feat(mongo): add common Helm chart and related templates
Signed-off-by: zhenyus <zhenyus@mathmast.com>
This commit is contained in:
zhenyus
parent
be1573ee12
commit
49162abfb0
25
freeleaps/helm-pkg/3rd/mongo/.helmignore
Normal file
25
freeleaps/helm-pkg/3rd/mongo/.helmignore
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
# img folder
|
||||||
|
img/
|
||||||
|
# Changelog
|
||||||
|
CHANGELOG.md
|
||||||
6
freeleaps/helm-pkg/3rd/mongo/Chart.lock
Normal file
6
freeleaps/helm-pkg/3rd/mongo/Chart.lock
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
repository: oci://registry-1.docker.io/bitnamicharts
|
||||||
|
version: 2.29.1
|
||||||
|
digest: sha256:0d3abbd4a9bdc95c1a5f504d253e347f723d9565222939020973dd3c4e1dd1f4
|
||||||
|
generated: "2025-02-01T22:43:49.819944027Z"
|
||||||
41
freeleaps/helm-pkg/3rd/mongo/Chart.yaml
Normal file
41
freeleaps/helm-pkg/3rd/mongo/Chart.yaml
Normal file
@ -0,0 +1,41 @@
|
|||||||
|
annotations:
|
||||||
|
category: Database
|
||||||
|
images: |
|
||||||
|
- name: kubectl
|
||||||
|
image: docker.io/bitnami/kubectl:1.32.1-debian-12-r4
|
||||||
|
- name: mongodb
|
||||||
|
image: docker.io/bitnami/mongodb:8.0.4-debian-12-r3
|
||||||
|
- name: mongodb-exporter
|
||||||
|
image: docker.io/bitnami/mongodb-exporter:0.43.1-debian-12-r3
|
||||||
|
- name: nginx
|
||||||
|
image: docker.io/bitnami/nginx:1.27.3-debian-12-r5
|
||||||
|
- name: os-shell
|
||||||
|
image: docker.io/bitnami/os-shell:12-debian-12-r36
|
||||||
|
licenses: Apache-2.0
|
||||||
|
apiVersion: v2
|
||||||
|
appVersion: 8.0.4
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
repository: oci://registry-1.docker.io/bitnamicharts
|
||||||
|
tags:
|
||||||
|
- bitnami-common
|
||||||
|
version: 2.x.x
|
||||||
|
description: MongoDB(R) is a relational open source NoSQL database. Easy to use, it
|
||||||
|
stores data in JSON-like documents. Automated scalability and high-performance.
|
||||||
|
Ideal for developing cloud native applications.
|
||||||
|
home: https://bitnami.com
|
||||||
|
icon: https://dyltqmyl993wv.cloudfront.net/assets/stacks/mongodb/img/mongodb-stack-220x234.png
|
||||||
|
keywords:
|
||||||
|
- mongodb
|
||||||
|
- database
|
||||||
|
- nosql
|
||||||
|
- cluster
|
||||||
|
- replicaset
|
||||||
|
- replication
|
||||||
|
maintainers:
|
||||||
|
- name: Broadcom, Inc. All Rights Reserved.
|
||||||
|
url: https://github.com/bitnami/charts
|
||||||
|
name: mongodb
|
||||||
|
sources:
|
||||||
|
- https://github.com/bitnami/charts/tree/main/bitnami/mongodb
|
||||||
|
version: 16.4.4
|
||||||
1326
freeleaps/helm-pkg/3rd/mongo/README.md
Normal file
1326
freeleaps/helm-pkg/3rd/mongo/README.md
Normal file
File diff suppressed because it is too large
Load Diff
26
freeleaps/helm-pkg/3rd/mongo/charts/common/.helmignore
Normal file
26
freeleaps/helm-pkg/3rd/mongo/charts/common/.helmignore
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
|
# img folder
|
||||||
|
img/
|
||||||
|
# Changelog
|
||||||
|
CHANGELOG.md
|
||||||
23
freeleaps/helm-pkg/3rd/mongo/charts/common/Chart.yaml
Normal file
23
freeleaps/helm-pkg/3rd/mongo/charts/common/Chart.yaml
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
annotations:
|
||||||
|
category: Infrastructure
|
||||||
|
licenses: Apache-2.0
|
||||||
|
apiVersion: v2
|
||||||
|
appVersion: 2.29.1
|
||||||
|
description: A Library Helm Chart for grouping common logic between bitnami charts.
|
||||||
|
This chart is not deployable by itself.
|
||||||
|
home: https://bitnami.com
|
||||||
|
icon: https://bitnami.com/downloads/logos/bitnami-mark.png
|
||||||
|
keywords:
|
||||||
|
- common
|
||||||
|
- helper
|
||||||
|
- template
|
||||||
|
- function
|
||||||
|
- bitnami
|
||||||
|
maintainers:
|
||||||
|
- name: Broadcom, Inc. All Rights Reserved.
|
||||||
|
url: https://github.com/bitnami/charts
|
||||||
|
name: common
|
||||||
|
sources:
|
||||||
|
- https://github.com/bitnami/charts/tree/main/bitnami/common
|
||||||
|
type: library
|
||||||
|
version: 2.29.1
|
||||||
235
freeleaps/helm-pkg/3rd/mongo/charts/common/README.md
Normal file
235
freeleaps/helm-pkg/3rd/mongo/charts/common/README.md
Normal file
@ -0,0 +1,235 @@
|
|||||||
|
# Bitnami Common Library Chart
|
||||||
|
|
||||||
|
A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between Bitnami charts.
|
||||||
|
|
||||||
|
## TL;DR
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
version: 2.x.x
|
||||||
|
repository: oci://registry-1.docker.io/bitnamicharts
|
||||||
|
```
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm dependency update
|
||||||
|
```
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "common.names.fullname" . }}
|
||||||
|
data:
|
||||||
|
myvalue: "Hello World"
|
||||||
|
```
|
||||||
|
|
||||||
|
Looking to use our applications in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog.
|
||||||
|
|
||||||
|
## Introduction
|
||||||
|
|
||||||
|
This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager.
|
||||||
|
|
||||||
|
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- Kubernetes 1.23+
|
||||||
|
- Helm 3.8.0+
|
||||||
|
|
||||||
|
## Parameters
|
||||||
|
|
||||||
|
## Special input schemas
|
||||||
|
|
||||||
|
### ImageRoot
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
registry:
|
||||||
|
type: string
|
||||||
|
description: Docker registry where the image is located
|
||||||
|
example: docker.io
|
||||||
|
|
||||||
|
repository:
|
||||||
|
type: string
|
||||||
|
description: Repository and image name
|
||||||
|
example: bitnami/nginx
|
||||||
|
|
||||||
|
tag:
|
||||||
|
type: string
|
||||||
|
description: image tag
|
||||||
|
example: 1.16.1-debian-10-r63
|
||||||
|
|
||||||
|
pullPolicy:
|
||||||
|
type: string
|
||||||
|
description: Specify a imagePullPolicy.'
|
||||||
|
|
||||||
|
pullSecrets:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
description: Optionally specify an array of imagePullSecrets (evaluated as templates).
|
||||||
|
|
||||||
|
debug:
|
||||||
|
type: boolean
|
||||||
|
description: Set to true if you would like to see extra information on logs
|
||||||
|
example: false
|
||||||
|
|
||||||
|
## An instance would be:
|
||||||
|
# registry: docker.io
|
||||||
|
# repository: bitnami/nginx
|
||||||
|
# tag: 1.16.1-debian-10-r63
|
||||||
|
# pullPolicy: IfNotPresent
|
||||||
|
# debug: false
|
||||||
|
```
|
||||||
|
|
||||||
|
### Persistence
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
enabled:
|
||||||
|
type: boolean
|
||||||
|
description: Whether enable persistence.
|
||||||
|
example: true
|
||||||
|
|
||||||
|
storageClass:
|
||||||
|
type: string
|
||||||
|
description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning.
|
||||||
|
example: "-"
|
||||||
|
|
||||||
|
accessMode:
|
||||||
|
type: string
|
||||||
|
description: Access mode for the Persistent Volume Storage.
|
||||||
|
example: ReadWriteOnce
|
||||||
|
|
||||||
|
size:
|
||||||
|
type: string
|
||||||
|
description: Size the Persistent Volume Storage.
|
||||||
|
example: 8Gi
|
||||||
|
|
||||||
|
path:
|
||||||
|
type: string
|
||||||
|
description: Path to be persisted.
|
||||||
|
example: /bitnami
|
||||||
|
|
||||||
|
## An instance would be:
|
||||||
|
# enabled: true
|
||||||
|
# storageClass: "-"
|
||||||
|
# accessMode: ReadWriteOnce
|
||||||
|
# size: 8Gi
|
||||||
|
# path: /bitnami
|
||||||
|
```
|
||||||
|
|
||||||
|
### ExistingSecret
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
description: Name of the existing secret.
|
||||||
|
example: mySecret
|
||||||
|
keyMapping:
|
||||||
|
description: Mapping between the expected key name and the name of the key in the existing secret.
|
||||||
|
type: object
|
||||||
|
|
||||||
|
## An instance would be:
|
||||||
|
# name: mySecret
|
||||||
|
# keyMapping:
|
||||||
|
# password: myPasswordKey
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Example of use
|
||||||
|
|
||||||
|
When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets.
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# templates/secret.yaml
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ include "common.names.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "common.names.fullname" . }}
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
password: {{ .Values.password | b64enc | quote }}
|
||||||
|
|
||||||
|
# templates/dpl.yaml
|
||||||
|
---
|
||||||
|
...
|
||||||
|
env:
|
||||||
|
- name: PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }}
|
||||||
|
key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }}
|
||||||
|
...
|
||||||
|
|
||||||
|
# values.yaml
|
||||||
|
---
|
||||||
|
name: mySecret
|
||||||
|
keyMapping:
|
||||||
|
password: myPasswordKey
|
||||||
|
```
|
||||||
|
|
||||||
|
### ValidateValue
|
||||||
|
|
||||||
|
#### NOTES.txt
|
||||||
|
|
||||||
|
```console
|
||||||
|
{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}}
|
||||||
|
{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}}
|
||||||
|
|
||||||
|
{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||||
|
```
|
||||||
|
|
||||||
|
If we force those values to be empty we will see some alerts
|
||||||
|
|
||||||
|
```console
|
||||||
|
helm install test mychart --set path.to.value00="",path.to.value01=""
|
||||||
|
'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value:
|
||||||
|
|
||||||
|
export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d)
|
||||||
|
|
||||||
|
'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value:
|
||||||
|
|
||||||
|
export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Upgrading
|
||||||
|
|
||||||
|
### To 1.0.0
|
||||||
|
|
||||||
|
[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
|
||||||
|
|
||||||
|
#### What changes were introduced in this major version?
|
||||||
|
|
||||||
|
- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field.
|
||||||
|
- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information.
|
||||||
|
- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts
|
||||||
|
|
||||||
|
#### Considerations when upgrading to this version
|
||||||
|
|
||||||
|
- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues
|
||||||
|
- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore
|
||||||
|
- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3
|
||||||
|
|
||||||
|
#### Useful links
|
||||||
|
|
||||||
|
- <https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-resolve-helm2-helm3-post-migration-issues-index.html>
|
||||||
|
- <https://helm.sh/docs/topics/v2_v3_migration/>
|
||||||
|
- <https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/>
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
<http://www.apache.org/licenses/LICENSE-2.0>
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
@ -0,0 +1,155 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a soft nodeAffinity definition
|
||||||
|
{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.affinities.nodes.soft" -}}
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- preference:
|
||||||
|
matchExpressions:
|
||||||
|
- key: {{ .key }}
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
{{- range .values }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
weight: 1
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a hard nodeAffinity definition
|
||||||
|
{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.affinities.nodes.hard" -}}
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
- matchExpressions:
|
||||||
|
- key: {{ .key }}
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
{{- range .values }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a nodeAffinity definition
|
||||||
|
{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.affinities.nodes" -}}
|
||||||
|
{{- if eq .type "soft" }}
|
||||||
|
{{- include "common.affinities.nodes.soft" . -}}
|
||||||
|
{{- else if eq .type "hard" }}
|
||||||
|
{{- include "common.affinities.nodes.hard" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a topologyKey definition
|
||||||
|
{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.affinities.topologyKey" -}}
|
||||||
|
{{ .topologyKey | default "kubernetes.io/hostname" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a soft podAffinity/podAntiAffinity definition
|
||||||
|
{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.affinities.pods.soft" -}}
|
||||||
|
{{- $component := default "" .component -}}
|
||||||
|
{{- $customLabels := default (dict) .customLabels -}}
|
||||||
|
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||||
|
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
|
||||||
|
{{- $extraNamespaces := default (list) .extraNamespaces -}}
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 10 }}
|
||||||
|
{{- if not (empty $component) }}
|
||||||
|
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $key, $value := $extraMatchLabels }}
|
||||||
|
{{ $key }}: {{ $value | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $extraNamespaces }}
|
||||||
|
namespaces:
|
||||||
|
- {{ .context.Release.Namespace }}
|
||||||
|
{{- with $extraNamespaces }}
|
||||||
|
{{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||||
|
weight: 1
|
||||||
|
{{- range $extraPodAffinityTerms }}
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 10 }}
|
||||||
|
{{- if not (empty $component) }}
|
||||||
|
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $key, $value := .extraMatchLabels }}
|
||||||
|
{{ $key }}: {{ $value | quote }}
|
||||||
|
{{- end }}
|
||||||
|
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||||
|
weight: {{ .weight | default 1 -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a hard podAffinity/podAntiAffinity definition
|
||||||
|
{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.affinities.pods.hard" -}}
|
||||||
|
{{- $component := default "" .component -}}
|
||||||
|
{{- $customLabels := default (dict) .customLabels -}}
|
||||||
|
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||||
|
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
|
||||||
|
{{- $extraNamespaces := default (list) .extraNamespaces -}}
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- labelSelector:
|
||||||
|
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }}
|
||||||
|
{{- if not (empty $component) }}
|
||||||
|
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $key, $value := $extraMatchLabels }}
|
||||||
|
{{ $key }}: {{ $value | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $extraNamespaces }}
|
||||||
|
namespaces:
|
||||||
|
- {{ .context.Release.Namespace }}
|
||||||
|
{{- with $extraNamespaces }}
|
||||||
|
{{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||||
|
{{- range $extraPodAffinityTerms }}
|
||||||
|
- labelSelector:
|
||||||
|
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 8 }}
|
||||||
|
{{- if not (empty $component) }}
|
||||||
|
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $key, $value := .extraMatchLabels }}
|
||||||
|
{{ $key }}: {{ $value | quote }}
|
||||||
|
{{- end }}
|
||||||
|
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a podAffinity/podAntiAffinity definition
|
||||||
|
{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.affinities.pods" -}}
|
||||||
|
{{- if eq .type "soft" }}
|
||||||
|
{{- include "common.affinities.pods.soft" . -}}
|
||||||
|
{{- else if eq .type "hard" }}
|
||||||
|
{{- include "common.affinities.pods.hard" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,239 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the target Kubernetes version
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.kubeVersion" -}}
|
||||||
|
{{- default (default .Capabilities.KubeVersion.Version .Values.kubeVersion) ((.Values.global).kubeVersion) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for poddisruptionbudget.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.policy.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
|
||||||
|
{{- print "policy/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "policy/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for networkpolicy.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.networkPolicy.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.7-0" $kubeVersion) -}}
|
||||||
|
{{- print "extensions/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "networking.k8s.io/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for job.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.job.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
|
||||||
|
{{- print "batch/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "batch/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for cronjob.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.cronjob.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
|
||||||
|
{{- print "batch/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "batch/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for daemonset.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.daemonset.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||||
|
{{- print "extensions/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "apps/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for deployment.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.deployment.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||||
|
{{- print "extensions/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "apps/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for statefulset.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.statefulset.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||||
|
{{- print "apps/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "apps/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for ingress.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.ingress.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if (.Values.ingress).apiVersion -}}
|
||||||
|
{{- .Values.ingress.apiVersion -}}
|
||||||
|
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}}
|
||||||
|
{{- print "extensions/v1beta1" -}}
|
||||||
|
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}}
|
||||||
|
{{- print "networking.k8s.io/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "networking.k8s.io/v1" -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for RBAC resources.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.rbac.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.17-0" $kubeVersion) -}}
|
||||||
|
{{- print "rbac.authorization.k8s.io/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "rbac.authorization.k8s.io/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for CRDs.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.crd.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}}
|
||||||
|
{{- print "apiextensions.k8s.io/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "apiextensions.k8s.io/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for APIService.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.apiService.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.10-0" $kubeVersion) -}}
|
||||||
|
{{- print "apiregistration.k8s.io/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "apiregistration.k8s.io/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for Horizontal Pod Autoscaler.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.hpa.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
|
||||||
|
{{- if .beta2 -}}
|
||||||
|
{{- print "autoscaling/v2beta2" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "autoscaling/v2beta1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "autoscaling/v2" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for Vertical Pod Autoscaler.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.vpa.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.11-0" $kubeVersion) -}}
|
||||||
|
{{- print "autoscaling/v1beta1" -}}
|
||||||
|
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||||
|
{{- print "autoscaling/v1beta2" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "autoscaling/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Returns true if PodSecurityPolicy is supported
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.psp.supported" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if or (empty $kubeVersion) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Returns true if AdmissionConfiguration is supported
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.admissionConfiguration.supported" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if or (empty $kubeVersion) (not (semverCompare "<1.23-0" $kubeVersion)) -}}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for AdmissionConfiguration.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.admissionConfiguration.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
|
||||||
|
{{- print "apiserver.config.k8s.io/v1alpha1" -}}
|
||||||
|
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||||
|
{{- print "apiserver.config.k8s.io/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "apiserver.config.k8s.io/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiVersion for PodSecurityConfiguration.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.podSecurityConfiguration.apiVersion" -}}
|
||||||
|
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
|
||||||
|
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
|
||||||
|
{{- print "pod-security.admission.config.k8s.io/v1alpha1" -}}
|
||||||
|
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
|
||||||
|
{{- print "pod-security.admission.config.k8s.io/v1beta1" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "pod-security.admission.config.k8s.io/v1" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Returns true if the used Helm version is 3.3+.
|
||||||
|
A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure.
|
||||||
|
This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error.
|
||||||
|
**To be removed when the catalog's minimun Helm version is 3.3**
|
||||||
|
*/}}
|
||||||
|
{{- define "common.capabilities.supportsHelmVersion" -}}
|
||||||
|
{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,46 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if the detected platform is Openshift
|
||||||
|
Usage:
|
||||||
|
{{- include "common.compatibility.isOpenshift" . -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.compatibility.isOpenshift" -}}
|
||||||
|
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Render a compatible securityContext depending on the platform. By default it is maintained as it is. In other platforms like Openshift we remove default user/group values that do not work out of the box with the restricted-v1 SCC
|
||||||
|
Usage:
|
||||||
|
{{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.compatibility.renderSecurityContext" -}}
|
||||||
|
{{- $adaptedContext := .secContext -}}
|
||||||
|
|
||||||
|
{{- if (((.context.Values.global).compatibility).openshift) -}}
|
||||||
|
{{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "common.compatibility.isOpenshift" .context)) -}}
|
||||||
|
{{/* Remove incompatible user/group values that do not work in Openshift out of the box */}}
|
||||||
|
{{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}}
|
||||||
|
{{- if not .secContext.seLinuxOptions -}}
|
||||||
|
{{/* If it is an empty object, we remove it from the resulting context because it causes validation issues */}}
|
||||||
|
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{/* Remove empty seLinuxOptions object if global.compatibility.omitEmptySeLinuxOptions is set to true */}}
|
||||||
|
{{- if and (((.context.Values.global).compatibility).omitEmptySeLinuxOptions) (not .secContext.seLinuxOptions) -}}
|
||||||
|
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{/* Remove fields that are disregarded when running the container in privileged mode */}}
|
||||||
|
{{- if $adaptedContext.privileged -}}
|
||||||
|
{{- $adaptedContext = omit $adaptedContext "capabilities" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- omit $adaptedContext "enabled" | toYaml -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,85 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Throw error when upgrading using empty passwords values that must not be empty.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}}
|
||||||
|
{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}}
|
||||||
|
{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }}
|
||||||
|
|
||||||
|
Required password params:
|
||||||
|
- validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error.
|
||||||
|
- context - Context - Required. Parent context.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.errors.upgrade.passwords.empty" -}}
|
||||||
|
{{- $validationErrors := join "" .validationErrors -}}
|
||||||
|
{{- if and $validationErrors .context.Release.IsUpgrade -}}
|
||||||
|
{{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}}
|
||||||
|
{{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}}
|
||||||
|
{{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}}
|
||||||
|
{{- $errorString = print $errorString "\n%s" -}}
|
||||||
|
{{- printf $errorString $validationErrors | fail -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Throw error when original container images are replaced.
|
||||||
|
The error can be bypassed by setting the "global.security.allowInsecureImages" to true. In this case,
|
||||||
|
a warning message will be shown instead.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.errors.insecureImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.errors.insecureImages" -}}
|
||||||
|
{{- $relocatedImages := list -}}
|
||||||
|
{{- $replacedImages := list -}}
|
||||||
|
{{- $retaggedImages := list -}}
|
||||||
|
{{- $globalRegistry := ((.context.Values.global).imageRegistry) -}}
|
||||||
|
{{- $originalImages := .context.Chart.Annotations.images -}}
|
||||||
|
{{- range .images -}}
|
||||||
|
{{- $registryName := default .registry $globalRegistry -}}
|
||||||
|
{{- $fullImageNameNoTag := printf "%s/%s" $registryName .repository -}}
|
||||||
|
{{- $fullImageName := printf "%s:%s" $fullImageNameNoTag .tag -}}
|
||||||
|
{{- if not (contains $fullImageNameNoTag $originalImages) -}}
|
||||||
|
{{- if not (contains $registryName $originalImages) -}}
|
||||||
|
{{- $relocatedImages = append $relocatedImages $fullImageName -}}
|
||||||
|
{{- else if not (contains .repository $originalImages) -}}
|
||||||
|
{{- $replacedImages = append $replacedImages $fullImageName -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if not (contains (printf "%s:%s" .repository .tag) $originalImages) -}}
|
||||||
|
{{- $retaggedImages = append $retaggedImages $fullImageName -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if and (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) (((.context.Values.global).security).allowInsecureImages) -}}
|
||||||
|
{{- print "\n\n⚠ SECURITY WARNING: Verifying original container images was skipped. Please note this Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.\n" -}}
|
||||||
|
{{- else if (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) -}}
|
||||||
|
{{- $errorString := "Original containers have been substituted for unrecognized ones. Deploying this chart with non-standard containers is likely to cause degraded security and performance, broken chart features, and missing environment variables." -}}
|
||||||
|
{{- $errorString = print $errorString "\n\nUnrecognized images:" -}}
|
||||||
|
{{- range (concat $relocatedImages $replacedImages) -}}
|
||||||
|
{{- $errorString = print $errorString "\n - " . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if or (contains "docker.io/bitnami/" $originalImages) (contains "docker.io/bitnamiprem/" $originalImages) -}}
|
||||||
|
{{- $errorString = print "\n\n⚠ ERROR: " $errorString -}}
|
||||||
|
{{- $errorString = print $errorString "\n\nIf you are sure you want to proceed with non-standard containers, you can skip container image verification by setting the global parameter 'global.security.allowInsecureImages' to true." -}}
|
||||||
|
{{- $errorString = print $errorString "\nFurther information can be obtained at https://github.com/bitnami/charts/issues/30850" -}}
|
||||||
|
{{- print $errorString | fail -}}
|
||||||
|
{{- else if gt (len $replacedImages) 0 -}}
|
||||||
|
{{- $errorString = print "\n\n⚠ WARNING: " $errorString -}}
|
||||||
|
{{- print $errorString -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- else if gt (len $retaggedImages) 0 -}}
|
||||||
|
{{- $warnString := "\n\n⚠ WARNING: Original containers have been retagged. Please note this Helm chart was tested, and validated on multiple platforms using a specific set of Tanzu Application Catalog containers. Substituting original image tags could cause unexpected behavior." -}}
|
||||||
|
{{- $warnString = print $warnString "\n\nRetagged images:" -}}
|
||||||
|
{{- range $retaggedImages -}}
|
||||||
|
{{- $warnString = print $warnString "\n - " . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- print $warnString -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
115
freeleaps/helm-pkg/3rd/mongo/charts/common/templates/_images.tpl
Normal file
115
freeleaps/helm-pkg/3rd/mongo/charts/common/templates/_images.tpl
Normal file
@ -0,0 +1,115 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Return the proper image name.
|
||||||
|
If image tag and digest are not defined, termination fallbacks to chart appVersion.
|
||||||
|
{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" .Values.global "chart" .Chart ) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.images.image" -}}
|
||||||
|
{{- $registryName := default .imageRoot.registry ((.global).imageRegistry) -}}
|
||||||
|
{{- $repositoryName := .imageRoot.repository -}}
|
||||||
|
{{- $separator := ":" -}}
|
||||||
|
{{- $termination := .imageRoot.tag | toString -}}
|
||||||
|
|
||||||
|
{{- if not .imageRoot.tag }}
|
||||||
|
{{- if .chart }}
|
||||||
|
{{- $termination = .chart.AppVersion | toString -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if .imageRoot.digest }}
|
||||||
|
{{- $separator = "@" -}}
|
||||||
|
{{- $termination = .imageRoot.digest | toString -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $registryName }}
|
||||||
|
{{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s%s%s" $repositoryName $separator $termination -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
|
||||||
|
{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.images.pullSecrets" -}}
|
||||||
|
{{- $pullSecrets := list }}
|
||||||
|
|
||||||
|
{{- range ((.global).imagePullSecrets) -}}
|
||||||
|
{{- if kindIs "map" . -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets .name -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets . -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- range .images -}}
|
||||||
|
{{- range .pullSecrets -}}
|
||||||
|
{{- if kindIs "map" . -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets .name -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if (not (empty $pullSecrets)) -}}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range $pullSecrets | uniq }}
|
||||||
|
- name: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Docker Image Registry Secret Names evaluating values as templates
|
||||||
|
{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.images.renderPullSecrets" -}}
|
||||||
|
{{- $pullSecrets := list }}
|
||||||
|
{{- $context := .context }}
|
||||||
|
|
||||||
|
{{- range (($context.Values.global).imagePullSecrets) -}}
|
||||||
|
{{- if kindIs "map" . -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- range .images -}}
|
||||||
|
{{- range .pullSecrets -}}
|
||||||
|
{{- if kindIs "map" . -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if (not (empty $pullSecrets)) -}}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range $pullSecrets | uniq }}
|
||||||
|
- name: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper image version (ingores image revision/prerelease info & fallbacks to chart appVersion)
|
||||||
|
{{ include "common.images.version" ( dict "imageRoot" .Values.path.to.the.image "chart" .Chart ) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.images.version" -}}
|
||||||
|
{{- $imageTag := .imageRoot.tag | toString -}}
|
||||||
|
{{/* regexp from https://github.com/Masterminds/semver/blob/23f51de38a0866c5ef0bfc42b3f735c73107b700/version.go#L41-L44 */}}
|
||||||
|
{{- if regexMatch `^([0-9]+)(\.[0-9]+)?(\.[0-9]+)?(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?$` $imageTag -}}
|
||||||
|
{{- $version := semver $imageTag -}}
|
||||||
|
{{- printf "%d.%d.%d" $version.Major $version.Minor $version.Patch -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print .chart.AppVersion -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
@ -0,0 +1,73 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Generate backend entry that is compatible with all Kubernetes API versions.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }}
|
||||||
|
|
||||||
|
Params:
|
||||||
|
- serviceName - String. Name of an existing service backend
|
||||||
|
- servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer.
|
||||||
|
- context - Dict - Required. The context for the template evaluation.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.ingress.backend" -}}
|
||||||
|
{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}}
|
||||||
|
{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}}
|
||||||
|
serviceName: {{ .serviceName }}
|
||||||
|
servicePort: {{ .servicePort }}
|
||||||
|
{{- else -}}
|
||||||
|
service:
|
||||||
|
name: {{ .serviceName }}
|
||||||
|
port:
|
||||||
|
{{- if typeIs "string" .servicePort }}
|
||||||
|
name: {{ .servicePort }}
|
||||||
|
{{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }}
|
||||||
|
number: {{ .servicePort | int }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Print "true" if the API pathType field is supported
|
||||||
|
Usage:
|
||||||
|
{{ include "common.ingress.supportsPathType" . }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.ingress.supportsPathType" -}}
|
||||||
|
{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}}
|
||||||
|
{{- print "false" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "true" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Returns true if the ingressClassname field is supported
|
||||||
|
Usage:
|
||||||
|
{{ include "common.ingress.supportsIngressClassname" . }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.ingress.supportsIngressClassname" -}}
|
||||||
|
{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}}
|
||||||
|
{{- print "false" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "true" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if cert-manager required annotations for TLS signed
|
||||||
|
certificates are set in the Ingress annotations
|
||||||
|
Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
|
||||||
|
Usage:
|
||||||
|
{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.ingress.certManagerRequest" -}}
|
||||||
|
{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,46 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Kubernetes standard labels
|
||||||
|
{{ include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.labels.standard" -}}
|
||||||
|
{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
|
||||||
|
{{- $default := dict "app.kubernetes.io/name" (include "common.names.name" .context) "helm.sh/chart" (include "common.names.chart" .context) "app.kubernetes.io/instance" .context.Release.Name "app.kubernetes.io/managed-by" .context.Release.Service -}}
|
||||||
|
{{- with .context.Chart.AppVersion -}}
|
||||||
|
{{- $_ := set $default "app.kubernetes.io/version" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{ template "common.tplvalues.merge" (dict "values" (list .customLabels $default) "context" .context) }}
|
||||||
|
{{- else -}}
|
||||||
|
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||||
|
helm.sh/chart: {{ include "common.names.chart" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- with .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ . | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Labels used on immutable fields such as deploy.spec.selector.matchLabels or svc.spec.selector
|
||||||
|
{{ include "common.labels.matchLabels" (dict "customLabels" .Values.podLabels "context" $) -}}
|
||||||
|
|
||||||
|
We don't want to loop over custom labels appending them to the selector
|
||||||
|
since it's very likely that it will break deployments, services, etc.
|
||||||
|
However, it's important to overwrite the standard labels if the user
|
||||||
|
overwrote them on metadata.labels fields.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.labels.matchLabels" -}}
|
||||||
|
{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
|
||||||
|
{{ merge (pick (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) "app.kubernetes.io/name" "app.kubernetes.io/instance") (dict "app.kubernetes.io/name" (include "common.names.name" .context) "app.kubernetes.io/instance" .context.Release.Name ) | toYaml }}
|
||||||
|
{{- else -}}
|
||||||
|
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,71 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.names.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.names.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.names.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride -}}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||||
|
{{- if contains $name .Release.Name -}}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified dependency name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
Usage:
|
||||||
|
{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.names.dependency.fullname" -}}
|
||||||
|
{{- if .chartValues.fullnameOverride -}}
|
||||||
|
{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $name := default .chartName .chartValues.nameOverride -}}
|
||||||
|
{{- if contains $name .context.Release.Name -}}
|
||||||
|
{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.names.namespace" -}}
|
||||||
|
{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a fully qualified app name adding the installation's namespace.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.names.fullname.namespace" -}}
|
||||||
|
{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,50 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return a resource request/limit object based on a given preset.
|
||||||
|
These presets are for basic testing and not meant to be used in production
|
||||||
|
{{ include "common.resources.preset" (dict "type" "nano") -}}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.resources.preset" -}}
|
||||||
|
{{/* The limits are the requests increased by 50% (except ephemeral-storage and xlarge/2xlarge sizes)*/}}
|
||||||
|
{{- $presets := dict
|
||||||
|
"nano" (dict
|
||||||
|
"requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
|
||||||
|
"limits" (dict "cpu" "150m" "memory" "192Mi" "ephemeral-storage" "2Gi")
|
||||||
|
)
|
||||||
|
"micro" (dict
|
||||||
|
"requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi")
|
||||||
|
"limits" (dict "cpu" "375m" "memory" "384Mi" "ephemeral-storage" "2Gi")
|
||||||
|
)
|
||||||
|
"small" (dict
|
||||||
|
"requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi")
|
||||||
|
"limits" (dict "cpu" "750m" "memory" "768Mi" "ephemeral-storage" "2Gi")
|
||||||
|
)
|
||||||
|
"medium" (dict
|
||||||
|
"requests" (dict "cpu" "500m" "memory" "1024Mi" "ephemeral-storage" "50Mi")
|
||||||
|
"limits" (dict "cpu" "750m" "memory" "1536Mi" "ephemeral-storage" "2Gi")
|
||||||
|
)
|
||||||
|
"large" (dict
|
||||||
|
"requests" (dict "cpu" "1.0" "memory" "2048Mi" "ephemeral-storage" "50Mi")
|
||||||
|
"limits" (dict "cpu" "1.5" "memory" "3072Mi" "ephemeral-storage" "2Gi")
|
||||||
|
)
|
||||||
|
"xlarge" (dict
|
||||||
|
"requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi")
|
||||||
|
"limits" (dict "cpu" "3.0" "memory" "6144Mi" "ephemeral-storage" "2Gi")
|
||||||
|
)
|
||||||
|
"2xlarge" (dict
|
||||||
|
"requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi")
|
||||||
|
"limits" (dict "cpu" "6.0" "memory" "12288Mi" "ephemeral-storage" "2Gi")
|
||||||
|
)
|
||||||
|
}}
|
||||||
|
{{- if hasKey $presets .type -}}
|
||||||
|
{{- index $presets .type | toYaml -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,192 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Generate secret name.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }}
|
||||||
|
|
||||||
|
Params:
|
||||||
|
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||||
|
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||||
|
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||||
|
- defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment.
|
||||||
|
- context - Dict - Required. The context for the template evaluation.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.secrets.name" -}}
|
||||||
|
{{- $name := (include "common.names.fullname" .context) -}}
|
||||||
|
|
||||||
|
{{- if .defaultNameSuffix -}}
|
||||||
|
{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- with .existingSecret -}}
|
||||||
|
{{- if not (typeIs "string" .) -}}
|
||||||
|
{{- with .name -}}
|
||||||
|
{{- $name = . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $name = . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- printf "%s" $name -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Generate secret key.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }}
|
||||||
|
|
||||||
|
Params:
|
||||||
|
- existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
|
||||||
|
to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
|
||||||
|
+info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
|
||||||
|
- key - String - Required. Name of the key in the secret.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.secrets.key" -}}
|
||||||
|
{{- $key := .key -}}
|
||||||
|
|
||||||
|
{{- if .existingSecret -}}
|
||||||
|
{{- if not (typeIs "string" .existingSecret) -}}
|
||||||
|
{{- if .existingSecret.keyMapping -}}
|
||||||
|
{{- $key = index .existingSecret.keyMapping $.key -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- printf "%s" $key -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Generate secret password or retrieve one if already created.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "honorProvidedValues" false "context" $) }}
|
||||||
|
|
||||||
|
Params:
|
||||||
|
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||||
|
- key - String - Required - Name of the key in the secret.
|
||||||
|
- providedValues - List<String> - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||||
|
- length - int - Optional - Length of the generated random password.
|
||||||
|
- strong - Boolean - Optional - Whether to add symbols to the generated random password.
|
||||||
|
- chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart.
|
||||||
|
- context - Context - Required - Parent context.
|
||||||
|
- failOnNew - Boolean - Optional - Default to true. If set to false, skip errors adding new keys to existing secrets.
|
||||||
|
- skipB64enc - Boolean - Optional - Default to false. If set to true, no the secret will not be base64 encrypted.
|
||||||
|
- skipQuote - Boolean - Optional - Default to false. If set to true, no quotes will be added around the secret.
|
||||||
|
- honorProvidedValues - Boolean - Optional - Default to false. If set to true, the values in providedValues have higher priority than an existing secret
|
||||||
|
The order in which this function returns a secret password:
|
||||||
|
1. Password provided via the values.yaml if honorProvidedValues = true
|
||||||
|
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
|
||||||
|
2. Already existing 'Secret' resource
|
||||||
|
(If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned)
|
||||||
|
3. Password provided via the values.yaml if honorProvidedValues = false
|
||||||
|
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
|
||||||
|
4. Randomly generated secret password
|
||||||
|
(A new random secret password with the length specified in the 'length' parameter will be generated and returned)
|
||||||
|
|
||||||
|
*/}}
|
||||||
|
{{- define "common.secrets.passwords.manage" -}}
|
||||||
|
|
||||||
|
{{- $password := "" }}
|
||||||
|
{{- $subchart := "" }}
|
||||||
|
{{- $chartName := default "" .chartName }}
|
||||||
|
{{- $passwordLength := default 10 .length }}
|
||||||
|
{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }}
|
||||||
|
{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }}
|
||||||
|
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }}
|
||||||
|
{{- if $secretData }}
|
||||||
|
{{- if hasKey $secretData .key }}
|
||||||
|
{{- $password = index $secretData .key | b64dec }}
|
||||||
|
{{- else if not (eq .failOnNew false) }}
|
||||||
|
{{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and $providedPasswordValue .honorProvidedValues }}
|
||||||
|
{{- $password = $providedPasswordValue | toString }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if not $password }}
|
||||||
|
{{- if $providedPasswordValue }}
|
||||||
|
{{- $password = $providedPasswordValue | toString }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if .context.Values.enabled }}
|
||||||
|
{{- $subchart = $chartName }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if not (eq .failOnNew false) }}
|
||||||
|
{{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}}
|
||||||
|
{{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}}
|
||||||
|
{{- $passwordValidationErrors := list $requiredPasswordError -}}
|
||||||
|
{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .strong }}
|
||||||
|
{{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }}
|
||||||
|
{{- $password = randAscii $passwordLength }}
|
||||||
|
{{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }}
|
||||||
|
{{- $password = printf "%s%s" $subStr $password | toString | shuffle }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $password = randAlphaNum $passwordLength }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if not .skipB64enc }}
|
||||||
|
{{- $password = $password | b64enc }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if .skipQuote -}}
|
||||||
|
{{- printf "%s" $password -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s" $password | quote -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Reuses the value from an existing secret, otherwise sets its value to a default value.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }}
|
||||||
|
|
||||||
|
Params:
|
||||||
|
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||||
|
- key - String - Required - Name of the key in the secret.
|
||||||
|
- defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||||
|
- context - Context - Required - Parent context.
|
||||||
|
|
||||||
|
*/}}
|
||||||
|
{{- define "common.secrets.lookup" -}}
|
||||||
|
{{- $value := "" -}}
|
||||||
|
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}}
|
||||||
|
{{- if and $secretData (hasKey $secretData .key) -}}
|
||||||
|
{{- $value = index $secretData .key -}}
|
||||||
|
{{- else if .defaultValue -}}
|
||||||
|
{{- $value = .defaultValue | toString | b64enc -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $value -}}
|
||||||
|
{{- printf "%s" $value -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Returns whether a previous generated secret already exists
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }}
|
||||||
|
|
||||||
|
Params:
|
||||||
|
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||||
|
- context - Context - Required - Parent context.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.secrets.exists" -}}
|
||||||
|
{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }}
|
||||||
|
{{- if $secret }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,21 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Storage Class
|
||||||
|
{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.storage.class" -}}
|
||||||
|
{{- $storageClass := (.global).storageClass | default .persistence.storageClass | default (.global).defaultStorageClass | default "" -}}
|
||||||
|
{{- if $storageClass -}}
|
||||||
|
{{- if (eq "-" $storageClass) -}}
|
||||||
|
{{- printf "storageClassName: \"\"" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "storageClassName: %s" $storageClass -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,52 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Renders a value that contains template perhaps with scope if the scope is present.
|
||||||
|
Usage:
|
||||||
|
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }}
|
||||||
|
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.tplvalues.render" -}}
|
||||||
|
{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }}
|
||||||
|
{{- if contains "{{" (toJson .value) }}
|
||||||
|
{{- if .scope }}
|
||||||
|
{{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }}
|
||||||
|
{{- else }}
|
||||||
|
{{- tpl $value .context }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $value }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Merge a list of values that contains template after rendering them.
|
||||||
|
Merge precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge
|
||||||
|
Usage:
|
||||||
|
{{ include "common.tplvalues.merge" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.tplvalues.merge" -}}
|
||||||
|
{{- $dst := dict -}}
|
||||||
|
{{- range .values -}}
|
||||||
|
{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | merge $dst -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{ $dst | toYaml }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Merge a list of values that contains template after rendering them.
|
||||||
|
Merge precedence is consistent with https://masterminds.github.io/sprig/dicts.html#mergeoverwrite-mustmergeoverwrite
|
||||||
|
Usage:
|
||||||
|
{{ include "common.tplvalues.merge-overwrite" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.tplvalues.merge-overwrite" -}}
|
||||||
|
{{- $dst := dict -}}
|
||||||
|
{{- range .values -}}
|
||||||
|
{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | mergeOverwrite $dst -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{ $dst | toYaml }}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,77 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Print instructions to get a secret value.
|
||||||
|
Usage:
|
||||||
|
{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.utils.secret.getvalue" -}}
|
||||||
|
{{- $varname := include "common.utils.fieldToEnvVar" . -}}
|
||||||
|
export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d)
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Build env var name given a field
|
||||||
|
Usage:
|
||||||
|
{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.utils.fieldToEnvVar" -}}
|
||||||
|
{{- $fieldNameSplit := splitList "-" .field -}}
|
||||||
|
{{- $upperCaseFieldNameSplit := list -}}
|
||||||
|
|
||||||
|
{{- range $fieldNameSplit -}}
|
||||||
|
{{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{ join "_" $upperCaseFieldNameSplit }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Gets a value from .Values given
|
||||||
|
Usage:
|
||||||
|
{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.utils.getValueFromKey" -}}
|
||||||
|
{{- $splitKey := splitList "." .key -}}
|
||||||
|
{{- $value := "" -}}
|
||||||
|
{{- $latestObj := $.context.Values -}}
|
||||||
|
{{- range $splitKey -}}
|
||||||
|
{{- if not $latestObj -}}
|
||||||
|
{{- printf "please review the entire path of '%s' exists in values" $.key | fail -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- $value = ( index $latestObj . ) -}}
|
||||||
|
{{- $latestObj = $value -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- printf "%v" (default "" $value) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Returns first .Values key with a defined value or first of the list if all non-defined
|
||||||
|
Usage:
|
||||||
|
{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.utils.getKeyFromList" -}}
|
||||||
|
{{- $key := first .keys -}}
|
||||||
|
{{- $reverseKeys := reverse .keys }}
|
||||||
|
{{- range $reverseKeys }}
|
||||||
|
{{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }}
|
||||||
|
{{- if $value -}}
|
||||||
|
{{- $key = . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- printf "%s" $key -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Checksum a template at "path" containing a *single* resource (ConfigMap,Secret) for use in pod annotations, excluding the metadata (see #18376).
|
||||||
|
Usage:
|
||||||
|
{{ include "common.utils.checksumTemplate" (dict "path" "/configmap.yaml" "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.utils.checksumTemplate" -}}
|
||||||
|
{{- $obj := include (print .context.Template.BasePath .path) .context | fromYaml -}}
|
||||||
|
{{ omit $obj "apiVersion" "kind" "metadata" | toYaml | sha256sum }}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,109 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Warning about using rolling tag.
|
||||||
|
Usage:
|
||||||
|
{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.warnings.rollingTag" -}}
|
||||||
|
|
||||||
|
{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||||
|
WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||||
|
+info https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Warning about replaced images from the original.
|
||||||
|
Usage:
|
||||||
|
{{ include "common.warnings.modifiedImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.warnings.modifiedImages" -}}
|
||||||
|
{{- $affectedImages := list -}}
|
||||||
|
{{- $printMessage := false -}}
|
||||||
|
{{- $originalImages := .context.Chart.Annotations.images -}}
|
||||||
|
{{- range .images -}}
|
||||||
|
{{- $fullImageName := printf (printf "%s/%s:%s" .registry .repository .tag) -}}
|
||||||
|
{{- if not (contains $fullImageName $originalImages) }}
|
||||||
|
{{- $affectedImages = append $affectedImages (printf "%s/%s:%s" .registry .repository .tag) -}}
|
||||||
|
{{- $printMessage = true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $printMessage }}
|
||||||
|
|
||||||
|
⚠ SECURITY WARNING: Original containers have been substituted. This Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.
|
||||||
|
|
||||||
|
Substituted images detected:
|
||||||
|
{{- range $affectedImages }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Warning about not setting the resource object in all deployments.
|
||||||
|
Usage:
|
||||||
|
{{ include "common.warnings.resources" (dict "sections" (list "path1" "path2") context $) }}
|
||||||
|
Example:
|
||||||
|
{{- include "common.warnings.resources" (dict "sections" (list "csiProvider.provider" "server" "volumePermissions" "") "context" $) }}
|
||||||
|
The list in the example assumes that the following values exist:
|
||||||
|
- csiProvider.provider.resources
|
||||||
|
- server.resources
|
||||||
|
- volumePermissions.resources
|
||||||
|
- resources
|
||||||
|
*/}}
|
||||||
|
{{- define "common.warnings.resources" -}}
|
||||||
|
{{- $values := .context.Values -}}
|
||||||
|
{{- $printMessage := false -}}
|
||||||
|
{{ $affectedSections := list -}}
|
||||||
|
{{- range .sections -}}
|
||||||
|
{{- if eq . "" -}}
|
||||||
|
{{/* Case where the resources section is at the root (one main deployment in the chart) */}}
|
||||||
|
{{- if not (index $values "resources") -}}
|
||||||
|
{{- $affectedSections = append $affectedSections "resources" -}}
|
||||||
|
{{- $printMessage = true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{/* Case where the are multiple resources sections (more than one main deployment in the chart) */}}
|
||||||
|
{{- $keys := split "." . -}}
|
||||||
|
{{/* We iterate through the different levels until arriving to the resource section. Example: a.b.c.resources */}}
|
||||||
|
{{- $section := $values -}}
|
||||||
|
{{- range $keys -}}
|
||||||
|
{{- $section = index $section . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if not (index $section "resources") -}}
|
||||||
|
{{/* If the section has enabled=false or replicaCount=0, do not include it */}}
|
||||||
|
{{- if and (hasKey $section "enabled") -}}
|
||||||
|
{{- if index $section "enabled" -}}
|
||||||
|
{{/* enabled=true */}}
|
||||||
|
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||||
|
{{- $printMessage = true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- else if and (hasKey $section "replicaCount") -}}
|
||||||
|
{{/* We need a casting to int because number 0 is not treated as an int by default */}}
|
||||||
|
{{- if (gt (index $section "replicaCount" | int) 0) -}}
|
||||||
|
{{/* replicaCount > 0 */}}
|
||||||
|
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||||
|
{{- $printMessage = true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{/* Default case, add it to the affected sections */}}
|
||||||
|
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||||
|
{{- $printMessage = true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $printMessage }}
|
||||||
|
|
||||||
|
WARNING: There are "resources" sections in the chart not set. Using "resourcesPreset" is not recommended for production. For production installations, please set the following values according to your workload needs:
|
||||||
|
{{- range $affectedSections }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
+info https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,51 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for existingSecret.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.cassandra.values.existingSecret" (dict "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.cassandra.values.existingSecret" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- .context.Values.cassandra.dbUser.existingSecret | quote -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .context.Values.dbUser.existingSecret | quote -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for enabled cassandra.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.cassandra.values.enabled" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.cassandra.values.enabled" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- printf "%v" .context.Values.cassandra.enabled -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for the key dbUser
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.cassandra.values.key.dbUser" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
cassandra.dbUser
|
||||||
|
{{- else -}}
|
||||||
|
dbUser
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,108 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Validate MariaDB required passwords are not empty.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
|
||||||
|
Params:
|
||||||
|
- secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret"
|
||||||
|
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.validations.values.mariadb.passwords" -}}
|
||||||
|
{{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}}
|
||||||
|
{{- $enabled := include "common.mariadb.values.enabled" . -}}
|
||||||
|
{{- $architecture := include "common.mariadb.values.architecture" . -}}
|
||||||
|
{{- $authPrefix := include "common.mariadb.values.key.auth" . -}}
|
||||||
|
{{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
|
||||||
|
{{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
|
||||||
|
{{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
|
||||||
|
{{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
|
||||||
|
|
||||||
|
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
|
||||||
|
{{- $requiredPasswords := list -}}
|
||||||
|
|
||||||
|
{{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}}
|
||||||
|
{{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
|
||||||
|
|
||||||
|
{{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
|
||||||
|
{{- if not (empty $valueUsername) -}}
|
||||||
|
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}}
|
||||||
|
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if (eq $architecture "replication") -}}
|
||||||
|
{{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}}
|
||||||
|
{{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
|
||||||
|
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for existingSecret.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mariadb.values.auth.existingSecret" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- .context.Values.mariadb.auth.existingSecret | quote -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .context.Values.auth.existingSecret | quote -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for enabled mariadb.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mariadb.values.enabled" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mariadb.values.enabled" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- printf "%v" .context.Values.mariadb.enabled -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for architecture
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mariadb.values.architecture" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- .context.Values.mariadb.architecture -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .context.Values.architecture -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for the key auth
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mariadb.values.key.auth" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
mariadb.auth
|
||||||
|
{{- else -}}
|
||||||
|
auth
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,67 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for existingSecret.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mongodb.values.auth.existingSecret" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- .context.Values.mongodb.auth.existingSecret | quote -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .context.Values.auth.existingSecret | quote -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for enabled mongodb.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mongodb.values.enabled" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mongodb.values.enabled" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- printf "%v" .context.Values.mongodb.enabled -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for the key auth
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mongodb.values.key.auth" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
mongodb.auth
|
||||||
|
{{- else -}}
|
||||||
|
auth
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for architecture
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mongodb.values.architecture" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- .context.Values.mongodb.architecture -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .context.Values.architecture -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,67 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for existingSecret.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mysql.values.auth.existingSecret" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- .context.Values.mysql.auth.existingSecret | quote -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .context.Values.auth.existingSecret | quote -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for enabled mysql.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mysql.values.enabled" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mysql.values.enabled" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- printf "%v" .context.Values.mysql.enabled -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for architecture
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mysql.values.architecture" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- .context.Values.mysql.architecture -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .context.Values.architecture -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for the key auth
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.mysql.values.key.auth" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
mysql.auth
|
||||||
|
{{- else -}}
|
||||||
|
auth
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,105 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to decide whether evaluate global values.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- key - String - Required. Field to be evaluated within global, e.g: "existingSecret"
|
||||||
|
*/}}
|
||||||
|
{{- define "common.postgresql.values.use.global" -}}
|
||||||
|
{{- if .context.Values.global -}}
|
||||||
|
{{- if .context.Values.global.postgresql -}}
|
||||||
|
{{- index .context.Values.global.postgresql .key | quote -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for existingSecret.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.postgresql.values.existingSecret" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.postgresql.values.existingSecret" -}}
|
||||||
|
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}}
|
||||||
|
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- default (.context.Values.existingSecret | quote) $globalValue -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for enabled postgresql.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.postgresql.values.enabled" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.postgresql.values.enabled" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- printf "%v" .context.Values.postgresql.enabled -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for the key postgressPassword.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.postgresql.values.key.postgressPassword" -}}
|
||||||
|
{{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}}
|
||||||
|
|
||||||
|
{{- if not $globalValue -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
postgresql.postgresqlPassword
|
||||||
|
{{- else -}}
|
||||||
|
postgresqlPassword
|
||||||
|
{{- end -}}
|
||||||
|
{{- else -}}
|
||||||
|
global.postgresql.postgresqlPassword
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for enabled.replication.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.postgresql.values.enabled.replication" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- printf "%v" .context.Values.postgresql.replication.enabled -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%v" .context.Values.replication.enabled -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for the key replication.password.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.postgresql.values.key.replicationPassword" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
postgresql.replication.password
|
||||||
|
{{- else -}}
|
||||||
|
replication.password
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,48 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right value for enabled redis.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.redis.values.enabled" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.redis.values.enabled" -}}
|
||||||
|
{{- if .subchart -}}
|
||||||
|
{{- printf "%v" .context.Values.redis.enabled -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%v" (not .context.Values.enabled) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Auxiliary function to get the right prefix path for the values
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }}
|
||||||
|
Params:
|
||||||
|
- subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
|
||||||
|
*/}}
|
||||||
|
{{- define "common.redis.values.keys.prefix" -}}
|
||||||
|
{{- if .subchart -}}redis.{{- else -}}{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Checks whether the redis chart's includes the standarizations (version >= 14)
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.redis.values.standarized.version" (dict "context" $) }}
|
||||||
|
*/}}
|
||||||
|
{{- define "common.redis.values.standarized.version" -}}
|
||||||
|
|
||||||
|
{{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}}
|
||||||
|
{{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }}
|
||||||
|
|
||||||
|
{{- if $standarizedAuthValues -}}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,51 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Validate values must not be empty.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}}
|
||||||
|
{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}}
|
||||||
|
{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
|
||||||
|
|
||||||
|
Validate value params:
|
||||||
|
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||||
|
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||||
|
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||||
|
*/}}
|
||||||
|
{{- define "common.validations.values.multiple.empty" -}}
|
||||||
|
{{- range .required -}}
|
||||||
|
{{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate a value must not be empty.
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }}
|
||||||
|
|
||||||
|
Validate value params:
|
||||||
|
- valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
|
||||||
|
- secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
|
||||||
|
- field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
|
||||||
|
- subchart - String - Optional - Name of the subchart that the validated password is part of.
|
||||||
|
*/}}
|
||||||
|
{{- define "common.validations.values.single.empty" -}}
|
||||||
|
{{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }}
|
||||||
|
{{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }}
|
||||||
|
|
||||||
|
{{- if not $value -}}
|
||||||
|
{{- $varname := "my-value" -}}
|
||||||
|
{{- $getCurrentValue := "" -}}
|
||||||
|
{{- if and .secret .field -}}
|
||||||
|
{{- $varname = include "common.utils.fieldToEnvVar" . -}}
|
||||||
|
{{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
8
freeleaps/helm-pkg/3rd/mongo/charts/common/values.yaml
Normal file
8
freeleaps/helm-pkg/3rd/mongo/charts/common/values.yaml
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
# Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
|
|
||||||
|
## bitnami/common
|
||||||
|
## It is required by CI/CD tools and processes.
|
||||||
|
## @skip exampleValue
|
||||||
|
##
|
||||||
|
exampleValue: common-chart
|
||||||
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:c5509b91449bf47da80d01ea289bb62ad562fb5126fb32f116a3788819fdeef7
|
|
||||||
size 101425
|
|
||||||
174
freeleaps/helm-pkg/3rd/mongo/templates/NOTES.txt
Normal file
174
freeleaps/helm-pkg/3rd/mongo/templates/NOTES.txt
Normal file
@ -0,0 +1,174 @@
|
|||||||
|
CHART NAME: {{ .Chart.Name }}
|
||||||
|
CHART VERSION: {{ .Chart.Version }}
|
||||||
|
APP VERSION: {{ .Chart.AppVersion }}
|
||||||
|
|
||||||
|
Did you know there are enterprise versions of the Bitnami catalog? For enhanced secure software supply chain features, unlimited pulls from Docker, LTS support, or application customization, see Bitnami Premium or Tanzu Application Catalog. See https://www.arrow.com/globalecs/na/vendors/bitnami for more information.
|
||||||
|
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||||
|
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||||
|
|
||||||
|
Get the list of pods by executing:
|
||||||
|
|
||||||
|
kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||||
|
|
||||||
|
Access the pod you want to debug by executing
|
||||||
|
|
||||||
|
kubectl exec --namespace {{ .Release.Namespace }} -ti <NAME OF THE POD> -- bash
|
||||||
|
|
||||||
|
In order to replicate the container startup scripts execute this command:
|
||||||
|
|
||||||
|
/opt/bitnami/scripts/mongodb/entrypoint.sh /opt/bitnami/scripts/mongodb/run.sh
|
||||||
|
|
||||||
|
{{- else }}
|
||||||
|
|
||||||
|
{{- $replicaCount := int .Values.replicaCount }}
|
||||||
|
{{- $portNumber := int .Values.service.ports.mongodb }}
|
||||||
|
{{- $fullname := include "mongodb.fullname" . }}
|
||||||
|
{{- $releaseNamespace := include "mongodb.namespace" . }}
|
||||||
|
{{- $clusterDomain := .Values.clusterDomain }}
|
||||||
|
{{- $loadBalancerIPListLength := len .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
{{- $mongoList := list }}
|
||||||
|
{{- range $e, $i := until $replicaCount }}
|
||||||
|
{{- $mongoList = append $mongoList (printf "%s-%d.%s-headless.%s.svc.%s:%d" $fullname $i $fullname $releaseNamespace $clusterDomain $portNumber) }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and (or (and (eq .Values.architecture "standalone") (or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort"))) (and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled)) (not .Values.auth.enabled) }}
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
WARNING
|
||||||
|
|
||||||
|
By not enabling "mongodb.auth.enabled" you have most likely exposed the
|
||||||
|
MongoDB® service externally without any authentication mechanism.
|
||||||
|
|
||||||
|
For security reasons, we strongly suggest that you enable authentication
|
||||||
|
setting the "mongodb.auth.enabled" parameter to "true".
|
||||||
|
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
** Please be patient while the chart is being deployed **
|
||||||
|
|
||||||
|
MongoDB® can be accessed on the following DNS name(s) and ports from within your cluster:
|
||||||
|
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
{{ join "\n" $mongoList | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
|
||||||
|
{{ $fullname }}.{{ $releaseNamespace }}.svc.{{ .Values.clusterDomain }}
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
|
||||||
|
To get the root password run:
|
||||||
|
|
||||||
|
export MONGODB_ROOT_PASSWORD=$(kubectl get secret --namespace {{ template "mongodb.namespace" . }} {{ template "mongodb.secretName" . }} -o jsonpath="{.data.mongodb-root-password}" | base64 -d)
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . -}}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . -}}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
{{- $customUsersList := splitList "," $customUsers }}
|
||||||
|
{{- range $index, $user := $customUsersList }}
|
||||||
|
|
||||||
|
To get the password for "{{ $user }}" run:
|
||||||
|
|
||||||
|
export MONGODB_PASSWORD=$(kubectl get secret --namespace {{ include "mongodb.namespace" $ }} {{ include "mongodb.secretName" $ }} -o jsonpath="{.data.mongodb-passwords}" | base64 -d | awk -F',' '{print ${{ add 1 $index }}}')
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
To connect to your database, create a MongoDB® client container:
|
||||||
|
|
||||||
|
kubectl run --namespace {{ template "mongodb.namespace" . }} {{ template "mongodb.fullname" . }}-client --rm --tty -i --restart='Never' --env="MONGODB_ROOT_PASSWORD=$MONGODB_ROOT_PASSWORD" --image {{ template "mongodb.image" . }} --command -- bash
|
||||||
|
|
||||||
|
Then, run the following command:
|
||||||
|
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
mongosh admin --host "{{ join "," $mongoList }}" {{- if .Values.auth.enabled }} --authenticationDatabase admin -u $MONGODB_ROOT_USER -p $MONGODB_ROOT_PASSWORD{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
mongosh admin --host "{{ template "mongodb.service.nameOverride" . }}" {{- if .Values.auth.enabled }} --authenticationDatabase admin -u $MONGODB_ROOT_USER -p $MONGODB_ROOT_PASSWORD{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled }}
|
||||||
|
|
||||||
|
To connect to your database nodes from outside, you need to add both primary and secondary nodes hostnames/IPs to your Mongo client. To obtain them, follow the instructions below:
|
||||||
|
|
||||||
|
{{- if eq "NodePort" .Values.externalAccess.service.type }}
|
||||||
|
{{- if .Values.externalAccess.service.domain }}
|
||||||
|
|
||||||
|
MongoDB® nodes domain: Use your provided hostname to reach MongoDB® nodes, {{ .Values.externalAccess.service.domain }}
|
||||||
|
|
||||||
|
{{- else }}
|
||||||
|
|
||||||
|
MongoDB® nodes domain: you can reach MongoDB® nodes on any of the K8s nodes external IPs.
|
||||||
|
|
||||||
|
kubectl get nodes -o wide
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
MongoDB® nodes port: You will have a different node port for each MongoDB® node. You can get the list of configured node ports using the command below:
|
||||||
|
|
||||||
|
echo "$(kubectl get svc --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "mongodb.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=mongodb,pod" -o jsonpath='{.items[*].spec.ports[0].nodePort}' | tr ' ' '\n')"
|
||||||
|
|
||||||
|
{{- else if contains "LoadBalancer" .Values.externalAccess.service.type }}
|
||||||
|
|
||||||
|
NOTE: It may take a few minutes for the LoadBalancer IPs to be available.
|
||||||
|
Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "mongodb.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=mongodb,pod" -w'
|
||||||
|
|
||||||
|
MongoDB® nodes domain: You will have a different external IP for each MongoDB® node. You can get the list of external IPs using the command below:
|
||||||
|
|
||||||
|
echo "$(kubectl get svc --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "mongodb.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=mongodb,pod" -o jsonpath='{.items[*].status.loadBalancer.ingress[0].ip}' | tr ' ' '\n')"
|
||||||
|
|
||||||
|
MongoDB® nodes port: {{ .Values.externalAccess.service.ports.mongodb }}
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- else if eq .Values.architecture "standalone" }}
|
||||||
|
|
||||||
|
To connect to your database from outside the cluster execute the following commands:
|
||||||
|
|
||||||
|
{{- if contains "NodePort" .Values.service.type }}
|
||||||
|
|
||||||
|
export NODE_IP=$(kubectl get nodes --namespace {{ template "mongodb.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||||
|
export NODE_PORT=$(kubectl get --namespace {{ template "mongodb.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "mongodb.service.nameOverride" . }})
|
||||||
|
mongo --host $NODE_IP --port $NODE_PORT {{- if .Values.auth.enabled }} --authenticationDatabase admin -p $MONGODB_ROOT_PASSWORD{{- end }}
|
||||||
|
|
||||||
|
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||||
|
|
||||||
|
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||||
|
Watch the status with: 'kubectl get svc --namespace {{ template "mongodb.namespace" . }} -w {{ template "mongodb.service.nameOverride" . }}'
|
||||||
|
|
||||||
|
export SERVICE_IP=$(kubectl get svc --namespace {{ template "mongodb.namespace" . }} {{ template "mongodb.service.nameOverride" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
|
||||||
|
mongosh --host $SERVICE_IP --port {{ $portNumber }} {{- if .Values.auth.enabled }} --authenticationDatabase admin -p $MONGODB_ROOT_PASSWORD{{- end }}
|
||||||
|
|
||||||
|
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||||
|
|
||||||
|
kubectl port-forward --namespace {{ template "mongodb.namespace" . }} svc/{{ template "mongodb.service.nameOverride" . }} {{ $portNumber }}:{{ $portNumber }} &
|
||||||
|
mongosh --host 127.0.0.1 {{- if .Values.auth.enabled }} --authenticationDatabase admin -p $MONGODB_ROOT_PASSWORD{{- end }}
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.metrics.enabled }}
|
||||||
|
|
||||||
|
To access the MongoDB® Prometheus metrics, get the MongoDB® Prometheus URL by running:
|
||||||
|
|
||||||
|
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ printf "%s-metrics" (include "mongodb.fullname" .) }} {{ .Values.metrics.service.ports.metrics }}:{{ .Values.metrics.service.ports.metrics }} &
|
||||||
|
echo "Prometheus Metrics URL: http://127.0.0.1:{{ .Values.metrics.service.ports.metrics }}/metrics"
|
||||||
|
|
||||||
|
Then, open the obtained URL in a browser.
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||||
|
{{- include "common.warnings.rollingTag" .Values.metrics.image }}
|
||||||
|
{{- include "common.warnings.rollingTag" .Values.externalAccess.autoDiscovery.image }}
|
||||||
|
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
|
||||||
|
{{- include "common.warnings.rollingTag" .Values.tls.image }}
|
||||||
|
{{- include "mongodb.validateValues" . }}
|
||||||
|
{{- include "common.warnings.resources" (dict "sections" (list "arbiter" "externalAccess.autoDiscovery" "hidden" "metrics" "" "tls" "volumePermissions") "context" $) }}
|
||||||
|
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.tls.image .Values.externalAccess.autoDiscovery.image .Values.externalAccess.dnsCheck.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }}
|
||||||
|
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.tls.image .Values.externalAccess.autoDiscovery.image .Values.externalAccess.dnsCheck.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }}
|
||||||
724
freeleaps/helm-pkg/3rd/mongo/templates/_helpers.tpl
Normal file
724
freeleaps/helm-pkg/3rd/mongo/templates/_helpers.tpl
Normal file
@ -0,0 +1,724 @@
|
|||||||
|
{{/*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.name" -}}
|
||||||
|
{{- include "common.names.name" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.fullname" -}}
|
||||||
|
{{- include "common.names.fullname" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default mongo service name which can be overridden.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.service.nameOverride" -}}
|
||||||
|
{{- if and .Values.service .Values.service.nameOverride -}}
|
||||||
|
{{- print .Values.service.nameOverride -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- if eq .Values.architecture "replicaset" -}}
|
||||||
|
{{- printf "%s-headless" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default mongo arbiter service name which can be overridden.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.arbiter.service.nameOverride" -}}
|
||||||
|
{{- if and .Values.arbiter.service .Values.arbiter.service.nameOverride -}}
|
||||||
|
{{- print .Values.arbiter.service.nameOverride -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-arbiter-headless" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default mongo hidden service name which can be overridden.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.hidden.service.nameOverride" -}}
|
||||||
|
{{- if and .Values.hidden.service .Values.hidden.service.nameOverride -}}
|
||||||
|
{{- print .Values.hidden.service.nameOverride -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-hidden-headless" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper MongoDB® image name
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.image" -}}
|
||||||
|
{{- include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper image name (for the metrics image)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.metrics.image" -}}
|
||||||
|
{{- include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper image name (for the init container volume-permissions image)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.volumePermissions.image" -}}
|
||||||
|
{{- include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper image name (for the init container auto-discovery image)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.externalAccess.autoDiscovery.image" -}}
|
||||||
|
{{- include "common.images.image" (dict "imageRoot" .Values.externalAccess.autoDiscovery.image "global" .Values.global) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper image name (for the init container dns-check image)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.externalAccess.dnsCheck.image" -}}
|
||||||
|
{{- include "common.images.image" (dict "imageRoot" .Values.externalAccess.dnsCheck.image "global" .Values.global) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper image name (for the TLS Certs image)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.tls.image" -}}
|
||||||
|
{{- include "common.images.image" (dict "imageRoot" .Values.tls.image "global" .Values.global) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Docker Image Registry Secret Names
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.imagePullSecrets" -}}
|
||||||
|
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image .Values.tls.image .Values.externalAccess.dnsCheck.image .Values.externalAccess.autoDiscovery.image) "context" $) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.namespace" -}}
|
||||||
|
{{- if and .Values.global .Values.global.namespaceOverride -}}
|
||||||
|
{{- print .Values.global.namespaceOverride -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print .Release.Namespace -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- define "mongodb.serviceMonitor.namespace" -}}
|
||||||
|
{{- if .Values.metrics.serviceMonitor.namespace -}}
|
||||||
|
{{- print .Values.metrics.serviceMonitor.namespace -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- include "mongodb.namespace" . -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- define "mongodb.prometheusRule.namespace" -}}
|
||||||
|
{{- if .Values.metrics.prometheusRule.namespace -}}
|
||||||
|
{{- print .Values.metrics.prometheusRule.namespace -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- include "mongodb.namespace" . -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Returns the proper service account name depending if an explicit service account name is set
|
||||||
|
in the values file. If the name is not set it will default to either mongodb.fullname if serviceAccount.create
|
||||||
|
is true or default otherwise.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
{{- default (include "mongodb.fullname" .) (print .Values.serviceAccount.name) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- default "default" (print .Values.serviceAccount.name) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the list of custom users to create during the initialization (string format)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.customUsers" -}}
|
||||||
|
{{- $customUsers := list -}}
|
||||||
|
{{- if .Values.auth.username -}}
|
||||||
|
{{- $customUsers = append $customUsers .Values.auth.username }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range .Values.auth.usernames }}
|
||||||
|
{{- $customUsers = append $customUsers . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- printf "%s" (default "" (join "," $customUsers)) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the list of passwords for the custom users (string format)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.customPasswords" -}}
|
||||||
|
{{- $customPasswords := list -}}
|
||||||
|
{{- if .Values.auth.password -}}
|
||||||
|
{{- $customPasswords = append $customPasswords .Values.auth.password }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range .Values.auth.passwords }}
|
||||||
|
{{- $customPasswords = append $customPasswords . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- printf "%s" (default "" (join "," $customPasswords)) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the list of custom databases to create during the initialization (string format)
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.customDatabases" -}}
|
||||||
|
{{- $customDatabases := list -}}
|
||||||
|
{{- if .Values.auth.database -}}
|
||||||
|
{{- $customDatabases = append $customDatabases .Values.auth.database }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range .Values.auth.databases }}
|
||||||
|
{{- $customDatabases = append $customDatabases . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- printf "%s" (default "" (join "," $customDatabases)) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the configmap with the MongoDB® configuration
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.configmapName" -}}
|
||||||
|
{{- if .Values.existingConfigmap -}}
|
||||||
|
{{- printf "%s" (tpl .Values.existingConfigmap $) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if a configmap object should be created for MongoDB®
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.createConfigmap" -}}
|
||||||
|
{{- if and .Values.configuration (not .Values.existingConfigmap) }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the secret with MongoDB® credentials
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.secretName" -}}
|
||||||
|
{{- if .Values.auth.existingSecret -}}
|
||||||
|
{{- printf "%s" (tpl .Values.auth.existingSecret $) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if a secret object should be created for MongoDB®
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.createSecret" -}}
|
||||||
|
{{- if and .Values.auth.enabled (not .Values.auth.existingSecret) }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if a secret object should be created for MongoDB
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.createPreviousSecret" -}}
|
||||||
|
{{- if and .Values.passwordUpdateJob.previousPasswords.rootPassword (not .Values.passwordUpdateJob.previousPasswords.existingSecret) }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the secret with previous MongoDB credentials
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.update-job.previousSecretName" -}}
|
||||||
|
{{- if .Values.passwordUpdateJob.previousPasswords.existingSecret -}}
|
||||||
|
{{- /* The secret with the new password is managed externally */ -}}
|
||||||
|
{{- tpl .Values.passwordUpdateJob.previousPasswords.existingSecret $ -}}
|
||||||
|
{{- else if .Values.passwordUpdateJob.previousPasswords.rootPassword -}}
|
||||||
|
{{- /* The secret with the new password is managed externally */ -}}
|
||||||
|
{{- printf "%s-previous-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- /* The secret with the new password is managed by the helm chart. We use the current secret name as it has the old password */ -}}
|
||||||
|
{{- include "common.names.fullname" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the secret with new MongoDB credentials
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.update-job.newSecretName" -}}
|
||||||
|
{{- if and (not .Values.passwordUpdateJob.previousPasswords.existingSecret) (not .Values.passwordUpdateJob.previousPasswords.rootPassword) -}}
|
||||||
|
{{- /* The secret with the new password is managed by the helm chart. We create a new secret as the current one has the old password */ -}}
|
||||||
|
{{- printf "%s-new-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- /* The secret with the new password is managed externally */ -}}
|
||||||
|
{{- include "mongodb.secretName" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Get the initialization scripts ConfigMap name.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.initdbScriptsCM" -}}
|
||||||
|
{{- if .Values.initdbScriptsConfigMap -}}
|
||||||
|
{{- printf "%s" (tpl .Values.initdbScriptsConfigMap $) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-init-scripts" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Get initial primary host to configure MongoDB cluster.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.initialPrimaryHost" -}}
|
||||||
|
{{ ternary ( printf "%s-0.%s.$(MY_POD_NAMESPACE).svc.%s" (include "mongodb.fullname" .) (include "mongodb.service.nameOverride" .) .Values.clusterDomain ) ( first .Values.externalAccess.service.publicNames ) ( empty .Values.externalAccess.service.publicNames ) }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Init container definition to change/establish volume permissions.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.initContainer.volumePermissions" }}
|
||||||
|
- name: volume-permissions
|
||||||
|
image: {{ include "mongodb.volumePermissions.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||||
|
command:
|
||||||
|
- /bin/bash
|
||||||
|
args:
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
mkdir -p {{ printf "%s/%s" .Values.persistence.mountPath (default "" .Values.persistence.subPath) }}
|
||||||
|
chown {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ printf "%s/%s" .Values.persistence.mountPath (default "" .Values.persistence.subPath) }}
|
||||||
|
find {{ printf "%s/%s" .Values.persistence.mountPath (default "" .Values.persistence.subPath) }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}
|
||||||
|
{{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
|
||||||
|
securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.volumePermissions.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.volumePermissions.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: {{ .Values.persistence.name | default "datadir" }}
|
||||||
|
mountPath: {{ .Values.persistence.mountPath }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Init container definition to recover log dir.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.initContainer.prepareLogDir" }}
|
||||||
|
- name: log-dir
|
||||||
|
image: {{ include "mongodb.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||||
|
command:
|
||||||
|
- /bin/bash
|
||||||
|
args:
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
ln -sf /dev/stdout "/opt/bitnami/mongodb/logs/mongodb.log"
|
||||||
|
{{- if .Values.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Init container definition to get external IP addresses.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.initContainers.autoDiscovery" -}}
|
||||||
|
- name: auto-discovery
|
||||||
|
image: {{ include "mongodb.externalAccess.autoDiscovery.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.externalAccess.autoDiscovery.image.pullPolicy | quote }}
|
||||||
|
# We need the service account token for contacting the k8s API
|
||||||
|
command:
|
||||||
|
- /scripts/auto-discovery.sh
|
||||||
|
env:
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: SHARED_FILE
|
||||||
|
value: "/shared/info.txt"
|
||||||
|
{{- if .Values.externalAccess.autoDiscovery.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.externalAccess.autoDiscovery.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.externalAccess.autoDiscovery.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.externalAccess.autoDiscovery.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: shared
|
||||||
|
mountPath: /shared
|
||||||
|
- name: scripts
|
||||||
|
mountPath: /scripts/auto-discovery.sh
|
||||||
|
subPath: auto-discovery.sh
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Init container definition to wait external DNS names.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.initContainers.dnsCheck" -}}
|
||||||
|
- name: dns-check
|
||||||
|
image: {{ include "mongodb.externalAccess.dnsCheck.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.externalAccess.dnsCheck.image.pullPolicy | quote }}
|
||||||
|
command:
|
||||||
|
- /bin/bash
|
||||||
|
args:
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
# MONGODB_INITIAL_PRIMARY_HOST should be resolvable
|
||||||
|
while ! (getent ahosts "{{ include "mongodb.initialPrimaryHost" . }}" | grep STREAM); do
|
||||||
|
sleep 10
|
||||||
|
done
|
||||||
|
{{- if .Values.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.externalAccess.dnsCheck.resources }}
|
||||||
|
resources: {{- toYaml .Values.externalAccess.dnsCheck.resources | nindent 12 }}
|
||||||
|
{{- else if ne .Values.externalAccess.dnsCheck.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.externalAccess.dnsCheck.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if the Arbiter should be deployed
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.arbiter.enabled" -}}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.arbiter.enabled }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the configmap with the MongoDB® configuration for the Arbiter
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.arbiter.configmapName" -}}
|
||||||
|
{{- if .Values.arbiter.existingConfigmap -}}
|
||||||
|
{{- printf "%s" (tpl .Values.arbiter.existingConfigmap $) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-arbiter" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if a configmap object should be created for MongoDB® Arbiter
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.arbiter.createConfigmap" -}}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.arbiter.enabled .Values.arbiter.configuration (not .Values.arbiter.existingConfigmap) }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if the Hidden should be deployed
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.hidden.enabled" -}}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.hidden.enabled }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the configmap with the MongoDB® configuration for the Hidden
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.hidden.configmapName" -}}
|
||||||
|
{{- if .Values.hidden.existingConfigmap -}}
|
||||||
|
{{- printf "%s" (tpl .Values.hidden.existingConfigmap $) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-hidden" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if a configmap object should be created for MongoDB® Hidden
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.hidden.createConfigmap" -}}
|
||||||
|
{{- if and (include "mongodb.hidden.enabled" .) .Values.hidden.enabled .Values.hidden.configuration (not .Values.hidden.existingConfigmap) }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Compile all warnings into a single message, and call fail.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues" -}}
|
||||||
|
{{- $messages := list -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.pspAndRBAC" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.architecture" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.customUsersDBs" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.customUsersDBsLength" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.externalAccessServiceType" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.loadBalancerIPsListLength" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.nodePortListLength" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.externalAccessAutoDiscoveryRBAC" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.externalAccessAutoDiscoverySA" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.replicaset.existingSecrets" .) -}}
|
||||||
|
{{- $messages := append $messages (include "mongodb.validateValues.hidden.existingSecrets" .) -}}
|
||||||
|
{{- $messages := without $messages "" -}}
|
||||||
|
{{- $message := join "\n" $messages -}}
|
||||||
|
|
||||||
|
{{- if $message -}}
|
||||||
|
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Validate RBAC is created when using PSP */}}
|
||||||
|
{{- define "mongodb.validateValues.pspAndRBAC" -}}
|
||||||
|
{{- if and (.Values.podSecurityPolicy.create) (not .Values.rbac.create) -}}
|
||||||
|
mongodb: podSecurityPolicy.create, rbac.create
|
||||||
|
Both podSecurityPolicy.create and rbac.create must be true, if you want
|
||||||
|
to create podSecurityPolicy
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Validate values of MongoDB® - must provide a valid architecture */}}
|
||||||
|
{{- define "mongodb.validateValues.architecture" -}}
|
||||||
|
{{- if and (ne .Values.architecture "standalone") (ne .Values.architecture "replicaset") -}}
|
||||||
|
mongodb: architecture
|
||||||
|
Invalid architecture selected. Valid values are "standalone" and
|
||||||
|
"replicaset". Please set a valid architecture (--set mongodb.architecture="xxxx")
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - both auth.usernames and auth.databases are necessary
|
||||||
|
to create a custom user and database during 1st initialization
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.customUsersDBs" -}}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . -}}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . -}}
|
||||||
|
{{- if or (and (empty $customUsers) (not (empty $customDatabases))) (and (not (empty $customUsers)) (empty $customDatabases)) }}
|
||||||
|
mongodb: auth.usernames, auth.databases
|
||||||
|
Both auth.usernames and auth.databases must be provided to create
|
||||||
|
custom users and databases during 1st initialization.
|
||||||
|
Please set both of them (--set auth.usernames[0]="xxxx",auth.databases[0]="yyyy")
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - both auth.usernames and auth.databases arrays should have the same length
|
||||||
|
to create a custom user and database during 1st initialization
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.customUsersDBsLength" -}}
|
||||||
|
{{- if ne (len .Values.auth.usernames) (len .Values.auth.databases) }}
|
||||||
|
mongodb: auth.usernames, auth.databases
|
||||||
|
Both auth.usernames and auth.databases arrays should have the same length
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - service type for external access
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.externalAccessServiceType" -}}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") (not (eq .Values.externalAccess.service.type "NodePort")) (not (eq .Values.externalAccess.service.type "LoadBalancer")) (not (eq .Values.externalAccess.service.type "ClusterIP")) -}}
|
||||||
|
mongodb: externalAccess.service.type
|
||||||
|
Available service type for external access are NodePort, LoadBalancer or ClusterIP.
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - number of replicas must be the same than LoadBalancer IPs list
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.loadBalancerIPsListLength" -}}
|
||||||
|
{{- $replicaCount := int .Values.replicaCount }}
|
||||||
|
{{- $loadBalancerListLength := len .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
{{- $publicNamesListLength := len .Values.externalAccess.service.publicNames }}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled (eq .Values.externalAccess.service.type "LoadBalancer") -}}
|
||||||
|
{{- if and (not .Values.externalAccess.autoDiscovery.enabled) (eq $loadBalancerListLength 0) (eq $publicNamesListLength 0) -}}
|
||||||
|
mongodb: .Values.externalAccess.service.loadBalancerIPs, .Values.externalAccess.service.publicNames
|
||||||
|
externalAccess.service.loadBalancerIPs, externalAccess.service.publicNames or externalAccess.autoDiscovery.enabled are required when externalAccess is enabled.
|
||||||
|
{{- else if and (not .Values.externalAccess.autoDiscovery.enabled) (not (eq $replicaCount $loadBalancerListLength )) (not (eq $loadBalancerListLength 0)) -}}
|
||||||
|
mongodb: .Values.externalAccess.service.loadBalancerIPs
|
||||||
|
Number of replicas ({{ $replicaCount }}) and loadBalancerIPs array length ({{ $loadBalancerListLength }}) must be the same.
|
||||||
|
{{- else if and (not .Values.externalAccess.autoDiscovery.enabled) (not (eq $replicaCount $publicNamesListLength )) (not (eq $publicNamesListLength 0)) -}}
|
||||||
|
mongodb: .Values.externalAccess.service.publicNames
|
||||||
|
Number of replicas ({{ $replicaCount }}) and publicNames array length ({{ $publicNamesListLength }}) must be the same.
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - number of replicas must be the same than NodePort list
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.nodePortListLength" -}}
|
||||||
|
{{- $replicaCount := int .Values.replicaCount }}
|
||||||
|
{{- $nodePortListLength := len .Values.externalAccess.service.nodePorts }}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled (eq .Values.externalAccess.service.type "NodePort") -}}
|
||||||
|
{{- if and (not .Values.externalAccess.autoDiscovery.enabled) (eq $nodePortListLength 0) -}}
|
||||||
|
mongodb: .Values.externalAccess.service.nodePorts
|
||||||
|
externalAccess.service.nodePorts or externalAccess.autoDiscovery.enabled are required when externalAccess is enabled.
|
||||||
|
{{- else if and (not .Values.externalAccess.autoDiscovery.enabled) (not (eq $replicaCount $nodePortListLength )) -}}
|
||||||
|
mongodb: .Values.externalAccess.service.nodePorts
|
||||||
|
Number of replicas ({{ $replicaCount }}) and nodePorts ({{ $nodePortListLength }}) array length must be the same.
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - RBAC should be enabled when autoDiscovery is enabled
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.externalAccessAutoDiscoveryRBAC" -}}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (not .Values.rbac.create ) }}
|
||||||
|
mongodb: rbac.create
|
||||||
|
By specifying "externalAccess.enabled=true" and "externalAccess.autoDiscovery.enabled=true"
|
||||||
|
an initContainer will be used to autodetect the external IPs/ports by querying the
|
||||||
|
K8s API. Please note this initContainer requires specific RBAC resources. You can create them
|
||||||
|
by specifying "--set rbac.create=true".
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - automountServiceAccountToken should be enabled when autoDiscovery is enabled
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.externalAccessAutoDiscoverySA" -}}
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (not .Values.automountServiceAccountToken ) }}
|
||||||
|
mongodb: automountServiceAccountToken
|
||||||
|
By specifying "externalAccess.enabled=true" and "externalAccess.autoDiscovery.enabled=true"
|
||||||
|
an initContainer will be used to autodetect the external IPs/ports by querying the
|
||||||
|
K8s API. Please note this initContainer requires a service account to access K8S API.
|
||||||
|
You can attach it to the pod by specifying "--set automountServiceAccountToken=true".
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - Number of replicaset secrets must be the same than number of replicaset nodes.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.replicaset.existingSecrets" -}}
|
||||||
|
{{- if and .Values.tls.enabled (eq .Values.architecture "replicaset") (not (empty .Values.tls.replicaset.existingSecrets)) }}
|
||||||
|
{{- $nbSecrets := len .Values.tls.replicaset.existingSecrets -}}
|
||||||
|
{{- if not (eq $nbSecrets (int .Values.replicaCount)) }}
|
||||||
|
mongodb: tls.replicaset.existingSecrets
|
||||||
|
tls.replicaset.existingSecrets Number of secrets and number of replicaset nodes must be the same.
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® - Number of hidden secrets must be the same than number of hidden nodes.
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.validateValues.hidden.existingSecrets" -}}
|
||||||
|
{{- if and .Values.tls.enabled (include "mongodb.hidden.enabled" .) (not (empty .Values.tls.hidden.existingSecrets)) }}
|
||||||
|
{{- $nbSecrets := len .Values.tls.hidden.existingSecrets -}}
|
||||||
|
{{- if not (eq $nbSecrets (int .Values.hidden.replicaCount)) }}
|
||||||
|
mongodb: tls.hidden.existingSecrets
|
||||||
|
tls.hidden.existingSecrets Number of secrets and number of hidden nodes must be the same.
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Validate values of MongoDB® exporter URI string - auth.enabled and/or tls.enabled must be enabled or it defaults
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.mongodb_exporter.uri" -}}
|
||||||
|
{{- $tlsEnabled := .Values.tls.enabled -}}
|
||||||
|
{{- $mTlsEnabled := and $tlsEnabled .Values.tls.mTLS.enabled -}}
|
||||||
|
{{- $tlsArgs := "" -}}
|
||||||
|
{{- if $tlsEnabled -}}
|
||||||
|
{{- $tlsCertKeyFile := ternary "&tlsCertificateKeyFile=/certs/mongodb.pem" "" $mTlsEnabled -}}
|
||||||
|
{{- $tlsArgs = printf "tls=true%s&tlsCAFile=/certs/mongodb-ca-cert" $tlsCertKeyFile -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if .Values.metrics.username -}}
|
||||||
|
{{- $uriAuth := ternary "$(echo $MONGODB_METRICS_USERNAME | sed -r \"s/@/%40/g;s/:/%3A/g\"):$(echo $MONGODB_METRICS_PASSWORD | sed -r \"s/@/%40/g;s/:/%3A/g\")@" "" .Values.auth.enabled -}}
|
||||||
|
{{- printf "mongodb://%slocalhost:%d/admin?%s" $uriAuth (int .Values.containerPorts.mongodb) $tlsArgs -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $uriAuth := ternary "$MONGODB_ROOT_USER:$(echo $MONGODB_ROOT_PASSWORD | sed -r \"s/@/%40/g;s/:/%3A/g\")@" "" .Values.auth.enabled -}}
|
||||||
|
{{- printf "mongodb://%slocalhost:%d/admin?%s" $uriAuth (int .Values.containerPorts.mongodb) $tlsArgs -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the appropriate apiGroup for PodSecurityPolicy.
|
||||||
|
*/}}
|
||||||
|
{{- define "podSecurityPolicy.apiGroup" -}}
|
||||||
|
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||||
|
{{- print "policy" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- print "extensions" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if a TLS secret object should be created
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.createTlsSecret" -}}
|
||||||
|
{{- if and .Values.tls.enabled (not .Values.tls.existingSecret) (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the secret containing MongoDB® TLS certificates
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.tlsSecretName" -}}
|
||||||
|
{{- $secretName := .Values.tls.existingSecret -}}
|
||||||
|
{{- if $secretName -}}
|
||||||
|
{{- printf "%s" (tpl $secretName $) -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-ca" (include "mongodb.fullname" .) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return true if certificates must be auto generated
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.autoGenerateCerts" -}}
|
||||||
|
{{- $standalone := (eq .Values.architecture "standalone") | ternary (not .Values.tls.standalone.existingSecret) true -}}
|
||||||
|
{{- $replicaset := (eq .Values.architecture "replicaset") | ternary (empty .Values.tls.replicaset.existingSecrets) true -}}
|
||||||
|
{{- $arbiter := (eq (include "mongodb.arbiter.enabled" .) "true") | ternary (not .Values.tls.arbiter.existingSecret) true -}}
|
||||||
|
{{- $hidden := (eq (include "mongodb.hidden.enabled" .) "true") | ternary (empty .Values.tls.hidden.existingSecrets) true -}}
|
||||||
|
{{- if and $standalone $replicaset $arbiter $hidden -}}
|
||||||
|
{{- true -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Generate argument list for mongodb-exporter
|
||||||
|
reference: https://github.com/percona/mongodb_exporter/blob/main/REFERENCE.md
|
||||||
|
*/}}
|
||||||
|
{{- define "mongodb.exporterArgs" -}}
|
||||||
|
{{- with .Values.metrics.collector -}}
|
||||||
|
{{- ternary " --collect-all" "" .all -}}
|
||||||
|
{{- ternary " --collector.diagnosticdata" "" .diagnosticdata -}}
|
||||||
|
{{- ternary " --collector.replicasetstatus" "" .replicasetstatus -}}
|
||||||
|
{{- ternary " --collector.dbstats" "" .dbstats -}}
|
||||||
|
{{- ternary " --collector.topmetrics" "" .topmetrics -}}
|
||||||
|
{{- ternary " --collector.indexstats" "" .indexstats -}}
|
||||||
|
{{- ternary " --collector.collstats" "" .collstats -}}
|
||||||
|
{{- if .collstatsColls -}}
|
||||||
|
{{- " --mongodb.collstats-colls=" -}}
|
||||||
|
{{- join "," .collstatsColls -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if .indexstatsColls -}}
|
||||||
|
{{- " --mongodb.indexstats-colls=" -}}
|
||||||
|
{{- join "," .indexstatsColls -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- $limitArg := print " --collector.collstats-limit=" .collstatsLimit -}}
|
||||||
|
{{- ne (print .collstatsLimit) "0" | ternary $limitArg "" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- ternary " --compatible-mode" "" .Values.metrics.compatibleMode -}}
|
||||||
|
{{- end -}}
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.arbiter.createConfigmap" .) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-arbiter" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
data:
|
||||||
|
mongodb.conf: |-
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.configuration "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,31 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.arbiter.enabled" .) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.arbiter.service.nameOverride" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
{{- if or .Values.arbiter.service.headless.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.arbiter.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: tcp-mongodb
|
||||||
|
port: {{ .Values.arbiter.service.ports.mongodb }}
|
||||||
|
targetPort: mongodb
|
||||||
|
{{- if .Values.arbiter.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.arbiter.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
{{- end }}
|
||||||
28
freeleaps/helm-pkg/3rd/mongo/templates/arbiter/pdb.yaml
Normal file
28
freeleaps/helm-pkg/3rd/mongo/templates/arbiter/pdb.yaml
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (include "mongodb.arbiter.enabled" .) .Values.arbiter.pdb.create }}
|
||||||
|
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-arbiter" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.arbiter.pdb.minAvailable }}
|
||||||
|
minAvailable: {{ .Values.arbiter.pdb.minAvailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.arbiter.pdb.maxUnavailable (not .Values.arbiter.pdb.minAvailable) }}
|
||||||
|
maxUnavailable: {{ .Values.arbiter.pdb.maxUnavailable | default 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.arbiter.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
{{- end }}
|
||||||
321
freeleaps/helm-pkg/3rd/mongo/templates/arbiter/statefulset.yaml
Normal file
321
freeleaps/helm-pkg/3rd/mongo/templates/arbiter/statefulset.yaml
Normal file
@ -0,0 +1,321 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.arbiter.enabled" .) }}
|
||||||
|
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-arbiter" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.arbiter.labels .Values.commonLabels ) "context" . ) }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
{{- if or .Values.arbiter.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.arbiter.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceName: {{ include "mongodb.arbiter.service.nameOverride" . }}
|
||||||
|
podManagementPolicy: {{ .Values.arbiter.podManagementPolicy }}
|
||||||
|
replicas: 1
|
||||||
|
{{- if .Values.arbiter.updateStrategy }}
|
||||||
|
updateStrategy: {{- toYaml .Values.arbiter.updateStrategy | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.arbiter.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: arbiter
|
||||||
|
{{- if or (include "mongodb.arbiter.createConfigmap" .) .Values.arbiter.podAnnotations .Values.passwordUpdateJob.enabled }}
|
||||||
|
annotations:
|
||||||
|
{{- if (include "mongodb.arbiter.createConfigmap" .) }}
|
||||||
|
checksum/configuration: {{ include (print $.Template.BasePath "/arbiter/configmap.yaml") . | sha256sum }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.enabled }}
|
||||||
|
charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.podAnnotations }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.podAnnotations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- include "mongodb.imagePullSecrets" . | nindent 6 }}
|
||||||
|
{{- if .Values.arbiter.schedulerName }}
|
||||||
|
schedulerName: {{ .Values.arbiter.schedulerName | quote }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ template "mongodb.serviceAccountName" . }}
|
||||||
|
{{- if .Values.arbiter.affinity }}
|
||||||
|
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.affinity "context" $) | nindent 8 }}
|
||||||
|
{{- else }}
|
||||||
|
affinity:
|
||||||
|
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.arbiter.podAffinityPreset "component" "mongodb" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.arbiter.podAntiAffinityPreset "component" "mongodb" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.arbiter.nodeAffinityPreset.type "key" .Values.arbiter.nodeAffinityPreset.key "values" .Values.arbiter.nodeAffinityPreset.values) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.nodeSelector }}
|
||||||
|
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.nodeSelector "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
automountServiceAccountToken: {{ .Values.arbiter.automountServiceAccountToken }}
|
||||||
|
{{- if .Values.arbiter.hostAliases }}
|
||||||
|
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.hostAliases "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.tolerations }}
|
||||||
|
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.tolerations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.topologySpreadConstraints "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.arbiter.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.runtimeClassName }}
|
||||||
|
runtimeClassName: {{ .Values.arbiter.runtimeClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.arbiter.podSecurityContext "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{ if .Values.arbiter.terminationGracePeriodSeconds }}
|
||||||
|
terminationGracePeriodSeconds: {{ .Values.arbiter.terminationGracePeriodSeconds }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||||
|
initContainers:
|
||||||
|
{{- if .Values.arbiter.initContainers }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.initContainers "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.enabled ( or .Values.externalAccess.service.publicNames .Values.externalAccess.service.domain ) }}
|
||||||
|
{{- include "mongodb.initContainers.dnsCheck" . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.tls.enabled .Values.arbiter.enabled }}
|
||||||
|
- name: generate-tls-certs
|
||||||
|
image: {{ include "mongodb.tls.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
|
||||||
|
env:
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MY_POD_HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
mountPath: /certs/CAs
|
||||||
|
{{- else }}
|
||||||
|
- name: mongodb-certs-0
|
||||||
|
mountPath: /certs-0
|
||||||
|
{{- end }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/generate-certs.sh
|
||||||
|
args:
|
||||||
|
- -s {{ include "mongodb.arbiter.service.nameOverride" . }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: mongodb-arbiter
|
||||||
|
image: {{ include "mongodb.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||||
|
{{- if .Values.arbiter.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.arbiter.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.arbiter.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.command "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.arbiter.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.args "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.lifecycleHooks }}
|
||||||
|
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.lifecycleHooks "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MONGODB_REPLICA_SET_MODE
|
||||||
|
value: "arbiter"
|
||||||
|
- name: MONGODB_INITIAL_PRIMARY_HOST
|
||||||
|
value: {{ include "mongodb.initialPrimaryHost" . | quote }}
|
||||||
|
- name: MONGODB_REPLICA_SET_NAME
|
||||||
|
value: {{ .Values.replicaSetName | quote }}
|
||||||
|
- name: MONGODB_ADVERTISED_HOSTNAME
|
||||||
|
value: "$(MY_POD_NAME).{{ include "mongodb.arbiter.service.nameOverride" . }}.$(MY_POD_NAMESPACE).svc.{{ .Values.clusterDomain }}"
|
||||||
|
- name: MONGODB_PORT_NUMBER
|
||||||
|
value: {{ .Values.arbiter.containerPorts.mongodb | quote }}
|
||||||
|
- name: MONGODB_ENABLE_IPV6
|
||||||
|
value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
- name: MONGODB_INITIAL_PRIMARY_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
- name: MONGODB_REPLICA_SET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-replica-set-key
|
||||||
|
{{- end }}
|
||||||
|
- name: ALLOW_EMPTY_PASSWORD
|
||||||
|
value: {{ ternary "no" "yes" .Values.auth.enabled | quote }}
|
||||||
|
{{- $extraFlags := .Values.arbiter.extraFlags | join " " -}}
|
||||||
|
{{- if and .Values.tls.enabled .Values.arbiter.enabled }}
|
||||||
|
{{- if .Values.tls.mTLS.enabled }}
|
||||||
|
{{- $extraFlags = printf "--tlsCAFile=/certs/mongodb-ca-cert %s" $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $extraFlags = printf "--tlsMode=%s --tlsCertificateKeyFile=/certs/mongodb.pem %s" .Values.tls.mode $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne $extraFlags "" }}
|
||||||
|
- name: MONGODB_EXTRA_FLAGS
|
||||||
|
value: {{ $extraFlags | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.tls.enabled .Values.arbiter.enabled }}
|
||||||
|
- name: MONGODB_CLIENT_EXTRA_FLAGS
|
||||||
|
value: --tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.extraEnvVars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.extraEnvVars "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.arbiter.extraEnvVarsCM .Values.arbiter.extraEnvVarsSecret }}
|
||||||
|
envFrom:
|
||||||
|
{{- if .Values.arbiter.extraEnvVarsCM }}
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ tpl .Values.arbiter.extraEnvVarsCM . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.extraEnvVarsSecret }}
|
||||||
|
- secretRef:
|
||||||
|
name: {{ tpl .Values.arbiter.extraEnvVarsSecret . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- containerPort: {{ .Values.arbiter.containerPorts.mongodb }}
|
||||||
|
name: mongodb
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.arbiter.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.arbiter.livenessProbe.enabled }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.arbiter.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- pgrep
|
||||||
|
- mongod
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.arbiter.readinessProbe.enabled }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.arbiter.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
tcpSocket:
|
||||||
|
port: mongodb
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.arbiter.startupProbe.enabled }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.arbiter.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/startup-probe.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.arbiter.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.arbiter.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /bitnami/mongodb
|
||||||
|
subPath: app-volume-dir
|
||||||
|
{{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf/mongodb.conf
|
||||||
|
subPath: mongodb.conf
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.tls.enabled .Values.arbiter.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.sidecars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.sidecars "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
{{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap .Values.arbiter.extraVolumes .Values.tls.enabled }}
|
||||||
|
- name: common-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
defaultMode: 0o555
|
||||||
|
{{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "mongodb.arbiter.configmapName" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.tls.enabled .Values.arbiter.enabled }}
|
||||||
|
- name: certs
|
||||||
|
emptyDir: {}
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
secret:
|
||||||
|
secretName: {{ template "mongodb.tlsSecretName" . }}
|
||||||
|
items:
|
||||||
|
- key: mongodb-ca-cert
|
||||||
|
path: mongodb-ca-cert
|
||||||
|
mode: 0o600
|
||||||
|
- key: mongodb-ca-key
|
||||||
|
path: mongodb-ca-key
|
||||||
|
mode: 0o600
|
||||||
|
{{- else }}
|
||||||
|
- name: mongodb-certs-0
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "common.tplvalues.render" ( dict "value" .Values.tls.arbiter.existingSecret "context" $) }}
|
||||||
|
defaultMode: 256
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.arbiter.extraVolumes }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.arbiter.extraVolumes "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
215
freeleaps/helm-pkg/3rd/mongo/templates/backup/cronjob.yaml
Normal file
215
freeleaps/helm-pkg/3rd/mongo/templates/backup/cronjob.yaml
Normal file
@ -0,0 +1,215 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.backup.enabled }}
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: CronJob
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}-mongodump
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodump
|
||||||
|
{{- if .Values.backup.cronjob.labels }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.labels "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.commonLabels }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- if .Values.backup.cronjob.annotations }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.backup.cronjob.annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
schedule: {{ quote .Values.backup.cronjob.schedule }}
|
||||||
|
{{- if .Values.backup.cronjob.timezone }}
|
||||||
|
timeZone: {{ .Values.backup.cronjob.timezone | quote }}
|
||||||
|
{{- end }}
|
||||||
|
concurrencyPolicy: {{ .Values.backup.cronjob.concurrencyPolicy }}
|
||||||
|
failedJobsHistoryLimit: {{ .Values.backup.cronjob.failedJobsHistoryLimit }}
|
||||||
|
successfulJobsHistoryLimit: {{ .Values.backup.cronjob.successfulJobsHistoryLimit }}
|
||||||
|
{{- if .Values.backup.cronjob.startingDeadlineSeconds }}
|
||||||
|
startingDeadlineSeconds: {{ .Values.backup.cronjob.startingDeadlineSeconds }}
|
||||||
|
{{- end }}
|
||||||
|
jobTemplate:
|
||||||
|
spec:
|
||||||
|
{{- if .Values.backup.cronjob.backoffLimit }}
|
||||||
|
backoffLimit: {{ .Values.backup.cronjob.backoffLimit }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.backup.cronjob.ttlSecondsAfterFinished }}
|
||||||
|
ttlSecondsAfterFinished: {{ .Values.backup.cronjob.ttlSecondsAfterFinished }}
|
||||||
|
{{- end }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {{- include "common.labels.standard" . | nindent 12 }}
|
||||||
|
app.kubernetes.io/component: mongodump
|
||||||
|
{{- if .Values.backup.cronjob.labels }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.labels "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.commonLabels }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- if .Values.backup.cronjob.annotations }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.backup.cronjob.annotations "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- include "mongodb.imagePullSecrets" . | nindent 10 }}
|
||||||
|
{{- if .Values.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
initContainers:
|
||||||
|
- name: generate-tls-certs
|
||||||
|
image: {{ include "mongodb.tls.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
|
||||||
|
env:
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MY_POD_HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
mountPath: /certs/CAs
|
||||||
|
{{- else }}
|
||||||
|
- name: mongodb-certs-0
|
||||||
|
mountPath: /certs-0
|
||||||
|
{{- end }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/generate-certs.sh
|
||||||
|
args:
|
||||||
|
- -s {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
{{- if .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
- -i {{ join "," .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames }}
|
||||||
|
- -n {{ join "," ( concat .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames ) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.tls.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.tls.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.tls.resourcesPreset) | nindent 16 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: {{ include "mongodb.fullname" . }}-mongodump
|
||||||
|
image: {{ include "mongodb.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||||
|
env:
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
- name: MONGODB_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
{{- end }}
|
||||||
|
- name: MONGODB_SERVICE_NAME
|
||||||
|
value: {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
- name: MONGODB_PORT_NUMBER
|
||||||
|
value: {{ .Values.containerPorts.mongodb | quote }}
|
||||||
|
- name: MONGODUMP_DIR
|
||||||
|
value: {{ .Values.backup.cronjob.storage.mountPath }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: MONGODB_CLIENT_EXTRA_FLAGS
|
||||||
|
value: --ssl --sslPEMKeyFile=/certs/mongodb.pem --sslCAFile=/certs/mongodb-ca-cert
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.backup.cronjob.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.command "context" $) | nindent 14 }}
|
||||||
|
{{- else }}
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- "mongodump {{- if .Values.auth.enabled }} --username=${MONGODB_ROOT_USER} --password=${MONGODB_ROOT_PASSWORD} --authenticationDatabase=admin {{- end }} --host=${MONGODB_SERVICE_NAME} --port=${MONGODB_PORT_NUMBER} ${MONGODB_CLIENT_EXTRA_FLAGS} {{- if (eq $.Values.architecture "replicaset") }}--oplog{{- end }} --gzip --archive=${MONGODUMP_DIR}/mongodump-$(date '+%Y-%m-%d-%H-%M').gz"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.backup.cronjob.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.resources "context" $) | nindent 14 }}
|
||||||
|
{{- else if ne .Values.backup.cronjob.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.backup.cronjob.resourcesPreset) | nindent 14 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
mountPath: /certs/CAs
|
||||||
|
{{- else }}
|
||||||
|
- name: mongodb-certs-0
|
||||||
|
mountPath: /certs-0
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
- name: datadir
|
||||||
|
mountPath: {{ .Values.backup.cronjob.storage.mountPath }}
|
||||||
|
subPath: {{ .Values.backup.cronjob.storage.subPath }}
|
||||||
|
{{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
|
||||||
|
securityContext:
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" ( omit .Values.backup.cronjob.containerSecurityContext "enabled" ) "context" $) | nindent 14 }}
|
||||||
|
{{- end }}
|
||||||
|
restartPolicy: {{ .Values.backup.cronjob.restartPolicy }}
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
- name: common-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
defaultMode: 0o550
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
emptyDir: {}
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
secret:
|
||||||
|
secretName: {{ template "mongodb.tlsSecretName" . }}
|
||||||
|
items:
|
||||||
|
- key: mongodb-ca-cert
|
||||||
|
path: mongodb-ca-cert
|
||||||
|
mode: 0o600
|
||||||
|
- key: mongodb-ca-key
|
||||||
|
path: mongodb-ca-key
|
||||||
|
mode: 0o600
|
||||||
|
{{- else }}
|
||||||
|
- name: mongodb-certs-0
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "common.tplvalues.render" ( dict "value" .Values.tls.standalone.existingSecret "context" $) }}
|
||||||
|
defaultMode: 256
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.backup.cronjob.storage.existingClaim }}
|
||||||
|
- name: datadir
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ printf "%s" (tpl .Values.backup.cronjob.storage.existingClaim .) }}
|
||||||
|
{{- else }}
|
||||||
|
- name: datadir
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ include "mongodb.fullname" . }}-mongodump
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
41
freeleaps/helm-pkg/3rd/mongo/templates/backup/pvc.yaml
Normal file
41
freeleaps/helm-pkg/3rd/mongo/templates/backup/pvc.yaml
Normal file
@ -0,0 +1,41 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.backup.enabled (not .Values.backup.cronjob.storage.existingClaim) -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}-mongodump
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodump
|
||||||
|
{{- if .Values.backup.cronjob.labels }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.labels "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.commonLabels }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations .Values.backup.cronjob.storage.resourcePolicy}}
|
||||||
|
annotations:
|
||||||
|
{{- if .Values.backup.cronjob.annotations }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.backup.cronjob.annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.backup.cronjob.storage.resourcePolicy }}
|
||||||
|
helm.sh/resource-policy: {{ .Values.backup.cronjob.storage.resourcePolicy | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
{{- range .Values.backup.cronjob.storage.accessModes }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.backup.cronjob.storage.size | quote }}
|
||||||
|
{{ include "common.storage.class" (dict "persistence" .Values.backup.cronjob.storage "global" .Values.global) | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
143
freeleaps/helm-pkg/3rd/mongo/templates/common-scripts-cm.yaml
Normal file
143
freeleaps/helm-pkg/3rd/mongo/templates/common-scripts-cm.yaml
Normal file
@ -0,0 +1,143 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
data:
|
||||||
|
{{- $fullname := include "mongodb.fullname" . }}
|
||||||
|
startup-probe.sh: |
|
||||||
|
#!/bin/bash
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
# Probes are using localhost/127.0.0.1 to tests if the service is up, ready or healthy. If TLS is enabled, we shouldn't validate the certificate hostname.
|
||||||
|
TLS_OPTIONS='--tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert --tlsAllowInvalidHostnames'
|
||||||
|
{{- end }}
|
||||||
|
exec mongosh $TLS_OPTIONS --port $MONGODB_PORT_NUMBER --eval 'if (!(db.hello().isWritablePrimary || db.hello().secondary)) { throw new Error("Not ready") }'
|
||||||
|
readiness-probe.sh: |
|
||||||
|
#!/bin/bash
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
# Probes are using localhost/127.0.0.1 to tests if the service is up, ready or healthy. If TLS is enabled, we shouldn't validate the certificate hostname.
|
||||||
|
TLS_OPTIONS='--tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert --tlsAllowInvalidHostnames'
|
||||||
|
{{- end }}
|
||||||
|
# Run the proper check depending on the version
|
||||||
|
[[ $(mongod -version | grep "db version") =~ ([0-9]+\.[0-9]+\.[0-9]+) ]] && VERSION=${BASH_REMATCH[1]}
|
||||||
|
. /opt/bitnami/scripts/libversion.sh
|
||||||
|
VERSION_MAJOR="$(get_sematic_version "$VERSION" 1)"
|
||||||
|
VERSION_MINOR="$(get_sematic_version "$VERSION" 2)"
|
||||||
|
VERSION_PATCH="$(get_sematic_version "$VERSION" 3)"
|
||||||
|
readiness_test='db.isMaster().ismaster || db.isMaster().secondary'
|
||||||
|
if [[ ( "$VERSION_MAJOR" -ge 5 ) || ( "$VERSION_MAJOR" -ge 4 && "$VERSION_MINOR" -ge 4 && "$VERSION_PATCH" -ge 2 ) ]]; then
|
||||||
|
readiness_test='db.hello().isWritablePrimary || db.hello().secondary'
|
||||||
|
fi
|
||||||
|
exec mongosh $TLS_OPTIONS --port $MONGODB_PORT_NUMBER --eval "if (!(${readiness_test})) { throw new Error(\"Not ready\") }"
|
||||||
|
ping-mongodb.sh: |
|
||||||
|
#!/bin/bash
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
# Probes are using localhost/127.0.0.1 to tests if the service is up, ready or healthy. If TLS is enabled, we shouldn't validate the certificate hostname.
|
||||||
|
TLS_OPTIONS='--tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert --tlsAllowInvalidHostnames'
|
||||||
|
{{- end }}
|
||||||
|
exec mongosh $TLS_OPTIONS --port $MONGODB_PORT_NUMBER --eval "db.adminCommand('ping')"
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
generate-certs.sh: |
|
||||||
|
#!/bin/bash
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
additional_ips=()
|
||||||
|
additional_names=()
|
||||||
|
while getopts "i:n:s:" flag
|
||||||
|
do
|
||||||
|
case "${flag}" in
|
||||||
|
i) read -a additional_ips <<< ${OPTARG//,/ } ;;
|
||||||
|
n) read -a additional_names <<< ${OPTARG//,/ } ;;
|
||||||
|
s) svc=${OPTARG// /} ;;
|
||||||
|
\?) exit 1 ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
my_hostname=$(hostname)
|
||||||
|
cp /certs/CAs/* /certs/
|
||||||
|
cat >/certs/openssl.cnf <<EOL
|
||||||
|
[req]
|
||||||
|
req_extensions = v3_req
|
||||||
|
distinguished_name = req_distinguished_name
|
||||||
|
[req_distinguished_name]
|
||||||
|
[ v3_req ]
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||||
|
subjectAltName = @alt_names
|
||||||
|
[alt_names]
|
||||||
|
DNS.1 = $svc
|
||||||
|
DNS.2 = $my_hostname
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
DNS.3 = $my_hostname.$svc.$MY_POD_NAMESPACE.svc.{{ .Values.clusterDomain }}
|
||||||
|
{{- else }}
|
||||||
|
DNS.3 = $svc.$MY_POD_NAMESPACE.svc.{{ .Values.clusterDomain }}
|
||||||
|
{{- end }}
|
||||||
|
EOL
|
||||||
|
index=2
|
||||||
|
for ip in "${additional_ips[@]}"; do
|
||||||
|
cat >>/certs/openssl.cnf <<EOL
|
||||||
|
IP.$index = $ip
|
||||||
|
EOL
|
||||||
|
((index++))
|
||||||
|
done;
|
||||||
|
index=5
|
||||||
|
for name in "${additional_names[@]}"; do
|
||||||
|
cat >>/certs/openssl.cnf <<EOL
|
||||||
|
DNS.$index = $(eval echo "${name}")
|
||||||
|
EOL
|
||||||
|
((index++))
|
||||||
|
done;
|
||||||
|
|
||||||
|
export RANDFILE=/certs/.rnd && openssl genrsa -out /certs/mongo.key 2048
|
||||||
|
#Create the client/server cert
|
||||||
|
openssl req -new -key /certs/mongo.key -out /certs/mongo.csr -subj "/C=US/O=My Organisations/OU=IT/CN=$my_hostname" -config /certs/openssl.cnf
|
||||||
|
#Signing the server cert with the CA cert and key
|
||||||
|
openssl x509 -req -in /certs/mongo.csr -CA /certs/mongodb-ca-cert -CAkey /certs/mongodb-ca-key -CAcreateserial -out /certs/mongo.crt -days 3650 -extensions v3_req -extfile /certs/openssl.cnf
|
||||||
|
rm /certs/mongo.csr
|
||||||
|
#Concatenate to a pem file for use as the client PEM file which can be used for both member and client authentication.
|
||||||
|
cat /certs/mongo.crt /certs/mongo.key > /certs/mongodb.pem
|
||||||
|
cd /certs/
|
||||||
|
shopt -s extglob
|
||||||
|
rm -rf !(mongodb-ca-cert|mongodb.pem|CAs|openssl.cnf)
|
||||||
|
chmod 0600 mongodb-ca-cert mongodb.pem
|
||||||
|
{{- else }}
|
||||||
|
{{- if eq .Values.architecture "standalone" }}
|
||||||
|
ID="0"
|
||||||
|
{{- else }}
|
||||||
|
if [[ "$MY_POD_NAME" =~ "arbiter-0"$ ]]; then
|
||||||
|
ID="0"
|
||||||
|
elif [[ "$MY_POD_NAME" =~ "hidden-"[0-9]{1,}$ ]]; then
|
||||||
|
ID="${MY_POD_NAME#"{{ printf "%s-hidden-" $fullname }}"}"
|
||||||
|
else
|
||||||
|
ID="${MY_POD_NAME#"{{ $fullname }}-"}"
|
||||||
|
fi
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.tls.pemChainIncluded }}
|
||||||
|
#Split the pem chain by the END CERTIFICATE string and store in files /certs/xx00, /certs/xx01 etc.
|
||||||
|
cat /certs-${ID}/tls.crt | csplit - -s -z '/\-*END CERTIFICATE\-*/+1' '{*}' -f /certs/xx
|
||||||
|
|
||||||
|
#Use first certificate as leaf node and combine with key to store in pem file
|
||||||
|
cat "/certs/xx00" "/certs-${ID}/tls.key" > "/certs/mongodb.pem"
|
||||||
|
|
||||||
|
#Use remaining intermediate certificates for ca.crt
|
||||||
|
echo $(find /certs/ -not -name 'xx00' -name 'xx*') | sort | xargs cat > "/certs/mongodb-ca-cert"
|
||||||
|
|
||||||
|
rm -rf /certs/xx*
|
||||||
|
{{- else }}
|
||||||
|
cat "/certs-${ID}/tls.crt" "/certs-${ID}/tls.key" > "/certs/mongodb.pem"
|
||||||
|
cp "/certs-${ID}/ca.crt" "/certs/mongodb-ca-cert"
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
chmod 0600 /certs/mongodb-ca-cert /certs/mongodb.pem
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
20
freeleaps/helm-pkg/3rd/mongo/templates/configmap.yaml
Normal file
20
freeleaps/helm-pkg/3rd/mongo/templates/configmap.yaml
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.createConfigmap" .) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
data:
|
||||||
|
mongodb.conf: |-
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
9
freeleaps/helm-pkg/3rd/mongo/templates/extra-list.yaml
Normal file
9
freeleaps/helm-pkg/3rd/mongo/templates/extra-list.yaml
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- range .Values.extraDeploy }}
|
||||||
|
---
|
||||||
|
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||||
|
{{- end }}
|
||||||
20
freeleaps/helm-pkg/3rd/mongo/templates/hidden/configmap.yaml
Normal file
20
freeleaps/helm-pkg/3rd/mongo/templates/hidden/configmap.yaml
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.hidden.createConfigmap" .) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-hidden" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
data:
|
||||||
|
mongodb.conf: |-
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.configuration "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,69 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (include "mongodb.hidden.enabled" .) .Values.externalAccess.hidden.enabled }}
|
||||||
|
{{- $fullName := include "mongodb.fullname" . }}
|
||||||
|
{{- $replicaCount := .Values.hidden.replicaCount | int }}
|
||||||
|
{{- $root := . }}
|
||||||
|
|
||||||
|
{{- range $i, $e := until $replicaCount }}
|
||||||
|
{{- $targetPod := printf "%s-hidden-%d" (printf "%s" $fullName) $i }}
|
||||||
|
{{- $_ := set $ "targetPod" $targetPod }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-hidden-%d-external" $fullName $i }}
|
||||||
|
namespace: {{ include "mongodb.namespace" $ }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $root.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
pod: {{ $targetPod }}
|
||||||
|
{{- if or $root.Values.externalAccess.hidden.service.annotations $root.Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list $root.Values.externalAccess.hidden.service.annotations $root.Values.commonAnnotations ) "context" $ ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ $root.Values.externalAccess.hidden.service.type }}
|
||||||
|
{{- if eq $root.Values.externalAccess.hidden.service.type "LoadBalancer" }}
|
||||||
|
{{- if not (empty $root.Values.externalAccess.hidden.service.loadBalancerIPs) }}
|
||||||
|
loadBalancerIP: {{ index $root.Values.externalAccess.hidden.service.loadBalancerIPs $i }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $root.Values.externalAccess.hidden.service.loadBalancerClass }}
|
||||||
|
loadBalancerClass: {{ $root.Values.externalAccess.hidden.service.loadBalancerClass }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $root.Values.externalAccess.hidden.service.loadBalancerSourceRanges }}
|
||||||
|
loadBalancerSourceRanges: {{- toYaml $root.Values.externalAccess.hidden.service.loadBalancerSourceRanges | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
allocateLoadBalancerNodePorts: {{ $root.Values.externalAccess.hidden.service.allocateLoadBalancerNodePorts }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if (or (eq $root.Values.externalAccess.hidden.service.type "LoadBalancer") (eq $root.Values.externalAccess.hidden.service.type "NodePort")) }}
|
||||||
|
externalTrafficPolicy: {{ $root.Values.externalAccess.hidden.service.externalTrafficPolicy | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $root.Values.externalAccess.hidden.service.sessionAffinity }}
|
||||||
|
sessionAffinity: {{ $root.Values.externalAccess.hidden.service.sessionAffinity }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $root.Values.externalAccess.hidden.service.sessionAffinityConfig }}
|
||||||
|
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" $root.Values.externalAccess.hidden.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: {{ $root.Values.externalAccess.hidden.service.portName | quote }}
|
||||||
|
port: {{ $root.Values.externalAccess.hidden.service.ports.mongodb }}
|
||||||
|
{{- if not (empty $root.Values.externalAccess.hidden.service.nodePorts) }}
|
||||||
|
{{- $nodePort := index $root.Values.externalAccess.hidden.service.nodePorts $i }}
|
||||||
|
nodePort: {{ $nodePort }}
|
||||||
|
{{- else }}
|
||||||
|
nodePort: null
|
||||||
|
{{- end }}
|
||||||
|
targetPort: mongodb
|
||||||
|
{{- if $root.Values.externalAccess.hidden.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" $root.Values.externalAccess.hidden.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list $root.Values.hidden.podLabels $root.Values.commonLabels ) "context" $ ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
statefulset.kubernetes.io/pod-name: {{ $targetPod }}
|
||||||
|
---
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.hidden.enabled" .) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.hidden.service.nameOverride" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
{{- if or .Values.hidden.service.headless.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.hidden.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: {{ .Values.hidden.service.portName | quote }}
|
||||||
|
port: {{ .Values.hidden.service.ports.mongodb }}
|
||||||
|
targetPort: mongodb
|
||||||
|
{{- if .Values.hidden.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.hidden.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
{{- end }}
|
||||||
28
freeleaps/helm-pkg/3rd/mongo/templates/hidden/pdb.yaml
Normal file
28
freeleaps/helm-pkg/3rd/mongo/templates/hidden/pdb.yaml
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (include "mongodb.hidden.enabled" .) .Values.hidden.pdb.create }}
|
||||||
|
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-hidden" (include "mongodb.fullname" . )}}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.hidden.pdb.minAvailable }}
|
||||||
|
minAvailable: {{ .Values.hidden.pdb.minAvailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.hidden.pdb.maxUnavailable (not .Values.hidden.pdb.minAvailable) }}
|
||||||
|
maxUnavailable: {{ .Values.hidden.pdb.maxUnavailable | default 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.hidden.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
{{- end }}
|
||||||
554
freeleaps/helm-pkg/3rd/mongo/templates/hidden/statefulset.yaml
Normal file
554
freeleaps/helm-pkg/3rd/mongo/templates/hidden/statefulset.yaml
Normal file
@ -0,0 +1,554 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.hidden.enabled" .) }}
|
||||||
|
{{- $replicaCount := int .Values.hidden.replicaCount }}
|
||||||
|
{{- $loadBalancerIPListLength := len .Values.externalAccess.hidden.service.loadBalancerIPs }}
|
||||||
|
{{- if not (and .Values.externalAccess.hidden.enabled (not .Values.externalAccess.autoDiscovery.enabled) (not (eq $replicaCount $loadBalancerIPListLength )) (eq .Values.externalAccess.hidden.service.type "LoadBalancer")) }}
|
||||||
|
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-hidden" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.hidden.labels .Values.commonLabels ) "context" . ) }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
{{- if or .Values.hidden.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.hidden.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceName: {{ include "mongodb.hidden.service.nameOverride" . }}
|
||||||
|
podManagementPolicy: {{ .Values.hidden.podManagementPolicy }}
|
||||||
|
replicas: {{ .Values.hidden.replicaCount }}
|
||||||
|
{{- if .Values.hidden.updateStrategy }}
|
||||||
|
updateStrategy: {{- toYaml .Values.hidden.updateStrategy | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.hidden.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: hidden
|
||||||
|
{{- if or (include "mongodb.hidden.createConfigmap" .) .Values.hidden.podAnnotations .Values.passwordUpdateJob.enabled }}
|
||||||
|
annotations:
|
||||||
|
{{- if (include "mongodb.hidden.createConfigmap" .) }}
|
||||||
|
checksum/configuration: {{ include (print $.Template.BasePath "/hidden/configmap.yaml") . | sha256sum }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.enabled }}
|
||||||
|
charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.podAnnotations }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.podAnnotations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- include "mongodb.imagePullSecrets" . | nindent 6 }}
|
||||||
|
{{- if .Values.hidden.schedulerName }}
|
||||||
|
schedulerName: {{ .Values.hidden.schedulerName | quote }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ template "mongodb.serviceAccountName" . }}
|
||||||
|
automountServiceAccountToken: {{ .Values.hidden.automountServiceAccountToken }}
|
||||||
|
{{- if .Values.hidden.hostAliases }}
|
||||||
|
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.hostAliases "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.affinity }}
|
||||||
|
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.affinity "context" $) | nindent 8 }}
|
||||||
|
{{- else }}
|
||||||
|
affinity:
|
||||||
|
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.hidden.podAffinityPreset "component" "hidden" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.hidden.podAntiAffinityPreset "component" "hidden" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.hidden.nodeAffinityPreset.type "key" .Values.hidden.nodeAffinityPreset.key "values" .Values.hidden.nodeAffinityPreset.values) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.nodeSelector }}
|
||||||
|
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.nodeSelector "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.tolerations }}
|
||||||
|
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.tolerations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.topologySpreadConstraints "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.hidden.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.runtimeClassName }}
|
||||||
|
runtimeClassName: {{ .Values.hidden.runtimeClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.hidden.podSecurityContext "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{ if .Values.hidden.terminationGracePeriodSeconds }}
|
||||||
|
terminationGracePeriodSeconds: {{ .Values.hidden.terminationGracePeriodSeconds }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||||
|
initContainers:
|
||||||
|
{{- if .Values.hidden.initContainers }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.initContainers "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.volumePermissions.enabled .Values.hidden.persistence.enabled }}
|
||||||
|
{{- include "mongodb.initContainer.volumePermissions" . | indent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.hidden.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.hidden.service.type "LoadBalancer") }}
|
||||||
|
{{- include "mongodb.initContainers.autoDiscovery" . | indent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.enabled ( or .Values.externalAccess.service.publicNames .Values.externalAccess.service.domain ) }}
|
||||||
|
{{- include "mongodb.initContainers.dnsCheck" . | indent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "mongodb.initContainer.prepareLogDir" . | nindent 8 }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: generate-tls-certs
|
||||||
|
image: {{ include "mongodb.tls.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
|
||||||
|
env:
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MY_POD_HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
volumeMounts:
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
mountPath: /certs/CAs
|
||||||
|
{{- else }}
|
||||||
|
{{- range $index, $_ := .Values.tls.hidden.existingSecrets }}
|
||||||
|
- name: mongodb-certs-{{ $index }}
|
||||||
|
mountPath: /certs-{{ $index }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/generate-certs.sh
|
||||||
|
args:
|
||||||
|
- -s {{ include "mongodb.hidden.service.nameOverride" . }}
|
||||||
|
{{- if .Values.externalAccess.hidden.service.loadBalancerIPs }}
|
||||||
|
- -i {{ join "," .Values.externalAccess.hidden.service.loadBalancerIPs }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames }}
|
||||||
|
- -n {{ join "," ( concat .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames ) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.tls.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.tls.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.tls.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: mongodb
|
||||||
|
image: {{ include "mongodb.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||||
|
{{- if .Values.hidden.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.hidden.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.hidden.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.command "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
command:
|
||||||
|
- /scripts/setup-hidden.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.hidden.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.args "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.lifecycleHooks }}
|
||||||
|
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.lifecycleHooks "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||||
|
{{- if and .Values.externalAccess.hidden.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.hidden.service.type "LoadBalancer") }}
|
||||||
|
- name: SHARED_FILE
|
||||||
|
value: "/shared/info.txt"
|
||||||
|
{{- end }}
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: MY_POD_HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MONGODB_REPLICA_SET_MODE
|
||||||
|
value: "hidden"
|
||||||
|
- name: MONGODB_INITIAL_PRIMARY_HOST
|
||||||
|
value: {{ include "mongodb.initialPrimaryHost" . | quote }}
|
||||||
|
- name: MONGODB_REPLICA_SET_NAME
|
||||||
|
value: {{ .Values.replicaSetName | quote }}
|
||||||
|
{{- if and .Values.replicaSetHostnames (not .Values.externalAccess.hidden.enabled) }}
|
||||||
|
- name: MONGODB_ADVERTISED_HOSTNAME
|
||||||
|
value: "$(MY_POD_NAME).{{ include "mongodb.hidden.service.nameOverride" . }}.$(MY_POD_NAMESPACE).svc.{{ .Values.clusterDomain }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . -}}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . -}}
|
||||||
|
{{- if not (empty $customUsers) }}
|
||||||
|
- name: MONGODB_EXTRA_USERNAMES
|
||||||
|
value: {{ $customUsers | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not (empty $customDatabases) }}
|
||||||
|
- name: MONGODB_EXTRA_DATABASES
|
||||||
|
value: {{ $customDatabases | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
- name: MONGODB_EXTRA_PASSWORDS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-passwords
|
||||||
|
{{- end }}
|
||||||
|
- name: MONGODB_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
- name: MONGODB_REPLICA_SET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-replica-set-key
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.metrics.enabled (not (empty .Values.metrics.username)) }}
|
||||||
|
- name: MONGODB_METRICS_USERNAME
|
||||||
|
value: {{ .Values.metrics.username | quote }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
- name: MONGODB_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
- name: ALLOW_EMPTY_PASSWORD
|
||||||
|
value: {{ ternary "no" "yes" .Values.auth.enabled | quote }}
|
||||||
|
- name: MONGODB_SYSTEM_LOG_VERBOSITY
|
||||||
|
value: {{ .Values.systemLogVerbosity | quote }}
|
||||||
|
- name: MONGODB_DISABLE_SYSTEM_LOG
|
||||||
|
value: {{ ternary "yes" "no" .Values.disableSystemLog | quote }}
|
||||||
|
- name: MONGODB_DISABLE_JAVASCRIPT
|
||||||
|
value: {{ ternary "yes" "no" .Values.disableJavascript | quote }}
|
||||||
|
- name: MONGODB_ENABLE_JOURNAL
|
||||||
|
value: {{ ternary "yes" "no" .Values.enableJournal | quote }}
|
||||||
|
- name: MONGODB_PORT_NUMBER
|
||||||
|
value: {{ .Values.hidden.containerPorts.mongodb | quote }}
|
||||||
|
- name: MONGODB_ENABLE_IPV6
|
||||||
|
value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }}
|
||||||
|
- name: MONGODB_ENABLE_DIRECTORY_PER_DB
|
||||||
|
value: {{ ternary "yes" "no" .Values.directoryPerDB | quote }}
|
||||||
|
{{- $extraFlags := .Values.hidden.extraFlags | join " " -}}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
{{- if .Values.tls.mTLS.enabled }}
|
||||||
|
{{- $extraFlags = printf "--tlsCAFile=/certs/mongodb-ca-cert %s" $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $extraFlags = printf "--tlsMode=%s --tlsCertificateKeyFile=/certs/mongodb.pem %s" .Values.tls.mode $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne $extraFlags "" }}
|
||||||
|
- name: MONGODB_EXTRA_FLAGS
|
||||||
|
value: {{ $extraFlags | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: MONGODB_CLIENT_EXTRA_FLAGS
|
||||||
|
value: --tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.extraEnvVars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.extraEnvVars "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.hidden.extraEnvVarsCM .Values.hidden.extraEnvVarsSecret }}
|
||||||
|
envFrom:
|
||||||
|
{{- if .Values.hidden.extraEnvVarsCM }}
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ tpl .Values.hidden.extraEnvVarsCM . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.extraEnvVarsSecret }}
|
||||||
|
- secretRef:
|
||||||
|
name: {{ tpl .Values.hidden.extraEnvVarsSecret . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- containerPort: {{ .Values.hidden.containerPorts.mongodb }}
|
||||||
|
name: mongodb
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.hidden.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.hidden.livenessProbe.enabled }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.hidden.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/ping-mongodb.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.hidden.readinessProbe.enabled }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.hidden.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/readiness-probe.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.hidden.startupProbe.enabled }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.hidden.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/startup-probe.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.hidden.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.hidden.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: datadir
|
||||||
|
mountPath: {{ .Values.hidden.persistence.mountPath }}
|
||||||
|
subPath: {{ .Values.hidden.persistence.subPath }}
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||||
|
- name: custom-init-scripts
|
||||||
|
mountPath: /docker-entrypoint-initdb.d
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.hidden.configuration .Values.hidden.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf/mongodb.conf
|
||||||
|
subPath: mongodb.conf
|
||||||
|
{{- end }}
|
||||||
|
- name: scripts
|
||||||
|
mountPath: /scripts/setup-hidden.sh
|
||||||
|
subPath: setup-hidden.sh
|
||||||
|
{{- if and .Values.externalAccess.hidden.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.hidden.service.type "LoadBalancer") }}
|
||||||
|
- name: shared
|
||||||
|
mountPath: /shared
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /.mongodb
|
||||||
|
subPath: mongosh-home
|
||||||
|
{{- if .Values.hidden.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.enabled }}
|
||||||
|
- name: metrics
|
||||||
|
image: {{ template "mongodb.metrics.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||||
|
{{- if .Values.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.command "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
command:
|
||||||
|
- /bin/bash
|
||||||
|
- -ec
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.args "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
/bin/mongodb_exporter {{ include "mongodb.exporterArgs" $ }} --mongodb.direct-connect --mongodb.global-conn-pool --mongodb.uri "{{ include "mongodb.mongodb_exporter.uri" . }}" {{ .Values.metrics.extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
{{- if not .Values.metrics.username }}
|
||||||
|
- name: MONGODB_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
{{- else }}
|
||||||
|
- name: MONGODB_METRICS_USERNAME
|
||||||
|
value: {{ .Values.metrics.username | quote }}
|
||||||
|
- name: MONGODB_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis-cluster/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
{{- if .Values.metrics.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: metrics
|
||||||
|
containerPort: 9216
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.metrics.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.livenessProbe.enabled }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
tcpSocket:
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.readinessProbe.enabled }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.startupProbe.enabled }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
tcpSocket:
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.sidecars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.sidecars "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
- name: common-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
defaultMode: 0o555
|
||||||
|
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||||
|
- name: custom-init-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ template "mongodb.initdbScriptsCM" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.hidden.configuration .Values.hidden.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "mongodb.hidden.configmapName" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.hidden.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.hidden.service.type "LoadBalancer") }}
|
||||||
|
- name: shared
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
- name: scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ printf "%s-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
defaultMode: 0o755
|
||||||
|
{{- if .Values.hidden.extraVolumes }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.extraVolumes "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
emptyDir: {}
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
secret:
|
||||||
|
secretName: {{ template "mongodb.tlsSecretName" . }}
|
||||||
|
items:
|
||||||
|
- key: mongodb-ca-cert
|
||||||
|
path: mongodb-ca-cert
|
||||||
|
mode: 0o600
|
||||||
|
- key: mongodb-ca-key
|
||||||
|
path: mongodb-ca-key
|
||||||
|
mode: 0o600
|
||||||
|
{{- else }}
|
||||||
|
{{- range $index, $secret := .Values.tls.hidden.existingSecrets }}
|
||||||
|
- name: mongodb-certs-{{ $index }}
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "common.tplvalues.render" ( dict "value" $secret "context" $) }}
|
||||||
|
defaultMode: 256
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not .Values.hidden.persistence.enabled }}
|
||||||
|
- name: datadir
|
||||||
|
{{- if .Values.hidden.persistence.medium }}
|
||||||
|
emptyDir:
|
||||||
|
medium: {{ .Values.hidden.persistence.medium | quote }}
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
name: datadir
|
||||||
|
{{- if .Values.hidden.persistence.annotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.persistence.annotations "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.labels }}
|
||||||
|
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
{{- range .Values.hidden.persistence.accessModes }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.hidden.persistence.size | quote }}
|
||||||
|
{{- if .Values.hidden.persistence.volumeClaimTemplates.requests }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.hidden.persistence.volumeClaimTemplates.requests "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.persistence.volumeClaimTemplates.dataSource }}
|
||||||
|
dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.persistence.volumeClaimTemplates.dataSource "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hidden.persistence.volumeClaimTemplates.selector }}
|
||||||
|
selector: {{- include "common.tplvalues.render" (dict "value" .Values.hidden.persistence.volumeClaimTemplates.selector "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{ include "common.storage.class" (dict "persistence" .Values.hidden.persistence "global" .Values.global) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,19 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.initdbScripts (not .Values.initdbScriptsConfigMap) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-init-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
data:
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.initdbScripts "context" .) | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
31
freeleaps/helm-pkg/3rd/mongo/templates/metrics-svc.yaml
Normal file
31
freeleaps/helm-pkg/3rd/mongo/templates/metrics-svc.yaml
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.metrics.enabled }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-metrics" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: metrics
|
||||||
|
{{- if or .Values.metrics.service.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.metrics.service.type }}
|
||||||
|
ports:
|
||||||
|
- port: {{ .Values.metrics.service.ports.metrics }}
|
||||||
|
targetPort: metrics
|
||||||
|
protocol: TCP
|
||||||
|
name: http-metrics
|
||||||
|
{{- if .Values.metrics.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- end }}
|
||||||
98
freeleaps/helm-pkg/3rd/mongo/templates/networkpolicy.yaml
Normal file
98
freeleaps/helm-pkg/3rd/mongo/templates/networkpolicy.yaml
Normal file
@ -0,0 +1,98 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.networkPolicy.enabled }}
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "common.names.namespace" . | quote }}
|
||||||
|
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.labels .Values.commonLabels ) "context" . ) }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or .Values.annotations .Values.commonAnnotation }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
podSelector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
{{- if .Values.networkPolicy.allowExternalEgress }}
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
{{- else }}
|
||||||
|
egress:
|
||||||
|
# Allow dns resolution
|
||||||
|
- ports:
|
||||||
|
- port: 53
|
||||||
|
protocol: UDP
|
||||||
|
- port: 53
|
||||||
|
protocol: TCP
|
||||||
|
# Allow connection to other cluster pods
|
||||||
|
- ports:
|
||||||
|
- port: {{ .Values.containerPorts.mongodb }}
|
||||||
|
to:
|
||||||
|
- podSelector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||||
|
{{- if (and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled) }}
|
||||||
|
{{- $kubernetesEndpoints := lookup "v1" "Endpoints" (include "common.names.namespace" .) "kubernetes" }}
|
||||||
|
{{- range $kubernetesEndpoints.subsets }}
|
||||||
|
# Allow connection to API server, required by auto-discovery containers
|
||||||
|
- ports:
|
||||||
|
{{- range .ports }}
|
||||||
|
- port: {{ .port }}
|
||||||
|
{{- end }}
|
||||||
|
to:
|
||||||
|
{{- range .addresses }}
|
||||||
|
- ipBlock:
|
||||||
|
cidr: {{ printf "%s/32" .ip }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.networkPolicy.extraEgress }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
ingress:
|
||||||
|
- ports:
|
||||||
|
- port: {{ .Values.containerPorts.mongodb }}
|
||||||
|
{{- if .Values.metrics.enabled }}
|
||||||
|
- port: {{ .Values.metrics.containerPort }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not .Values.networkPolicy.allowExternal }}
|
||||||
|
from:
|
||||||
|
- podSelector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.networkPolicy.addExternalClientAccess }}
|
||||||
|
- podSelector:
|
||||||
|
matchLabels:
|
||||||
|
{{ template "common.names.fullname" . }}-client: "true"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.networkPolicy.ingressPodMatchLabels }}
|
||||||
|
- podSelector:
|
||||||
|
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $ingressNSMatchLabels := coalesce .Values.networkPolicy.ingressNSMatchLabels .Values.networkPolicy.namespaceSelector }}
|
||||||
|
{{- if $ingressNSMatchLabels }}
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
|
||||||
|
{{- $ingressNSPodMatchLabels := coalesce .Values.networkPolicy.ingressNSPodMatchLabels .Values.networkPolicy.podSelector }}
|
||||||
|
{{- if $ingressNSPodMatchLabels }}
|
||||||
|
podSelector:
|
||||||
|
matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $extraIngress := coalesce .Values.networkPolicy.extraIngress .Values.networkPolicy.customRules }}
|
||||||
|
{{- if $extraIngress }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" $extraIngress "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
23
freeleaps/helm-pkg/3rd/mongo/templates/prometheusrule.yaml
Normal file
23
freeleaps/helm-pkg/3rd/mongo/templates/prometheusrule.yaml
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: PrometheusRule
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.prometheusRule.namespace" . }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
{{- if .Values.metrics.prometheusRule.additionalLabels }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
groups:
|
||||||
|
- name: {{ include "mongodb.fullname" . }}
|
||||||
|
rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
51
freeleaps/helm-pkg/3rd/mongo/templates/psp.yaml
Normal file
51
freeleaps/helm-pkg/3rd/mongo/templates/psp.yaml
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (include "common.capabilities.psp.supported" .) .Values.podSecurityPolicy.create }}
|
||||||
|
apiVersion: policy/v1beta1
|
||||||
|
kind: PodSecurityPolicy
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.podSecurityPolicy.spec }}
|
||||||
|
{{ include "common.tplvalues.render" ( dict "value" .Values.podSecurityPolicy.spec "context" $ ) | nindent 2 }}
|
||||||
|
{{- else }}
|
||||||
|
allowPrivilegeEscalation: {{ .Values.podSecurityPolicy.allowPrivilegeEscalation }}
|
||||||
|
fsGroup:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: {{ .Values.podSecurityContext.fsGroup }}
|
||||||
|
max: {{ .Values.podSecurityContext.fsGroup }}
|
||||||
|
hostIPC: false
|
||||||
|
hostNetwork: false
|
||||||
|
hostPID: false
|
||||||
|
privileged: {{ .Values.podSecurityPolicy.privileged }}
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
requiredDropCapabilities:
|
||||||
|
- ALL
|
||||||
|
runAsUser:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: {{ .Values.containerSecurityContext.runAsUser }}
|
||||||
|
max: {{ .Values.containerSecurityContext.runAsUser }}
|
||||||
|
seLinux:
|
||||||
|
rule: 'RunAsAny'
|
||||||
|
supplementalGroups:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: {{ .Values.containerSecurityContext.runAsUser }}
|
||||||
|
max: {{ .Values.containerSecurityContext.runAsUser }}
|
||||||
|
volumes:
|
||||||
|
- 'configMap'
|
||||||
|
- 'secret'
|
||||||
|
- 'emptyDir'
|
||||||
|
- 'persistentVolumeClaim'
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,73 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled (not (eq .Values.externalAccess.service.type "ClusterIP")) }}
|
||||||
|
{{- $fullName := include "mongodb.fullname" . }}
|
||||||
|
{{- $replicaCount := .Values.replicaCount | int }}
|
||||||
|
{{- $root := . }}
|
||||||
|
|
||||||
|
{{- range $i, $e := until $replicaCount }}
|
||||||
|
{{- $targetPod := printf "%s-%d" (printf "%s" $fullName) $i }}
|
||||||
|
{{- $_ := set $ "targetPod" $targetPod }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-%d-external" $fullName $i }}
|
||||||
|
namespace: {{ include "mongodb.namespace" $ }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $root.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
pod: {{ $targetPod }}
|
||||||
|
{{- if or $root.Values.externalAccess.service.annotations $root.Values.commonAnnotations $root.Values.externalAccess.service.annotationsList }}
|
||||||
|
{{- $exclusiveAnnotations := dict }}
|
||||||
|
{{- if gt (len $root.Values.externalAccess.service.annotationsList) $i }}
|
||||||
|
{{- $exclusiveAnnotations = index $root.Values.externalAccess.service.annotationsList $i }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list $root.Values.externalAccess.service.annotations $root.Values.commonAnnotations $exclusiveAnnotations ) "context" $ ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ $root.Values.externalAccess.service.type }}
|
||||||
|
{{- if eq $root.Values.externalAccess.service.type "LoadBalancer" }}
|
||||||
|
{{- if not (empty $root.Values.externalAccess.service.loadBalancerIPs) }}
|
||||||
|
loadBalancerIP: {{ index $root.Values.externalAccess.service.loadBalancerIPs $i }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (eq $root.Values.externalAccess.service.type "LoadBalancer") $root.Values.externalAccess.service.loadBalancerClass }}
|
||||||
|
loadBalancerClass: {{ $root.Values.externalAccess.service.loadBalancerClass }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $root.Values.externalAccess.service.loadBalancerSourceRanges }}
|
||||||
|
loadBalancerSourceRanges: {{- toYaml $root.Values.externalAccess.service.loadBalancerSourceRanges | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
allocateLoadBalancerNodePorts: {{ $root.Values.externalAccess.service.allocateLoadBalancerNodePorts }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if (or (eq $root.Values.externalAccess.service.type "LoadBalancer") (eq $root.Values.externalAccess.service.type "NodePort")) }}
|
||||||
|
externalTrafficPolicy: {{ $root.Values.externalAccess.service.externalTrafficPolicy | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $root.Values.externalAccess.service.sessionAffinity }}
|
||||||
|
sessionAffinity: {{ $root.Values.externalAccess.service.sessionAffinity }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $root.Values.externalAccess.service.sessionAffinityConfig }}
|
||||||
|
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" $root.Values.externalAccess.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: {{ $root.Values.externalAccess.service.portName | quote }}
|
||||||
|
port: {{ $root.Values.externalAccess.service.ports.mongodb }}
|
||||||
|
{{- if not (empty $root.Values.externalAccess.service.nodePorts) }}
|
||||||
|
{{- $nodePort := index $root.Values.externalAccess.service.nodePorts $i }}
|
||||||
|
nodePort: {{ $nodePort }}
|
||||||
|
{{- else }}
|
||||||
|
nodePort: null
|
||||||
|
{{- end }}
|
||||||
|
targetPort: mongodb
|
||||||
|
{{- if $root.Values.externalAccess.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" $root.Values.externalAccess.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list $root.Values.podLabels $root.Values.commonLabels ) "context" $ ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
statefulset.kubernetes.io/pod-name: {{ $targetPod }}
|
||||||
|
---
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: {{ .Values.service.portName | quote }}
|
||||||
|
port: {{ .Values.service.ports.mongodb }}
|
||||||
|
targetPort: mongodb
|
||||||
|
{{- if .Values.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- end }}
|
||||||
28
freeleaps/helm-pkg/3rd/mongo/templates/replicaset/pdb.yaml
Normal file
28
freeleaps/helm-pkg/3rd/mongo/templates/replicaset/pdb.yaml
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.pdb.create }}
|
||||||
|
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.pdb.minAvailable }}
|
||||||
|
minAvailable: {{ .Values.pdb.minAvailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.pdb.maxUnavailable (not .Values.pdb.minAvailable) }}
|
||||||
|
maxUnavailable: {{ .Values.pdb.maxUnavailable | default 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,316 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
data:
|
||||||
|
{{- $fullname := include "mongodb.fullname" . }}
|
||||||
|
{{- $releaseNamespace := include "mongodb.namespace" . }}
|
||||||
|
{{- if and .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }}
|
||||||
|
auto-discovery.sh: |-
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
SVC_NAME="${MY_POD_NAME}-external"
|
||||||
|
|
||||||
|
# Auxiliary functions
|
||||||
|
retry_while() {
|
||||||
|
local -r cmd="${1:?cmd is missing}"
|
||||||
|
local -r retries="${2:-12}"
|
||||||
|
local -r sleep_time="${3:-5}"
|
||||||
|
local return_value=1
|
||||||
|
|
||||||
|
read -r -a command <<< "$cmd"
|
||||||
|
for ((i = 1 ; i <= retries ; i+=1 )); do
|
||||||
|
"${command[@]}" && return_value=0 && break
|
||||||
|
sleep "$sleep_time"
|
||||||
|
done
|
||||||
|
return $return_value
|
||||||
|
}
|
||||||
|
k8s_svc_lb_ip() {
|
||||||
|
local namespace=${1:?namespace is missing}
|
||||||
|
local service=${2:?service is missing}
|
||||||
|
local service_ip=$(kubectl get svc "$service" -n "$namespace" -o jsonpath="{.status.loadBalancer.ingress[0].ip}")
|
||||||
|
local service_hostname=$(kubectl get svc "$service" -n "$namespace" -o jsonpath="{.status.loadBalancer.ingress[0].hostname}")
|
||||||
|
|
||||||
|
if [[ -n ${service_ip} ]]; then
|
||||||
|
echo "${service_ip}"
|
||||||
|
else
|
||||||
|
echo "${service_hostname}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
k8s_svc_lb_ip_ready() {
|
||||||
|
local namespace=${1:?namespace is missing}
|
||||||
|
local service=${2:?service is missing}
|
||||||
|
[[ -n "$(k8s_svc_lb_ip "$namespace" "$service")" ]]
|
||||||
|
}
|
||||||
|
# Wait until LoadBalancer IP is ready
|
||||||
|
retry_while "k8s_svc_lb_ip_ready {{ $releaseNamespace }} $SVC_NAME" || exit 1
|
||||||
|
# Obtain LoadBalancer external IP
|
||||||
|
k8s_svc_lb_ip "{{ $releaseNamespace }}" "$SVC_NAME" | tee "$SHARED_FILE"
|
||||||
|
{{- end }}
|
||||||
|
setup.sh: |-
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
. /opt/bitnami/scripts/mongodb-env.sh
|
||||||
|
. /opt/bitnami/scripts/libfs.sh
|
||||||
|
. /opt/bitnami/scripts/liblog.sh
|
||||||
|
. /opt/bitnami/scripts/libvalidations.sh
|
||||||
|
|
||||||
|
{{- if .Values.externalAccess.enabled }}
|
||||||
|
{{- if eq .Values.externalAccess.service.type "LoadBalancer" }}
|
||||||
|
{{- if .Values.externalAccess.autoDiscovery.enabled }}
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME="$(<${SHARED_FILE})"
|
||||||
|
{{- else }}
|
||||||
|
ID="${MY_POD_NAME#"{{ $fullname }}-"}"
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME=$(echo '{{ coalesce .Values.externalAccess.service.publicNames .Values.externalAccess.service.loadBalancerIPs }}' | tr -d '[]' | cut -d ' ' -f "$(($ID + 1))")
|
||||||
|
{{- end }}
|
||||||
|
{{- else if eq .Values.externalAccess.service.type "NodePort" }}
|
||||||
|
ID="${MY_POD_NAME#"{{ $fullname }}-"}"
|
||||||
|
if is_empty_value "$MONGODB_ADVERTISED_PORT_NUMBER"; then
|
||||||
|
export MONGODB_ADVERTISED_PORT_NUMBER=$(echo '{{ .Values.externalAccess.service.nodePorts }}' | tr -d '[]' | cut -d ' ' -f "$(($ID + 1))")
|
||||||
|
fi
|
||||||
|
{{- if .Values.externalAccess.service.domain }}
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME={{ .Values.externalAccess.service.domain }}
|
||||||
|
{{- else }}
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME=$MY_POD_HOST_IP
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.replicaSetConfigurationSettings.enabled }}
|
||||||
|
# placed here before root password env is overwritten
|
||||||
|
# makes no assumption about starting state
|
||||||
|
# ensures that any stepDown or non-default starting state is handled
|
||||||
|
/scripts/replicaSetConfigurationSettings.sh &
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
if is_empty_value "$MONGODB_ADVERTISED_PORT_NUMBER"; then
|
||||||
|
export MONGODB_ADVERTISED_PORT_NUMBER="$MONGODB_PORT_NUMBER"
|
||||||
|
fi
|
||||||
|
|
||||||
|
info "Advertised Hostname: $MONGODB_ADVERTISED_HOSTNAME"
|
||||||
|
info "Advertised Port: $MONGODB_ADVERTISED_PORT_NUMBER"
|
||||||
|
|
||||||
|
# Check for existing replica set in case there is no data in the PVC
|
||||||
|
# This is for cases where the PVC is lost or for MongoDB caches without
|
||||||
|
# persistence
|
||||||
|
current_primary=""
|
||||||
|
if is_dir_empty "${MONGODB_DATA_DIR}/db"; then
|
||||||
|
info "Data dir empty, checking if the replica set already exists"
|
||||||
|
{{- $replicaCount := int .Values.replicaCount }}
|
||||||
|
{{- $portNumber := int .Values.service.ports.mongodb }}
|
||||||
|
{{- $fullname := include "mongodb.fullname" . }}
|
||||||
|
{{- $releaseNamespace := include "mongodb.namespace" . }}
|
||||||
|
{{- $clusterDomain := .Values.clusterDomain }}
|
||||||
|
{{- $mongoList := list }}
|
||||||
|
{{- range $e, $i := until $replicaCount }}
|
||||||
|
{{- $mongoList = append $mongoList (printf "%s-%d.%s-headless.%s.svc.%s:%d" $fullname $i $fullname $releaseNamespace $clusterDomain $portNumber) }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.externalAccess.externalMaster.enabled }}
|
||||||
|
current_primary={{ printf "%s:%d" (.Values.externalAccess.externalMaster.host) ( int .Values.externalAccess.externalMaster.port) }}
|
||||||
|
{{- else }}
|
||||||
|
current_primary=$(mongosh admin --host "{{ join "," $mongoList }}" {{- if .Values.auth.enabled }} --authenticationDatabase admin -u $MONGODB_ROOT_USER -p $MONGODB_ROOT_PASSWORD{{- end }}{{- if .Values.tls.enabled}} --tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert{{- end }} --eval 'db.runCommand("ismaster")' | awk -F\' '/primary:/ {print $2}')
|
||||||
|
{{- end }}
|
||||||
|
if ! is_empty_value "$current_primary"; then
|
||||||
|
info "Detected existing primary: ${current_primary}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! is_empty_value "$current_primary" && [[ "$MONGODB_ADVERTISED_HOSTNAME:$MONGODB_ADVERTISED_PORT_NUMBER" == "$current_primary" ]]; then
|
||||||
|
info "Advertised name matches current primary, configuring node as a primary"
|
||||||
|
export MONGODB_REPLICA_SET_MODE="primary"
|
||||||
|
elif ! is_empty_value "$current_primary" && [[ "$MONGODB_ADVERTISED_HOSTNAME:$MONGODB_ADVERTISED_PORT_NUMBER" != "$current_primary" ]]; then
|
||||||
|
info "Current primary is different from this node. Configuring the node as replica of ${current_primary}"
|
||||||
|
export MONGODB_REPLICA_SET_MODE="secondary"
|
||||||
|
export MONGODB_INITIAL_PRIMARY_HOST="${current_primary%:*}"
|
||||||
|
export MONGODB_INITIAL_PRIMARY_PORT_NUMBER="${current_primary#*:}"
|
||||||
|
export MONGODB_SET_SECONDARY_OK="yes"
|
||||||
|
elif [[ "$MY_POD_NAME" = "{{ $fullname }}-0" ]]; then
|
||||||
|
info "Pod name matches initial primary pod name, configuring node as a primary"
|
||||||
|
export MONGODB_REPLICA_SET_MODE="primary"
|
||||||
|
else
|
||||||
|
info "Pod name doesn't match initial primary pod name, configuring node as a secondary"
|
||||||
|
export MONGODB_REPLICA_SET_MODE="secondary"
|
||||||
|
export MONGODB_INITIAL_PRIMARY_PORT_NUMBER="$MONGODB_PORT_NUMBER"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$MONGODB_REPLICA_SET_MODE" == "secondary" ]]; then
|
||||||
|
export MONGODB_INITIAL_PRIMARY_ROOT_USER="$MONGODB_ROOT_USER"
|
||||||
|
export MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD="$MONGODB_ROOT_PASSWORD"
|
||||||
|
export MONGODB_ROOT_PASSWORD=""
|
||||||
|
export MONGODB_EXTRA_USERNAMES=""
|
||||||
|
export MONGODB_EXTRA_DATABASES=""
|
||||||
|
export MONGODB_EXTRA_PASSWORDS=""
|
||||||
|
export MONGODB_ROOT_PASSWORD_FILE=""
|
||||||
|
export MONGODB_EXTRA_USERNAMES_FILE=""
|
||||||
|
export MONGODB_EXTRA_DATABASES_FILE=""
|
||||||
|
export MONGODB_EXTRA_PASSWORDS_FILE=""
|
||||||
|
fi
|
||||||
|
exec /opt/bitnami/scripts/mongodb/entrypoint.sh /opt/bitnami/scripts/mongodb/run.sh
|
||||||
|
setup-hidden.sh: |-
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
. /opt/bitnami/scripts/mongodb-env.sh
|
||||||
|
|
||||||
|
{{- if .Values.externalAccess.hidden.enabled }}
|
||||||
|
{{- if eq .Values.externalAccess.hidden.service.type "LoadBalancer" }}
|
||||||
|
{{- if .Values.externalAccess.autoDiscovery.enabled }}
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME="$(<${SHARED_FILE})"
|
||||||
|
{{- else }}
|
||||||
|
ID="${MY_POD_NAME#"{{ $fullname }}-hidden-"}"
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME=$(echo '{{ .Values.externalAccess.hidden.service.loadBalancerIPs }}' | tr -d '[]' | cut -d ' ' -f "$(($ID + 1))")
|
||||||
|
{{- end }}
|
||||||
|
{{- else if eq .Values.externalAccess.hidden.service.type "NodePort" }}
|
||||||
|
ID="${MY_POD_NAME#"{{ $fullname }}-hidden-"}"
|
||||||
|
if is_empty_value "$MONGODB_ADVERTISED_PORT_NUMBER"; then
|
||||||
|
export MONGODB_ADVERTISED_PORT_NUMBER=$(echo '{{ .Values.externalAccess.service.nodePorts }}' | tr -d '[]' | cut -d ' ' -f "$(($ID + 1))")
|
||||||
|
fi
|
||||||
|
{{- if .Values.externalAccess.hidden.service.domain }}
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME={{ .Values.externalAccess.hidden.service.domain }}
|
||||||
|
{{- else }}
|
||||||
|
export MONGODB_ADVERTISED_HOSTNAME=$MY_POD_HOST_IP
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.replicaSetConfigurationSettings.enabled }}
|
||||||
|
# placed here before root password env is overwritten
|
||||||
|
# makes no assumption about starting state
|
||||||
|
# ensures that any stepDown or non-default starting state is handled
|
||||||
|
/scripts/replicaSetConfigurationSettings.sh &
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
echo "Advertised Hostname: $MONGODB_ADVERTISED_HOSTNAME"
|
||||||
|
echo "Advertised Port: $MONGODB_ADVERTISED_PORT_NUMBER"
|
||||||
|
echo "Configuring node as a hidden node"
|
||||||
|
export MONGODB_REPLICA_SET_MODE="hidden"
|
||||||
|
export MONGODB_INITIAL_PRIMARY_ROOT_USER="$MONGODB_ROOT_USER"
|
||||||
|
export MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD="$MONGODB_ROOT_PASSWORD"
|
||||||
|
export MONGODB_INITIAL_PRIMARY_PORT_NUMBER="$MONGODB_PORT_NUMBER"
|
||||||
|
export MONGODB_ROOT_PASSWORD=""
|
||||||
|
export MONGODB_EXTRA_USERNAMES=""
|
||||||
|
export MONGODB_EXTRA_DATABASES=""
|
||||||
|
export MONGODB_EXTRA_PASSWORDS=""
|
||||||
|
export MONGODB_ROOT_PASSWORD_FILE=""
|
||||||
|
export MONGODB_EXTRA_USERNAMES_FILE=""
|
||||||
|
export MONGODB_EXTRA_DATABASES_FILE=""
|
||||||
|
export MONGODB_EXTRA_PASSWORDS_FILE=""
|
||||||
|
exec /opt/bitnami/scripts/mongodb/entrypoint.sh /opt/bitnami/scripts/mongodb/run.sh
|
||||||
|
{{- if .Values.replicaSetConfigurationSettings.enabled }}
|
||||||
|
replicaSetConfigurationSettings.sh: |-
|
||||||
|
#!/bin/bash
|
||||||
|
# This script to be called when pod starts.
|
||||||
|
# This script sets rs settings which can not be applied via conf file
|
||||||
|
|
||||||
|
function logger ()
|
||||||
|
#$1 is the line to be logged
|
||||||
|
{
|
||||||
|
echo "replicaSetConfigurationSettings.sh -- ${1}" >&1
|
||||||
|
}
|
||||||
|
|
||||||
|
SLEEP_PERIOD=10
|
||||||
|
|
||||||
|
{{- if and .Values.auth.enabled (or .Values.auth.rootPassword .Values.auth.existingSecret)}}
|
||||||
|
usernameAndPassword="{{- if .Values.tls.enabled}} --tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert{{- end }} -u ${MONGODB_ROOT_USER} -p ${MONGODB_ROOT_PASSWORD}"
|
||||||
|
{{- else }}
|
||||||
|
usernameAndPassword=""
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
# load Values.replicaSetConfigurationSettings.configuration into associtive array which makes iterating and string manipulation easy
|
||||||
|
declare -A desiredRsConf
|
||||||
|
{{ range $setting, $value := .Values.replicaSetConfigurationSettings.configuration -}}
|
||||||
|
{{ printf "desiredRsConf[%s]='%v'" $setting $value }}
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
|
rsConfWriteAttempts=0
|
||||||
|
rs_conf_configured_ok=unknown
|
||||||
|
|
||||||
|
while [[ "${rs_conf_configured_ok}" != "true" ]]; do
|
||||||
|
|
||||||
|
# give the rs setup a chance to succeed before attempting to read or configure
|
||||||
|
sleep ${SLEEP_PERIOD}
|
||||||
|
|
||||||
|
counter=0
|
||||||
|
while ! mongosh ${usernameAndPassword} --eval 'rs.conf()'; do
|
||||||
|
counter=$((${counter} +1))
|
||||||
|
logger "not yet able to read rs.conf settings from the currently running rs (after ${counter} attempts)"
|
||||||
|
sleep ${SLEEP_PERIOD}
|
||||||
|
done
|
||||||
|
counter=$((${counter} +1))
|
||||||
|
logger "rs.conf settings have been read from the currently running rs (after ${counter} attempts)"
|
||||||
|
|
||||||
|
# read rs.conf again and store it. settings format is '"<key>" : <value>,'
|
||||||
|
currentRsConf=$(mongosh ${usernameAndPassword} --eval 'rs.conf()')
|
||||||
|
|
||||||
|
desiredEqualsactual=unknown
|
||||||
|
settingsToConfigure=""
|
||||||
|
for key in ${!desiredRsConf[@]}; do
|
||||||
|
value=${desiredRsConf[$key]}
|
||||||
|
if ! $(echo "\"${currentRsConf}"\" | grep -q -e "${key}: ${value},"); then
|
||||||
|
if [[ $key =~ ^members\[[0-9]+\]\..+ ]]; then
|
||||||
|
memberIndex=$(echo $key | grep -o -E '[0-9]+')
|
||||||
|
nodeConfigKey=${key#*.}
|
||||||
|
settingsToConfigure="${settingsToConfigure}cfg.members[${memberIndex}].${nodeConfigKey} = ${value}; "
|
||||||
|
else
|
||||||
|
# General rs settings
|
||||||
|
settingsToConfigure="${settingsToConfigure}cfg.settings.${key} = ${value}; "
|
||||||
|
fi
|
||||||
|
desiredEqualsactual=false
|
||||||
|
else
|
||||||
|
logger "rs conf: ${key} is already at desired value: ${value}"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ "${desiredEqualsactual}" != "false" ]]; then
|
||||||
|
logger "replicaSetConfigurationSettings match the settings of the currently running rs"
|
||||||
|
desiredEqualsactual=true
|
||||||
|
rs_conf_configured_ok=true
|
||||||
|
logger "Current settings match desired settings (There have been ${rsConfWriteAttempts} attempts to write to mongoDB rs configuration)"
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
# apply the settings only if this member is currently the mongo replicaset PRIMARY
|
||||||
|
# it might take a little time before any pod is PRIMARY
|
||||||
|
isMaster=unknown
|
||||||
|
if ! mongosh ${usernameAndPassword} --eval 'rs.isMaster()' | grep -q "ismaster: true"; then
|
||||||
|
isMaster=false
|
||||||
|
logger "This node is not yet PRIMARY - replicaSetConfigurationSettings will only be set on the member that is currently PRIMARY"
|
||||||
|
else
|
||||||
|
isMaster=true
|
||||||
|
logger "This node is PRIMARY"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "${isMaster}" == "true" ]]; then
|
||||||
|
logger "This node is currently PRIMARY - will apply rs.conf settings"
|
||||||
|
|
||||||
|
# avoiding tricky string substitution with single quotes by making the eval string a set of vars
|
||||||
|
rsconf="cfg = rs.conf();"
|
||||||
|
rsreconf="rs.reconfig(cfg);"
|
||||||
|
rsCommand="${rsconf} ${settingsToConfigure} ${rsreconf}"
|
||||||
|
|
||||||
|
mongosh ${usernameAndPassword} --eval "${rsCommand}"
|
||||||
|
if [ $? -ne 0 ]; then
|
||||||
|
logger "Failed to apply mongodb cfg.settings configuration"
|
||||||
|
else
|
||||||
|
logger "mongodb replicaset cfg.settings configuration applied"
|
||||||
|
logger "Will check rs conf"
|
||||||
|
# don't exit just yet - the settings will be checked in the next loop
|
||||||
|
fi
|
||||||
|
rsConfWriteAttempts=$((${rsConfWriteAttempts} + 1 ))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
@ -0,0 +1,565 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
{{- $replicaCount := int .Values.replicaCount }}
|
||||||
|
{{- $loadBalancerIPListLength := len .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
{{- $publicNamesLength := len .Values.externalAccess.service.publicNames }}
|
||||||
|
{{- if not (and .Values.externalAccess.enabled (not .Values.externalAccess.autoDiscovery.enabled) (eq .Values.externalAccess.service.type "LoadBalancer") (not (eq $replicaCount $loadBalancerIPListLength)) (not (eq $replicaCount $publicNamesLength))) }}
|
||||||
|
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.labels .Values.commonLabels ) "context" . ) }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or .Values.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceName: {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
||||||
|
replicas: {{ .Values.replicaCount }}
|
||||||
|
{{- if .Values.updateStrategy }}
|
||||||
|
updateStrategy: {{- toYaml .Values.updateStrategy | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or (include "mongodb.createConfigmap" .) .Values.podAnnotations .Values.passwordUpdateJob.enabled }}
|
||||||
|
annotations:
|
||||||
|
{{- if (include "mongodb.createConfigmap" .) }}
|
||||||
|
checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.enabled }}
|
||||||
|
charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.podAnnotations }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- include "mongodb.imagePullSecrets" . | nindent 6 }}
|
||||||
|
{{- if .Values.schedulerName }}
|
||||||
|
schedulerName: {{ .Values.schedulerName | quote }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ template "mongodb.serviceAccountName" . }}
|
||||||
|
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||||
|
{{- if .Values.hostAliases }}
|
||||||
|
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.affinity }}
|
||||||
|
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
|
||||||
|
{{- else }}
|
||||||
|
affinity:
|
||||||
|
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "component" "mongodb" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "component" "mongodb" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.nodeSelector }}
|
||||||
|
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tolerations }}
|
||||||
|
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.runtimeClassName }}
|
||||||
|
runtimeClassName: {{ .Values.runtimeClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{ if .Values.terminationGracePeriodSeconds }}
|
||||||
|
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||||
|
initContainers:
|
||||||
|
{{- if .Values.initContainers }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
|
||||||
|
{{- include "mongodb.initContainer.volumePermissions" . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }}
|
||||||
|
{{- include "mongodb.initContainers.autoDiscovery" . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.enabled ( or .Values.externalAccess.service.publicNames .Values.externalAccess.service.domain ) }}
|
||||||
|
{{- include "mongodb.initContainers.dnsCheck" . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "mongodb.initContainer.prepareLogDir" . | nindent 8 }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: generate-tls-certs
|
||||||
|
image: {{ include "mongodb.tls.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
|
||||||
|
env:
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MY_POD_HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
volumeMounts:
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
mountPath: /certs/CAs
|
||||||
|
{{- else }}
|
||||||
|
{{- range $index, $_ := .Values.tls.replicaset.existingSecrets }}
|
||||||
|
- name: mongodb-certs-{{ $index }}
|
||||||
|
mountPath: /certs-{{ $index }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/generate-certs.sh
|
||||||
|
args:
|
||||||
|
- -s {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
{{- if .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
- -i {{ join "," .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames }}
|
||||||
|
- -n {{ join "," ( concat .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames ) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.tls.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.tls.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.tls.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.securityContext }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.tls.securityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: mongodb
|
||||||
|
image: {{ include "mongodb.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||||
|
{{- if .Values.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
command:
|
||||||
|
- /scripts/setup.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.lifecycleHooks }}
|
||||||
|
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||||
|
{{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }}
|
||||||
|
- name: SHARED_FILE
|
||||||
|
value: "/shared/info.txt"
|
||||||
|
{{- end }}
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MY_POD_HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: MONGODB_INITIAL_PRIMARY_HOST
|
||||||
|
value: {{ include "mongodb.initialPrimaryHost" . | quote }}
|
||||||
|
- name: MONGODB_REPLICA_SET_NAME
|
||||||
|
value: {{ .Values.replicaSetName | quote }}
|
||||||
|
{{- if and .Values.replicaSetHostnames (not .Values.externalAccess.enabled) }}
|
||||||
|
- name: MONGODB_ADVERTISED_HOSTNAME
|
||||||
|
value: "$(MY_POD_NAME).{{ include "mongodb.service.nameOverride" . }}.$(MY_POD_NAMESPACE).svc.{{ .Values.clusterDomain }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . -}}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . -}}
|
||||||
|
{{- if not (empty $customUsers) }}
|
||||||
|
- name: MONGODB_EXTRA_USERNAMES
|
||||||
|
value: {{ $customUsers | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not (empty $customDatabases) }}
|
||||||
|
- name: MONGODB_EXTRA_DATABASES
|
||||||
|
value: {{ $customDatabases | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
- name: MONGODB_EXTRA_PASSWORDS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-passwords
|
||||||
|
{{- end }}
|
||||||
|
- name: MONGODB_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
- name: MONGODB_REPLICA_SET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-replica-set-key
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.metrics.enabled (not (empty .Values.metrics.username)) }}
|
||||||
|
- name: MONGODB_METRICS_USERNAME
|
||||||
|
value: {{ .Values.metrics.username | quote }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
- name: MONGODB_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
- name: ALLOW_EMPTY_PASSWORD
|
||||||
|
value: {{ ternary "no" "yes" .Values.auth.enabled | quote }}
|
||||||
|
- name: MONGODB_SYSTEM_LOG_VERBOSITY
|
||||||
|
value: {{ .Values.systemLogVerbosity | quote }}
|
||||||
|
- name: MONGODB_DISABLE_SYSTEM_LOG
|
||||||
|
value: {{ ternary "yes" "no" .Values.disableSystemLog | quote }}
|
||||||
|
- name: MONGODB_DISABLE_JAVASCRIPT
|
||||||
|
value: {{ ternary "yes" "no" .Values.disableJavascript | quote }}
|
||||||
|
- name: MONGODB_ENABLE_JOURNAL
|
||||||
|
value: {{ ternary "yes" "no" .Values.enableJournal | quote }}
|
||||||
|
- name: MONGODB_PORT_NUMBER
|
||||||
|
value: {{ .Values.containerPorts.mongodb | quote }}
|
||||||
|
- name: MONGODB_ENABLE_IPV6
|
||||||
|
value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }}
|
||||||
|
- name: MONGODB_ENABLE_DIRECTORY_PER_DB
|
||||||
|
value: {{ ternary "yes" "no" .Values.directoryPerDB | quote }}
|
||||||
|
{{- $extraFlags := .Values.extraFlags | join " " -}}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
{{- if .Values.tls.mTLS.enabled }}
|
||||||
|
{{- $extraFlags = printf "--tlsCAFile=/certs/mongodb-ca-cert %s" $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $extraFlags = printf "--tlsMode=%s --tlsCertificateKeyFile=/certs/mongodb.pem %s" .Values.tls.mode $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne $extraFlags "" }}
|
||||||
|
- name: MONGODB_EXTRA_FLAGS
|
||||||
|
value: {{ $extraFlags | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: MONGODB_CLIENT_EXTRA_FLAGS
|
||||||
|
value: --tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.extraEnvVars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
|
||||||
|
envFrom:
|
||||||
|
{{- if .Values.extraEnvVarsCM }}
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ tpl .Values.extraEnvVarsCM . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.extraEnvVarsSecret }}
|
||||||
|
- secretRef:
|
||||||
|
name: {{ tpl .Values.extraEnvVarsSecret . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: mongodb
|
||||||
|
containerPort: {{ .Values.containerPorts.mongodb }}
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.livenessProbe.enabled }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/ping-mongodb.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.readinessProbe.enabled }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/readiness-probe.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.startupProbe.enabled }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/startup-probe.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /.mongodb
|
||||||
|
subPath: mongosh-home
|
||||||
|
- name: {{ .Values.persistence.name | default "datadir" }}
|
||||||
|
mountPath: {{ .Values.persistence.mountPath }}
|
||||||
|
subPath: {{ .Values.persistence.subPath }}
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||||
|
- name: custom-init-scripts
|
||||||
|
mountPath: /docker-entrypoint-initdb.d
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf/mongodb.conf
|
||||||
|
subPath: mongodb.conf
|
||||||
|
{{- end }}
|
||||||
|
- name: scripts
|
||||||
|
mountPath: /scripts/setup.sh
|
||||||
|
subPath: setup.sh
|
||||||
|
{{ if .Values.replicaSetConfigurationSettings.enabled }}
|
||||||
|
- name: scripts
|
||||||
|
mountPath: /scripts/replicaSetConfigurationSettings.sh
|
||||||
|
subPath: replicaSetConfigurationSettings.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }}
|
||||||
|
- name: shared
|
||||||
|
mountPath: /shared
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.enabled }}
|
||||||
|
- name: metrics
|
||||||
|
image: {{ template "mongodb.metrics.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||||
|
{{- if .Values.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.command "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
command:
|
||||||
|
- /bin/bash
|
||||||
|
- -ec
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.args "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
/bin/mongodb_exporter {{ include "mongodb.exporterArgs" $ }} --mongodb.direct-connect --mongodb.global-conn-pool --web.listen-address ":{{ .Values.metrics.containerPort }}" --mongodb.uri "{{ include "mongodb.mongodb_exporter.uri" . }}" {{ .Values.metrics.extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
{{- if not .Values.metrics.username }}
|
||||||
|
- name: MONGODB_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
{{- else }}
|
||||||
|
- name: MONGODB_METRICS_USERNAME
|
||||||
|
value: {{ .Values.metrics.username | quote }}
|
||||||
|
- name: MONGODB_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: metrics
|
||||||
|
containerPort: {{ .Values.metrics.containerPort }}
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.metrics.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.livenessProbe.enabled }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
tcpSocket:
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.readinessProbe.enabled }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.startupProbe.enabled }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
tcpSocket:
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sidecars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
- name: common-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
defaultMode: 0o550
|
||||||
|
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||||
|
- name: custom-init-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ template "mongodb.initdbScriptsCM" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "mongodb.configmapName" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }}
|
||||||
|
- name: shared
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
- name: scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ printf "%s-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
defaultMode: 0o755
|
||||||
|
{{- if .Values.extraVolumes }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
emptyDir: {}
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
secret:
|
||||||
|
secretName: {{ template "mongodb.tlsSecretName" . }}
|
||||||
|
items:
|
||||||
|
- key: mongodb-ca-cert
|
||||||
|
path: mongodb-ca-cert
|
||||||
|
mode: 0o600
|
||||||
|
- key: mongodb-ca-key
|
||||||
|
path: mongodb-ca-key
|
||||||
|
mode: 0o600
|
||||||
|
{{- else }}
|
||||||
|
{{- range $index, $secret := .Values.tls.replicaset.existingSecrets }}
|
||||||
|
- name: mongodb-certs-{{ $index }}
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "common.tplvalues.render" ( dict "value" $secret "context" $) }}
|
||||||
|
defaultMode: 256
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not .Values.persistence.enabled }}
|
||||||
|
- name: datadir
|
||||||
|
{{- if .Values.persistence.medium }}
|
||||||
|
emptyDir:
|
||||||
|
medium: {{ .Values.persistence.medium | quote }}
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }}
|
||||||
|
persistentVolumeClaimRetentionPolicy:
|
||||||
|
whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
|
||||||
|
whenScaled: {{ .Values.persistentVolumeClaimRetentionPolicy.whenScaled }}
|
||||||
|
{{- end }}
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: datadir
|
||||||
|
{{- if .Values.persistence.annotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.labels }}
|
||||||
|
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
{{- range .Values.persistence.accessModes }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.persistence.size | quote }}
|
||||||
|
{{- if .Values.persistence.volumeClaimTemplates.requests }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.persistence.volumeClaimTemplates.requests "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.volumeClaimTemplates.dataSource }}
|
||||||
|
dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.volumeClaimTemplates.dataSource "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.volumeClaimTemplates.selector }}
|
||||||
|
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.volumeClaimTemplates.selector "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{ include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
41
freeleaps/helm-pkg/3rd/mongo/templates/replicaset/svc.yaml
Normal file
41
freeleaps/helm-pkg/3rd/mongo/templates/replicaset/svc.yaml
Normal file
@ -0,0 +1,41 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (eq .Values.architecture "replicaset") .Values.externalAccess.enabled (eq .Values.externalAccess.service.type "ClusterIP") }}
|
||||||
|
|
||||||
|
{{- $fullName := include "mongodb.fullname" . }}
|
||||||
|
{{- $replicaCount := .Values.replicaCount | int }}
|
||||||
|
{{- $root := . }}
|
||||||
|
|
||||||
|
{{- range $i, $e := until $replicaCount }}
|
||||||
|
{{- $targetPod := printf "%s-%d" (printf "%s" $fullName) $i }}
|
||||||
|
{{- $_ := set $ "targetPod" $targetPod }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-%d" $fullName $i }}
|
||||||
|
namespace: {{ include "mongodb.namespace" $ }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $root.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or $root.Values.service.annotations $root.Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list $root.Values.service.annotations $root.Values.commonAnnotations ) "context" $ ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: {{ $root.Values.service.portName | quote }}
|
||||||
|
port: {{ $root.Values.service.ports.mongodb }}
|
||||||
|
targetPort: mongodb
|
||||||
|
{{- if $root.Values.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" $root.Values.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list $root.Values.podLabels $root.Values.commonLabels ) "context" $ ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
statefulset.kubernetes.io/pod-name: {{ $targetPod }}
|
||||||
|
---
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
31
freeleaps/helm-pkg/3rd/mongo/templates/role.yaml
Normal file
31
freeleaps/helm-pkg/3rd/mongo/templates/role.yaml
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.rbac.create }}
|
||||||
|
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
{{- if .Values.rbac.rules }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if and (include "common.capabilities.psp.supported" .) .Values.podSecurityPolicy.create }}
|
||||||
|
- apiGroups: ['{{ template "podSecurityPolicy.apiGroup" . }}']
|
||||||
|
resources: ['podsecuritypolicies']
|
||||||
|
verbs: ['use']
|
||||||
|
resourceNames: [{{ include "mongodb.fullname" . }}]
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
21
freeleaps/helm-pkg/3rd/mongo/templates/rolebinding.yaml
Normal file
21
freeleaps/helm-pkg/3rd/mongo/templates/rolebinding.yaml
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.serviceAccount.create .Values.rbac.create }}
|
||||||
|
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
kind: Role
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "mongodb.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
{{- end }}
|
||||||
33
freeleaps/helm-pkg/3rd/mongo/templates/secrets-ca.yaml
Normal file
33
freeleaps/helm-pkg/3rd/mongo/templates/secrets-ca.yaml
Normal file
@ -0,0 +1,33 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.createTlsSecret" .) }}
|
||||||
|
{{- $secretName := printf "%s" (include "mongodb.tlsSecretName" .) }}
|
||||||
|
{{- $fullname := include "mongodb.fullname" . }}
|
||||||
|
{{- $releaseNamespace := .Release.Namespace }}
|
||||||
|
{{- $clusterDomain := .Values.clusterDomain }}
|
||||||
|
{{- $cn := printf "%s.%s.svc.%s" $fullname .Release.Namespace $clusterDomain }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ $secretName }}
|
||||||
|
namespace: {{ template "mongodb.namespace" . }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
{{- if or .Values.tls.caCert .Values.tls.caKey (not .Values.tls.autoGenerated) }}
|
||||||
|
{{- $ca := buildCustomCert (required "A valid .Values.tls.caCert is required!" .Values.tls.caCert) (required "A valid .Values.tls.caKey is required!" .Values.tls.caKey) }}
|
||||||
|
mongodb-ca-cert: {{ b64enc $ca.Cert }}
|
||||||
|
mongodb-ca-key: {{ b64enc $ca.Key }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $ca := genCA "myMongo-ca" 3650 }}
|
||||||
|
mongodb-ca-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "mongodb-ca-cert" "defaultValue" $ca.Cert "context" $) }}
|
||||||
|
mongodb-ca-key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "mongodb-ca-key" "defaultValue" $ca.Key "context" $) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
128
freeleaps/helm-pkg/3rd/mongo/templates/secrets.yaml
Normal file
128
freeleaps/helm-pkg/3rd/mongo/templates/secrets.yaml
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
{{- $replicaCount := int .Values.replicaCount }}
|
||||||
|
{{- $port := .Values.service.ports.mongodb }}
|
||||||
|
{{- $host := include "mongodb.service.nameOverride" . }}
|
||||||
|
{{- $hostForURI := printf "%s:%s" (include "mongodb.service.nameOverride" .) (print $port) }}
|
||||||
|
{{- if (eq .Values.architecture "replicaset") }}
|
||||||
|
{{- $fullname := include "mongodb.fullname" . }}
|
||||||
|
{{- $releaseNamespace := include "mongodb.namespace" . }}
|
||||||
|
{{- $clusterDomain := .Values.clusterDomain }}
|
||||||
|
{{- $mongoList := list }}
|
||||||
|
{{- $mongoOnlyHostList := list }}
|
||||||
|
{{- range $e, $i := until $replicaCount }}
|
||||||
|
{{- $mongoOnlyHostList = append $mongoList (printf "%s-%d.%s-headless.%s.svc.%s" $fullname $i $fullname $releaseNamespace $clusterDomain) }}
|
||||||
|
{{- $mongoList = append $mongoList (printf "%s-%d.%s-headless.%s.svc.%s:%s" $fullname $i $fullname $releaseNamespace $clusterDomain (print $port)) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $host = (join "," $mongoOnlyHostList) }}
|
||||||
|
{{- $hostForURI = (join "," $mongoList) }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Root user section. */}}
|
||||||
|
{{- $rootPassword := include "common.secrets.passwords.manage" (dict "secret" (include "mongodb.secretName" .) "key" "mongodb-root-password" "providedValues" (list "auth.rootPassword" ) "honorProvidedValues" true "context" $) | trimAll "\"" | b64dec }}
|
||||||
|
|
||||||
|
{{/* Custom user section. This chart allows creating multiple users */}}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . }}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . }}
|
||||||
|
{{- $customPasswords := include "mongodb.customPasswords" . }}
|
||||||
|
{{- $passwords := "" }}
|
||||||
|
{{- $passwordList := list -}}
|
||||||
|
{{- $customUsersList := list }}
|
||||||
|
{{- $customDatabasesList := list }}
|
||||||
|
{{- $customPasswordsList := list }}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
{{- $customUsersList = splitList "," $customUsers }}
|
||||||
|
{{- $customDatabasesList = splitList "," $customDatabases }}
|
||||||
|
{{- if not (empty $customPasswords) }}
|
||||||
|
{{- $passwordList = $customPasswords }}
|
||||||
|
{{- $customPasswordsList = splitList "," $customPasswords }}
|
||||||
|
{{- else }}
|
||||||
|
{{- range $customUsersList }}
|
||||||
|
{{- $customPasswordsList = append $customPasswordsList (randAlphaNum 10) }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- $passwordList = (join "," $customPasswordsList) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $passwords = include "common.secrets.passwords.manage" (dict "secret" (include "mongodb.secretName" .) "key" "mongodb-passwords" "providedValues" (list "mongodbPasswords") "honorProvidedValues" true "context" (set (deepCopy $) "Values" (dict "mongodbPasswords" $passwordList))) | trimAll "\"" | b64dec }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if (include "mongodb.createSecret" .) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ template "mongodb.namespace" . }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
mongodb-root-password: {{ print $rootPassword | b64enc | quote }}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
mongodb-passwords: {{ print $passwords | b64enc | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.username }}
|
||||||
|
mongodb-metrics-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "mongodb.fullname" .) "key" "mongodb-metrics-password" "providedValues" (list "metrics.password" ) "honorProvidedValues" true "context" $) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
mongodb-replica-set-key: {{ include "common.secrets.passwords.manage" (dict "secret" (include "mongodb.fullname" .) "key" "mongodb-replica-set-key" "providedValues" (list "auth.replicaSetKey" ) "honorProvidedValues" true "context" $) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.serviceBindings.enabled }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ include "common.names.fullname" . }}-svcbind-root
|
||||||
|
namespace: {{ .Release.Namespace | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
type: servicebinding.io/mongodb
|
||||||
|
data:
|
||||||
|
provider: {{ print "bitnami" | b64enc | quote }}
|
||||||
|
type: {{ print "mongodb" | b64enc | quote }}
|
||||||
|
host: {{ print $host | b64enc | quote }}
|
||||||
|
port: {{ print $port | b64enc | quote }}
|
||||||
|
username: {{ print .Values.auth.rootUser | b64enc | quote }}
|
||||||
|
password: {{ print $rootPassword | b64enc | quote }}
|
||||||
|
database: {{ print "admin" | b64enc | quote }}
|
||||||
|
uri: {{ printf "mongodb://%s:%s@%s/admin" .Values.auth.rootUser $rootPassword $hostForURI | b64enc | quote }}
|
||||||
|
{{- range $e, $i := until (len $customUsersList) }}
|
||||||
|
---
|
||||||
|
{{- $currentSecret := printf "%s-svcbind-%d" (include "common.names.fullname" $) $i }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ $currentSecret }}
|
||||||
|
namespace: {{ $.Release.Namespace | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
{{- if $.Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
type: servicebinding.io/mongodb
|
||||||
|
data:
|
||||||
|
{{- $currentUser := index $customUsersList $i }}
|
||||||
|
{{- $currentDatabase := last $customDatabasesList }}
|
||||||
|
{{- if gt (len $customDatabasesList) $i }}
|
||||||
|
{{- $currentDatabase = index $customDatabasesList $i }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $currentProvidedPassword := index $customPasswordsList $i }}
|
||||||
|
{{- $currentPassword := include "common.secrets.lookup" (dict "secret" $currentSecret "key" "password" "defaultValue" $currentProvidedPassword "context" $) | b64dec }}
|
||||||
|
provider: {{ print "bitnami" | b64enc | quote }}
|
||||||
|
type: {{ print "mongodb" | b64enc | quote }}
|
||||||
|
host: {{ print $host | b64enc | quote }}
|
||||||
|
port: {{ print $port | b64enc | quote }}
|
||||||
|
username: {{ print $currentUser | b64enc | quote }}
|
||||||
|
password: {{ print $currentPassword | b64enc | quote }}
|
||||||
|
database: {{ print $currentDatabase | b64enc | quote }}
|
||||||
|
uri: {{ printf "mongodb://%s:%s@%s/%s" $currentUser $currentPassword $hostForURI $currentDatabase | b64enc | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
20
freeleaps/helm-pkg/3rd/mongo/templates/serviceaccount.yaml
Normal file
20
freeleaps/helm-pkg/3rd/mongo/templates/serviceaccount.yaml
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
secrets:
|
||||||
|
- name: {{ include "mongodb.secretName" . }}
|
||||||
|
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||||
|
{{- end }}
|
||||||
48
freeleaps/helm-pkg/3rd/mongo/templates/servicemonitor.yaml
Normal file
48
freeleaps/helm-pkg/3rd/mongo/templates/servicemonitor.yaml
Normal file
@ -0,0 +1,48 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.serviceMonitor.namespace" . }}
|
||||||
|
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: metrics
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||||
|
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||||
|
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/component: metrics
|
||||||
|
endpoints:
|
||||||
|
- port: http-metrics
|
||||||
|
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||||
|
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||||
|
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||||
|
{{- end }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- "{{ include "mongodb.namespace" . }}"
|
||||||
|
{{- end }}
|
||||||
501
freeleaps/helm-pkg/3rd/mongo/templates/standalone/dep-sts.yaml
Normal file
501
freeleaps/helm-pkg/3rd/mongo/templates/standalone/dep-sts.yaml
Normal file
@ -0,0 +1,501 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if not (eq .Values.architecture "replicaset") }}
|
||||||
|
apiVersion: {{ if .Values.useStatefulSet }}{{ include "common.capabilities.statefulset.apiVersion" . }}{{- else }}{{ include "common.capabilities.deployment.apiVersion" . }}{{- end }}
|
||||||
|
kind: {{ if .Values.useStatefulSet }}StatefulSet{{- else }}Deployment{{- end }}
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.labels .Values.commonLabels ) "context" . ) }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or .Values.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ gt (.Values.replicaCount | int) 1 | ternary 1 .Values.replicaCount }}
|
||||||
|
{{- if .Values.useStatefulSet }}
|
||||||
|
serviceName: {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.updateStrategy}}
|
||||||
|
{{- if .Values.useStatefulSet }}
|
||||||
|
updateStrategy:
|
||||||
|
{{- else }}
|
||||||
|
strategy:
|
||||||
|
{{- end }}
|
||||||
|
{{- toYaml .Values.updateStrategy | nindent 4 }}
|
||||||
|
{{- end}}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or (include "mongodb.createConfigmap" .) .Values.podAnnotations .Values.passwordUpdateJob.enabled }}
|
||||||
|
annotations:
|
||||||
|
{{- if (include "mongodb.createConfigmap" .) }}
|
||||||
|
checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.enabled }}
|
||||||
|
charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.podAnnotations }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- include "mongodb.imagePullSecrets" . | nindent 6 }}
|
||||||
|
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||||
|
{{- if .Values.hostAliases }}
|
||||||
|
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.schedulerName }}
|
||||||
|
schedulerName: {{ .Values.schedulerName | quote }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ template "mongodb.serviceAccountName" . }}
|
||||||
|
{{- if .Values.affinity }}
|
||||||
|
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
|
||||||
|
{{- else }}
|
||||||
|
affinity:
|
||||||
|
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "component" "mongodb" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "component" "mongodb" "customLabels" $podLabels "topologyKey" .Values.topologyKey "context" $) | nindent 10 }}
|
||||||
|
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.nodeSelector }}
|
||||||
|
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tolerations }}
|
||||||
|
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.runtimeClassName }}
|
||||||
|
runtimeClassName: {{ .Values.runtimeClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{ if .Values.terminationGracePeriodSeconds }}
|
||||||
|
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||||
|
initContainers:
|
||||||
|
{{- if .Values.initContainers }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
|
||||||
|
{{- include "mongodb.initContainer.volumePermissions" . | indent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "mongodb.initContainer.prepareLogDir" . | nindent 8 }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: generate-tls-certs
|
||||||
|
image: {{ include "mongodb.tls.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
|
||||||
|
env:
|
||||||
|
- name: MY_POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: MY_POD_HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
mountPath: /certs/CAs
|
||||||
|
{{- else }}
|
||||||
|
- name: mongodb-certs-0
|
||||||
|
mountPath: /certs-0
|
||||||
|
{{- end }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/generate-certs.sh
|
||||||
|
args:
|
||||||
|
- -s {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
{{- if .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
- -i {{ join "," .Values.externalAccess.service.loadBalancerIPs }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames }}
|
||||||
|
- -n {{ join "," ( concat .Values.tls.extraDnsNames .Values.externalAccess.service.publicNames ) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.tls.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.tls.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.tls.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.securityContext }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.tls.securityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: mongodb
|
||||||
|
image: {{ include "mongodb.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||||
|
{{- if .Values.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.lifecycleHooks }}
|
||||||
|
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . -}}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . -}}
|
||||||
|
{{- if not (empty $customUsers) }}
|
||||||
|
- name: MONGODB_EXTRA_USERNAMES
|
||||||
|
value: {{ $customUsers | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not (empty $customDatabases) }}
|
||||||
|
- name: MONGODB_EXTRA_DATABASES
|
||||||
|
value: {{ $customDatabases | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
- name: MONGODB_EXTRA_PASSWORDS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-passwords
|
||||||
|
{{- end }}
|
||||||
|
- name: MONGODB_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.metrics.enabled (not (empty .Values.metrics.username)) }}
|
||||||
|
- name: MONGODB_METRICS_USERNAME
|
||||||
|
value: {{ .Values.metrics.username | quote }}
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
- name: MONGODB_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
- name: ALLOW_EMPTY_PASSWORD
|
||||||
|
value: {{ ternary "no" "yes" .Values.auth.enabled | quote }}
|
||||||
|
- name: MONGODB_SYSTEM_LOG_VERBOSITY
|
||||||
|
value: {{ .Values.systemLogVerbosity | quote }}
|
||||||
|
- name: MONGODB_DISABLE_SYSTEM_LOG
|
||||||
|
value: {{ ternary "yes" "no" .Values.disableSystemLog | quote }}
|
||||||
|
- name: MONGODB_DISABLE_JAVASCRIPT
|
||||||
|
value: {{ ternary "yes" "no" .Values.disableJavascript | quote }}
|
||||||
|
- name: MONGODB_ENABLE_JOURNAL
|
||||||
|
value: {{ ternary "yes" "no" .Values.enableJournal | quote }}
|
||||||
|
- name: MONGODB_PORT_NUMBER
|
||||||
|
value: {{ .Values.containerPorts.mongodb | quote }}
|
||||||
|
- name: MONGODB_ENABLE_IPV6
|
||||||
|
value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }}
|
||||||
|
- name: MONGODB_ENABLE_DIRECTORY_PER_DB
|
||||||
|
value: {{ ternary "yes" "no" .Values.directoryPerDB | quote }}
|
||||||
|
{{- $extraFlags := .Values.extraFlags | join " " -}}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
{{- if .Values.tls.mTLS.enabled }}
|
||||||
|
{{- $extraFlags = printf "--tlsCAFile=/certs/mongodb-ca-cert %s" $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $extraFlags = printf "--tlsMode=%s --tlsCertificateKeyFile=/certs/mongodb.pem %s" .Values.tls.mode $extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne $extraFlags "" }}
|
||||||
|
- name: MONGODB_EXTRA_FLAGS
|
||||||
|
value: {{ $extraFlags | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: MONGODB_CLIENT_EXTRA_FLAGS
|
||||||
|
value: --tls {{ if .Values.tls.mTLS.enabled }}--tlsCertificateKeyFile=/certs/mongodb.pem {{ end }}--tlsCAFile=/certs/mongodb-ca-cert
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.extraEnvVars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
|
||||||
|
envFrom:
|
||||||
|
{{- if .Values.extraEnvVarsCM }}
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ tpl .Values.extraEnvVarsCM . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.extraEnvVarsSecret }}
|
||||||
|
- secretRef:
|
||||||
|
name: {{ tpl .Values.extraEnvVarsSecret . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: mongodb
|
||||||
|
containerPort: {{ .Values.containerPorts.mongodb }}
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.livenessProbe.enabled }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/ping-mongodb.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.readinessProbe.enabled }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/readiness-probe.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.startupProbe.enabled }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bitnami/scripts/startup-probe.sh
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/mongodb/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /.mongodb
|
||||||
|
subPath: mongosh-home
|
||||||
|
- name: {{ .Values.persistence.name | default "datadir" }}
|
||||||
|
mountPath: {{ .Values.persistence.mountPath }}
|
||||||
|
subPath: {{ .Values.persistence.subPath }}
|
||||||
|
- name: common-scripts
|
||||||
|
mountPath: /bitnami/scripts
|
||||||
|
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||||
|
- name: custom-init-scripts
|
||||||
|
mountPath: /docker-entrypoint-initdb.d
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
mountPath: /opt/bitnami/mongodb/conf/mongodb.conf
|
||||||
|
subPath: mongodb.conf
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.enabled }}
|
||||||
|
- name: metrics
|
||||||
|
image: {{ template "mongodb.metrics.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||||
|
{{- if .Values.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.command "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
command:
|
||||||
|
- /bin/bash
|
||||||
|
- -ec
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.diagnosticMode.enabled }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.args "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
/bin/mongodb_exporter {{ include "mongodb.exporterArgs" $ }} --mongodb.direct-connect --mongodb.global-conn-pool --web.listen-address ":{{ .Values.metrics.containerPort }}" --mongodb.uri "{{ include "mongodb.mongodb_exporter.uri" . }}" {{ .Values.metrics.extraFlags }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
{{- if .Values.auth.enabled }}
|
||||||
|
{{- if not .Values.metrics.username }}
|
||||||
|
- name: MONGODB_ROOT_USER
|
||||||
|
value: {{ .Values.auth.rootUser | quote }}
|
||||||
|
- name: MONGODB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
{{- else }}
|
||||||
|
- name: MONGODB_METRICS_USERNAME
|
||||||
|
value: {{ .Values.metrics.username | quote }}
|
||||||
|
- name: MONGODB_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "mongodb.secretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: metrics
|
||||||
|
containerPort: {{ .Values.metrics.containerPort }}
|
||||||
|
{{- if not .Values.diagnosticMode.enabled }}
|
||||||
|
{{- if .Values.metrics.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.livenessProbe.enabled }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
tcpSocket:
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.readinessProbe.enabled }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- else if .Values.metrics.startupProbe.enabled }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||||
|
tcpSocket:
|
||||||
|
port: metrics
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.resources }}
|
||||||
|
resources: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.resources "context" $) | nindent 12 }}
|
||||||
|
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sidecars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
- name: common-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }}
|
||||||
|
defaultMode: 0o550
|
||||||
|
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||||
|
- name: custom-init-scripts
|
||||||
|
configMap:
|
||||||
|
name: {{ template "mongodb.initdbScriptsCM" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "mongodb.configmapName" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.extraVolumes }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.enabled }}
|
||||||
|
- name: certs
|
||||||
|
emptyDir: {}
|
||||||
|
{{- if (include "mongodb.autoGenerateCerts" .) }}
|
||||||
|
- name: certs-volume
|
||||||
|
secret:
|
||||||
|
secretName: {{ template "mongodb.tlsSecretName" . }}
|
||||||
|
items:
|
||||||
|
- key: mongodb-ca-cert
|
||||||
|
path: mongodb-ca-cert
|
||||||
|
mode: 0o600
|
||||||
|
- key: mongodb-ca-key
|
||||||
|
path: mongodb-ca-key
|
||||||
|
mode: 0o600
|
||||||
|
{{- else }}
|
||||||
|
- name: mongodb-certs-0
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "common.tplvalues.render" ( dict "value" .Values.tls.standalone.existingSecret "context" $) }}
|
||||||
|
defaultMode: 256
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not .Values.persistence.enabled }}
|
||||||
|
- name: {{ .Values.persistence.name | default "datadir" }}
|
||||||
|
{{- if .Values.persistence.medium }}
|
||||||
|
emptyDir:
|
||||||
|
medium: {{ .Values.persistence.medium | quote }}
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- else if .Values.persistence.existingClaim }}
|
||||||
|
- name: {{ .Values.persistence.name | default "datadir" }}
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ printf "%s" (tpl .Values.persistence.existingClaim .) }}
|
||||||
|
{{- else if not .Values.useStatefulSet }}
|
||||||
|
- name: {{ .Values.persistence.name | default "datadir" }}
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ template "mongodb.fullname" . }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }}
|
||||||
|
persistentVolumeClaimRetentionPolicy:
|
||||||
|
whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
|
||||||
|
whenScaled: {{ .Values.persistentVolumeClaimRetentionPolicy.whenScaled }}
|
||||||
|
{{- end }}
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
name: {{ .Values.persistence.name | default "datadir" }}
|
||||||
|
{{- if .Values.persistence.annotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.labels }}
|
||||||
|
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
{{- range .Values.persistence.accessModes }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.persistence.size | quote }}
|
||||||
|
{{- if .Values.persistence.volumeClaimTemplates.selector }}
|
||||||
|
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.volumeClaimTemplates.selector "context" $) | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{ include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
28
freeleaps/helm-pkg/3rd/mongo/templates/standalone/pdb.yaml
Normal file
28
freeleaps/helm-pkg/3rd/mongo/templates/standalone/pdb.yaml
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and (not (eq .Values.architecture "replicaset")) .Values.pdb.create }}
|
||||||
|
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if .Values.commonAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.pdb.minAvailable }}
|
||||||
|
minAvailable: {{ .Values.pdb.minAvailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.pdb.maxUnavailable (not .Values.pdb.minAvailable) }}
|
||||||
|
maxUnavailable: {{ .Values.pdb.maxUnavailable | default 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- end }}
|
||||||
31
freeleaps/helm-pkg/3rd/mongo/templates/standalone/pvc.yaml
Normal file
31
freeleaps/helm-pkg/3rd/mongo/templates/standalone/pvc.yaml
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) (not (eq .Values.architecture "replicaset")) (not .Values.useStatefulSet) }}
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.fullname" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
annotations:
|
||||||
|
{{- if .Values.persistence.resourcePolicy }}
|
||||||
|
helm.sh/resource-policy: {{ .Values.persistence.resourcePolicy | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.persistence.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
{{- range .Values.persistence.accessModes }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.persistence.size | quote }}
|
||||||
|
{{ include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) }}
|
||||||
|
{{- end }}
|
||||||
62
freeleaps/helm-pkg/3rd/mongo/templates/standalone/svc.yaml
Normal file
62
freeleaps/helm-pkg/3rd/mongo/templates/standalone/svc.yaml
Normal file
@ -0,0 +1,62 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if not (eq .Values.architecture "replicaset") }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "mongodb.service.nameOverride" . }}
|
||||||
|
namespace: {{ include "mongodb.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- if or .Values.service.annotations .Values.commonAnnotations }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.service.type }}
|
||||||
|
{{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
|
||||||
|
clusterIP: {{ .Values.service.clusterIP }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerIP }}
|
||||||
|
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerClass }}
|
||||||
|
loadBalancerClass: {{ .Values.service.loadBalancerClass }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.externalIPs }}
|
||||||
|
externalIPs: {{ toYaml .Values.service.externalIPs | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.loadBalancerSourceRanges }}
|
||||||
|
loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if (eq .Values.service.type "LoadBalancer") }}
|
||||||
|
allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.sessionAffinity }}
|
||||||
|
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.sessionAffinityConfig }}
|
||||||
|
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if (or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort")) }}
|
||||||
|
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: {{ .Values.service.portName | quote }}
|
||||||
|
port: {{ .Values.service.ports.mongodb }}
|
||||||
|
targetPort: mongodb
|
||||||
|
{{- if and (or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort")) .Values.service.nodePorts.mongodb }}
|
||||||
|
nodePort: {{ .Values.service.nodePorts.mongodb }}
|
||||||
|
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||||
|
nodePort: null
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.extraPorts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: mongodb
|
||||||
|
{{- end }}
|
||||||
245
freeleaps/helm-pkg/3rd/mongo/templates/update-password/job.yaml
Normal file
245
freeleaps/helm-pkg/3rd/mongo/templates/update-password/job.yaml
Normal file
@ -0,0 +1,245 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.passwordUpdateJob.enabled }}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . }}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . }}
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-password-update" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||||
|
namespace: {{ include "common.names.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/part-of: mongodb
|
||||||
|
app.kubernetes.io/component: update-job
|
||||||
|
{{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations .Values.passwordUpdateJob.annotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
backoffLimit: {{ .Values.passwordUpdateJob.backoffLimit }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.passwordUpdateJob.podLabels .Values.commonLabels ) "context" . ) }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||||
|
app.kubernetes.io/part-of: mongodb
|
||||||
|
app.kubernetes.io/component: update-job
|
||||||
|
{{- if .Values.passwordUpdateJob.podAnnotations }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.podAnnotations "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- include "mongodb.imagePullSecrets" . | nindent 6 }}
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
{{- if .Values.passwordUpdateJob.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.passwordUpdateJob.podSecurityContext "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
automountServiceAccountToken: {{ .Values.passwordUpdateJob.automountServiceAccountToken }}
|
||||||
|
{{- if .Values.passwordUpdateJob.hostAliases }}
|
||||||
|
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.hostAliases "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
initContainers:
|
||||||
|
{{- if .Values.passwordUpdateJob.initContainers }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.initContainers "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: update-credentials
|
||||||
|
image: {{ template "mongodb.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
{{- if .Values.passwordUpdateJob.command }}
|
||||||
|
command: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.command "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
command:
|
||||||
|
- /bin/bash
|
||||||
|
- -ec
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.args }}
|
||||||
|
args: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.args "context" $) | nindent 12 }}
|
||||||
|
{{- else }}
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
{{- if .Values.usePasswordFiles }}
|
||||||
|
# We need to load all the secret env vars to the system
|
||||||
|
for file in $(find /bitnami/mongodb/secrets -type f); do
|
||||||
|
env_var_name="$(basename $file)"
|
||||||
|
echo "Exporting $env_var_name"
|
||||||
|
export $env_var_name="$(< $file)"
|
||||||
|
done
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
. /opt/bitnami/scripts/mongodb-env.sh
|
||||||
|
. /opt/bitnami/scripts/libmongodb.sh
|
||||||
|
. /opt/bitnami/scripts/liblog.sh
|
||||||
|
|
||||||
|
protocol=mongodb
|
||||||
|
{{- if eq .Values.architecture "replicaset" }}
|
||||||
|
replicaset={{- range $i, $_ := until (int .Values.replicaCount) }}{{- if ne $i 0 }},{{- end }}{{ include "common.names.fullname" $ }}-{{ $i }}.{{ include "mongodb.service.nameOverride" $ }}:{{ $.Values.containerPorts.mongodb }}{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
replicaset={{ include "common.names.fullname" . }}:{{ .Values.service.ports.mongodb }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
info "Starting password update job"
|
||||||
|
if [[ -f /job-status/root-password-changed ]]; then
|
||||||
|
info "Root password already updated. Skipping"
|
||||||
|
else
|
||||||
|
info "Updating root password"
|
||||||
|
mongosh "${protocol}://$MONGODB_ROOT_USER:$MONGODB_PREVIOUS_ROOT_PASSWORD@$replicaset/admin" --eval "db.changeUserPassword('$MONGODB_ROOT_USER', '$MONGODB_NEW_ROOT_PASSWORD')"
|
||||||
|
touch /job-status/root-password-changed
|
||||||
|
info "Root password successfully updated"
|
||||||
|
fi
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
|
||||||
|
databases_extra=()
|
||||||
|
usernames_extra=()
|
||||||
|
IFS="$(mongodb_field_separator "$MONGODB_EXTRA_DATABASES")" read -r -a databases_extra <<<"$MONGODB_EXTRA_DATABASES"
|
||||||
|
IFS="$(mongodb_field_separator "$MONGODB_EXTRA_USERNAMES")" read -r -a usernames_extra <<<"$MONGODB_EXTRA_USERNAMES"
|
||||||
|
new_passwords_extra=()
|
||||||
|
IFS="$(mongodb_field_separator "$MONGODB_NEW_EXTRA_PASSWORDS")" read -r -a new_passwords_extra <<<"$MONGODB_NEW_EXTRA_PASSWORDS"
|
||||||
|
|
||||||
|
for ((i = 0; i < ${#usernames_extra[@]}; i++)); do
|
||||||
|
if [[ -f /job-status/password-${usernames_extra[i]}-changed ]]; then
|
||||||
|
info "User ${usernames_extra[i]} password already updated. Skipping"
|
||||||
|
else
|
||||||
|
info "Updating user ${usernames_extra[i]} password"
|
||||||
|
mongosh "${protocol}://$MONGODB_ROOT_USER:$MONGODB_NEW_ROOT_PASSWORD@$replicaset/${databases_extra[i]}?authSource=admin" --eval "db.changeUserPassword('${usernames_extra[i]}', '${new_passwords_extra[i]}');"
|
||||||
|
touch /job-status/password-${usernames_extra[i]}-changed
|
||||||
|
info "User ${usernames_extra[i]} password successfully updated"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.metrics.username }}
|
||||||
|
if [[ -f /job-status/metrics-password-changed ]]; then
|
||||||
|
info "Metrics password already updated. Skipping"
|
||||||
|
else
|
||||||
|
info "Updating metrics password"
|
||||||
|
mongosh "${protocol}://$MONGODB_ROOT_USER:$MONGODB_NEW_ROOT_PASSWORD@$replicaset/admin" --eval "db.changeUserPassword('$MONGODB_METRICS_USER', '$MONGODB_NEW_METRICS_PASSWORD')"
|
||||||
|
touch /job-status/root-password-changed
|
||||||
|
info "Metrics password successfully updated"
|
||||||
|
fi
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.passwordUpdateJob.extraCommands }}
|
||||||
|
info "Running extra commmands"
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraCommands "context" $) | nindent 14 }}
|
||||||
|
{{- end }}
|
||||||
|
info "Password update job finished successfully"
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: {{ ternary "true" "false" .Values.image.debug | quote }}
|
||||||
|
{{- if not .Values.auth.usePasswordFiles }}
|
||||||
|
- name: MONGODB_PREVIOUS_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ template "mongodb.update-job.previousSecretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
- name: MONGODB_NEW_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ template "mongodb.update-job.newSecretName" . }}
|
||||||
|
key: mongodb-root-password
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
- name: MONGODB_EXTRA_USERNAMES
|
||||||
|
value: {{ $customUsers | quote }}
|
||||||
|
- name: MONGODB_EXTRA_DATABASES
|
||||||
|
value: {{ $customDatabases | quote }}
|
||||||
|
{{- if not .Values.auth.usePasswordFiles }}
|
||||||
|
- name: MONGODB_NEW_EXTRA_PASSWORDS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ template "mongodb.update-job.newSecretName" . }}
|
||||||
|
key: mongodb-passwords
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.username }}
|
||||||
|
- name: MONGODB_METRICS_USER
|
||||||
|
value: {{ .Values.metrics.username | quote }}
|
||||||
|
{{- if not .Values.auth.usePasswordFiles }}
|
||||||
|
- name: MONGODB_PREVIOUS_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ template "mongodb.update-job.previousSecretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
- name: MONGODB_NEW_METRICS_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ template "mongodb.update-job.newSecretName" . }}
|
||||||
|
key: mongodb-metrics-password
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.extraEnvVars }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraEnvVars "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.passwordUpdateJob.extraEnvVarsCM .Values.passwordUpdateJob.extraEnvVarsSecret }}
|
||||||
|
envFrom:
|
||||||
|
{{- if .Values.passwordUpdateJob.extraEnvVarsCM }}
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ .Values.passwordUpdateJob.extraEnvVarsCM }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.extraEnvVarsSecret }}
|
||||||
|
- secretRef:
|
||||||
|
name: {{ .Values.passwordUpdateJob.extraEnvVarsSecret }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.passwordUpdateJob.containerSecurityContext "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.customLivenessProbe }}
|
||||||
|
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customLivenessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.customReadinessProbe }}
|
||||||
|
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customReadinessProbe "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.customStartupProbe }}
|
||||||
|
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customStartupProbe "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /job-status
|
||||||
|
subPath: job-dir
|
||||||
|
{{- if .Values.usePasswordFiles }}
|
||||||
|
- name: mongodb-previous-credentials
|
||||||
|
mountPath: /bitnami/mongodb/secrets/previous
|
||||||
|
- name: mongodb-new-credentials
|
||||||
|
mountPath: /bitnami/mongodb/secrets/new
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.extraVolumeMounts }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraVolumeMounts "context" $) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.resources }}
|
||||||
|
resources: {{- toYaml .Values.passwordUpdateJob.resources | nindent 12 }}
|
||||||
|
{{- else if ne .Values.passwordUpdateJob.resourcesPreset "none" }}
|
||||||
|
resources: {{- include "common.resources.preset" (dict "type" .Values.passwordUpdateJob.resourcesPreset) | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
{{- if and .Values.auth.usePasswordFiles }}
|
||||||
|
- name: mongodb-previous-credentials
|
||||||
|
secret:
|
||||||
|
secretName: {{ template "mongodb.update-job.previousSecretName" . }}
|
||||||
|
items:
|
||||||
|
- key: mongodb-root-password
|
||||||
|
path: MONGODB_PREVIOUS_ROOT_PASSWORD
|
||||||
|
- name: mongodb-new-credentials
|
||||||
|
secret:
|
||||||
|
secretName: {{ template "mongodb.update-job.newSecretName" . }}
|
||||||
|
items:
|
||||||
|
- key: mongodb-root-password
|
||||||
|
path: MONGODB_NEW_ROOT_PASSWORD
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
- key: mongodb-passwords
|
||||||
|
path: MONGODB_NEW_EXTRA_PASSWORDS
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.username }}
|
||||||
|
- key: mongodb-metrics-password
|
||||||
|
path: MONGODB_NEW_METRICS_PASSWORD
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.passwordUpdateJob.extraVolumes }}
|
||||||
|
{{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraVolumes "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.passwordUpdateJob.enabled (include "mongodb.createSecret" .) (not ( include "mongodb.createPreviousSecret" . )) (not .Values.passwordUpdateJob.previousPasswords.existingSecret) }}
|
||||||
|
{{- $rootPassword := .Values.auth.rootPassword }}
|
||||||
|
{{- $metricsPassword := .Values.metrics.password }}
|
||||||
|
{{- $customUsers := include "mongodb.customUsers" . }}
|
||||||
|
{{- $customPasswords := join "," (include "mongodb.customPasswords" .) }}
|
||||||
|
{{- $customDatabases := include "mongodb.customDatabases" . }}
|
||||||
|
{{- $replicationPassword := .Values.auth.replicationPassword }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-new-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||||
|
namespace: {{ include "common.names.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/part-of: mongodb
|
||||||
|
{{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
mongodb-root-password: {{ required "The new root password is required!" $rootPassword | b64enc | quote }}
|
||||||
|
{{- if and (not (empty $customUsers)) (not (empty $customDatabases)) }}
|
||||||
|
mongodb-passwords: {{ required "The new custom passwords are required!" $customPasswords | b64enc | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.metrics.username }}
|
||||||
|
mongodb-metrics-password: {{ required "The new metrics password is required!" $metricsPassword | b64enc | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,21 @@
|
|||||||
|
{{- /*
|
||||||
|
Copyright Broadcom, Inc. All Rights Reserved.
|
||||||
|
SPDX-License-Identifier: APACHE-2.0
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.passwordUpdateJob.enabled (eq ( include "mongodb.createPreviousSecret" . ) "true") }}
|
||||||
|
{{- $rootPassword := .Values.passwordUpdateJob.previousPasswords.rootPassword }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ printf "%s-previous-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||||
|
namespace: {{ include "common.names.namespace" . | quote }}
|
||||||
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||||
|
app.kubernetes.io/part-of: mongodb
|
||||||
|
{{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }}
|
||||||
|
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }}
|
||||||
|
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
mongodb-root-password: {{ required "The previous root password is required!" $rootPassword | b64enc | quote }}
|
||||||
|
{{- end }}
|
||||||
232
freeleaps/helm-pkg/3rd/mongo/values.schema.json
Normal file
232
freeleaps/helm-pkg/3rd/mongo/values.schema.json
Normal file
@ -0,0 +1,232 @@
|
|||||||
|
{
|
||||||
|
"$schema": "http://json-schema.org/schema#",
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"architecture": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "MongoDB® architecture",
|
||||||
|
"form": true,
|
||||||
|
"description": "Allowed values: `standalone` or `replicaset`"
|
||||||
|
},
|
||||||
|
"auth": {
|
||||||
|
"type": "object",
|
||||||
|
"title": "Authentication configuration",
|
||||||
|
"form": true,
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean",
|
||||||
|
"title": "Enable Authentication",
|
||||||
|
"form": true
|
||||||
|
},
|
||||||
|
"rootUser": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "MongoDB® admin user",
|
||||||
|
"form": true,
|
||||||
|
"description": "Name of the admin user. Default is root"
|
||||||
|
},
|
||||||
|
"rootPassword": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "MongoDB® admin password",
|
||||||
|
"form": true,
|
||||||
|
"description": "Defaults to a random 10-character alphanumeric string if not set",
|
||||||
|
"hidden": {
|
||||||
|
"value": false,
|
||||||
|
"path": "auth/enabled"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"database": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "MongoDB® custom database",
|
||||||
|
"description": "Name of the custom database to be created during the 1st initialization of MongoDB®",
|
||||||
|
"form": true
|
||||||
|
},
|
||||||
|
"username": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "MongoDB® custom user",
|
||||||
|
"description": "Name of the custom user to be created during the 1st initialization of MongoDB®. This user only has permissions on the MongoDB® custom database",
|
||||||
|
"form": true
|
||||||
|
},
|
||||||
|
"password": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "Password for MongoDB® custom user",
|
||||||
|
"form": true,
|
||||||
|
"description": "Defaults to a random 10-character alphanumeric string if not set",
|
||||||
|
"hidden": {
|
||||||
|
"value": false,
|
||||||
|
"path": "auth/enabled"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"replicaSetKey": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "Key used for replica set authentication",
|
||||||
|
"form": true,
|
||||||
|
"description": "Defaults to a random 10-character alphanumeric string if not set",
|
||||||
|
"hidden": {
|
||||||
|
"value": "standalone",
|
||||||
|
"path": "architecture"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"replicaCount": {
|
||||||
|
"type": "integer",
|
||||||
|
"form": true,
|
||||||
|
"title": "Number of MongoDB® replicas",
|
||||||
|
"hidden": {
|
||||||
|
"value": "standalone",
|
||||||
|
"path": "architecture"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"configuration": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "MongoDB® Custom Configuration",
|
||||||
|
"form": true,
|
||||||
|
"render": "textArea"
|
||||||
|
},
|
||||||
|
"arbiter": {
|
||||||
|
"type": "object",
|
||||||
|
"title": "Arbiter configuration",
|
||||||
|
"form": true,
|
||||||
|
"properties": {
|
||||||
|
"configuration": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "Arbiter Custom Configuration",
|
||||||
|
"form": true,
|
||||||
|
"render": "textArea",
|
||||||
|
"hidden": {
|
||||||
|
"value": "standalone",
|
||||||
|
"path": "architecture"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"networkPolicy": {
|
||||||
|
"type": "object",
|
||||||
|
"title": "Network policy configuration",
|
||||||
|
"form": true,
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean",
|
||||||
|
"form": true,
|
||||||
|
"title": "Enable network policy",
|
||||||
|
"description": "Enable network policy using Kubernetes native NP",
|
||||||
|
"hidden": {
|
||||||
|
"value": false,
|
||||||
|
"path": "networkPolicy/enabled"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"ingress": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"namespaceSelector": {
|
||||||
|
"type": "object",
|
||||||
|
"title": "Namespace selector label that is allowed to access this instance",
|
||||||
|
"hidden": {
|
||||||
|
"value": {},
|
||||||
|
"path": "networkPolicy/ingress/namespaceSelector"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"podSelector": {
|
||||||
|
"type": "object",
|
||||||
|
"title": "Pod selector label that is allowed to access this instance",
|
||||||
|
"hidden": {
|
||||||
|
"value": {},
|
||||||
|
"path": "networkPolicy/ingress/podSelector"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"customRules": {
|
||||||
|
"type": "array",
|
||||||
|
"title": "Custom rules for ingress network policy",
|
||||||
|
"hidden": {
|
||||||
|
"value": [],
|
||||||
|
"path": "networkPolicy/ingress/customRules"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"egress": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"customRules": {
|
||||||
|
"type": "array",
|
||||||
|
"title": "Custom rules for egress network policy",
|
||||||
|
"hidden": {
|
||||||
|
"value": [],
|
||||||
|
"path": "networkPolicy/egress/customRules"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"persistence": {
|
||||||
|
"type": "object",
|
||||||
|
"title": "Persistence configuration",
|
||||||
|
"form": true,
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean",
|
||||||
|
"form": true,
|
||||||
|
"title": "Enable persistence",
|
||||||
|
"description": "Enable persistence using Persistent Volume Claims"
|
||||||
|
},
|
||||||
|
"size": {
|
||||||
|
"type": "string",
|
||||||
|
"title": "Persistent Volume Size",
|
||||||
|
"form": true,
|
||||||
|
"render": "slider",
|
||||||
|
"sliderMin": 1,
|
||||||
|
"sliderMax": 100,
|
||||||
|
"sliderUnit": "Gi",
|
||||||
|
"hidden": {
|
||||||
|
"value": false,
|
||||||
|
"path": "persistence/enabled"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"volumePermissions": {
|
||||||
|
"type": "object",
|
||||||
|
"hidden": {
|
||||||
|
"value": false,
|
||||||
|
"path": "persistence/enabled"
|
||||||
|
},
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean",
|
||||||
|
"form": true,
|
||||||
|
"title": "Enable Init Containers",
|
||||||
|
"description": "Use an init container to set required folder permissions on the data volume before mounting it in the final destination"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"metrics": {
|
||||||
|
"type": "object",
|
||||||
|
"form": true,
|
||||||
|
"title": "Prometheus metrics details",
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean",
|
||||||
|
"title": "Create Prometheus metrics exporter",
|
||||||
|
"description": "Create a side-car container to expose Prometheus metrics",
|
||||||
|
"form": true
|
||||||
|
},
|
||||||
|
"serviceMonitor": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"enabled": {
|
||||||
|
"type": "boolean",
|
||||||
|
"title": "Create Prometheus Operator ServiceMonitor",
|
||||||
|
"description": "Create a ServiceMonitor to track metrics using Prometheus Operator",
|
||||||
|
"form": true,
|
||||||
|
"hidden": {
|
||||||
|
"value": false,
|
||||||
|
"path": "metrics/enabled"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
2660
freeleaps/helm-pkg/3rd/mongo/values.yaml
Normal file
2660
freeleaps/helm-pkg/3rd/mongo/values.yaml
Normal file
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user