }} livenessProbe: httpGet: @@ -67,9 +78,18 @@ spec: - name: hazelcast-jet-storage mountPath: /data/hazelcast-jet env: + {{- if .Values.metrics.enabled }} + - name: PROMETHEUS_PORT + value: "{{ .Values.metrics.service.port }}" + {{- end }} - name: JAVA_OPTS - value: "-Dhazelcast.rest.enabled={{ .Values.jet.rest }} -Dhazelcast.config=/data/hazelcast-jet/hazelcast.xml -Dhazelcast.jet.config=/data/hazelcast-jet/hazelcast-jet.xml -DserviceName={{ template "hazelcast-jet.fullname" . }} -Dnamespace={{ .Release.Namespace }} {{ if .Values.gracefulShutdown.enabled }}-Dhazelcast.shutdownhook.policy=GRACEFUL -Dhazelcast.shutdownhook.enabled=true -Dhazelcast.graceful.shutdown.max.wait={{ .Values.gracefulShutdown.maxWaitSeconds }} {{ end }} {{ .Values.jet.javaOpts }}" + value: "-Dhazelcast.rest.enabled={{ .Values.jet.rest }} -Dhazelcast.config=/data/hazelcast-jet/hazelcast.yaml -Dhazelcast.jet.config=/data/hazelcast-jet/hazelcast-jet.yaml -DserviceName={{ template "hazelcast-jet.fullname" . }} -Dnamespace={{ .Release.Namespace }} {{ if .Values.gracefulShutdown.enabled }}-Dhazelcast.shutdownhook.policy=GRACEFUL -Dhazelcast.shutdownhook.enabled=true -Dhazelcast.graceful.shutdown.max.wait={{ .Values.gracefulShutdown.maxWaitSeconds }} {{ end }} {{ if .Values.metrics.enabled }}-Dhazelcast.jmx=true{{ end }} {{ .Values.jet.javaOpts }}" serviceAccountName: {{ template "hazelcast-jet.serviceAccountName" . }} + {{- if .Values.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + fsGroup: {{ .Values.securityContext.fsGroup }} + {{- end }} volumes: - name: hazelcast-jet-storage configMap: diff --git a/stable/hazelcast-jet/templates/tests/test-hazelcast-jet.yaml b/stable/hazelcast-jet/templates/tests/test-hazelcast-jet.yaml new file mode 100644 index 0000000000..7ce2b25c24 --- /dev/null +++ b/stable/hazelcast-jet/templates/tests/test-hazelcast-jet.yaml @@ -0,0 +1,43 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ template "hazelcast-jet.fullname" . }}-test-{{ randAlphaNum 5 | lower }}" + annotations: + "helm.sh/hook": test-success + "helm.sh/hook-delete-policy": hook-succeeded, hook-failed + labels: + app.kubernetes.io/name: {{ template "hazelcast-jet.name" . }} + helm.sh/chart: {{ template "hazelcast-jet.chart" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/component: "test" + role: test +spec: + hostNetwork: false + hostPID: false + hostIPC: false + securityContext: + runAsNonRoot: true + runAsUser: 1001 + containers: + - name: "{{ template "hazelcast-jet.fullname" . }}-test" + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + command: + - "bash" + - "-c" + - | + set -ex + # Get the number of Hazelcast members in the cluster + CLUSTER_SIZE=$(curl {{ template "hazelcast-jet.fullname" . }}:{{ .Values.service.port }}/hazelcast/health/cluster-size) + # Test the currect number of Hazelcast members + test ${CLUSTER_SIZE} -eq {{ .Values.cluster.memberCount }} + securityContext: + runAsNonRoot: true + runAsUser: 1001 + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + restartPolicy: Never \ No newline at end of file diff --git a/stable/hazelcast-jet/values.yaml b/stable/hazelcast-jet/values.yaml index 329a7f4ad5..a68d918885 100644 --- a/stable/hazelcast-jet/values.yaml +++ b/stable/hazelcast-jet/values.yaml @@ -5,7 +5,7 @@ image: # repository is the Hazelcast Jet image name repository: "hazelcast/hazelcast-jet" # tag is the Hazelcast Jet image tag - tag: "3.0" + tag: "3.1" # pullPolicy is the Docker image pull policy # It's recommended to change this to 'Always' if the image tag is 'latest' # ref: http://kubernetes.io/docs/user-guide/images/#updating-images @@ -30,66 +30,52 @@ jet: javaOpts: # configurationFiles are Hazelcast Jet configuration files configurationFiles: - hazelcast.xml: |- - - - - true - - - - - - - - - ${serviceName} - ${namespace} - - - - - - - hazelcast-jet.xml: |- - - - - - 8 - - 100 - - 1 - - - - custom property - - - - 1024 - - 16384 - - 3 - - - - - 120 - - 5 - - false - - + hazelcast.yaml: |- + hazelcast: + network: + join: + multicast: + enabled: false + kubernetes: + enabled: true + namespace: ${namespace} + service-name: ${serviceName} + resolve-not-ready-addresses: true + hazelcast-jet.yaml: |- + hazelcast-jet: + instance: + # period between flow control packets in milliseconds + flow-control-period: 100 + # number of backup copies to configure for Hazelcast IMaps used internally in a Jet job + backup-count: 1 + # the delay after which auto-scaled jobs will restart if a new member is added to the + # cluster. The default is 10 seconds. Has no effect on jobs with auto scaling disabled + scale-up-delay-millis: 10000 + # Sets whether lossless job restart is enabled for the node. With + # lossless restart you can restart the whole cluster without losing the + # jobs and their state. The feature is implemented on top of the Hot + # Restart feature of Hazelcast IMDG which persists the data to disk. + lossless-restart-enabled: false + edge-defaults: + # capacity of the concurrent SPSC queue between each two processors + queue-size: 1024 + # network packet size limit in bytes, only applies to distributed edges + packet-size-limit: 16384 + # receive window size multiplier, only applies to distributed edges + receive-window-multiplier: 3 + metrics: + # whether metrics collection is enabled + enabled: true + # whether jmx mbean metrics collection is enabled + jmx-enabled: true + # the number of seconds the metrics will be retained on the instance + retention-seconds: 120 + # the metrics collection interval in seconds + collection-interval-seconds: 5 + # whether metrics should be collected for data structures. Metrics + # collection can have some overhead if there is a large number of data + # structures + metrics-for-data-structures: false # nodeSelector is an array of Hazelcast Node labels for POD assignments # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector @@ -159,3 +145,22 @@ serviceAccount: # The name of the ServiceAccount to use. # If not set and create is true, a name is generated using the fullname template name: + +# Security Context properties +securityContext: + # enabled is a flag to enable Security Context + enabled: true + # runAsUser is the user ID used to run the container + runAsUser: 1001 + # fsGroup is the group ID associated with the container + fsGroup: 1001 + +# Allows to enable a Prometheus to scrape pods +metrics: + enabled: false + service: + type: ClusterIP + port: 8080 + annotations: + prometheus.io/scrape: "true" + prometheus.io/path: "/metrics"