From 80f5d310e20868fa0900e64664cbffc625ab404e Mon Sep 17 00:00:00 2001 From: Naseem Date: Sun, 30 Jun 2019 13:33:31 -0400 Subject: [PATCH] [incubator/jaeger] Update image, add service accounts, remove configmap, passwords as secrets (#15108) * Update image, add service accounts, remove configmap Signed-off-by: Naseem * passwords as secrets Signed-off-by: Naseem * Bump image Signed-off-by: Naseem * Update README Signed-off-by: Naseem * Improve secret logic Signed-off-by: Naseem * Following best practices regarding service accounts Signed-off-by: Naseem --- incubator/jaeger/Chart.yaml | 4 +- incubator/jaeger/README.md | 156 +++++++++--------- incubator/jaeger/templates/_helpers.tpl | 66 ++++++++ incubator/jaeger/templates/agent-ds.yaml | 1 + incubator/jaeger/templates/agent-sa.yaml | 12 ++ .../templates/cassandra-schema-job.yaml | 21 +-- .../jaeger/templates/cassandra-schema-sa.yaml | 12 ++ .../jaeger/templates/cassandra-secret.yaml | 14 ++ .../jaeger/templates/collector-deploy.yaml | 43 ++--- incubator/jaeger/templates/collector-sa.yaml | 12 ++ incubator/jaeger/templates/common-cm.yaml | 22 --- .../templates/elasticsearch-secret.yaml | 14 ++ incubator/jaeger/templates/hotrod-deploy.yaml | 1 + incubator/jaeger/templates/hotrod-sa.yaml | 12 ++ incubator/jaeger/templates/query-deploy.yaml | 43 ++--- incubator/jaeger/templates/query-sa.yaml | 12 ++ incubator/jaeger/templates/spark-cronjob.yaml | 32 +--- incubator/jaeger/templates/spark-sa.yaml | 12 ++ incubator/jaeger/values.yaml | 34 +++- 19 files changed, 318 insertions(+), 205 deletions(-) create mode 100644 incubator/jaeger/templates/agent-sa.yaml create mode 100644 incubator/jaeger/templates/cassandra-schema-sa.yaml create mode 100644 incubator/jaeger/templates/cassandra-secret.yaml create mode 100644 incubator/jaeger/templates/collector-sa.yaml delete mode 100644 incubator/jaeger/templates/common-cm.yaml create mode 100644 incubator/jaeger/templates/elasticsearch-secret.yaml create mode 100644 incubator/jaeger/templates/hotrod-sa.yaml create mode 100644 incubator/jaeger/templates/query-sa.yaml create mode 100644 incubator/jaeger/templates/spark-sa.yaml diff --git a/incubator/jaeger/Chart.yaml b/incubator/jaeger/Chart.yaml index 153fe004c2..7de4658022 100644 --- a/incubator/jaeger/Chart.yaml +++ b/incubator/jaeger/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 -appVersion: 1.12.0 +appVersion: 1.13.1 description: A Jaeger Helm chart for Kubernetes name: jaeger -version: 0.11.1 +version: 0.12.0 keywords: - jaeger - opentracing diff --git a/incubator/jaeger/README.md b/incubator/jaeger/README.md index 53fdabe9dc..78c7e92e92 100644 --- a/incubator/jaeger/README.md +++ b/incubator/jaeger/README.md @@ -135,91 +135,97 @@ The following table lists the configurable parameters of the Jaeger chart and th | Parameter | Description | Default | |------------------------------------------|-------------------------------------|----------------------------------------| -| `agent.annotations` | Annotations for Agent | nil | -| `agent.cmdlineParams` | Additional command line parameters | nil | -| `agent.dnsPolicy` | Configure DNS policy for agents | ClusterFirst | -| `agent.service.annotations` | Annotations for Agent SVC | nil | -| `agent.service.binaryPort` | jaeger.thrift over binary thrift | 6832 | -| `agent.service.compactPort` | jaeger.thrift over compact thrift | 6831 | -| `agent.image` | Image for Jaeger Agent | jaegertracing/jaeger-agent | -| `agent.podAnnotations` | Annotations for Agent pod | nil | -| `agent.pullPolicy` | Agent image pullPolicy | IfNotPresent | +| `agent.annotations` | Annotations for Agent | `nil` | +| `agent.cmdlineParams` | Additional command line parameters | `nil` | +| `agent.dnsPolicy` | Configure DNS policy for agents | `ClusterFirst` | +| `agent.service.annotations` | Annotations for Agent SVC | `nil` | +| `agent.service.binaryPort` | jaeger.thrift over binary thrift | `6832` | +| `agent.service.compactPort` | jaeger.thrift over compact thrift | `6831` | +| `agent.image` | Image for Jaeger Agent | `jaegertracing/jaeger-agent` | +| `agent.podAnnotations` | Annotations for Agent pod | `nil` | +| `agent.pullPolicy` | Agent image pullPolicy | `IfNotPresent` | | `agent.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `agent.service.annotations` | Annotations for Agent SVC | nil | -| `agent.service.binaryPort` | jaeger.thrift over binary thrift | 6832 | -| `agent.service.compactPort` | jaeger.thrift over compact thrift | 6831 | -| `agent.service.zipkinThriftPort` | zipkin.thrift over compact thrift | 5775 | -| `agent.useHostNetwork` | Enable hostNetwork for agents | false | +| `agent.service.annotations` | Annotations for Agent SVC | `nil` | +| `agent.service.binaryPort` | jaeger.thrift over binary thrift | `6832` | +| `agent.service.compactPort` | jaeger.thrift over compact thrift | `6831` | +| `agent.service.zipkinThriftPort` | zipkin.thrift over compact thrift | `5775` | +| `agent.useHostNetwork` | Enable hostNetwork for agents | `false` | | `agent.tolerations` | Node Tolerations | `[]` | -| `cassandra.config.cluster_name` | Cluster name | jaeger | -| `cassandra.config.dc_name` | Datacenter name | dc1 | -| `cassandra.config.endpoint_snitch` | Node discovery method | GossipingPropertyFileSnitch | -| `cassandra.config.rack_name` | Rack name | rack1 | -| `cassandra.config.seed_size` | Seed size | 1 | -| `cassandra.image.tag` | The image tag/version | 3.11.3 | -| `cassandra.persistence.enabled` | To enable storage persistence | false (Highly recommended to enable) | -| `collector.cmdlineParams` | Additional command line parameters | nil | -| `collector.podAnnotations` | Annotations for Collector pod | nil | -| `collector.service.httpPort` | Client port for HTTP thrift | 14268 | -| `collector.service.annotations` | Annotations for Collector SVC | nil | -| `collector.image` | Image for jaeger collector | jaegertracing/jaeger-collector | -| `collector.pullPolicy` | Collector image pullPolicy | IfNotPresent | +| `collector.cmdlineParams` | Additional command line parameters | `nil` | +| `collector.podAnnotations` | Annotations for Collector pod | `nil` | +| `collector.service.httpPort` | Client port for HTTP thrift | `14268` | +| `collector.service.annotations` | Annotations for Collector SVC | `nil` | +| `collector.image` | Image for jaeger collector | `jaegertracing/jaeger-collector` | +| `collector.pullPolicy` | Collector image pullPolicy | `IfNotPresent` | | `collector.tolerations` | Node Tolerations | `[]` | -| `collector.service.annotations` | Annotations for Collector SVC | nil | -| `collector.service.httpPort` | Client port for HTTP thrift | 14268 | +| `collector.service.annotations` | Annotations for Collector SVC | `nil` | +| `collector.service.httpPort` | Client port for HTTP thrift | `14268` | | `collector.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `collector.service.tchannelPort` | Jaeger Agent port for thrift | 14267 | -| `collector.service.type` | Service type | ClusterIP | -| `collector.service.zipkinPort` | Zipkin port for JSON/thrift HTTP | 9411 | -| `elasticsearch.cluster.name` | Elasticsearch cluster name | "tracing" | -| `elasticsearch.data.persistence.enabled` | To enable storage persistence | false (Highly recommended to enable) | -| `elasticsearch.image.tag` | Elasticsearch image tag | "5.4" | -| `elasticsearch.rbac.create` | To enable RBAC | false | +| `collector.service.tchannelPort` | Jaeger Agent port for thrift | `14267` | +| `collector.service.type` | Service type | `ClusterIP` | +| `collector.service.zipkinPort` | Zipkin port for JSON/thrift HTTP | `9411` | +| `elasticsearch.rbac.create` | To enable RBAC | `false` | | `fullnameOverride` | Override full name | `nil` | -| `hotrod.enabled` | Enables the Hotrod demo app | false | +| `hotrod.enabled` | Enables the Hotrod demo app | `false` | | `hotrod.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | | `nameOverride` | Override name | `nil` | -| `provisionDataStore.cassandra` | Provision Cassandra Data Store | true | -| `provisionDataStore.elasticsearch` | Provision Elasticsearch Data Store | false | -| `query.agentSidecar.enabled` | Enable agent sidecare for query deployment | true | -| `query.service.annotations` | Annotations for Query SVC | nil | -| `query.cmdlineParams` | Additional command line parameters | nil | -| `query.image` | Image for Jaeger Query UI | jaegertracing/jaeger-query | -| `query.ingress.enabled` | Allow external traffic access | false | -| `query.ingress.annotations` | Configure annotations for Ingress | {} | -| `query.ingress.hosts` | Configure host for Ingress | nil | -| `query.ingress.tls` | Configure tls for Ingress | nil | -| `query.podAnnotations` | Annotations for Query pod | nil | -| `query.pullPolicy` | Query UI image pullPolicy | IfNotPresent | +| `provisionDataStore.cassandra` | Provision Cassandra Data Store | `true` | +| `provisionDataStore.elasticsearch` | Provision Elasticsearch Data Store | `false` | +| `query.agentSidecar.enabled` | Enable agent sidecare for query deployment | `true` | +| `query.service.annotations` | Annotations for Query SVC | `nil` | +| `query.cmdlineParams` | Additional command line parameters | `nil` | +| `query.image` | Image for Jaeger Query UI | `jaegertracing/jaeger-query ` | +| `query.ingress.enabled` | Allow external traffic access | `false` | +| `query.ingress.annotations` | Configure annotations for Ingress | `{}` | +| `query.ingress.hosts` | Configure host for Ingress | `nil` | +| `query.ingress.tls` | Configure tls for Ingress | `nil` | +| `query.podAnnotations` | Annotations for Query pod | `nil` | +| `query.pullPolicy` | Query UI image pullPolicy | `IfNotPresent` | | `query.tolerations` | Node Tolerations | `[]` | | `query.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `query.service.port` | External accessible port | 80 | -| `query.service.type` | Service type | ClusterIP | -| `query.basePath` | Base path of Query UI, used for ingress as well (if it is enabled) | / | -| `schema.annotations` | Annotations for the schema job | nil | -| `schema.image` | Image to setup cassandra schema | jaegertracing/jaeger-cassandra-schema | -| `schema.mode` | Schema mode (prod or test) | prod | -| `schema.pullPolicy` | Schema image pullPolicy | IfNotPresent | -| `spark.enabled` | Enables the dependencies job | false | -| `spark.image` | Image for the dependencies job | jaegertracing/spark-dependencies | -| `spark.pullPolicy` | Image pull policy of the deps image | Always | -| `spark.schedule` | Schedule of the cron job | "49 23 * * *" | -| `spark.successfulJobsHistoryLimit` | Cron job successfulJobsHistoryLimit | 5 | -| `spark.failedJobsHistoryLimit` | Cron job failedJobsHistoryLimit | 5 | -| `spark.tag` | Tag of the dependencies job image | latest | +| `query.service.port` | External accessible port | `80` | +| `query.service.type` | Service type | `ClusterIP` | +| `query.basePath` | Base path of Query UI, used for ingress as well (if it is enabled) | `/` | +| `schema.annotations` | Annotations for the schema job | `nil` | +| `schema.image` | Image to setup cassandra schema | `jaegertracing/jaeger-cassandra-schema` | +| `schema.mode` | Schema mode (prod or test) | `prod` | +| `schema.pullPolicy` | Schema image pullPolicy | `IfNotPresent` | +| `serviceAccounts.agent.create` | Create service account | `true` | +| `serviceAccounts.agent.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `` | +| `serviceAccounts.cassandraSchema.create` | Create service account | `true` | +| `serviceAccounts.cassandraSchema.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `` | +| `serviceAccounts.collector.create` | Create service account | `true` | +| `serviceAccounts.collector.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `` | +| `serviceAccounts.hotrod.create` | Create service account | `true` | +| `serviceAccounts.hotrod.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `` | +| `serviceAccounts.query.create` | Create service account | `true` | +| `serviceAccounts.query.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `` | +| `serviceAccounts.spark.create` | Create service account | `true` | +| `serviceAccounts.spark.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `` | +| `spark.enabled` | Enables the dependencies job | `false` | +| `spark.image` | Image for the dependencies job | `jaegertracing/spark-dependencies` | +| `spark.pullPolicy` | Image pull policy of the deps image | `Always` | +| `spark.schedule` | Schedule of the cron job | `"49 23 * * *"` | +| `spark.successfulJobsHistoryLimit` | Cron job successfulJobsHistoryLimit | `5` | +| `spark.failedJobsHistoryLimit` | Cron job failedJobsHistoryLimit | `5` | +| `spark.tag` | Tag of the dependencies job image | `latest` | | `spark.tolerations` | Node Tolerations | `[]` | -| `storage.cassandra.host` | Provisioned cassandra host | cassandra | -| `storage.cassandra.password` | Provisioned cassandra password | password | -| `storage.cassandra.port` | Provisioned cassandra port | 9042 | -| `storage.cassandra.user` | Provisioned cassandra username | user | -| `storage.elasticsearch.host` | Provisioned elasticsearch host | elasticsearch | -| `storage.elasticsearch.password` | Provisioned elasticsearch password | changeme | -| `storage.elasticsearch.port` | Provisioned elasticsearch port | 9200 | -| `storage.elasticsearch.scheme` | Provisioned elasticsearch scheme | http | -| `storage.elasticsearch.user` | Provisioned elasticsearch user | elastic | -| `storage.elasticsearch.nodesWanOnly` | Only access specified es host | false | -| `storage.type` | Storage type (ES or Cassandra) | cassandra | -| `tag` | Image tag/version | 1.12.0 | +| `storage.cassandra.existingSecret` | Name of existing password secret object (for password authentication) | `nil` +| `storage.cassandra.host` | Provisioned cassandra host | `cassandra` | +| `storage.cassandra.password` | Provisioned cassandra password (ignored if storage.cassandra.existingSecret set) | `password` | +| `storage.cassandra.port` | Provisioned cassandra port | `9042` | +| `storage.cassandra.usePassword` | Use password | `true` | +| `storage.cassandra.user` | Provisioned cassandra username | `user` | +| `storage.elasticsearch.existingSecret` | Name of existing password secret object (for password authentication) | `nil` | +| `storage.elasticsearch.host` | Provisioned elasticsearch host | `elasticsearch` | +| `storage.elasticsearch.password` | Provisioned elasticsearch password (ignored if storage.elasticsearch.existingSecret set) | `changeme` | +| `storage.elasticsearch.port` | Provisioned elasticsearch port | `9200` | +| `storage.elasticsearch.scheme` | Provisioned elasticsearch scheme | `http` | +| `storage.elasticsearch.usePassword` | Use password | `true` | +| `storage.elasticsearch.user` | Provisioned elasticsearch user | `elastic` | +| `storage.elasticsearch.nodesWanOnly` | Only access specified es host | `false` | +| `storage.type` | Storage type (ES or Cassandra) | `cassandra` | +| `tag` | Image tag/version | `1.13.1` | For more information about some of the tunable parameters that Cassandra provides, please visit the helm chart for [cassandra](https://github.com/kubernetes/charts/tree/master/incubator/cassandra) and the official [website](http://cassandra.apache.org/) at apache.org. diff --git a/incubator/jaeger/templates/_helpers.tpl b/incubator/jaeger/templates/_helpers.tpl index 7205ab8d06..17ed523abe 100644 --- a/incubator/jaeger/templates/_helpers.tpl +++ b/incubator/jaeger/templates/_helpers.tpl @@ -31,6 +31,72 @@ Create chart name and version as used by the chart label. {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{/* +Create the name of the cassandra schema service account to use +*/}} +{{- define "jaeger.cassandraSchema.serviceAccountName" -}} +{{- if .Values.serviceAccounts.cassandraSchema.create -}} + {{ default (printf "%s-cassandra-schema" (include "jaeger.fullname" .)) .Values.serviceAccounts.cassandraSchema.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.cassandraSchema.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the spark service account to use +*/}} +{{- define "jaeger.spark.serviceAccountName" -}} +{{- if .Values.serviceAccounts.spark.create -}} + {{ default (printf "%s-spark" (include "jaeger.fullname" .)) .Values.serviceAccounts.spark.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.spark.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the hotrod service account to use +*/}} +{{- define "jaeger.hotrod.serviceAccountName" -}} +{{- if .Values.serviceAccounts.hotrod.create -}} + {{ default (printf "%s-hotrod" (include "jaeger.fullname" .)) .Values.serviceAccounts.hotrod.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.hotrod.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the query service account to use +*/}} +{{- define "jaeger.query.serviceAccountName" -}} +{{- if .Values.serviceAccounts.query.create -}} + {{ default (include "jaeger.query.name" .) .Values.serviceAccounts.query.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.query.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the agent service account to use +*/}} +{{- define "jaeger.agent.serviceAccountName" -}} +{{- if .Values.serviceAccounts.agent.create -}} + {{ default (include "jaeger.agent.name" .) .Values.serviceAccounts.agent.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.agent.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the collector service account to use +*/}} +{{- define "jaeger.collector.serviceAccountName" -}} +{{- if .Values.serviceAccounts.collector.create -}} + {{ default (include "jaeger.collector.name" .) .Values.serviceAccounts.collector.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.collector.name }} +{{- end -}} +{{- end -}} + {{/* Create a fully qualified query name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). diff --git a/incubator/jaeger/templates/agent-ds.yaml b/incubator/jaeger/templates/agent-ds.yaml index 60366520b9..bcc005a5cf 100644 --- a/incubator/jaeger/templates/agent-ds.yaml +++ b/incubator/jaeger/templates/agent-ds.yaml @@ -43,6 +43,7 @@ spec: tolerations: {{ toYaml .Values.agent.tolerations | indent 8 }} {{- end }} + serviceAccountName: {{ template "jaeger.agent.serviceAccountName" . }} containers: - name: {{ template "jaeger.agent.name" . }} image: {{ .Values.agent.image }}:{{ .Values.tag }} diff --git a/incubator/jaeger/templates/agent-sa.yaml b/incubator/jaeger/templates/agent-sa.yaml new file mode 100644 index 0000000000..9b0087fbb2 --- /dev/null +++ b/incubator/jaeger/templates/agent-sa.yaml @@ -0,0 +1,12 @@ +{{- if and .Values.agent.enabled .Values.serviceAccounts.agent.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "jaeger.agent.name" . }} + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: agent +{{- end -}} diff --git a/incubator/jaeger/templates/cassandra-schema-job.yaml b/incubator/jaeger/templates/cassandra-schema-job.yaml index b28f1b22cb..add50983ed 100644 --- a/incubator/jaeger/templates/cassandra-schema-job.yaml +++ b/incubator/jaeger/templates/cassandra-schema-job.yaml @@ -24,31 +24,20 @@ spec: {{ toYaml .Values.schema.podLabels | indent 8 }} {{- end }} spec: + serviceAccountName: {{ include "jaeger.fullname" . }}-cassandra-schema containers: - name: {{ include "jaeger.fullname" . }}-cassandra-schema image: {{ .Values.schema.image }}:{{ .Values.tag }} imagePullPolicy: {{ .Values.schema.pullPolicy }} env: - name: CQLSH_HOST - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.servers + value: {{ template "cassandra.host" . }} - name: MODE - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.schema.mode + value: {{ .Values.schema.mode | quote }} - name: DATACENTER - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.datacenter.name + value: {{ .Values.cassandra.config.dc_name | quote }} - name: CASSANDRA_PORT - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.port + value: {{ .Values.storage.cassandra.port | quote }} resources: {{ toYaml .Values.schema.resources | indent 10 }} restartPolicy: OnFailure diff --git a/incubator/jaeger/templates/cassandra-schema-sa.yaml b/incubator/jaeger/templates/cassandra-schema-sa.yaml new file mode 100644 index 0000000000..459c29234c --- /dev/null +++ b/incubator/jaeger/templates/cassandra-schema-sa.yaml @@ -0,0 +1,12 @@ +{{- if and (eq .Values.storage.type "cassandra") .Values.serviceAccounts.cassandraSchema.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "jaeger.cassandraSchema.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: cassandra-schema +{{- end -}} diff --git a/incubator/jaeger/templates/cassandra-secret.yaml b/incubator/jaeger/templates/cassandra-secret.yaml new file mode 100644 index 0000000000..4a262de4f2 --- /dev/null +++ b/incubator/jaeger/templates/cassandra-secret.yaml @@ -0,0 +1,14 @@ +{{ if and (eq .Values.storage.type "cassandra") .Values.storage.cassandra.usePassword (not .Values.storage.cassandra.existingSecret) -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "jaeger.fullname" . }}-cassandra + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +type: Opaque +data: + password: {{ .Values.storage.cassandra.password | b64enc | quote }} +{{- end }} diff --git a/incubator/jaeger/templates/collector-deploy.yaml b/incubator/jaeger/templates/collector-deploy.yaml index 865670eacf..ee7dc7c1c2 100644 --- a/incubator/jaeger/templates/collector-deploy.yaml +++ b/incubator/jaeger/templates/collector-deploy.yaml @@ -42,6 +42,7 @@ spec: tolerations: {{ toYaml .Values.collector.tolerations | indent 8 }} {{- end }} + serviceAccountName: {{ template "jaeger.collector.serviceAccountName" . }} containers: - name: {{ template "jaeger.collector.name" . }} image: {{ .Values.collector.image }}:{{ .Values.tag }} @@ -55,47 +56,29 @@ spec: value: {{ .Values.storage.type }} {{- if eq .Values.storage.type "cassandra" }} - name: CASSANDRA_SERVERS - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.servers + value: {{ template "cassandra.host" . }} - name: CASSANDRA_PORT - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.port + value: {{ .Values.storage.cassandra.port | quote }} - name: CASSANDRA_KEYSPACE - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.keyspace + value: {{ printf "%s_%s" "jaeger_v1" .Values.cassandra.config.dc_name | quote }} - name: CASSANDRA_USERNAME - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.username + value: {{ .Values.storage.cassandra.user }} - name: CASSANDRA_PASSWORD valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.password + secretKeyRef: + name: {{ if .Values.storage.cassandra.existingSecret }}{{ .Values.storage.cassandra.existingSecret }}{{- else }}{{ include "jaeger.fullname" . }}-cassandra{{- end }} + key: password {{- end }} {{- if eq .Values.storage.type "elasticsearch" }} - name: ES_PASSWORD valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.password + secretKeyRef: + name: {{ if .Values.storage.elasticsearch.existingSecret }}{{ .Values.storage.elasticsearch.existingSecret }}{{- else }}{{ include "jaeger.fullname" . }}-elasticsearch{{- end }} + key: password - name: ES_SERVER_URLS - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.server-urls + value: {{ template "elasticsearch.client.url" . }} - name: ES_USERNAME - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.username + value: {{ .Values.storage.elasticsearch.user }} {{- end }} ports: - containerPort: {{ .Values.collector.service.grpcPort }} diff --git a/incubator/jaeger/templates/collector-sa.yaml b/incubator/jaeger/templates/collector-sa.yaml new file mode 100644 index 0000000000..ecff821729 --- /dev/null +++ b/incubator/jaeger/templates/collector-sa.yaml @@ -0,0 +1,12 @@ +{{- if and .Values.collector.enabled .Values.serviceAccounts.collector.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "jaeger.collector.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: collector +{{- end -}} diff --git a/incubator/jaeger/templates/common-cm.yaml b/incubator/jaeger/templates/common-cm.yaml deleted file mode 100644 index 75b2074067..0000000000 --- a/incubator/jaeger/templates/common-cm.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "jaeger.fullname" . }} - labels: - app.kubernetes.io/name: {{ include "jaeger.name" . }} - helm.sh/chart: {{ include "jaeger.chart" . }} - app.kubernetes.io/managed-by: {{ .Release.Service }} - app.kubernetes.io/instance: {{ .Release.Name }} -data: - cassandra.contact-points: {{ template "cassandra.contact_points" . }} - cassandra.datacenter.name: {{ .Values.cassandra.config.dc_name | quote }} - cassandra.keyspace: {{ printf "%s_%s" "jaeger_v1" .Values.cassandra.config.dc_name | quote }} - cassandra.password: {{ .Values.storage.cassandra.password }} - cassandra.port: {{ .Values.storage.cassandra.port | quote }} - cassandra.schema.mode: {{ .Values.schema.mode | quote }} - cassandra.servers: {{ template "cassandra.host" . }} - cassandra.username: {{ .Values.storage.cassandra.user }} - es.password: {{ .Values.storage.elasticsearch.password }} - es.server-urls: {{ template "elasticsearch.client.url" . }} - es.username: {{ .Values.storage.elasticsearch.user }} - es.nodes-wan-only: {{ .Values.storage.elasticsearch.nodesWanOnly | quote }} diff --git a/incubator/jaeger/templates/elasticsearch-secret.yaml b/incubator/jaeger/templates/elasticsearch-secret.yaml new file mode 100644 index 0000000000..f009c26e52 --- /dev/null +++ b/incubator/jaeger/templates/elasticsearch-secret.yaml @@ -0,0 +1,14 @@ +{{ if and (eq .Values.storage.type "elasticsearch") .Values.storage.elasticsearch.usePassword (not .Values.storage.elasticsearch.existingSecret) -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "jaeger.fullname" . }}-elasticsearch + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +type: Opaque +data: + password: {{ .Values.storage.elasticsearch.password | b64enc | quote }} +{{- end }} diff --git a/incubator/jaeger/templates/hotrod-deploy.yaml b/incubator/jaeger/templates/hotrod-deploy.yaml index 2dfa471a28..d8da3e5dca 100644 --- a/incubator/jaeger/templates/hotrod-deploy.yaml +++ b/incubator/jaeger/templates/hotrod-deploy.yaml @@ -24,6 +24,7 @@ spec: app.kubernetes.io/component: hotrod app.kubernetes.io/instance: {{ .Release.Name }} spec: + serviceAccountName: {{ template "jaeger.hotrod.serviceAccountName" . }} containers: - name: {{ include "jaeger.fullname" . }}-hotrod image: {{ .Values.hotrod.image.repository }}:{{ .Values.tag }} diff --git a/incubator/jaeger/templates/hotrod-sa.yaml b/incubator/jaeger/templates/hotrod-sa.yaml new file mode 100644 index 0000000000..d7daa32e36 --- /dev/null +++ b/incubator/jaeger/templates/hotrod-sa.yaml @@ -0,0 +1,12 @@ +{{- if and .Values.hotrod.enabled .Values.serviceAccounts.hotrod.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "jaeger.hotrod.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: hotrod +{{- end -}} diff --git a/incubator/jaeger/templates/query-deploy.yaml b/incubator/jaeger/templates/query-deploy.yaml index 41f585c14c..cafbcdc824 100644 --- a/incubator/jaeger/templates/query-deploy.yaml +++ b/incubator/jaeger/templates/query-deploy.yaml @@ -42,6 +42,7 @@ spec: tolerations: {{ toYaml .Values.query.tolerations | indent 8 }} {{- end }} + serviceAccountName: {{ template "jaeger.query.serviceAccountName" . }} containers: - name: {{ template "jaeger.query.name" . }} image: {{ .Values.query.image }}:{{ .Values.tag }} @@ -55,47 +56,29 @@ spec: value: {{ .Values.storage.type }} {{- if eq .Values.storage.type "cassandra" }} - name: CASSANDRA_SERVERS - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.servers + value: {{ template "cassandra.host" . }} - name: CASSANDRA_PORT - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.port + value: {{ .Values.storage.cassandra.port | quote }} - name: CASSANDRA_KEYSPACE - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.keyspace + value: {{ printf "%s_%s" "jaeger_v1" .Values.cassandra.config.dc_name | quote }} - name: CASSANDRA_USERNAME - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.username + value: {{ .Values.storage.cassandra.user }} - name: CASSANDRA_PASSWORD valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.password + secretKeyRef: + name: {{ if .Values.storage.cassandra.existingSecret }}{{ .Values.storage.cassandra.existingSecret }}{{- else }}{{ include "jaeger.fullname" . }}-cassandra{{- end }} + key: password {{- end }} {{- if eq .Values.storage.type "elasticsearch" }} - name: ES_PASSWORD valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.password + secretKeyRef: + name: {{ if .Values.storage.elasticsearch.existingSecret }}{{ .Values.storage.elasticsearch.existingSecret }}{{- else }}{{ include "jaeger.fullname" . }}-elasticsearch{{- end }} + key: password - name: ES_SERVER_URLS - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.server-urls + value: {{ template "elasticsearch.client.url" . }} - name: ES_USERNAME - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.username + value: {{ .Values.storage.elasticsearch.user }} {{- end }} - name: QUERY_BASE_PATH value: {{ .Values.query.basePath | quote }} diff --git a/incubator/jaeger/templates/query-sa.yaml b/incubator/jaeger/templates/query-sa.yaml new file mode 100644 index 0000000000..ffdd642dfb --- /dev/null +++ b/incubator/jaeger/templates/query-sa.yaml @@ -0,0 +1,12 @@ +{{- if and .Values.query.enabled .Values.serviceAccounts.query.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "jaeger.query.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: query +{{- end -}} diff --git a/incubator/jaeger/templates/spark-cronjob.yaml b/incubator/jaeger/templates/spark-cronjob.yaml index eeb9f9c152..90c2b91f02 100644 --- a/incubator/jaeger/templates/spark-cronjob.yaml +++ b/incubator/jaeger/templates/spark-cronjob.yaml @@ -35,6 +35,7 @@ spec: tolerations: {{ toYaml .Values.spark.tolerations | indent 8 }} {{- end }} + serviceAccountName: {{ template "jaeger.spark.serviceAccountName" . }} containers: - name: {{ include "jaeger.fullname" . }}-spark image: {{ .Values.spark.image }}:{{ .Values.spark.tag }} @@ -44,37 +45,22 @@ spec: value: {{ .Values.storage.type }} {{- if eq .Values.storage.type "cassandra" }} - name: CASSANDRA_CONTACT_POINTS - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.contact-points + value: {{ template "cassandra.contact_points" . }} - name: CASSANDRA_KEYSPACE - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: cassandra.keyspace + value: {{ printf "%s_%s" "jaeger_v1" .Values.cassandra.config.dc_name | quote }} {{- end }} {{- if eq .Values.storage.type "elasticsearch" }} - name: ES_NODES - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.server-urls + value: {{ template "elasticsearch.client.url" . }} - name: ES_NODES_WAN_ONLY - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.nodes-wan-only + value: {{ .Values.storage.elasticsearch.nodesWanOnly | quote }} - name: ES_PASSWORD valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.password + secretKeyRef: + name: {{ if .Values.storage.elasticsearch.existingSecret }}{{ .Values.storage.elasticsearch.existingSecret }}{{- else }}{{ include "jaeger.fullname" . }}-elasticsearch{{- end }} + key: password - name: ES_USERNAME - valueFrom: - configMapKeyRef: - name: {{ include "jaeger.fullname" . }} - key: es.username + value: {{ .Values.storage.elasticsearch.user }} {{- end }} resources: {{ toYaml .Values.spark.resources | indent 14 }} diff --git a/incubator/jaeger/templates/spark-sa.yaml b/incubator/jaeger/templates/spark-sa.yaml new file mode 100644 index 0000000000..3f4b8caceb --- /dev/null +++ b/incubator/jaeger/templates/spark-sa.yaml @@ -0,0 +1,12 @@ +{{- if and .Values.spark.enabled .Values.serviceAccounts.spark.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "jaeger.spark.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ include "jaeger.name" . }} + helm.sh/chart: {{ include "jaeger.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: spark +{{- end -}} diff --git a/incubator/jaeger/values.yaml b/incubator/jaeger/values.yaml index 2d58730186..bff8f10f99 100644 --- a/incubator/jaeger/values.yaml +++ b/incubator/jaeger/values.yaml @@ -6,11 +6,31 @@ provisionDataStore: cassandra: true elasticsearch: false -tag: 1.12.0 +tag: 1.13.1 nameOverride: "" fullnameOverride: "" +serviceAccounts: + cassandraSchema: + create: true + name: + agent: + create: true + name: + collector: + create: true + name: + query: + create: true + name: + spark: + create: true + name: + hotrod: + create: true + name: + storage: # allowed values (cassandra, elasticsearch) type: cassandra @@ -18,19 +38,23 @@ storage: host: cassandra port: 9042 user: user + usePassword: true password: password + ## Use existing secret (ignores previous password) + # existingSecret: elasticsearch: scheme: http host: elasticsearch port: 9200 user: elastic + usePassword: true password: changeme + ## Use existing secret (ignores previous password) + # existingSecret: nodesWanOnly: false # Begin: Override values on the Cassandra subchart to customize for Jaeger cassandra: - image: - tag: 3.11.3 persistence: # To enable persistence, please see the documentation for the Cassandra chart enabled: false @@ -67,15 +91,11 @@ schema: # Begin: Override values on the Elasticsearch subchart to customize for Jaeger elasticsearch: - image: - tag: "6.6" cluster: name: "tracing" data: persistence: enabled: false - rbac: - create: false agent: enabled: true