Change chart directory structure
This commit is contained in:
wbsong111
@@ -0,0 +1,340 @@
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
⚠ WARNING: Since August 28th, 2025, only a limited subset of images/charts are available for free.
|
||||
Subscribe to Bitnami Secure Images to receive continued support and security updates.
|
||||
More info at https://bitnami.com and https://github.com/bitnami/containers/issues/83267
|
||||
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||
|
||||
Get the list of pods by executing:
|
||||
|
||||
kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||
|
||||
Access the pod you want to debug by executing
|
||||
|
||||
kubectl exec --namespace {{ .Release.Namespace }} -ti <NAME OF THE POD> -- bash
|
||||
|
||||
In order to replicate the container startup scripts execute this command:
|
||||
|
||||
/opt/bitnami/scripts/kafka/entrypoint.sh /opt/bitnami/scripts/kafka/run.sh
|
||||
|
||||
{{- else }}
|
||||
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $clientPort := int .Values.listeners.client.containerPort }}
|
||||
|
||||
{{- if and (or (eq .Values.service.type "LoadBalancer") .Values.externalAccess.enabled) (eq (upper .Values.listeners.external.protocol) "PLAINTEXT") }}
|
||||
---------------------------------------------------------------------------------------------
|
||||
WARNING
|
||||
|
||||
By specifying "serviceType=LoadBalancer" and not configuring the authentication
|
||||
you have most likely exposed the Kafka service externally without any
|
||||
authentication mechanism.
|
||||
|
||||
For security reasons, we strongly suggest that you switch to "ClusterIP" or
|
||||
"NodePort". As alternative, you can also configure the Kafka authentication.
|
||||
|
||||
---------------------------------------------------------------------------------------------
|
||||
{{- end }}
|
||||
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
Kafka can be accessed by consumers via port {{ $clientPort }} on the following DNS name from within your cluster:
|
||||
|
||||
{{ $fullname }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}
|
||||
|
||||
Each Kafka broker can be accessed by producers via port {{ $clientPort }} on the following DNS name(s) from within your cluster:
|
||||
|
||||
{{- $brokerList := list }}
|
||||
{{- if not .Values.controller.controllerOnly }}
|
||||
{{- range $i := until (int .Values.controller.replicaCount) }}
|
||||
{{- $brokerList = append $brokerList (printf "%s-controller-%d.%s-controller-headless.%s.svc.%s:%d" $fullname $i $fullname $releaseNamespace $clusterDomain $clientPort) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $i := until (int .Values.broker.replicaCount) }}
|
||||
{{- $brokerList = append $brokerList (printf "%s-broker-%d.%s-broker-headless.%s.svc.%s:%d" $fullname $i $fullname $releaseNamespace $clusterDomain $clientPort) }}
|
||||
{{- end }}
|
||||
{{ join "\n" $brokerList | nindent 4 }}
|
||||
{{- $clientSaslEnabled := regexFind "SASL" (upper .Values.listeners.client.protocol) }}
|
||||
{{- $clientSslEnabled := regexFind "SSL" (upper .Values.listeners.client.protocol) }}
|
||||
{{- $clientMTlsEnabled := or (and .Values.listeners.client.sslClientAuth (not (eq .Values.listeners.client.sslClientAuth "none"))) (and (empty .Values.listeners.client.sslClientAuth) (not (eq .Values.tls.sslClientAuth "none"))) }}
|
||||
{{- if or $clientSaslEnabled $clientSslEnabled }}
|
||||
|
||||
The {{ upper .Values.listeners.client.name }} listener for Kafka client connections from within your cluster have been configured with the following security settings:
|
||||
{{- if $clientSaslEnabled }}
|
||||
- SASL authentication
|
||||
{{- end }}
|
||||
{{- if $clientSslEnabled }}
|
||||
- TLS encryption
|
||||
{{- end }}
|
||||
{{- if and $clientSslEnabled $clientMTlsEnabled }}
|
||||
- mTLS authentication
|
||||
{{- end }}
|
||||
|
||||
To connect a client to your Kafka, you need to create the 'client.properties' configuration files with the content below:
|
||||
|
||||
security.protocol={{ .Values.listeners.client.protocol }}
|
||||
{{- if $clientSaslEnabled }}
|
||||
{{- if regexFind "OAUTHBEARER" (upper .Values.sasl.enabledMechanisms ) }}
|
||||
sasl.jaas.config="org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required"\
|
||||
clientId="<Valid id From OAUTH provider>" \
|
||||
password="<Valid password for id from OAUTH provider>";
|
||||
sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler
|
||||
sasl.oauthbearer.token.endpoint.url={{ .Values.sasl.oauthbearer.tokenEndpointUrl }}
|
||||
{{- else }}
|
||||
{{- if regexFind "SCRAM-SHA-256" (upper .Values.sasl.enabledMechanisms) }}
|
||||
sasl.mechanism=SCRAM-SHA-256
|
||||
{{- else if regexFind "SCRAM-SHA-512" (upper .Values.sasl.enabledMechanisms) }}
|
||||
sasl.mechanism=SCRAM-SHA-512
|
||||
{{- else if regexFind "PLAIN" (upper .Values.sasl.enabledMechanisms) }}
|
||||
sasl.mechanism=PLAIN
|
||||
{{- end }}
|
||||
{{- $securityModule := ternary "org.apache.kafka.common.security.scram.ScramLoginModule required" "org.apache.kafka.common.security.plain.PlainLoginModule required" (regexMatch "SCRAM" (upper .Values.sasl.enabledMechanisms)) }}
|
||||
sasl.jaas.config={{ $securityModule }} \
|
||||
username="{{ index .Values.sasl.client.users 0 }}" \
|
||||
password="$(kubectl get secret {{ $fullname }}-user-passwords --namespace {{ $releaseNamespace }} -o jsonpath='{.data.client-passwords}' | base64 -d | cut -d , -f 1)";
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $clientSslEnabled }}
|
||||
{{- $clientTlsType := upper .Values.tls.type }}
|
||||
ssl.truststore.type={{ $clientTlsType }}
|
||||
{{- if eq $clientTlsType "JKS" }}
|
||||
ssl.truststore.location=/tmp/kafka.truststore.jks
|
||||
# Uncomment this line if your client truststore is password protected
|
||||
#ssl.truststore.password=
|
||||
{{- else if eq $clientTlsType "PEM" }}
|
||||
ssl.truststore.certificates=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
{{- end }}
|
||||
{{- if and $clientMTlsEnabled }}
|
||||
ssl.keystore.type={{ $clientTlsType }}
|
||||
{{- if eq $clientTlsType "JKS" }}
|
||||
ssl.keystore.location=/tmp/client.keystore.jks
|
||||
# Uncomment this line if your client truststore is password protected
|
||||
#ssl.keystore.password=
|
||||
{{- else if eq $clientTlsType "PEM" }}
|
||||
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
ssl.keystore.key=-----BEGIN ENCRYPTED PRIVATE KEY----- \
|
||||
... \
|
||||
-----END ENCRYPTED PRIVATE KEY-----
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.tls.endpointIdentificationAlgorithm "" }}
|
||||
ssl.endpoint.identification.algorithm=
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
To create a pod that you can use as a Kafka client run the following commands:
|
||||
|
||||
kubectl run {{ $fullname }}-client --restart='Never' --image {{ template "kafka.image" . }} --namespace {{ $releaseNamespace }} --command -- sleep infinity
|
||||
{{- if or $clientSaslEnabled $clientSslEnabled }}
|
||||
kubectl cp --namespace {{ $releaseNamespace }} /path/to/client.properties {{ $fullname }}-client:/tmp/client.properties
|
||||
{{- end }}
|
||||
{{- if and $clientSslEnabled (eq (upper .Values.tls.type) "JKS") }}
|
||||
kubectl cp --namespace {{ $releaseNamespace }} ./kafka.truststore.jks {{ $fullname }}-client:/tmp/kafka.truststore.jks
|
||||
{{- if $clientMTlsEnabled }}
|
||||
kubectl cp --namespace {{ $releaseNamespace }} ./client.keystore.jks {{ $fullname }}-client:/tmp/client.keystore.jks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
kubectl exec --tty -i {{ $fullname }}-client --namespace {{ $releaseNamespace }} -- bash
|
||||
|
||||
PRODUCER:
|
||||
kafka-console-producer.sh \
|
||||
{{- if or $clientSaslEnabled $clientSslEnabled }}
|
||||
--producer.config /tmp/client.properties \
|
||||
{{- end }}
|
||||
--bootstrap-server {{ $fullname }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ .Values.service.ports.client }} \
|
||||
--topic test
|
||||
|
||||
CONSUMER:
|
||||
kafka-console-consumer.sh \
|
||||
{{- if or $clientSaslEnabled $clientSslEnabled }}
|
||||
--consumer.config /tmp/client.properties \
|
||||
{{- end }}
|
||||
--bootstrap-server {{ $fullname }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}:{{ .Values.service.ports.client }} \
|
||||
--topic test \
|
||||
--from-beginning
|
||||
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
{{- if or (not .Values.controller.controllerOnly) .Values.externalAccess.controller.forceExpose }}
|
||||
|
||||
{{- if and .Values.controller.controllerOnly .Values.externalAccess.controller.forceExpose }}
|
||||
To connect to your Kafka controller-only nodes from outside the cluster, follow these instructions:
|
||||
{{- else }}
|
||||
To connect to your Kafka controller+broker nodes from outside the cluster, follow these instructions:
|
||||
{{- end }}
|
||||
|
||||
{{- if eq "NodePort" .Values.externalAccess.controller.service.type }}
|
||||
{{- if .Values.externalAccess.controller.service.domain }}
|
||||
Kafka brokers domain: Use your provided hostname to reach Kafka brokers, {{ .Values.externalAccess.controller.service.domain }}
|
||||
|
||||
{{- else }}
|
||||
Kafka brokers domain: You can get the external node IP from the Kafka configuration file with the following commands (Check the EXTERNAL listener)
|
||||
|
||||
1. Obtain the pod name:
|
||||
|
||||
kubectl get pods --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka"
|
||||
|
||||
2. Obtain pod configuration:
|
||||
|
||||
kubectl exec -it KAFKA_POD -- cat /opt/bitnami/kafka/config/server.properties | grep advertised.listeners
|
||||
|
||||
{{- end }}
|
||||
Kafka brokers port: You will have a different node port for each Kafka broker. You can get the list of configured node ports using the command below:
|
||||
|
||||
echo "$(kubectl get svc --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -o jsonpath='{.items[*].spec.ports[0].nodePort}' | tr ' ' '\n')"
|
||||
|
||||
{{- else if eq "LoadBalancer" .Values.externalAccess.controller.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IPs to be available.
|
||||
|
||||
Watch the status with: 'kubectl get svc --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -w'
|
||||
|
||||
Kafka Brokers domain: You will have a different external IP for each Kafka broker. You can get the list of external IPs using the command below:
|
||||
|
||||
echo "$(kubectl get svc --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -o jsonpath='{.items[*].status.loadBalancer.ingress[0].ip}' | tr ' ' '\n')"
|
||||
|
||||
Kafka Brokers port: {{ .Values.externalAccess.controller.service.ports.external }}
|
||||
|
||||
{{- else if eq "ClusterIP" .Values.externalAccess.controller.service.type }}
|
||||
Kafka brokers domain: Use your provided hostname to reach Kafka brokers, {{ .Values.externalAccess.controller.service.domain }}
|
||||
|
||||
Kafka brokers port: You will have a different port for each Kafka broker starting at {{ .Values.externalAccess.controller.service.ports.external }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- $brokerReplicaCount := int .Values.broker.replicaCount -}}
|
||||
{{- if gt $brokerReplicaCount 0 }}
|
||||
To connect to your Kafka broker nodes from outside the cluster, follow these instructions:
|
||||
|
||||
{{- if eq "NodePort" .Values.externalAccess.broker.service.type }}
|
||||
{{- if .Values.externalAccess.broker.service.domain }}
|
||||
Kafka brokers domain: Use your provided hostname to reach Kafka brokers, {{ .Values.externalAccess.broker.service.domain }}
|
||||
|
||||
{{- else }}
|
||||
Kafka brokers domain: You can get the external node IP from the Kafka configuration file with the following commands (Check the EXTERNAL listener)
|
||||
|
||||
1. Obtain the pod name:
|
||||
|
||||
kubectl get pods --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka"
|
||||
|
||||
2. Obtain pod configuration:
|
||||
|
||||
kubectl exec -it KAFKA_POD -- cat /opt/bitnami/kafka/config/server.properties | grep advertised.listeners
|
||||
|
||||
{{- end }}
|
||||
Kafka brokers port: You will have a different node port for each Kafka broker. You can get the list of configured node ports using the command below:
|
||||
|
||||
echo "$(kubectl get svc --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -o jsonpath='{.items[*].spec.ports[0].nodePort}' | tr ' ' '\n')"
|
||||
|
||||
{{- else if eq "LoadBalancer" .Values.externalAccess.broker.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IPs to be available.
|
||||
|
||||
Watch the status with: 'kubectl get svc --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -w'
|
||||
|
||||
Kafka Brokers domain: You will have a different external IP for each Kafka broker. You can get the list of external IPs using the command below:
|
||||
|
||||
echo "$(kubectl get svc --namespace {{ include "common.names.namespace" . }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka,pod" -o jsonpath='{.items[*].status.loadBalancer.ingress[0].ip}' | tr ' ' '\n')"
|
||||
|
||||
Kafka Brokers port: {{ .Values.externalAccess.broker.service.ports.external }}
|
||||
|
||||
{{- else if eq "ClusterIP" .Values.externalAccess.broker.service.type }}
|
||||
Kafka brokers domain: Use your provided hostname to reach Kafka brokers, {{ .Values.externalAccess.broker.service.domain }}
|
||||
|
||||
Kafka brokers port: You will have a different port for each Kafka broker starting at {{ .Values.externalAccess.broker.service.ports.external }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or $clientSaslEnabled $clientSslEnabled }}
|
||||
{{- $externalSaslEnabled := regexFind "SASL" (upper .Values.listeners.external.protocol) }}
|
||||
{{- $externalSslEnabled := regexFind "SSL" (upper .Values.listeners.external.protocol) }}
|
||||
{{- $externalMTlsEnabled := or (and .Values.listeners.external.sslClientAuth (not (eq .Values.listeners.external.sslClientAuth "none"))) (and (empty .Values.listeners.external.sslClientAuth) (not (eq .Values.tls.sslClientAuth "none"))) }}
|
||||
|
||||
The {{ upper .Values.listeners.external.name }} listener for Kafka client connections from within your cluster have been configured with the following settings:
|
||||
{{- if $externalSaslEnabled }}
|
||||
- SASL authentication
|
||||
{{- end }}
|
||||
{{- if $externalSslEnabled }}
|
||||
- TLS encryption
|
||||
{{- end }}
|
||||
{{- if and $externalSslEnabled $externalMTlsEnabled }}
|
||||
- mTLS authentication
|
||||
{{- end }}
|
||||
|
||||
To connect a client to your Kafka, you need to create the 'client.properties' configuration files with the content below:
|
||||
|
||||
security.protocol={{ .Values.listeners.external.protocol }}
|
||||
{{- if $externalSaslEnabled }}
|
||||
{{- if regexFind "OAUTHBEARER" (upper .Values.sasl.enabledMechanisms ) }}
|
||||
sasl.jaas.config="org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required"\
|
||||
clientId="<Valid id From OAUTH provider>" \
|
||||
password="<Valid password for id from OAUTH provider>";
|
||||
sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler
|
||||
sasl.oauthbearer.token.endpoint.url={{ .Values.sasl.oauthbearer.tokenEndpointUrl }}
|
||||
{{- else }}
|
||||
{{- if regexFind "SCRAM-SHA-256" (upper .Values.sasl.enabledMechanisms) }}
|
||||
sasl.mechanism=SCRAM-SHA-256
|
||||
{{- else if regexFind "SCRAM-SHA-512" (upper .Values.sasl.enabledMechanisms) }}
|
||||
sasl.mechanism=SCRAM-SHA-512
|
||||
{{- else }}
|
||||
sasl.mechanism=PLAIN
|
||||
{{- end }}
|
||||
{{- $securityModule := ternary "org.apache.kafka.common.security.scram.ScramLoginModule required" "org.apache.kafka.common.security.plain.PlainLoginModule required" (regexMatch "SCRAM" (upper .Values.sasl.enabledMechanisms)) }}
|
||||
sasl.jaas.config={{ $securityModule }} \
|
||||
username="{{ index .Values.sasl.client.users 0 }}" \
|
||||
password="$(kubectl get secret {{ $fullname }}-user-passwords --namespace {{ $releaseNamespace }} -o jsonpath='{.data.client-passwords}' | base64 -d | cut -d , -f 1)";
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $externalSslEnabled }}
|
||||
{{- $clientTlsType := upper .Values.tls.type }}
|
||||
ssl.truststore.type={{ $clientTlsType }}
|
||||
{{- if eq $clientTlsType "JKS" }}
|
||||
ssl.truststore.location=/tmp/kafka.truststore.jks
|
||||
# Uncomment this line if your client truststore is password protected
|
||||
#ssl.truststore.password=
|
||||
{{- else if eq $clientTlsType "PEM" }}
|
||||
ssl.truststore.certificates=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
{{- end }}
|
||||
{{- if and $externalMTlsEnabled }}
|
||||
ssl.keystore.type={{ $clientTlsType }}
|
||||
{{- if eq $clientTlsType "JKS" }}
|
||||
ssl.keystore.location=/tmp/client.keystore.jks
|
||||
# Uncomment this line if your client truststore is password protected
|
||||
#ssl.keystore.password=
|
||||
{{- else if eq $clientTlsType "PEM" }}
|
||||
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE----- \
|
||||
... \
|
||||
-----END CERTIFICATE-----
|
||||
ssl.keystore.key=-----BEGIN ENCRYPTED PRIVATE KEY----- \
|
||||
... \
|
||||
-----END ENCRYPTED PRIVATE KEY-----
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.tls.endpointIdentificationAlgorithm "" }}
|
||||
ssl.endpoint.identification.algorithm=
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "broker" "controller" "metrics.jmx" "provisioning" "defaultInitContainers.volumePermissions" "defaultInitContainers.prepareConfig" "defaultInitContainers.autoDiscovery") "context" $) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.defaultInitContainers.volumePermissions.image .Values.defaultInitContainers.autoDiscovery.image .Values.metrics.jmx.image) "context" $) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.defaultInitContainers.volumePermissions.image .Values.defaultInitContainers.autoDiscovery.image .Values.metrics.jmx.image) "context" $) }}
|
||||
{{- include "kafka.checkRollingTags" . }}
|
||||
{{- include "kafka.validateValues" . }}
|
||||
@@ -0,0 +1,998 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return the proper Kafka controller-eligible fullname
|
||||
*/}}
|
||||
{{- define "kafka.controller.fullname" -}}
|
||||
{{- printf "%s-controller" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Kafka broker fullname
|
||||
*/}}
|
||||
{{- define "kafka.broker.fullname" -}}
|
||||
{{- printf "%s-broker" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "kafka.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Kafka image name
|
||||
*/}}
|
||||
{{- define "kafka.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "kafka.volumePermissions.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.defaultInitContainers.volumePermissions.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container auto-discovery image)
|
||||
*/}}
|
||||
{{- define "kafka.autoDiscovery.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.defaultInitContainers.autoDiscovery.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper JMX exporter image name
|
||||
*/}}
|
||||
{{- define "kafka.metrics.jmx.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.metrics.jmx.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "kafka.imagePullSecrets" -}}
|
||||
{{ include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.defaultInitContainers.volumePermissions.image .Values.defaultInitContainers.autoDiscovery.image .Values.metrics.jmx.image) "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if encryption via TLS for client connections should be configured
|
||||
*/}}
|
||||
{{- define "kafka.sslEnabled" -}}
|
||||
{{- $res := "" -}}
|
||||
{{- $listeners := list .Values.listeners.client .Values.listeners.interbroker .Values.listeners.controller -}}
|
||||
{{- range $i := .Values.listeners.extraListeners -}}
|
||||
{{- $listeners = append $listeners $i -}}
|
||||
{{- end -}}
|
||||
{{- if and .Values.externalAccess.enabled -}}
|
||||
{{- $listeners = append $listeners .Values.listeners.external -}}
|
||||
{{- end -}}
|
||||
{{- range $listener := $listeners -}}
|
||||
{{- if regexFind "SSL" (upper $listener.protocol) -}}
|
||||
{{- $res = "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $res -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if SASL connections should be configured
|
||||
*/}}
|
||||
{{- define "kafka.saslEnabled" -}}
|
||||
{{- $res := "" -}}
|
||||
{{- if include "kafka.client.saslEnabled" . -}}
|
||||
{{- $res = "true" -}}
|
||||
{{- else -}}
|
||||
{{- $listeners := list .Values.listeners.interbroker .Values.listeners.controller -}}
|
||||
{{- range $listener := $listeners -}}
|
||||
{{- if regexFind "SASL" (upper $listener.protocol) -}}
|
||||
{{- $res = "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $res -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if SASL connections should be configured
|
||||
*/}}
|
||||
{{- define "kafka.client.saslEnabled" -}}
|
||||
{{- $res := "" -}}
|
||||
{{- $listeners := list .Values.listeners.client -}}
|
||||
{{- range $i := .Values.listeners.extraListeners -}}
|
||||
{{- $listeners = append $listeners $i -}}
|
||||
{{- end -}}
|
||||
{{- if and .Values.externalAccess.enabled -}}
|
||||
{{- $listeners = append $listeners .Values.listeners.external -}}
|
||||
{{- end -}}
|
||||
{{- range $listener := $listeners -}}
|
||||
{{- if regexFind "SASL" (upper $listener.protocol) -}}
|
||||
{{- $res = "true" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $res -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if a SASL mechanism that uses usernames and passwords is in use
|
||||
*/}}
|
||||
{{- define "kafka.saslUserPasswordsEnabled" -}}
|
||||
{{- if (include "kafka.saslEnabled" .) -}}
|
||||
{{- if or (regexFind "PLAIN" (upper .Values.sasl.enabledMechanisms)) (regexFind "SCRAM" (upper .Values.sasl.enabledMechanisms)) -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns true if a SASL mechanism that uses client IDs and client secrets is in use
|
||||
*/}}
|
||||
{{- define "kafka.saslClientSecretsEnabled" -}}
|
||||
{{- if (include "kafka.saslEnabled" .) -}}
|
||||
{{- if (regexFind "OAUTHBEARER" (upper .Values.sasl.enabledMechanisms)) -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the security module based on the provided sasl mechanism
|
||||
*/}}
|
||||
{{- define "kafka.saslSecurityModule" -}}
|
||||
{{- if eq "PLAIN" .mechanism -}}
|
||||
org.apache.kafka.common.security.plain.PlainLoginModule required
|
||||
{{- else if regexFind "SCRAM" .mechanism -}}
|
||||
org.apache.kafka.common.security.scram.ScramLoginModule required
|
||||
{{- else if eq "OAUTHBEARER" .mechanism -}}
|
||||
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka Kraft secret
|
||||
*/}}
|
||||
{{- define "kafka.kraftSecretName" -}}
|
||||
{{- if .Values.existingKraftSecret -}}
|
||||
{{- print (tpl .Values.existingKraftSecret .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-kraft" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka SASL credentials secret
|
||||
*/}}
|
||||
{{- define "kafka.saslSecretName" -}}
|
||||
{{- if .Values.sasl.existingSecret -}}
|
||||
{{- print (tpl .Values.sasl.existingSecret .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-user-passwords" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a SASL credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.createSaslSecret" -}}
|
||||
{{- if and (include "kafka.saslEnabled" .) (empty .Values.sasl.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.tlsSecretName" -}}
|
||||
{{- if .Values.tls.existingSecret -}}
|
||||
{{- print (tpl .Values.tls.existingSecret .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-tls" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.createTlsSecret" -}}
|
||||
{{- if and (include "kafka.sslEnabled" .) (empty .Values.tls.existingSecret) .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "helm") -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a Certificate object should be created
|
||||
*/}}
|
||||
{{- define "kafka.createCertificate" -}}
|
||||
{{- if and (include "kafka.sslEnabled" .) (empty .Values.tls.existingSecret) .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka TLS credentials secret
|
||||
*/}}
|
||||
{{- define "kafka.tlsPasswordsSecretName" -}}
|
||||
{{- if .Values.tls.passwordsSecret -}}
|
||||
{{- print (tpl .Values.tls.passwordsSecret .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-tls-passwords" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.createTlsPasswordsSecret" -}}
|
||||
{{- if and (include "kafka.sslEnabled" .) (or (empty .Values.tls.passwordsSecret) .Values.tls.autoGenerated.enabled) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the secret name for the Kafka Provisioning client
|
||||
*/}}
|
||||
{{- define "kafka.client.passwordsSecretName" -}}
|
||||
{{- if .Values.provisioning.auth.tls.passwordsSecret -}}
|
||||
{{- print (tpl .Values.provisioning.auth.tls.passwordsSecret .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-client-secret" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use for the Kafka Provisioning client
|
||||
*/}}
|
||||
{{- define "kafka.provisioning.serviceAccountName" -}}
|
||||
{{- if .Values.provisioning.serviceAccount.create -}}
|
||||
{{ default (printf "%s-provisioning" (include "common.names.fullname" .)) .Values.provisioning.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.provisioning.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka controller-eligible configuration configmap
|
||||
*/}}
|
||||
{{- define "kafka.controller.configmapName" -}}
|
||||
{{- if .Values.controller.existingConfigmap -}}
|
||||
{{- print (tpl .Values.controller.existingConfigmap .) -}}
|
||||
{{- else if .Values.existingConfigmap -}}
|
||||
{{- print (tpl .Values.existingConfigmap .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-configuration" (include "kafka.controller.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka controller-eligible secret configuration
|
||||
*/}}
|
||||
{{- define "kafka.controller.secretConfigName" -}}
|
||||
{{- if .Values.controller.existingSecretConfig -}}
|
||||
{{- print (tpl .Values.controller.existingSecretConfig .) -}}
|
||||
{{- else if .Values.existingSecretConfig -}}
|
||||
{{- print (tpl .Values.controller.existingSecretConfig .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-secret-configuration" (include "kafka.controller.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka controller-eligible secret configuration values
|
||||
*/}}
|
||||
{{- define "kafka.controller.secretConfig" -}}
|
||||
{{- if .Values.secretConfig }}
|
||||
{{- print (tpl .Values.secretConfig .) -}}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.secretConfig }}
|
||||
{{- print (tpl .Values.controller.secretConfig .) -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a configmap object should be created for controller-eligible pods
|
||||
*/}}
|
||||
{{- define "kafka.controller.createConfigmap" -}}
|
||||
{{- if and (not .Values.controller.existingConfigmap) (not .Values.existingConfigmap) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret object with config should be created for controller-eligible pods
|
||||
*/}}
|
||||
{{- define "kafka.controller.createSecretConfig" -}}
|
||||
{{- if and (or .Values.controller.secretConfig .Values.secretConfig) (and (not .Values.controller.existingSecretConfig) (not .Values.existingSecretConfig)) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{/*
|
||||
Return true if a secret object with config exists for controller-eligible pods
|
||||
*/}}
|
||||
{{- define "kafka.controller.secretConfigExists" -}}
|
||||
{{- if or .Values.controller.secretConfig .Values.secretConfig .Values.controller.existingSecretConfig .Values.existingSecretConfig }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka broker configuration configmap
|
||||
*/}}
|
||||
{{- define "kafka.broker.configmapName" -}}
|
||||
{{- if .Values.broker.existingConfigmap -}}
|
||||
{{- print (tpl .Values.broker.existingConfigmap .) -}}
|
||||
{{- else if .Values.existingConfigmap -}}
|
||||
{{- print (tpl .Values.existingConfigmap .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-configuration" (include "kafka.broker.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka broker secret configuration
|
||||
*/}}
|
||||
{{- define "kafka.broker.secretConfigName" -}}
|
||||
{{- if .Values.broker.existingSecretConfig -}}
|
||||
{{- print (tpl .Values.broker.existingSecretConfig .) -}}
|
||||
{{- else if .Values.existingSecretConfig -}}
|
||||
{{- print (tpl .Values.existingSecretConfig .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-secret-configuration" (include "kafka.broker.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka broker secret configuration values
|
||||
*/}}
|
||||
{{- define "kafka.broker.secretConfig" -}}
|
||||
{{- if .Values.secretConfig }}
|
||||
{{- print (tpl .Values.secretConfig .) -}}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.secretConfig }}
|
||||
{{- print (tpl .Values.broker.secretConfig .) -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a configmap object should be created for broker pods
|
||||
*/}}
|
||||
{{- define "kafka.broker.createConfigmap" -}}
|
||||
{{- if and (not .Values.broker.existingConfigmap) (not .Values.existingConfigmap) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret object with config should be created for broker pods
|
||||
*/}}
|
||||
{{- define "kafka.broker.createSecretConfig" -}}
|
||||
{{- if and (or .Values.broker.secretConfig .Values.secretConfig) (and (not .Values.broker.existingSecretConfig) (not .Values.existingSecretConfig)) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret object with config exists for broker pods
|
||||
*/}}
|
||||
{{- define "kafka.broker.secretConfigExists" -}}
|
||||
{{- if or .Values.broker.secretConfig .Values.secretConfig .Values.broker.existingSecretConfig .Values.existingSecretConfig }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka log4j2 ConfigMap name.
|
||||
*/}}
|
||||
{{- define "kafka.log4j2.configMapName" -}}
|
||||
{{- if .Values.existingLog4j2ConfigMap -}}
|
||||
{{- print (tpl .Values.existingLog4j2ConfigMap .) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-log4j2-configuration" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka configuration configmap
|
||||
*/}}
|
||||
{{- define "kafka.metrics.jmx.configmapName" -}}
|
||||
{{- if .Values.metrics.jmx.existingConfigmap -}}
|
||||
{{- print (tpl .Values.metrics.jmx.existingConfigmap .) -}}
|
||||
{{- else -}}
|
||||
{{ printf "%s-jmx-configuration" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a configmap object should be created
|
||||
*/}}
|
||||
{{- define "kafka.metrics.jmx.createConfigmap" -}}
|
||||
{{- if and .Values.metrics.jmx.enabled .Values.metrics.jmx.config (not .Values.metrics.jmx.existingConfigmap) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the Kafka listeners settings based on the listeners.* object
|
||||
*/}}
|
||||
{{- define "kafka.listeners" -}}
|
||||
{{- if .context.Values.listeners.overrideListeners -}}
|
||||
{{- print .context.Values.listeners.overrideListeners -}}
|
||||
{{- else -}}
|
||||
{{- $listeners := list .context.Values.listeners.client .context.Values.listeners.interbroker -}}
|
||||
{{- if .context.Values.externalAccess.enabled -}}
|
||||
{{- $listeners = append $listeners .context.Values.listeners.external -}}
|
||||
{{- end -}}
|
||||
{{- if .isController -}}
|
||||
{{- if .context.Values.controller.controllerOnly -}}
|
||||
{{- $listeners = list .context.Values.listeners.controller -}}
|
||||
{{- else -}}
|
||||
{{- $listeners = append $listeners .context.Values.listeners.controller -}}
|
||||
{{- range $i := .context.Values.listeners.extraListeners -}}
|
||||
{{- $listeners = append $listeners $i -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- range $i := .context.Values.listeners.extraListeners -}}
|
||||
{{- $listeners = append $listeners $i -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $res := list -}}
|
||||
{{- range $listener := $listeners -}}
|
||||
{{- $res = append $res (printf "%s://:%d" (upper $listener.name) (int $listener.containerPort)) -}}
|
||||
{{- end -}}
|
||||
{{- join "," $res -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the list of advertised listeners, although the advertised address will be replaced during each node init time
|
||||
*/}}
|
||||
{{- define "kafka.advertisedListeners" -}}
|
||||
{{- if .Values.listeners.advertisedListeners -}}
|
||||
{{- print .Values.listeners.advertisedListeners -}}
|
||||
{{- else -}}
|
||||
{{- $listeners := list .Values.listeners.client .Values.listeners.interbroker -}}
|
||||
{{- range $i := .Values.listeners.extraListeners -}}
|
||||
{{- $listeners = append $listeners $i -}}
|
||||
{{- end -}}
|
||||
{{- $res := list -}}
|
||||
{{- range $listener := $listeners -}}
|
||||
{{- $res = append $res (printf "%s://advertised-address-placeholder:%d" (upper $listener.name) (int $listener.containerPort)) -}}
|
||||
{{- end -}}
|
||||
{{- join "," $res -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the value listener.security.protocol.map based on the values of 'listeners.*.protocol'
|
||||
*/}}
|
||||
{{- define "kafka.securityProtocolMap" -}}
|
||||
{{- if .context.Values.listeners.securityProtocolMap -}}
|
||||
{{- print .context.Values.listeners.securityProtocolMap -}}
|
||||
{{- else -}}
|
||||
{{- $listeners := list .context.Values.listeners.controller .context.Values.listeners.client .context.Values.listeners.interbroker -}}
|
||||
{{- if and .isController .context.Values.controller.controllerOnly -}}
|
||||
{{- $listeners = list .context.Values.listeners.controller -}}
|
||||
{{- else -}}
|
||||
{{- range $i := .context.Values.listeners.extraListeners -}}
|
||||
{{- $listeners = append $listeners $i -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .context.Values.externalAccess.enabled -}}
|
||||
{{- $listeners = append $listeners .context.Values.listeners.external -}}
|
||||
{{- end -}}
|
||||
{{- $res := list -}}
|
||||
{{- range $listener := $listeners -}}
|
||||
{{- $res = append $res (printf "%s:%s" (upper $listener.name) (upper $listener.protocol)) -}}
|
||||
{{- end -}}
|
||||
{{ join "," $res }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the containerPorts for listeners.extraListeners
|
||||
*/}}
|
||||
{{- define "kafka.extraListeners.containerPorts" -}}
|
||||
{{- range $listener := .Values.listeners.extraListeners -}}
|
||||
- name: {{ lower $listener.name}}
|
||||
containerPort: {{ $listener.containerPort }}
|
||||
{{ end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the controller quorum bootstrap servers based on the number of controller-eligible nodes
|
||||
*/}}
|
||||
{{- define "kafka.controller.quorumBootstrapServers" -}}
|
||||
{{- if .Values.controller.quorumBootstrapServers -}}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.controller.quorumBootstrapServers "context" $) -}}
|
||||
{{- else -}}
|
||||
{{- $fullname := include "kafka.controller.fullname" . }}
|
||||
{{- $serviceName := printf "%s-headless" (include "kafka.controller.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $releaseNamespace := include "common.names.namespace" . -}}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $port := int .Values.listeners.controller.containerPort }}
|
||||
{{- $bootstrapServers := list -}}
|
||||
{{- if and (.Values.controller.autoscaling) (.Values.controller.autoscaling.hpa) (.Values.controller.autoscaling.hpa.enabled) -}}
|
||||
{{- range $i := until (int .Values.controller.autoscaling.hpa.maxReplicas) -}}
|
||||
{{- $nodeAddress := printf "%s-%d.%s.%s.svc.%s:%d" $fullname (int $i) $serviceName $releaseNamespace $clusterDomain $port -}}
|
||||
{{- $bootstrapServers = append $bootstrapServers $nodeAddress -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- range $i := until (int .Values.controller.replicaCount) -}}
|
||||
{{- $nodeAddress := printf "%s-%d.%s.%s.svc.%s:%d" $fullname (int $i) $serviceName $releaseNamespace $clusterDomain $port -}}
|
||||
{{- if eq (int $.Values.kraftVersion) 0 }}
|
||||
{{- $nodeId := add (int $i) (int $.Values.controller.minId) -}}
|
||||
{{- $bootstrapServers = append $bootstrapServers (printf "%d@%s" $nodeId $nodeAddress ) -}}
|
||||
{{- else }}
|
||||
{{- $bootstrapServers = append $bootstrapServers $nodeAddress -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- join "," $bootstrapServers -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Section of the server.properties shared by both controller-eligible and broker nodes
|
||||
*/}}
|
||||
{{- define "kafka.commonConfig" -}}
|
||||
controller.listener.names: {{ .Values.listeners.controller.name }}
|
||||
{{- if eq (int .Values.kraftVersion) 0 }}
|
||||
controller.quorum.voters: {{ include "kafka.controller.quorumBootstrapServers" . }}
|
||||
{{- else }}
|
||||
controller.quorum.bootstrap.servers: {{ include "kafka.controller.quorumBootstrapServers" . }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" . }}
|
||||
# TLS configuration
|
||||
ssl.keystore.type: JKS
|
||||
ssl.truststore.type: JKS
|
||||
ssl.keystore.location: /opt/bitnami/kafka/config/certs/kafka.keystore.jks
|
||||
ssl.truststore.location: /opt/bitnami/kafka/config/certs/kafka.truststore.jks
|
||||
ssl.client.auth: {{ .Values.tls.sslClientAuth }}
|
||||
ssl.endpoint.identification.algorithm: {{ .Values.tls.endpointIdentificationAlgorithm }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.saslEnabled" .) }}
|
||||
# Listeners SASL JAAS configuration
|
||||
sasl.enabled.mechanisms: {{ upper .Values.sasl.enabledMechanisms }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.interbroker.protocol) }}
|
||||
sasl.mechanism.inter.broker.protocol: {{ upper .Values.sasl.interBrokerMechanism }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.controller.protocol) }}
|
||||
sasl.mechanism.controller.protocol: {{ upper .Values.sasl.controllerMechanism }}
|
||||
{{- end }}
|
||||
{{- $listeners := list .Values.listeners.client .Values.listeners.interbroker .Values.listeners.controller }}
|
||||
{{- range $i := .Values.listeners.extraListeners }}
|
||||
{{- $listeners = append $listeners $i }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
{{- $listeners = append $listeners .Values.listeners.external }}
|
||||
{{- end }}
|
||||
{{- range $listener := $listeners }}
|
||||
{{- if and $listener.sslClientAuth (regexFind "SSL" (upper $listener.protocol)) }}
|
||||
listener.name.{{lower $listener.name}}.ssl.client.auth: {{ $listener.sslClientAuth }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper $listener.protocol) }}
|
||||
{{- range $mechanism := splitList "," $.Values.sasl.enabledMechanisms }}
|
||||
{{- $securityModule := include "kafka.saslSecurityModule" (dict "mechanism" (upper $mechanism)) }}
|
||||
{{- if and (eq (upper $mechanism) "OAUTHBEARER") (or (eq $listener.name $.Values.listeners.interbroker.name) (eq $listener.name $.Values.listeners.controller.name)) }}
|
||||
listener.name.{{lower $listener.name}}.oauthbearer.sasl.login.callback.handler.class: org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler
|
||||
{{- end }}
|
||||
{{- $saslJaasConfig := list $securityModule }}
|
||||
{{- if eq $listener.name $.Values.listeners.interbroker.name }}
|
||||
{{- if (eq (upper $mechanism) "OAUTHBEARER") }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (printf "clientId=\"%s\"" $.Values.sasl.interbroker.clientId) }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (print "clientSecret=\"interbroker-client-secret-placeholder\"") }}
|
||||
{{- else }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (printf "username=\"%s\"" $.Values.sasl.interbroker.user) }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (print "password=\"interbroker-password-placeholder\"") }}
|
||||
{{- end }}
|
||||
{{- else if eq $listener.name $.Values.listeners.controller.name }}
|
||||
{{- if (eq (upper $mechanism) "OAUTHBEARER") }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (printf "clientId=\"%s\"" $.Values.sasl.controller.clientId) }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (print "clientSecret=\"controller-client-secret-placeholder\"") }}
|
||||
{{- else }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (printf "username=\"%s\"" $.Values.sasl.controller.user) }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (print "password=\"controller-password-placeholder\"") }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (upper $mechanism) "PLAIN" }}
|
||||
{{- if eq $listener.name $.Values.listeners.interbroker.name }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (printf "user_%s=\"interbroker-password-placeholder\"" $.Values.sasl.interbroker.user) }}
|
||||
{{- else if eq $listener.name $.Values.listeners.controller.name }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (printf "user_%s=\"controller-password-placeholder\"" $.Values.sasl.controller.user) }}
|
||||
{{- end }}
|
||||
{{- range $i, $user := $.Values.sasl.client.users }}
|
||||
{{- $saslJaasConfig = append $saslJaasConfig (printf "user_%s=\"password-placeholder-%d\"" $user (int $i)) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
listener.name.{{lower $listener.name}}.{{lower $mechanism}}.sasl.jaas.config: {{ printf "%s;" (join " " $saslJaasConfig) }}
|
||||
{{- if eq (upper $mechanism) "OAUTHBEARER" }}
|
||||
listener.name.{{lower $listener.name}}.oauthbearer.sasl.server.callback.handler.class: org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerValidatorCallbackHandler
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if regexFind "OAUTHBEARER" .Values.sasl.enabledMechanisms }}
|
||||
sasl.oauthbearer.token.endpoint.url: {{ .Values.sasl.oauthbearer.tokenEndpointUrl }}
|
||||
sasl.oauthbearer.jwks.endpoint.url: {{ .Values.sasl.oauthbearer.jwksEndpointUrl }}
|
||||
sasl.oauthbearer.expected.audience: {{ .Values.sasl.oauthbearer.expectedAudience }}
|
||||
sasl.oauthbearer.sub.claim.name: {{ .Values.sasl.oauthbearer.subClaimName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Environment variables required to configure SASL
|
||||
*/}}
|
||||
{{- define "kafka.saslEnv" -}}
|
||||
{{- if and (include "kafka.client.saslEnabled" . ) (include "kafka.saslUserPasswordsEnabled" .) .Values.sasl.client.users }}
|
||||
- name: KAFKA_CLIENT_USERS
|
||||
value: {{ join "," .Values.sasl.client.users | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: KAFKA_CLIENT_PASSWORDS_FILE
|
||||
value: /opt/bitnami/kafka/config/secrets/client-passwords
|
||||
{{- else }}
|
||||
- name: KAFKA_CLIENT_PASSWORDS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
key: client-passwords
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.interbroker.protocol) }}
|
||||
{{- if include "kafka.saslUserPasswordsEnabled" . }}
|
||||
- name: KAFKA_INTER_BROKER_USER
|
||||
value: {{ .Values.sasl.interbroker.user | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: KAFKA_INTER_BROKER_PASSWORD_FILE
|
||||
value: /opt/bitnami/kafka/config/secrets/inter-broker-password
|
||||
{{- else }}
|
||||
- name: KAFKA_INTER_BROKER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
key: inter-broker-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslClientSecretsEnabled" . }}
|
||||
- name: KAFKA_INTER_BROKER_CLIENT_ID
|
||||
value: {{ .Values.sasl.interbroker.clientId | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: KAFKA_INTER_BROKER_CLIENT_SECRET_FILE
|
||||
value: /opt/bitnami/kafka/config/secrets/inter-broker-client-secret
|
||||
{{- else }}
|
||||
- name: KAFKA_INTER_BROKER_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
key: inter-broker-client-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.controller.protocol) }}
|
||||
{{- if include "kafka.saslUserPasswordsEnabled" . }}
|
||||
- name: KAFKA_CONTROLLER_USER
|
||||
value: {{ .Values.sasl.controller.user | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: KAFKA_CONTROLLER_PASSWORD_FILE
|
||||
value: /opt/bitnami/kafka/config/secrets/controller-password
|
||||
{{- else }}
|
||||
- name: KAFKA_CONTROLLER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
key: controller-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslClientSecretsEnabled" . }}
|
||||
- name: KAFKA_CONTROLLER_CLIENT_ID
|
||||
value: {{ .Values.sasl.controller.clientId | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: KAFKA_CONTROLLER_CLIENT_SECRET_FILE
|
||||
value: /opt/bitnami/kafka/config/secrets/controller-client-secret
|
||||
{{- else }}
|
||||
- name: KAFKA_CONTROLLER_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
key: controller-client-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Environment variables shared by both controller-eligible and broker nodes
|
||||
*/}}
|
||||
{{- define "kafka.commonEnv" -}}
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: KAFKA_KRAFT_CLUSTER_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "kafka.kraftSecretName" . }}
|
||||
key: cluster-id
|
||||
{{- if and (include "kafka.saslEnabled" .) (or (regexFind "SCRAM" (upper .Values.sasl.enabledMechanisms)) (regexFind "SCRAM" (upper .Values.sasl.controllerMechanism)) (regexFind "SCRAM" (upper .Values.sasl.interBrokerMechanism))) }}
|
||||
- name: KAFKA_KRAFT_BOOTSTRAP_SCRAM_USERS
|
||||
value: "true"
|
||||
{{ include "kafka.saslEnv" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.enabled }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
- name: JMX_PORT
|
||||
value: {{ .Values.metrics.jmx.kafkaJmxPort | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Check if there are rolling tags in the images
|
||||
*/}}
|
||||
{{- define "kafka.checkRollingTags" -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.defaultInitContainers.volumePermissions.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.defaultInitContainers.autoDiscovery.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.metrics.jmx.image }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
{{- define "kafka.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.listener.protocols" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.controller.nodePortListLength" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.broker.nodePortListLength" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.controller.externalIPListLength" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.broker.externalIPListLength" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.brokerRackAwareness" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.domainSpecified" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceType" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessAutoDiscoveryRBAC" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessAutoDiscoveryIPsOrNames" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceList" (dict "element" "loadBalancerIPs" "context" .)) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceList" (dict "element" "loadBalancerNames" "context" .)) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceList" (dict "element" "loadBalancerAnnotations" "context" . )) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.saslMechanisms" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.tlsSecret" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.provisioning.tlsPasswords" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.missingController" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - Authentication protocols for Kafka */}}
|
||||
{{- define "kafka.validateValues.listener.protocols" -}}
|
||||
{{- $authProtocols := list "PLAINTEXT" "SASL_PLAINTEXT" "SASL_SSL" "SSL" -}}
|
||||
{{- if not .Values.listeners.securityProtocolMap -}}
|
||||
{{- $listeners := list .Values.listeners.client .Values.listeners.interbroker .Values.listeners.controller -}}
|
||||
{{- if and .Values.externalAccess.enabled -}}
|
||||
{{- $listeners = append $listeners .Values.listeners.external -}}
|
||||
{{- end -}}
|
||||
{{- $error := false -}}
|
||||
{{- range $listener := $listeners -}}
|
||||
{{- if not (has (upper $listener.protocol) $authProtocols) -}}
|
||||
{{- $error := true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $error -}}
|
||||
kafka: listeners.*.protocol
|
||||
Available authentication protocols are "PLAINTEXT" "SASL_PLAINTEXT" "SSL" "SASL_SSL"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - number of controller-eligible replicas must be the same as NodePort list in controller-eligible external service */}}
|
||||
{{- define "kafka.validateValues.controller.nodePortListLength" -}}
|
||||
{{- $replicaCount := int .Values.controller.replicaCount -}}
|
||||
{{- $nodePortListLength := len .Values.externalAccess.controller.service.nodePorts -}}
|
||||
{{- $nodePortListIsEmpty := empty .Values.externalAccess.controller.service.nodePorts -}}
|
||||
{{- $nodePortListLengthEqualsReplicaCount := eq $nodePortListLength $replicaCount -}}
|
||||
{{- $externalIPListIsEmpty := empty .Values.externalAccess.controller.service.externalIPs -}}
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.defaultInitContainers.autoDiscovery.enabled) (eq .Values.externalAccess.controller.service.type "NodePort") (or (and (not $nodePortListIsEmpty) (not $nodePortListLengthEqualsReplicaCount)) (and $nodePortListIsEmpty $externalIPListIsEmpty)) -}}
|
||||
kafka: .Values.externalAccess.controller.service.nodePorts
|
||||
Number of controller-eligible replicas and externalAccess.controller.service.nodePorts array length must be the same. Currently: replicaCount = {{ $replicaCount }} and length nodePorts = {{ $nodePortListLength }} - {{ $externalIPListIsEmpty }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - number of broker replicas must be the same as NodePort list in broker external service */}}
|
||||
{{- define "kafka.validateValues.broker.nodePortListLength" -}}
|
||||
{{- $replicaCount := int .Values.broker.replicaCount -}}
|
||||
{{- $nodePortListLength := len .Values.externalAccess.broker.service.nodePorts -}}
|
||||
{{- $nodePortListIsEmpty := empty .Values.externalAccess.broker.service.nodePorts -}}
|
||||
{{- $nodePortListLengthEqualsReplicaCount := eq $nodePortListLength $replicaCount -}}
|
||||
{{- $externalIPListIsEmpty := empty .Values.externalAccess.broker.service.externalIPs -}}
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.defaultInitContainers.autoDiscovery.enabled) (eq .Values.externalAccess.broker.service.type "NodePort") (or (and (not $nodePortListIsEmpty) (not $nodePortListLengthEqualsReplicaCount)) (and $nodePortListIsEmpty $externalIPListIsEmpty)) -}}
|
||||
kafka: .Values.externalAccess.broker.service.nodePorts
|
||||
Number of broker replicas and externalAccess.broker.service.nodePorts array length must be the same. Currently: replicaCount = {{ $replicaCount }} and length nodePorts = {{ $nodePortListLength }} - {{ $externalIPListIsEmpty }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - number of replicas must be the same as externalIPs list */}}
|
||||
{{- define "kafka.validateValues.controller.externalIPListLength" -}}
|
||||
{{- $replicaCount := int .Values.controller.replicaCount -}}
|
||||
{{- $externalIPListLength := len .Values.externalAccess.controller.service.externalIPs -}}
|
||||
{{- $externalIPListIsEmpty := empty .Values.externalAccess.controller.service.externalIPs -}}
|
||||
{{- $externalIPListEqualsReplicaCount := eq $externalIPListLength $replicaCount -}}
|
||||
{{- $nodePortListIsEmpty := empty .Values.externalAccess.controller.service.nodePorts -}}
|
||||
{{- if and .Values.externalAccess.enabled (or .Values.externalAccess.controller.forceExpose (not .Values.controller.controllerOnly)) (not .Values.defaultInitContainers.autoDiscovery.enabled) (eq .Values.externalAccess.controller.service.type "NodePort") (or (and (not $externalIPListIsEmpty) (not $externalIPListEqualsReplicaCount)) (and $externalIPListIsEmpty $nodePortListIsEmpty)) -}}
|
||||
kafka: .Values.externalAccess.controller.service.externalIPs
|
||||
Number of controller-eligible replicas and externalAccess.controller.service.externalIPs array length must be the same. Currently: replicaCount = {{ $replicaCount }} and length externalIPs = {{ $externalIPListLength }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - number of replicas must be the same as externalIPs list */}}
|
||||
{{- define "kafka.validateValues.broker.externalIPListLength" -}}
|
||||
{{- $replicaCount := int .Values.broker.replicaCount -}}
|
||||
{{- $externalIPListLength := len .Values.externalAccess.broker.service.externalIPs -}}
|
||||
{{- $externalIPListIsEmpty := empty .Values.externalAccess.broker.service.externalIPs -}}
|
||||
{{- $externalIPListEqualsReplicaCount := eq $externalIPListLength $replicaCount -}}
|
||||
{{- $nodePortListIsEmpty := empty .Values.externalAccess.broker.service.nodePorts -}}
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.defaultInitContainers.autoDiscovery.enabled) (eq .Values.externalAccess.broker.service.type "NodePort") (or (and (not $externalIPListIsEmpty) (not $externalIPListEqualsReplicaCount)) (and $externalIPListIsEmpty $nodePortListIsEmpty)) -}}
|
||||
kafka: .Values.externalAccess.broker.service.externalIPs
|
||||
Number of broker replicas and externalAccess.broker.service.externalIPs array length must be the same. Currently: replicaCount = {{ $replicaCount }} and length externalIPs = {{ $externalIPListLength }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - broker rack assignment allowed values */}}
|
||||
{{- define "kafka.validateValues.brokerRackAwareness" -}}
|
||||
{{- if and .Values.brokerRackAwareness.enabled (ne .Values.brokerRackAwareness.cloudProvider "aws-az") (ne .Values.brokerRackAwareness.cloudProvider "azure") -}}
|
||||
kafka: .Values.brokerRackAwareness.cloudProvider
|
||||
Available values for the cloud provider to use for broker rack awareness are "aws-az" or "azure"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - domain must be defined if external service type ClusterIP */}}
|
||||
{{- define "kafka.validateValues.domainSpecified" -}}
|
||||
{{- if and (eq .Values.externalAccess.controller.service.type "ClusterIP") (empty .Values.externalAccess.controller.service.domain) -}}
|
||||
kafka: .Values.externalAccess.controller.service.domain
|
||||
Domain must be specified if service type ClusterIP is set for external service
|
||||
{{- end -}}
|
||||
{{- if and (eq .Values.externalAccess.broker.service.type "ClusterIP") (empty .Values.externalAccess.broker.service.domain) -}}
|
||||
kafka: .Values.externalAccess.broker.service.domain
|
||||
Domain must be specified if service type ClusterIP is set for external service
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - service type for external access */}}
|
||||
{{- define "kafka.validateValues.externalAccessServiceType" -}}
|
||||
{{- if and (not (eq .Values.externalAccess.controller.service.type "NodePort")) (not (eq .Values.externalAccess.controller.service.type "LoadBalancer")) (not (eq .Values.externalAccess.controller.service.type "ClusterIP")) -}}
|
||||
kafka: externalAccess.controller.service.type
|
||||
Available service type for external access are NodePort, LoadBalancer or ClusterIP.
|
||||
{{- end -}}
|
||||
{{- if and (not (eq .Values.externalAccess.broker.service.type "NodePort")) (not (eq .Values.externalAccess.broker.service.type "LoadBalancer")) (not (eq .Values.externalAccess.broker.service.type "ClusterIP")) -}}
|
||||
kafka: externalAccess.broker.service.type
|
||||
Available service type for external access are NodePort, LoadBalancer or ClusterIP.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - RBAC should be enabled when autoDiscovery is enabled */}}
|
||||
{{- define "kafka.validateValues.externalAccessAutoDiscoveryRBAC" -}}
|
||||
{{- if and .Values.externalAccess.enabled .Values.defaultInitContainers.autoDiscovery.enabled (not .Values.rbac.create ) }}
|
||||
kafka: rbac.create
|
||||
By specifying "externalAccess.enabled=true" and "defaultInitContainers.autoDiscovery.enabled=true"
|
||||
an initContainer will be used to auto-detect the external IPs/ports by querying the
|
||||
K8s API. Please note this initContainer requires specific RBAC resources. You can create them
|
||||
by specifying "--set rbac.create=true".
|
||||
{{- end -}}
|
||||
{{- if and .Values.externalAccess.enabled .Values.defaultInitContainers.autoDiscovery.enabled (gt (int .Values.controller.replicaCount) 0) (not .Values.controller.automountServiceAccountToken) }}
|
||||
kafka: controller-automountServiceAccountToken
|
||||
By specifying "externalAccess.enabled=true" and "defaultInitContainers.autoDiscovery.enabled=true"
|
||||
an initContainer will be used to auto-detect the external IPs/ports by querying the
|
||||
K8s API. Please note this initContainer requires the service account token. Please set controller.automountServiceAccountToken=true
|
||||
and broker.automountServiceAccountToken=true.
|
||||
{{- end -}}
|
||||
{{- if and .Values.externalAccess.enabled .Values.defaultInitContainers.autoDiscovery.enabled (gt (int .Values.broker.replicaCount) 0) (not .Values.broker.automountServiceAccountToken) }}
|
||||
kafka: broker-automountServiceAccountToken
|
||||
By specifying "externalAccess.enabled=true" and "defaultInitContainers.autoDiscovery.enabled=true"
|
||||
an initContainer will be used to auto-detect the external IPs/ports by querying the
|
||||
K8s API. Please note this initContainer requires the service account token. Please set controller.automountServiceAccountToken=true
|
||||
and broker.automountServiceAccountToken=true.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - LoadBalancerIPs or LoadBalancerNames should be set when autoDiscovery is disabled */}}
|
||||
{{- define "kafka.validateValues.externalAccessAutoDiscoveryIPsOrNames" -}}
|
||||
{{- $loadBalancerNameListLength := len .Values.externalAccess.controller.service.loadBalancerNames -}}
|
||||
{{- $loadBalancerIPListLength := len .Values.externalAccess.controller.service.loadBalancerIPs -}}
|
||||
{{- if and .Values.externalAccess.enabled (gt (int .Values.controller.replicaCount) 0) (or .Values.externalAccess.controller.forceExpose (not .Values.controller.controllerOnly)) (eq .Values.externalAccess.controller.service.type "LoadBalancer") (not .Values.defaultInitContainers.autoDiscovery.enabled) (eq $loadBalancerNameListLength 0) (eq $loadBalancerIPListLength 0) }}
|
||||
kafka: externalAccess.controller.service.loadBalancerNames or externalAccess.controller.service.loadBalancerIPs
|
||||
By specifying "externalAccess.enabled=true", "defaultInitContainers.autoDiscovery.enabled=false" and
|
||||
"externalAccess.controller.service.type=LoadBalancer" at least one of externalAccess.controller.service.loadBalancerNames
|
||||
or externalAccess.controller.service.loadBalancerIPs must be set and the length of those arrays must be equal
|
||||
to the number of replicas.
|
||||
{{- end -}}
|
||||
{{- $loadBalancerNameListLength := len .Values.externalAccess.broker.service.loadBalancerNames -}}
|
||||
{{- $loadBalancerIPListLength := len .Values.externalAccess.broker.service.loadBalancerIPs -}}
|
||||
{{- $replicaCount := int .Values.broker.replicaCount }}
|
||||
{{- if and .Values.externalAccess.enabled (gt 0 $replicaCount) (eq .Values.externalAccess.broker.service.type "LoadBalancer") (not .Values.defaultInitContainers.autoDiscovery.enabled) (eq $loadBalancerNameListLength 0) (eq $loadBalancerIPListLength 0) }}
|
||||
kafka: externalAccess.broker.service.loadBalancerNames or externalAccess.broker.service.loadBalancerIPs
|
||||
By specifying "externalAccess.enabled=true", "defaultInitContainers.autoDiscovery.enabled=false" and
|
||||
"externalAccess.broker.service.type=LoadBalancer" at least one of externalAccess.broker.service.loadBalancerNames
|
||||
or externalAccess.broker.service.loadBalancerIPs must be set and the length of those arrays must be equal
|
||||
to the number of replicas.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - number of replicas must be the same as loadBalancerIPs list */}}
|
||||
{{- define "kafka.validateValues.externalAccessServiceList" -}}
|
||||
{{- $replicaCount := int .context.Values.controller.replicaCount }}
|
||||
{{- $listLength := len (get .context.Values.externalAccess.controller.service .element) -}}
|
||||
{{- if and .context.Values.externalAccess.enabled (or .context.Values.externalAccess.controller.forceExpose (not .context.Values.controller.controllerOnly)) (not .context.Values.defaultInitContainers.autoDiscovery.enabled) (eq .context.Values.externalAccess.controller.service.type "LoadBalancer") (gt $listLength 0) (not (eq $replicaCount $listLength)) }}
|
||||
kafka: externalAccess.service.{{ .element }}
|
||||
Number of replicas and {{ .element }} array length must be the same. Currently: replicaCount = {{ $replicaCount }} and {{ .element }} = {{ $listLength }}
|
||||
{{- end -}}
|
||||
{{- $replicaCount := int .context.Values.broker.replicaCount }}
|
||||
{{- $listLength := len (get .context.Values.externalAccess.broker.service .element) -}}
|
||||
{{- if and .context.Values.externalAccess.enabled (gt 0 $replicaCount) (not .context.Values.defaultInitContainers.autoDiscovery.enabled) (eq .context.Values.externalAccess.broker.service.type "LoadBalancer") (gt $listLength 0) (not (eq $replicaCount $listLength)) }}
|
||||
kafka: externalAccess.service.{{ .element }}
|
||||
Number of replicas and {{ .element }} array length must be the same. Currently: replicaCount = {{ $replicaCount }} and {{ .element }} = {{ $listLength }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - SASL mechanisms must be provided when using SASL */}}
|
||||
{{- define "kafka.validateValues.saslMechanisms" -}}
|
||||
{{- if and (include "kafka.saslEnabled" .) (not .Values.sasl.enabledMechanisms) }}
|
||||
kafka: sasl.enabledMechanisms
|
||||
The SASL mechanisms are required when listeners use SASL security protocol.
|
||||
{{- end }}
|
||||
{{- if not (contains .Values.sasl.interBrokerMechanism .Values.sasl.enabledMechanisms) }}
|
||||
kafka: sasl.enabledMechanisms
|
||||
sasl.interBrokerMechanism must be provided and it should be one of the specified mechanisms at sasl.enabledMechanisms
|
||||
{{- end -}}
|
||||
{{- if not (contains .Values.sasl.controllerMechanism .Values.sasl.enabledMechanisms) }}
|
||||
kafka: sasl.enabledMechanisms
|
||||
sasl.controllerMechanism must be provided and it should be one of the specified mechanisms at sasl.enabledMechanisms
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - Secrets containing TLS certs must be provided when TLS authentication is enabled */}}
|
||||
{{- define "kafka.validateValues.tlsSecret" -}}
|
||||
{{- if and (include "kafka.sslEnabled" .) (eq (upper .Values.tls.type) "JKS") (empty .Values.tls.existingSecret) (not .Values.tls.autoGenerated.enabled) }}
|
||||
kafka: tls.existingSecret
|
||||
A secret containing the Kafka JKS keystores and truststore is required
|
||||
when TLS encryption in enabled and TLS format is "JKS"
|
||||
{{- else if and (include "kafka.sslEnabled" .) (eq (upper .Values.tls.type) "PEM") (empty .Values.tls.existingSecret) (not .Values.tls.autoGenerated.enabled) }}
|
||||
kafka: tls.existingSecret
|
||||
A secret containing the Kafka TLS certificates and keys is required
|
||||
when TLS encryption in enabled and TLS format is "PEM"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka provisioning - keyPasswordSecretKey, keystorePasswordSecretKey or truststorePasswordSecretKey must not be used without passwordsSecret */}}
|
||||
{{- define "kafka.validateValues.provisioning.tlsPasswords" -}}
|
||||
{{- if and (regexFind "SSL" (upper .Values.listeners.client.protocol)) .Values.provisioning.enabled (not .Values.provisioning.auth.tls.passwordsSecret) }}
|
||||
{{- if or .Values.provisioning.auth.tls.keyPasswordSecretKey .Values.provisioning.auth.tls.keystorePasswordSecretKey .Values.provisioning.auth.tls.truststorePasswordSecretKey }}
|
||||
kafka: tls.keyPasswordSecretKey,tls.keystorePasswordSecretKey,tls.truststorePasswordSecretKey
|
||||
tls.keyPasswordSecretKey,tls.keystorePasswordSecretKey,tls.truststorePasswordSecretKey
|
||||
must not be used without passwordsSecret setted.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - At least 1 controller is configured or controller.quorum.bootstrap.servers is set */}}
|
||||
{{- define "kafka.validateValues.missingController" -}}
|
||||
{{- if and (le (int .Values.controller.replicaCount) 0) (not .Values.controller.quorumBootstrapServers) }}
|
||||
kafka: Missing controller-eligible nodes
|
||||
No controller-eligible nodes have been configured.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,512 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Returns an init-container that changes the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each node
|
||||
*/}}
|
||||
{{- define "kafka.defaultInitContainers.volumePermissions" -}}
|
||||
{{- $roleValues := index .context.Values .role -}}
|
||||
- name: volume-permissions
|
||||
image: {{ include "kafka.volumePermissions.image" .context }}
|
||||
imagePullPolicy: {{ .context.Values.defaultInitContainers.volumePermissions.image.pullPolicy | quote }}
|
||||
{{- if .context.Values.defaultInitContainers.volumePermissions.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .context.Values.defaultInitContainers.volumePermissions.containerSecurityContext "context" .context) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .context.Values.defaultInitContainers.volumePermissions.resources }}
|
||||
resources: {{- toYaml .context.Values.defaultInitContainers.volumePermissions.resources | nindent 4 }}
|
||||
{{- else if ne .context.Values.defaultInitContainers.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .context.Values.defaultInitContainers.volumePermissions.resourcesPreset) | nindent 4 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
mkdir -p {{ $roleValues.persistence.mountPath }} {{ $roleValues.logPersistence.mountPath }}
|
||||
{{- if eq ( toString ( .context.Values.defaultInitContainers.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}
|
||||
find {{ $roleValues.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R $(id -u):$(id -G | cut -d " " -f2)
|
||||
find {{ $roleValues.logPersistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R $(id -u):$(id -G | cut -d " " -f2)
|
||||
{{- else }}
|
||||
find {{ $roleValues.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ $roleValues.containerSecurityContext.runAsUser }}:{{ $roleValues.podSecurityContext.fsGroup }}
|
||||
find {{ $roleValues.logPersistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ $roleValues.containerSecurityContext.runAsUser }}:{{ $roleValues.podSecurityContext.fsGroup }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ $roleValues.persistence.mountPath }}
|
||||
- name: logs
|
||||
mountPath: {{ $roleValues.logPersistence.mountPath }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns an init-container that auto-discovers the external access details
|
||||
*/}}
|
||||
{{- define "kafka.defaultInitContainers.autoDiscovery" -}}
|
||||
{{- $externalAccess := index .context.Values.externalAccess .role }}
|
||||
- name: auto-discovery
|
||||
image: {{ include "kafka.autoDiscovery.image" .context }}
|
||||
imagePullPolicy: {{ .context.Values.defaultInitContainers.autoDiscovery.image.pullPolicy | quote }}
|
||||
{{- if .context.Values.defaultInitContainers.autoDiscovery.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .context.Values.defaultInitContainers.autoDiscovery.containerSecurityContext "context" .context) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .context.Values.defaultInitContainers.autoDiscovery.resources }}
|
||||
resources: {{- toYaml .context.Values.defaultInitContainers.autoDiscovery.resources | nindent 4 }}
|
||||
{{- else if ne .context.Values.defaultInitContainers.autoDiscovery.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .context.Values.defaultInitContainers.autoDiscovery.resourcesPreset) | nindent 4 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
SVC_NAME="${MY_POD_NAME}-external"
|
||||
AUTODISCOVERY_SERVICE_TYPE="${AUTODISCOVERY_SERVICE_TYPE:-}"
|
||||
|
||||
# Auxiliary functions
|
||||
retry_while() {
|
||||
local -r cmd="${1:?cmd is missing}"
|
||||
local -r retries="${2:-12}"
|
||||
local -r sleep_time="${3:-5}"
|
||||
local return_value=1
|
||||
read -r -a command <<< "$cmd"
|
||||
for ((i = 1 ; i <= retries ; i+=1 )); do
|
||||
"${command[@]}" && return_value=0 && break
|
||||
sleep "$sleep_time"
|
||||
done
|
||||
return $return_value
|
||||
}
|
||||
k8s_svc_lb_ip() {
|
||||
local namespace=${1:?namespace is missing}
|
||||
local service=${2:?service is missing}
|
||||
local service_ip=$(kubectl get svc "$service" -n "$namespace" -o jsonpath="{.status.loadBalancer.ingress[0].ip}")
|
||||
local service_hostname=$(kubectl get svc "$service" -n "$namespace" -o jsonpath="{.status.loadBalancer.ingress[0].hostname}")
|
||||
if [[ -n ${service_ip} ]]; then
|
||||
echo "${service_ip}"
|
||||
else
|
||||
echo "${service_hostname}"
|
||||
fi
|
||||
}
|
||||
k8s_svc_lb_ip_ready() {
|
||||
local namespace=${1:?namespace is missing}
|
||||
local service=${2:?service is missing}
|
||||
[[ -n "$(k8s_svc_lb_ip "$namespace" "$service")" ]]
|
||||
}
|
||||
k8s_svc_node_port() {
|
||||
local namespace=${1:?namespace is missing}
|
||||
local service=${2:?service is missing}
|
||||
local index=${3:-0}
|
||||
local node_port="$(kubectl get svc "$service" -n "$namespace" -o jsonpath="{.spec.ports[$index].nodePort}")"
|
||||
echo "$node_port"
|
||||
}
|
||||
|
||||
if [[ "$AUTODISCOVERY_SERVICE_TYPE" = "LoadBalancer" ]]; then
|
||||
# Wait until LoadBalancer IP is ready
|
||||
retry_while "k8s_svc_lb_ip_ready $MY_POD_NAMESPACE $SVC_NAME" || exit 1
|
||||
# Obtain LoadBalancer external IP
|
||||
k8s_svc_lb_ip "$MY_POD_NAMESPACE" "$SVC_NAME" | tee "/shared/external-host.txt"
|
||||
elif [[ "$AUTODISCOVERY_SERVICE_TYPE" = "NodePort" ]]; then
|
||||
k8s_svc_node_port "$MY_POD_NAMESPACE" "$SVC_NAME" | tee "/shared/external-port.txt"
|
||||
else
|
||||
echo "Unsupported autodiscovery service type: '$AUTODISCOVERY_SERVICE_TYPE'"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env:
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: MY_POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: AUTODISCOVERY_SERVICE_TYPE
|
||||
value: {{ $externalAccess.service.type | quote }}
|
||||
volumeMounts:
|
||||
- name: init-shared
|
||||
mountPath: /shared
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns an init-container that prepares the Kafka configuration files for main containers to use them
|
||||
*/}}
|
||||
{{- define "kafka.defaultInitContainers.prepareConfig" -}}
|
||||
{{- $roleValues := index .context.Values .role -}}
|
||||
{{- $externalAccessEnabled := or (and (eq .role "broker") .context.Values.externalAccess.enabled) (and (eq .role "controller") .context.Values.externalAccess.enabled (or .context.Values.externalAccess.controller.forceExpose (not .context.Values.controller.controllerOnly))) }}
|
||||
- name: prepare-config
|
||||
image: {{ include "kafka.image" .context }}
|
||||
imagePullPolicy: {{ .context.Values.image.pullPolicy }}
|
||||
{{- if .context.Values.defaultInitContainers.prepareConfig.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .context.Values.defaultInitContainers.prepareConfig.containerSecurityContext "context" .context) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .context.Values.defaultInitContainers.prepareConfig.resources }}
|
||||
resources: {{- toYaml .context.Values.defaultInitContainers.prepareConfig.resources | nindent 4 }}
|
||||
{{- else if ne .context.Values.defaultInitContainers.prepareConfig.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .context.Values.defaultInitContainers.prepareConfig.resourcesPreset) | nindent 4 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
. /opt/bitnami/scripts/libkafka.sh
|
||||
|
||||
{{- if $externalAccessEnabled }}
|
||||
configure_external_access() {
|
||||
local host port
|
||||
# Configure external hostname
|
||||
if [[ -f "/shared/external-host.txt" ]]; then
|
||||
host=$(cat "/shared/external-host.txt")
|
||||
elif [[ -n "${EXTERNAL_ACCESS_HOST:-}" ]]; then
|
||||
host="$EXTERNAL_ACCESS_HOST"
|
||||
elif [[ -n "${EXTERNAL_ACCESS_HOSTS_LIST:-}" ]]; then
|
||||
read -r -a hosts <<< "$(tr ',' ' ' <<<"${EXTERNAL_ACCESS_HOSTS_LIST}")"
|
||||
host="${hosts[$POD_ID]}"
|
||||
elif is_boolean_yes "$EXTERNAL_ACCESS_HOST_USE_PUBLIC_IP"; then
|
||||
host=$(curl -s https://ipinfo.io/ip)
|
||||
else
|
||||
error "External access hostname not provided"
|
||||
fi
|
||||
# Configure external port
|
||||
if [[ -f "/shared/external-port.txt" ]]; then
|
||||
port=$(cat "/shared/external-port.txt")
|
||||
elif [[ -n "${EXTERNAL_ACCESS_PORT:-}" ]]; then
|
||||
port="$EXTERNAL_ACCESS_PORT"
|
||||
if is_boolean_yes "${EXTERNAL_ACCESS_PORT_AUTOINCREMENT:-}"; then
|
||||
port="$((port + POD_ID))"
|
||||
fi
|
||||
elif [[ -n "${EXTERNAL_ACCESS_PORTS_LIST:-}" ]]; then
|
||||
read -r -a ports <<<"$(tr ',' ' ' <<<"${EXTERNAL_ACCESS_PORTS_LIST}")"
|
||||
port="${ports[$POD_ID]}"
|
||||
else
|
||||
error "External access port not provided"
|
||||
fi
|
||||
# Configure Kafka advertised listeners
|
||||
sed -i -E "s|^(advertised\.listeners=\S+)$|\1,${EXTERNAL_ACCESS_LISTENER_NAME}://${host}:${port}|" "$KAFKA_CONF_FILE"
|
||||
}
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" .context }}
|
||||
configure_kafka_tls() {
|
||||
# Remove previously existing keystores and certificates, if any
|
||||
rm -f /certs/kafka.keystore.jks /certs/kafka.truststore.jks
|
||||
rm -f /certs/tls.crt /certs/tls.key /certs/ca.crt
|
||||
find /certs -name "xx*" -exec rm {} \;
|
||||
if [[ "${KAFKA_TLS_TYPE}" = "PEM" ]]; then
|
||||
# Copy PEM certificate and key
|
||||
if [[ -f "/mounted-certs/kafka-${POD_ROLE}-${POD_ID}.crt" && "/mounted-certs/kafka-${POD_ROLE}-${POD_ID}.key" ]]; then
|
||||
cp "/mounted-certs/kafka-${POD_ROLE}-${POD_ID}.crt" /certs/tls.crt
|
||||
# Copy the PEM key ensuring the key used PEM format with PKCS#8
|
||||
openssl pkcs8 -topk8 -nocrypt -passin pass:"${KAFKA_TLS_PEM_KEY_PASSWORD:-}" -in "/mounted-certs/kafka-${POD_ROLE}-${POD_ID}.key" > /certs/tls.key
|
||||
elif [[ -f /mounted-certs/tls.crt && -f /mounted-certs/tls.key ]]; then
|
||||
cp "/mounted-certs/tls.crt" /certs/tls.crt
|
||||
# Copy the PEM key ensuring the key used PEM format with PKCS#8
|
||||
openssl pkcs8 -topk8 -passin pass:"${KAFKA_TLS_PEM_KEY_PASSWORD:-}" -nocrypt -in "/mounted-certs/tls.key" > /certs/tls.key
|
||||
else
|
||||
error "PEM key and cert files not found"
|
||||
fi
|
||||
{{- if not .context.Values.tls.pemChainIncluded }}
|
||||
# Copy CA certificate
|
||||
if [[ -f /mounted-certs/ca.crt ]]; then
|
||||
cp /mounted-certs/ca.crt /certs/ca.crt
|
||||
else
|
||||
error "CA certificate file not found"
|
||||
fi
|
||||
{{- else }}
|
||||
# CA certificates are also included in the same certificate
|
||||
# All public certs will be included in the truststore
|
||||
cp /certs/tls.crt /certs/ca.crt
|
||||
{{- end }}
|
||||
# Create JKS keystore from PEM cert and key
|
||||
openssl pkcs12 -export -in "/certs/tls.crt" \
|
||||
-passout pass:"$KAFKA_TLS_KEYSTORE_PASSWORD" \
|
||||
-inkey "/certs/tls.key" \
|
||||
-out "/certs/kafka.keystore.p12"
|
||||
keytool -importkeystore -srckeystore "/certs/kafka.keystore.p12" \
|
||||
-srcstoretype PKCS12 \
|
||||
-srcstorepass "$KAFKA_TLS_KEYSTORE_PASSWORD" \
|
||||
-deststorepass "$KAFKA_TLS_KEYSTORE_PASSWORD" \
|
||||
-destkeystore "/certs/kafka.keystore.jks" \
|
||||
-noprompt
|
||||
# Create JKS truststore from CA cert
|
||||
keytool -keystore /certs/kafka.truststore.jks -alias CARoot -import -file /certs/ca.crt -storepass "$KAFKA_TLS_TRUSTSTORE_PASSWORD" -noprompt
|
||||
# Remove extra files
|
||||
rm -f "/certs/kafka.keystore.p12" "/certs/tls.crt" "/certs/tls.key" "/certs/ca.crt"
|
||||
elif [[ "$KAFKA_TLS_TYPE" = "JKS" ]]; then
|
||||
if [[ -f "/mounted-certs/kafka-${POD_ROLE}-${POD_ID}.keystore.jks" ]]; then
|
||||
cp "/mounted-certs/kafka-${POD_ROLE}-${POD_ID}.keystore.jks" /certs/kafka.keystore.jks
|
||||
elif [[ -f "$KAFKA_TLS_KEYSTORE_FILE" ]]; then
|
||||
cp "$KAFKA_TLS_KEYSTORE_FILE" /certs/kafka.keystore.jks
|
||||
else
|
||||
error "Keystore file not found"
|
||||
fi
|
||||
if [[ -f "$KAFKA_TLS_TRUSTSTORE_FILE" ]]; then
|
||||
cp "$KAFKA_TLS_TRUSTSTORE_FILE" /certs/kafka.truststore.jks
|
||||
else
|
||||
error "Truststore file not found"
|
||||
fi
|
||||
else
|
||||
error "Invalid type $KAFKA_TLS_TYPE"
|
||||
fi
|
||||
# Configure TLS password settings in Kafka configuration
|
||||
[[ -n "${KAFKA_TLS_KEYSTORE_PASSWORD:-}" ]] && kafka_server_conf_set "ssl.keystore.password" "$KAFKA_TLS_KEYSTORE_PASSWORD"
|
||||
[[ -n "${KAFKA_TLS_TRUSTSTORE_PASSWORD:-}" ]] && kafka_server_conf_set "ssl.truststore.password" "$KAFKA_TLS_TRUSTSTORE_PASSWORD"
|
||||
[[ -n "${KAFKA_TLS_PEM_KEY_PASSWORD:-}" ]] && kafka_server_conf_set "ssl.key.password" "$KAFKA_TLS_PEM_KEY_PASSWORD"
|
||||
# Avoid errors caused by previous checks
|
||||
true
|
||||
}
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslEnabled" .context }}
|
||||
configure_kafka_sasl() {
|
||||
# Replace placeholders with passwords
|
||||
{{- if regexFind "SASL" (upper .context.Values.listeners.interbroker.protocol) }}
|
||||
{{- if include "kafka.saslUserPasswordsEnabled" .context }}
|
||||
replace_in_file "$KAFKA_CONF_FILE" "interbroker-password-placeholder" "$KAFKA_INTER_BROKER_PASSWORD"
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslClientSecretsEnabled" .context }}
|
||||
replace_in_file "$KAFKA_CONF_FILE" "interbroker-client-secret-placeholder" "$KAFKA_INTER_BROKER_CLIENT_SECRET"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .context.Values.listeners.controller.protocol) }}
|
||||
{{- if include "kafka.saslUserPasswordsEnabled" .context }}
|
||||
replace_in_file "$KAFKA_CONF_FILE" "controller-password-placeholder" "$KAFKA_CONTROLLER_PASSWORD"
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslClientSecretsEnabled" .context }}
|
||||
replace_in_file "$KAFKA_CONF_FILE" "controller-client-secret-placeholder" "$KAFKA_CONTROLLER_CLIENT_SECRET"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.client.saslEnabled" .context }}
|
||||
read -r -a passwords <<< "$(tr ',;' ' ' <<<"${KAFKA_CLIENT_PASSWORDS:-}")"
|
||||
for ((i = 0; i < ${#passwords[@]}; i++)); do
|
||||
replace_in_file "$KAFKA_CONF_FILE" "password-placeholder-${i}\"" "${passwords[i]}\""
|
||||
done
|
||||
{{- end }}
|
||||
}
|
||||
{{- end }}
|
||||
{{- if .context.Values.brokerRackAwareness.enabled }}
|
||||
configure_kafka_broker_rack() {
|
||||
local -r metadata_api_ip="169.254.169.254"
|
||||
local broker_rack=""
|
||||
{{- if eq .context.Values.brokerRackAwareness.cloudProvider "aws-az" }}
|
||||
echo "Obtaining broker.rack for aws-az rack assignment"
|
||||
ec2_metadata_token=$(curl -X PUT "http://${metadata_api_ip}/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
|
||||
broker_rack=$(curl -H "X-aws-ec2-metadata-token: $ec2_metadata_token" "http://${metadata_api_ip}/latest/meta-data/placement/availability-zone-id")
|
||||
{{- else if eq .context.Values.brokerRackAwareness.cloudProvider "azure" }}
|
||||
echo "Obtaining broker.rack for azure rack assignment"
|
||||
location=$(curl -s -H Metadata:true --noproxy "*" "http://${metadata_api_ip}/metadata/instance/compute/location?api-version={{ .context.Values.brokerRackAwareness.azureApiVersion }}&format=text")
|
||||
zone=$(curl -s -H Metadata:true --noproxy "*" "http://${metadata_api_ip}/metadata/instance/compute/zone?api-version={{ .context.Values.brokerRackAwareness.azureApiVersion }}&format=text")
|
||||
broker_rack="${location}-${zone}"
|
||||
{{- end }}
|
||||
kafka_server_conf_set "broker.rack" "$broker_rack"
|
||||
}
|
||||
{{- end }}
|
||||
{{- if and $externalAccessEnabled .context.Values.defaultInitContainers.autoDiscovery.enabled }}
|
||||
# Wait for autodiscovery to finish
|
||||
retry_while "test -f /shared/external-host.txt -o -f /shared/external-port.txt" || error "Timed out waiting for autodiscovery init-container"
|
||||
{{- end }}
|
||||
|
||||
cp /configmaps/server.properties $KAFKA_CONF_FILE
|
||||
|
||||
# Get pod ID and role, last and second last fields in the pod name respectively
|
||||
POD_ID="${MY_POD_NAME##*-}"
|
||||
POD_ROLE="${MY_POD_NAME%-*}"; POD_ROLE="${POD_ROLE##*-}"
|
||||
|
||||
# Configure node.id
|
||||
ID=$((POD_ID + KAFKA_MIN_ID))
|
||||
[[ -f "/bitnami/kafka/data/meta.properties" ]] && ID="$(grep "node.id" /bitnami/kafka/data/meta.properties | awk -F '=' '{print $2}')"
|
||||
kafka_server_conf_set "node.id" "$ID"
|
||||
# Configure initial controllers
|
||||
if [[ "controller" =~ "$POD_ROLE" ]]; then
|
||||
INITIAL_CONTROLLERS=()
|
||||
for ((i = 0; i < {{ int .context.Values.controller.replicaCount }}; i++)); do
|
||||
var="KAFKA_CONTROLLER_${i}_DIR_ID"; DIR_ID="${!var}"
|
||||
[[ $i -eq $POD_ID ]] && [[ -f "/bitnami/kafka/data/meta.properties" ]] && DIR_ID="$(grep "directory.id" /bitnami/kafka/data/meta.properties | awk -F '=' '{print $2}')"
|
||||
INITIAL_CONTROLLERS+=("${i}@${KAFKA_FULLNAME}-${POD_ROLE}-${i}.${KAFKA_CONTROLLER_SVC_NAME}.${MY_POD_NAMESPACE}.svc.${CLUSTER_DOMAIN}:${KAFKA_CONTROLLER_PORT}:${DIR_ID}")
|
||||
done
|
||||
echo "${INITIAL_CONTROLLERS[*]}" | awk -v OFS=',' '{$1=$1}1' > /shared/initial-controllers.txt
|
||||
fi
|
||||
{{- if not .context.Values.listeners.advertisedListeners }}
|
||||
replace_in_file "$KAFKA_CONF_FILE" "advertised-address-placeholder" "${MY_POD_NAME}.${KAFKA_FULLNAME}-${POD_ROLE}-headless.${MY_POD_NAMESPACE}.svc.${CLUSTER_DOMAIN}"
|
||||
{{- if $externalAccessEnabled }}
|
||||
configure_external_access
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" .context }}
|
||||
configure_kafka_tls
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslEnabled" .context }}
|
||||
sasl_env_vars=(
|
||||
KAFKA_CLIENT_PASSWORDS
|
||||
KAFKA_INTER_BROKER_PASSWORD
|
||||
KAFKA_INTER_BROKER_CLIENT_SECRET
|
||||
KAFKA_CONTROLLER_PASSWORD
|
||||
KAFKA_CONTROLLER_CLIENT_SECRET
|
||||
)
|
||||
for env_var in "${sasl_env_vars[@]}"; do
|
||||
file_env_var="${env_var}_FILE"
|
||||
if [[ -n "${!file_env_var:-}" ]]; then
|
||||
if [[ -r "${!file_env_var:-}" ]]; then
|
||||
export "${env_var}=$(< "${!file_env_var}")"
|
||||
unset "${file_env_var}"
|
||||
else
|
||||
warn "Skipping export of '${env_var}'. '${!file_env_var:-}' is not readable."
|
||||
fi
|
||||
fi
|
||||
done
|
||||
configure_kafka_sasl
|
||||
{{- end }}
|
||||
{{- if .context.Values.brokerRackAwareness.enabled }}
|
||||
configure_kafka_broker_rack
|
||||
{{- end }}
|
||||
if [[ -f /secret-config/server-secret.properties ]]; then
|
||||
cat /secret-config/server-secret.properties >> $KAFKA_CONF_FILE
|
||||
fi
|
||||
|
||||
{{- include "common.tplvalues.render" ( dict "value" .context.Values.defaultInitContainers.prepareConfig.extraInit "context" .context ) | nindent 6 }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .context.Values.image.debug .context.Values.diagnosticMode.enabled) | quote }}
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: MY_POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KAFKA_FULLNAME
|
||||
value: {{ include "common.names.fullname" .context | quote }}
|
||||
- name: CLUSTER_DOMAIN
|
||||
value: {{ .context.Values.clusterDomain | quote }}
|
||||
- name: KAFKA_VOLUME_DIR
|
||||
value: {{ $roleValues.persistence.mountPath | quote }}
|
||||
- name: KAFKA_CONF_FILE
|
||||
value: /config/server.properties
|
||||
- name: KAFKA_MIN_ID
|
||||
value: {{ $roleValues.minId | quote }}
|
||||
- name: KAFKA_CONTROLLER_SVC_NAME
|
||||
value: {{ printf "%s-headless" (include "kafka.controller.fullname" .context) | trunc 63 | trimSuffix "-" }}
|
||||
- name: KAFKA_CONTROLLER_PORT
|
||||
value: {{ .context.Values.listeners.controller.containerPort | quote }}
|
||||
{{- $kraftSecret := include "kafka.kraftSecretName" .context }}
|
||||
{{- range $i := until (int .context.Values.controller.replicaCount) }}
|
||||
- name: KAFKA_CONTROLLER_{{ $i }}_DIR_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $kraftSecret }}
|
||||
key: controller-{{ $i }}-id
|
||||
{{- end }}
|
||||
{{- if $externalAccessEnabled }}
|
||||
- name: EXTERNAL_ACCESS_LISTENER_NAME
|
||||
value: {{ upper .context.Values.listeners.external.name | quote }}
|
||||
{{- $externalAccess := index .context.Values.externalAccess .role }}
|
||||
{{- if or (eq $externalAccess.service.type "LoadBalancer") (and $externalAccess.service.loadBalancerNames (eq $externalAccess.service.type "ClusterIP")) }}
|
||||
{{- if not .context.Values.defaultInitContainers.autoDiscovery.enabled }}
|
||||
- name: EXTERNAL_ACCESS_HOSTS_LIST
|
||||
value: {{ join "," (default $externalAccess.service.loadBalancerIPs $externalAccess.service.loadBalancerNames) | quote }}
|
||||
{{- end }}
|
||||
- name: EXTERNAL_ACCESS_PORT
|
||||
value: {{ $externalAccess.service.ports.external | quote }}
|
||||
{{- else if eq $externalAccess.service.type "NodePort" }}
|
||||
{{- if $externalAccess.service.domain }}
|
||||
- name: EXTERNAL_ACCESS_HOST
|
||||
value: {{ $externalAccess.service.domain | quote }}
|
||||
{{- else if and $externalAccess.service.usePodIPs .context.Values.defaultInitContainers.autoDiscovery.enabled }}
|
||||
- name: MY_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: EXTERNAL_ACCESS_HOST
|
||||
value: "$(MY_POD_IP)"
|
||||
{{- else if or $externalAccess.service.useHostIPs .context.Values.defaultInitContainers.autoDiscovery.enabled }}
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: EXTERNAL_ACCESS_HOST
|
||||
value: "$(HOST_IP)"
|
||||
{{- else if and $externalAccess.service.externalIPs (not .context.Values.defaultInitContainers.autoDiscovery.enabled) }}
|
||||
- name: EXTERNAL_ACCESS_HOSTS_LIST
|
||||
value: {{ join "," $externalAccess.service.externalIPs }}
|
||||
{{- else }}
|
||||
- name: EXTERNAL_ACCESS_HOST_USE_PUBLIC_IP
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if not .context.Values.defaultInitContainers.autoDiscovery.enabled }}
|
||||
{{- if and $externalAccess.service.externalIPs (empty $externalAccess.service.nodePorts)}}
|
||||
- name: EXTERNAL_ACCESS_PORT
|
||||
value: {{ $externalAccess.service.ports.external | quote }}
|
||||
{{- else }}
|
||||
- name: EXTERNAL_ACCESS_PORTS_LIST
|
||||
value: {{ join "," $externalAccess.service.nodePorts | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if eq $externalAccess.service.type "ClusterIP" }}
|
||||
- name: EXTERNAL_ACCESS_HOST
|
||||
value: {{ $externalAccess.service.domain | quote }}
|
||||
- name: EXTERNAL_ACCESS_PORT
|
||||
value: {{ $externalAccess.service.ports.external | quote}}
|
||||
- name: EXTERNAL_ACCESS_PORT_AUTOINCREMENT
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslEnabled" .context }}
|
||||
{{- include "kafka.saslEnv" .context | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" .context }}
|
||||
- name: KAFKA_TLS_TYPE
|
||||
value: {{ ternary "PEM" "JKS" (or .context.Values.tls.autoGenerated.enabled (eq (upper .context.Values.tls.type) "PEM")) }}
|
||||
{{- if eq (upper .context.Values.tls.type) "JKS" }}
|
||||
- name: KAFKA_TLS_KEYSTORE_FILE
|
||||
value: {{ printf "/mounted-certs/%s" ( default "kafka.keystore.jks" .context.Values.tls.jksKeystoreKey) | quote }}
|
||||
- name: KAFKA_TLS_TRUSTSTORE_FILE
|
||||
value: {{ printf "/mounted-certs/%s" ( default "kafka.truststore.jks" .context.Values.tls.jksTruststoreKey) | quote }}
|
||||
{{- end }}
|
||||
- name: KAFKA_TLS_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.tlsPasswordsSecretName" .context }}
|
||||
key: {{ .context.Values.tls.passwordsSecretKeystoreKey | quote }}
|
||||
- name: KAFKA_TLS_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.tlsPasswordsSecretName" .context }}
|
||||
key: {{ .context.Values.tls.passwordsSecretTruststoreKey | quote }}
|
||||
{{- if and (not .context.Values.tls.autoGenerated.enabled) (or .context.Values.tls.keyPassword (and .context.Values.tls.passwordsSecret .context.Values.tls.passwordsSecretPemPasswordKey)) }}
|
||||
- name: KAFKA_TLS_PEM_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.tlsPasswordsSecretName" .context }}
|
||||
key: {{ default "key-password" .context.Values.tls.passwordsSecretPemPasswordKey | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /bitnami/kafka
|
||||
- name: kafka-config
|
||||
mountPath: /config
|
||||
- name: kafka-configmaps
|
||||
mountPath: /configmaps
|
||||
- name: kafka-secret-config
|
||||
mountPath: /secret-config
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: init-shared
|
||||
mountPath: /shared
|
||||
{{- if include "kafka.sslEnabled" .context }}
|
||||
- name: kafka-shared-certs
|
||||
mountPath: /certs
|
||||
{{- if and (include "kafka.sslEnabled" .context) (or .context.Values.tls.existingSecret .context.Values.tls.autoGenerated.enabled) }}
|
||||
- name: kafka-certs
|
||||
mountPath: /mounted-certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .context.Values.usePasswordFiles (include "kafka.saslEnabled" .context) }}
|
||||
- name: kafka-sasl
|
||||
mountPath: /opt/bitnami/kafka/config/secrets
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.broker.replicaCount }}
|
||||
{{- if and (include "kafka.broker.createSecretConfig" .) (gt $replicaCount 0) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-secret-configuration" (include "kafka.broker.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
server-secret.properties: {{ include "kafka.broker.secretConfig" . | b64enc }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka broker configuration.
|
||||
ref: https://kafka.apache.org/documentation/#configuration
|
||||
*/}}
|
||||
{{- define "kafka.broker.config" -}}
|
||||
{{- if or .Values.config .Values.broker.config }}
|
||||
{{- include "common.tplvalues.render" (dict "value" (coalesce .Values.broker.config .Values.config) "context" .) }}
|
||||
{{- else }}
|
||||
# Listeners configuration
|
||||
listeners: {{ include "kafka.listeners" (dict "isController" false "context" .) }}
|
||||
listener.security.protocol.map: {{ include "kafka.securityProtocolMap" (dict "isController" false "context" .) }}
|
||||
advertised.listeners: {{ include "kafka.advertisedListeners" . }}
|
||||
inter.broker.listener.name: {{ .Values.listeners.interbroker.name }}
|
||||
# Kafka data logs directory
|
||||
log.dir: {{ printf "%s/data" .Values.broker.persistence.mountPath }}
|
||||
# Kafka application logs directory
|
||||
logs.dir: {{ .Values.broker.logPersistence.mountPath }}
|
||||
# KRaft node role
|
||||
process.roles: broker
|
||||
# Common Kafka Configuration
|
||||
{{ include "kafka.commonConfig" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $replicaCount := int .Values.broker.replicaCount }}
|
||||
{{- if and (include "kafka.broker.createConfigmap" .) (gt $replicaCount 0) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-configuration" (include "kafka.broker.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- $configuration := include "kafka.broker.config" . | fromYaml -}}
|
||||
{{- if or .Values.overrideConfiguration .Values.broker.overrideConfiguration }}
|
||||
{{- $overrideConfiguration := include "common.tplvalues.render" (dict "value" .Values.overrideConfiguration "context" .) | fromYaml }}
|
||||
{{- $brokerOverrideConfiguration := include "common.tplvalues.render" (dict "value" .Values.broker.overrideConfiguration "context" .) | fromYaml }}
|
||||
{{- $configuration = mustMergeOverwrite $configuration $overrideConfiguration $brokerOverrideConfiguration }}
|
||||
{{- end }}
|
||||
server.properties: |-
|
||||
{{- range $key, $value := $configuration }}
|
||||
{{ $key }}={{ include "common.tplvalues.render" (dict "value" $value "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.broker.autoscaling.hpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "kafka.broker.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if or .Values.broker.autoscaling.hpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.broker.autoscaling.hpa.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ template "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
name: {{ template "kafka.broker.fullname" . }}
|
||||
minReplicas: {{ .Values.broker.autoscaling.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.broker.autoscaling.hpa.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.broker.autoscaling.hpa.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.broker.autoscaling.hpa.targetCPU }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.autoscaling.hpa.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.broker.autoscaling.hpa.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,95 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.broker.replicaCount }}
|
||||
{{- if and .Values.networkPolicy.enabled (or (gt $replicaCount 0) .Values.broker.autoscaling.hpa.enabled) }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "kafka.broker.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.broker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow internal communications between nodes
|
||||
- ports:
|
||||
- port: {{ .Values.listeners.client.containerPort }}
|
||||
- port: {{ .Values.listeners.interbroker.containerPort }}
|
||||
{{- range $listener := .Values.listeners.extraListeners }}
|
||||
- port: {{ $listener.containerPort }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- port: {{ .Values.listeners.external.containerPort }}
|
||||
{{- end }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
# Allow client connections
|
||||
- ports:
|
||||
- port: {{ .Values.listeners.client.containerPort }}
|
||||
- port: {{ .Values.listeners.interbroker.containerPort }}
|
||||
{{- range $listener := .Values.listeners.extraListeners }}
|
||||
- port: {{ $listener.containerPort }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- port: {{ .Values.listeners.external.containerPort }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
- port: {{ .Values.metrics.jmx.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.addExternalClientAccess }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressPodMatchLabels }}
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressNSMatchLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressNSPodMatchLabel "context" $ ) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.broker.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "kafka.broker.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.broker.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.broker.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.broker.pdb.maxUnavailable (not .Values.broker.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.broker.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.broker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- end }}
|
||||
@@ -0,0 +1,414 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.broker.replicaCount }}
|
||||
{{- if or (gt $replicaCount 0) .Values.broker.autoscaling.hpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "kafka.broker.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podManagementPolicy: {{ .Values.broker.podManagementPolicy }}
|
||||
{{- if not .Values.broker.autoscaling.hpa.enabled }}
|
||||
replicas: {{ .Values.broker.replicaCount }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.broker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
serviceName: {{ printf "%s-headless" (include "kafka.broker.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
updateStrategy: {{- include "common.tplvalues.render" (dict "value" .Values.broker.updateStrategy "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.broker.minReadySeconds }}
|
||||
minReadySeconds: {{ .Values.broker.minReadySeconds }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
annotations:
|
||||
{{- if include "kafka.broker.createConfigmap" . }}
|
||||
checksum/configuration: {{ include (print $.Template.BasePath "/broker/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if or (include "kafka.createSaslSecret" .) (not .Values.existingKraftSecret) }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.createTlsSecret" . }}
|
||||
checksum/tls-secret: {{ include (print $.Template.BasePath "/tls-secret.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.metrics.jmx.createConfigmap" . }}
|
||||
checksum/jmx-configuration: {{ include (print $.Template.BasePath "/metrics/jmx-configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.broker.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "kafka.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.broker.automountServiceAccountToken }}
|
||||
{{- if .Values.broker.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.broker.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
hostNetwork: {{ .Values.broker.hostNetwork }}
|
||||
hostIPC: {{ .Values.broker.hostIPC }}
|
||||
{{- if .Values.broker.schedulerName }}
|
||||
schedulerName: {{ .Values.broker.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.broker.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.broker.podAffinityPreset "component" "broker" "customLabels" $podLabels "topologyKey" .Values.broker.topologyKey "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.broker.podAntiAffinityPreset "component" "broker" "customLabels" $podLabels "topologyKey" .Values.broker.topologyKey "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.broker.nodeAffinityPreset.type "key" .Values.broker.nodeAffinityPreset.key "values" .Values.broker.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.broker.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.broker.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.broker.topologySpreadConstraints "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.broker.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.priorityClassName }}
|
||||
priorityClassName: {{ .Values.broker.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.runtimeClassName }}
|
||||
runtimeClassName: {{ .Values.controller.runtimeClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.broker.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "kafka.serviceAccountName" . }}
|
||||
enableServiceLinks: {{ .Values.broker.enableServiceLinks }}
|
||||
initContainers:
|
||||
{{- if and .Values.defaultInitContainers.volumePermissions.enabled .Values.broker.persistence.enabled }}
|
||||
{{- include "kafka.defaultInitContainers.volumePermissions" (dict "context" . "role" "broker") | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.externalAccess.enabled .Values.defaultInitContainers.autoDiscovery.enabled }}
|
||||
{{- include "kafka.defaultInitContainers.autoDiscovery" (dict "context" . "role" "broker") | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "kafka.defaultInitContainers.prepareConfig" (dict "context" . "role" "broker") | nindent 8 }}
|
||||
{{- if .Values.broker.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.broker.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kafka
|
||||
image: {{ include "kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.broker.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.broker.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.broker.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.broker.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.broker.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.broker.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: KAFKA_HEAP_OPTS
|
||||
value: {{ coalesce .Values.broker.heapOpts .Values.heapOpts | quote }}
|
||||
- name: KAFKA_CFG_PROCESS_ROLES
|
||||
value: broker
|
||||
{{- include "kafka.commonEnv" . | nindent 12 }}
|
||||
{{- if .Values.broker.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.broker.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.broker.extraEnvVarsCM .Values.extraEnvVarsCM .Values.broker.extraEnvVarsSecret .Values.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.broker.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.broker.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.broker.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: client
|
||||
containerPort: {{ .Values.listeners.client.containerPort }}
|
||||
- name: interbroker
|
||||
containerPort: {{ .Values.listeners.interbroker.containerPort }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- name: external
|
||||
containerPort: {{ .Values.listeners.external.containerPort }}
|
||||
{{- end }}
|
||||
{{- if .Values.listeners.extraListeners }}
|
||||
{{- include "kafka.extraListeners.containerPorts" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.extraContainerPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.broker.extraContainerPorts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.broker.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.broker.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.broker.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.broker.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- -f
|
||||
- kafka
|
||||
{{- end }}
|
||||
{{- if .Values.broker.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.broker.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.broker.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.broker.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: "client"
|
||||
{{- end }}
|
||||
{{- if .Values.broker.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.broker.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.broker.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.broker.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: "client"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.broker.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.resources }}
|
||||
resources: {{- toYaml .Values.broker.resources | nindent 12 }}
|
||||
{{- else if ne .Values.broker.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.broker.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.broker.persistence.mountPath }}
|
||||
- name: logs
|
||||
mountPath: {{ .Values.broker.logPersistence.mountPath }}
|
||||
- name: kafka-config
|
||||
mountPath: /opt/bitnami/kafka/config/server.properties
|
||||
subPath: server.properties
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
{{- if or .Values.log4j2 .Values.existingLog4j2ConfigMap }}
|
||||
- name: log4j2-config
|
||||
mountPath: /opt/bitnami/kafka/config/log4j2.yaml
|
||||
subPath: log4j2.yaml
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" . }}
|
||||
- name: kafka-shared-certs
|
||||
mountPath: /opt/bitnami/kafka/config/certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if and .Values.usePasswordFiles (include "kafka.saslEnabled" .) }}
|
||||
- name: kafka-sasl
|
||||
mountPath: /opt/bitnami/kafka/config/secrets
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.broker.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
- name: jmx-exporter
|
||||
image: {{ include "kafka.metrics.jmx.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.jmx.image.pullPolicy | quote }}
|
||||
{{- if .Values.metrics.jmx.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.jmx.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- java
|
||||
args:
|
||||
- -XX:MaxRAMPercentage=100
|
||||
- -XshowSettings:vm
|
||||
- -jar
|
||||
- jmx_prometheus_standalone.jar
|
||||
- {{ .Values.metrics.jmx.containerPorts.metrics | quote }}
|
||||
- /etc/jmx-kafka/jmx-kafka-prometheus.yml
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.jmx.containerPorts.metrics }}
|
||||
{{- if .Values.metrics.jmx.resources }}
|
||||
resources: {{- toYaml .Values.metrics.jmx.resources | nindent 12 }}
|
||||
{{- else if ne .Values.metrics.jmx.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.jmx.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.livenessProbe.enabled }}
|
||||
livenessProbe: {{- omit .Values.metrics.jmx.livenessProbe "enabled" | toYaml | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.readinessProbe.enabled }}
|
||||
readinessProbe: {{- omit .Values.metrics.jmx.readinessProbe "enabled" | toYaml | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: jmx-config
|
||||
mountPath: /etc/jmx-kafka
|
||||
{{- end }}
|
||||
{{- if .Values.broker.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.broker.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: kafka-configmaps
|
||||
configMap:
|
||||
name: {{ include "kafka.broker.configmapName" . }}
|
||||
- name: kafka-secret-config
|
||||
{{- if (include "kafka.broker.secretConfigExists" .) }}
|
||||
secret:
|
||||
secretName: {{ include "kafka.broker.secretConfigName" . }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
- name: kafka-config
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: init-shared
|
||||
emptyDir: {}
|
||||
{{- if or .Values.log4j2 .Values.existingLog4j2ConfigMap }}
|
||||
- name: log4j2-config
|
||||
configMap:
|
||||
name: {{ include "kafka.log4j2.configMapName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
- name: jmx-config
|
||||
configMap:
|
||||
name: {{ include "kafka.metrics.jmx.configmapName" . }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" . }}
|
||||
- name: kafka-shared-certs
|
||||
emptyDir: {}
|
||||
{{- if or .Values.tls.existingSecret .Values.tls.autoGenerated.enabled }}
|
||||
- name: kafka-certs
|
||||
projected:
|
||||
defaultMode: 256
|
||||
sources:
|
||||
- secret:
|
||||
name: {{ include "kafka.tlsSecretName" . }}
|
||||
{{- if .Values.tls.jksTruststoreSecret }}
|
||||
- secret:
|
||||
name: {{ .Values.tls.jksTruststoreSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.usePasswordFiles (include "kafka.saslEnabled" .) }}
|
||||
- name: kafka-sasl
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.broker.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.broker.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if .Values.broker.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ printf "%s" (tpl .Values.broker.persistence.existingClaim .) }}
|
||||
{{- end }}
|
||||
{{- if not .Values.broker.logPersistence.enabled }}
|
||||
- name: logs
|
||||
emptyDir: {}
|
||||
{{- else if .Values.broker.logPersistence.existingClaim }}
|
||||
- name: logs
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ printf "%s" (tpl .Values.broker.logPersistence.existingClaim .) }}
|
||||
{{- end }}
|
||||
{{- if or (and .Values.broker.persistence.enabled (not .Values.broker.persistence.existingClaim)) (and .Values.broker.logPersistence.enabled (not .Values.broker.logPersistence.existingClaim)) }}
|
||||
{{- if .Values.broker.persistentVolumeClaimRetentionPolicy.enabled }}
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: {{ .Values.broker.persistentVolumeClaimRetentionPolicy.whenDeleted }}
|
||||
whenScaled: {{ .Values.broker.persistentVolumeClaimRetentionPolicy.whenScaled }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
{{- if and .Values.broker.persistence.enabled (not .Values.broker.persistence.existingClaim) }}
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
{{- if .Values.broker.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.broker.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.broker.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.broker.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.broker.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.broker.persistence.size | quote }}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.broker.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- if .Values.broker.persistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.broker.persistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- if and .Values.broker.logPersistence.enabled (not .Values.broker.logPersistence.existingClaim) }}
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: logs
|
||||
{{- if .Values.broker.logPersistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.broker.logPersistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.broker.logPersistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.broker.logPersistence.size | quote }}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.broker.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- if .Values.broker.logPersistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.broker.logPersistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,75 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
{{- $fullname := include "kafka.broker.fullname" . }}
|
||||
{{- $replicaCount := .Values.broker.replicaCount | int }}
|
||||
{{- range $i := until $replicaCount }}
|
||||
{{- $targetPod := printf "%s-%d" (printf "%s" $fullname) $i }}
|
||||
{{- $_ := set $ "targetPod" $targetPod }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-%d-external" $fullname $i | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" $ | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.externalAccess.broker.service.labels $.Values.commonLabels ) "context" $ ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
pod: {{ $targetPod }}
|
||||
{{- if or $.Values.externalAccess.broker.service.annotations $.Values.commonAnnotations $.Values.externalAccess.broker.service.loadBalancerAnnotations }}
|
||||
annotations:
|
||||
{{- if and (not (empty $.Values.externalAccess.broker.service.loadBalancerAnnotations)) (eq (len $.Values.externalAccess.broker.service.loadBalancerAnnotations) $replicaCount) }}
|
||||
{{ include "common.tplvalues.render" ( dict "value" (index $.Values.externalAccess.broker.service.loadBalancerAnnotations $i) "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or $.Values.externalAccess.broker.service.annotations $.Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list $.Values.externalAccess.broker.service.annotations $.Values.commonAnnotations ) "context" $ ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ $.Values.externalAccess.broker.service.type }}
|
||||
{{- if eq $.Values.externalAccess.broker.service.type "LoadBalancer" }}
|
||||
allocateLoadBalancerNodePorts: {{ $.Values.externalAccess.broker.service.allocateLoadBalancerNodePorts }}
|
||||
{{- if (not (empty $.Values.externalAccess.broker.service.loadBalancerClass)) }}
|
||||
loadBalancerClass: {{ $.Values.externalAccess.broker.service.loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- if and (not (empty $.Values.externalAccess.broker.service.loadBalancerIPs)) (eq (len $.Values.externalAccess.broker.service.loadBalancerIPs) $replicaCount) }}
|
||||
loadBalancerIP: {{ index $.Values.externalAccess.broker.service.loadBalancerIPs $i }}
|
||||
{{- end }}
|
||||
{{- if $.Values.externalAccess.broker.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{- toYaml $.Values.externalAccess.broker.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
publishNotReadyAddresses: {{ $.Values.externalAccess.broker.service.publishNotReadyAddresses }}
|
||||
ports:
|
||||
- name: tcp-kafka
|
||||
port: {{ $.Values.externalAccess.broker.service.ports.external }}
|
||||
{{- if le (add $i 1) (len $.Values.externalAccess.broker.service.nodePorts) }}
|
||||
nodePort: {{ index $.Values.externalAccess.broker.service.nodePorts $i }}
|
||||
{{- else }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
targetPort: external
|
||||
{{- if $.Values.externalAccess.broker.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" $.Values.externalAccess.broker.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and (eq $.Values.externalAccess.broker.service.type "NodePort") (le (add $i 1) (len $.Values.externalAccess.broker.service.externalIPs)) }}
|
||||
externalIPs: [{{ index $.Values.externalAccess.broker.service.externalIPs $i | quote }}]
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.broker.podLabels $.Values.commonLabels ) "context" $ ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
app.kubernetes.io/component: broker
|
||||
statefulset.kubernetes.io/pod-name: {{ $targetPod }}
|
||||
{{- with $.Values.externalAccess.broker.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $.Values.externalAccess.broker.service.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,45 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.broker.replicaCount }}
|
||||
{{- if gt $replicaCount 0 }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "kafka.broker.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.externalAccess.broker.service.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if or .Values.service.headless.broker.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.broker.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
- name: tcp-interbroker
|
||||
port: {{ .Values.service.ports.interbroker }}
|
||||
protocol: TCP
|
||||
targetPort: interbroker
|
||||
- name: tcp-client
|
||||
port: {{ .Values.service.ports.client }}
|
||||
protocol: TCP
|
||||
targetPort: client
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.broker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- with .Values.service.headless.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.headless.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,46 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.broker.replicaCount }}
|
||||
{{- if and (gt $replicaCount 0) (include "common.capabilities.apiVersions.has" ( dict "version" "autoscaling.k8s.io/v1/VerticalPodAutoscaler" "context" . )) .Values.broker.autoscaling.vpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.vpa.apiVersion" . }}
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "kafka.broker.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: broker
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if or .Values.broker.autoscaling.vpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.broker.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
resourcePolicy:
|
||||
containerPolicies:
|
||||
- containerName: kafka
|
||||
{{- with .Values.broker.autoscaling.vpa.controlledResources }}
|
||||
controlledResources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.broker.autoscaling.vpa.maxAllowed }}
|
||||
maxAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.broker.autoscaling.vpa.minAllowed }}
|
||||
minAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
targetRef:
|
||||
apiVersion: {{ (include "common.capabilities.statefulset.apiVersion" .) }}
|
||||
kind: StatefulSet
|
||||
name: {{ template "kafka.broker.fullname" . }}
|
||||
{{- if .Values.broker.autoscaling.vpa.updatePolicy }}
|
||||
updatePolicy:
|
||||
{{- with .Values.broker.autoscaling.vpa.updatePolicy.updateMode }}
|
||||
updateMode: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if include "kafka.createCertificate" . }}
|
||||
{{- if empty .Values.tls.autoGenerated.certManager.existingIssuer }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ printf "%s-clusterissuer" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
{{- end }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
secretName: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
|
||||
commonName: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
|
||||
isCA: true
|
||||
issuerRef:
|
||||
name: {{ default (printf "%s-clusterissuer" (include "common.names.fullname" .)) .Values.tls.autoGenerated.certManager.existingIssuer }}
|
||||
kind: {{ default "Issuer" .Values.tls.autoGenerated.certManager.existingIssuerKind }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ca:
|
||||
secretName: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if include "kafka.createCertificate" . }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ printf "%s-crt" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
secretName: {{ include "kafka.tlsSecretName" . }}
|
||||
commonName: {{ printf "%s.%s.svc.%s" (include "common.names.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain }}
|
||||
issuerRef:
|
||||
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
|
||||
kind: Issuer
|
||||
subject:
|
||||
organizations:
|
||||
- "Kafka"
|
||||
dnsNames:
|
||||
{{- $controllerSvcName := printf "%s-headless" (include "kafka.controller.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $brokerSvcName := printf "%s-headless" (include "kafka.broker.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
- '*.{{ include "common.names.namespace" . }}'
|
||||
- '*.{{ include "common.names.namespace" . }}.svc'
|
||||
- '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
|
||||
- '*.{{ $controllerSvcName }}'
|
||||
- '*.{{ $controllerSvcName }}.{{ include "common.names.namespace" . }}'
|
||||
- '*.{{ $controllerSvcName }}.{{ include "common.names.namespace" . }}.svc'
|
||||
- '*.{{ $controllerSvcName }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
|
||||
- '*.{{ $brokerSvcName }}'
|
||||
- '*.{{ $brokerSvcName }}.{{ include "common.names.namespace" . }}'
|
||||
- '*.{{ $brokerSvcName }}.{{ include "common.names.namespace" . }}.svc'
|
||||
- '*.{{ $brokerSvcName }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
|
||||
{{- if .Values.externalAccess.enabled -}}
|
||||
{{- with .Values.externalAccess.broker.service.domain }}
|
||||
- '*.{{ . }}'
|
||||
{{- end }}
|
||||
{{- with .Values.externalAccess.controller.service.domain }}
|
||||
- '*.{{ . }}'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range .Values.tls.autoGenerated.customAltNames }}
|
||||
- '{{ . }}'
|
||||
{{- end }}
|
||||
privateKey:
|
||||
algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }}
|
||||
size: {{ int .Values.tls.autoGenerated.certManager.keySize }}
|
||||
duration: {{ .Values.tls.autoGenerated.certManager.duration }}
|
||||
renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.controller.replicaCount }}
|
||||
{{- if and (include "kafka.controller.createSecretConfig" .) (gt $replicaCount 0) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-secret-configuration" (include "kafka.controller.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
server-secret.properties: {{ include "kafka.controller.secretConfig" . | b64enc }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka controller configuration.
|
||||
ref: https://kafka.apache.org/documentation/#configuration
|
||||
*/}}
|
||||
{{- define "kafka.controller.config" -}}
|
||||
{{- if or .Values.config .Values.controller.config }}
|
||||
{{- include "common.tplvalues.render" (dict "value" (coalesce .Values.controller.config .Values.config) "context" .) }}
|
||||
{{- else }}
|
||||
# Listeners configuration
|
||||
listeners: {{ include "kafka.listeners" (dict "isController" true "context" .) }}
|
||||
listener.security.protocol.map: {{ include "kafka.securityProtocolMap" (dict "isController" true "context" .) }}
|
||||
{{- if not .Values.controller.controllerOnly }}
|
||||
advertised.listeners: {{ include "kafka.advertisedListeners" . }}
|
||||
inter.broker.listener.name: {{ .Values.listeners.interbroker.name }}
|
||||
{{- end }}
|
||||
# Kafka data logs directory
|
||||
log.dir: {{ printf "%s/data" .Values.controller.persistence.mountPath }}
|
||||
# Kafka application logs directory
|
||||
logs.dir: {{ .Values.controller.logPersistence.mountPath }}
|
||||
# KRaft node role
|
||||
process.roles: {{ ternary "controller" "controller,broker" .Values.controller.controllerOnly }}
|
||||
# Common Kafka Configuration
|
||||
{{ include "kafka.commonConfig" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $replicaCount := int .Values.controller.replicaCount }}
|
||||
{{- if and (include "kafka.controller.createConfigmap" .) (gt $replicaCount 0) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-configuration" (include "kafka.controller.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- $configuration := include "kafka.controller.config" . | fromYaml -}}
|
||||
{{- if or .Values.overrideConfiguration .Values.controller.overrideConfiguration }}
|
||||
{{- $overrideConfiguration := include "common.tplvalues.render" (dict "value" .Values.overrideConfiguration "context" .) | fromYaml }}
|
||||
{{- $controllerOverrideConfiguration := include "common.tplvalues.render" (dict "value" .Values.controller.overrideConfiguration "context" .) | fromYaml }}
|
||||
{{- $configuration = mustMergeOverwrite $configuration $overrideConfiguration $controllerOverrideConfiguration }}
|
||||
{{- end }}
|
||||
server.properties: |-
|
||||
{{- range $key, $value := $configuration }}
|
||||
{{ $key }}={{ include "common.tplvalues.render" (dict "value" $value "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.controller.autoscaling.hpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "kafka.controller.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if or .Values.controller.autoscaling.hpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.controller.autoscaling.hpa.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ template "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
name: {{ template "kafka.controller.fullname" . }}
|
||||
minReplicas: {{ .Values.controller.autoscaling.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.controller.autoscaling.hpa.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.controller.autoscaling.hpa.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.controller.autoscaling.hpa.targetCPU }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.autoscaling.hpa.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.controller.autoscaling.hpa.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,101 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.controller.replicaCount }}
|
||||
{{- if and .Values.networkPolicy.enabled (or (gt $replicaCount 0) .Values.controller.autoscaling.hpa.enabled) }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "kafka.controller.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.controller.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow internal communications between nodes
|
||||
- ports:
|
||||
- port: {{ .Values.listeners.controller.containerPort }}
|
||||
{{- if not .Values.controller.controllerOnly }}
|
||||
- port: {{ .Values.listeners.client.containerPort }}
|
||||
- port: {{ .Values.listeners.interbroker.containerPort }}
|
||||
{{- range $listener := .Values.listeners.extraListeners }}
|
||||
- port: {{ $listener.containerPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- port: {{ .Values.listeners.external.containerPort }}
|
||||
{{- end }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
# Allow client connections
|
||||
- ports:
|
||||
- port: {{ .Values.listeners.controller.containerPort }}
|
||||
{{- if not .Values.controller.controllerOnly }}
|
||||
- port: {{ .Values.listeners.client.containerPort }}
|
||||
- port: {{ .Values.listeners.interbroker.containerPort }}
|
||||
{{- range $listener := .Values.listeners.extraListeners }}
|
||||
- port: {{ $listener.containerPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- port: {{ .Values.listeners.external.containerPort }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
- port: {{ .Values.metrics.jmx.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if and .Values.networkPolicy.addExternalClientAccess (not .Values.controller.controllerOnly) }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressPodMatchLabels }}
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressNSMatchLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressNSPodMatchLabel "context" $ ) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.controller.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "kafka.controller.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.controller.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.controller.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.controller.pdb.maxUnavailable (not .Values.controller.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.controller.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.controller.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- end }}
|
||||
@@ -0,0 +1,425 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "kafka.controller.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podManagementPolicy: {{ .Values.controller.podManagementPolicy }}
|
||||
{{- if not .Values.controller.autoscaling.hpa.enabled }}
|
||||
replicas: {{ .Values.controller.replicaCount }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.controller.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
serviceName: {{ printf "%s-headless" (include "kafka.controller.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
updateStrategy: {{- include "common.tplvalues.render" (dict "value" .Values.controller.updateStrategy "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.controller.minReadySeconds }}
|
||||
minReadySeconds: {{ .Values.controller.minReadySeconds }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
annotations:
|
||||
{{- if include "kafka.controller.createConfigmap" . }}
|
||||
checksum/configuration: {{ include (print $.Template.BasePath "/controller-eligible/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if or (include "kafka.createSaslSecret" .) (not .Values.existingKraftSecret) }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.createTlsSecret" . }}
|
||||
checksum/tls-secret: {{ include (print $.Template.BasePath "/tls-secret.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.metrics.jmx.createConfigmap" . }}
|
||||
checksum/jmx-configuration: {{ include (print $.Template.BasePath "/metrics/jmx-configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.controller.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "kafka.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.controller.automountServiceAccountToken }}
|
||||
{{- if .Values.controller.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.controller.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
hostNetwork: {{ .Values.controller.hostNetwork }}
|
||||
hostIPC: {{ .Values.controller.hostIPC }}
|
||||
{{- if .Values.controller.schedulerName }}
|
||||
schedulerName: {{ .Values.controller.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.controller.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.controller.podAffinityPreset "component" "controller-eligible" "customLabels" $podLabels "topologyKey" .Values.controller.topologyKey "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.controller.podAntiAffinityPreset "component" "controller-eligible" "customLabels" $podLabels "topologyKey" .Values.controller.topologyKey "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.controller.nodeAffinityPreset.type "key" .Values.controller.nodeAffinityPreset.key "values" .Values.controller.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.controller.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.controller.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.controller.topologySpreadConstraints "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.priorityClassName }}
|
||||
priorityClassName: {{ .Values.controller.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.runtimeClassName }}
|
||||
runtimeClassName: {{ .Values.controller.runtimeClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.controller.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "kafka.serviceAccountName" . }}
|
||||
enableServiceLinks: {{ .Values.controller.enableServiceLinks }}
|
||||
{{- if .Values.dnsPolicy }}
|
||||
dnsPolicy: {{ .Values.dnsPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.dnsConfig }}
|
||||
dnsConfig: {{- include "common.tplvalues.render" (dict "value" .Values.dnsConfig "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if and .Values.defaultInitContainers.volumePermissions.enabled .Values.controller.persistence.enabled }}
|
||||
{{- include "kafka.defaultInitContainers.volumePermissions" (dict "context" . "role" "controller") | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.externalAccess.enabled .Values.defaultInitContainers.autoDiscovery.enabled (or .Values.externalAccess.controller.forceExpose (not .Values.controller.controllerOnly)) }}
|
||||
{{- include "kafka.defaultInitContainers.autoDiscovery" (dict "context" . "role" "controller") | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "kafka.defaultInitContainers.prepareConfig" (dict "context" . "role" "controller") | nindent 8 }}
|
||||
{{- if .Values.controller.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.controller.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kafka
|
||||
image: {{ include "kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.controller.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.controller.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.controller.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.controller.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.controller.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.controller.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: KAFKA_HEAP_OPTS
|
||||
value: {{ coalesce .Values.controller.heapOpts .Values.heapOpts | quote }}
|
||||
- name: KAFKA_CFG_PROCESS_ROLES
|
||||
value: {{ ternary "controller" "controller,broker" .Values.controller.controllerOnly | quote }}
|
||||
- name: KAFKA_INITIAL_CONTROLLERS_FILE
|
||||
value: /shared/initial-controllers.txt
|
||||
{{- include "kafka.commonEnv" . | nindent 12 }}
|
||||
{{- if .Values.controller.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.controller.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.controller.extraEnvVarsCM .Values.extraEnvVarsCM .Values.controller.extraEnvVarsSecret .Values.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.controller.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.controller.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.controller.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: controller
|
||||
containerPort: {{ .Values.listeners.controller.containerPort }}
|
||||
{{- if not .Values.controller.controllerOnly }}
|
||||
- name: client
|
||||
containerPort: {{ .Values.listeners.client.containerPort }}
|
||||
- name: interbroker
|
||||
containerPort: {{ .Values.listeners.interbroker.containerPort }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- name: external
|
||||
containerPort: {{ .Values.listeners.external.containerPort }}
|
||||
{{- end }}
|
||||
{{- if and .Values.listeners.extraListeners (not .Values.controller.controllerOnly) }}
|
||||
{{- include "kafka.extraListeners.containerPorts" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.extraContainerPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.controller.extraContainerPorts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.controller.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.controller.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.controller.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.controller.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- -f
|
||||
- kafka
|
||||
{{- end }}
|
||||
{{- if .Values.controller.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.controller.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.controller.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.controller.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: "controller"
|
||||
{{- end }}
|
||||
{{- if .Values.controller.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.controller.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.controller.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.controller.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: "controller"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.controller.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.resources }}
|
||||
resources: {{- toYaml .Values.controller.resources | nindent 12 }}
|
||||
{{- else if ne .Values.controller.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.controller.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.controller.persistence.mountPath }}
|
||||
- name: logs
|
||||
mountPath: {{ .Values.controller.logPersistence.mountPath }}
|
||||
- name: kafka-config
|
||||
mountPath: /opt/bitnami/kafka/config/server.properties
|
||||
subPath: server.properties
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: init-shared
|
||||
mountPath: /shared
|
||||
{{- if or .Values.log4j2 .Values.existingLog4j2ConfigMap }}
|
||||
- name: log4j2-config
|
||||
mountPath: /opt/bitnami/kafka/config/log4j2.yaml
|
||||
subPath: log4j2.yaml
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" . }}
|
||||
- name: kafka-shared-certs
|
||||
mountPath: /opt/bitnami/kafka/config/certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if and .Values.usePasswordFiles (include "kafka.saslEnabled" .) }}
|
||||
- name: kafka-sasl
|
||||
mountPath: /opt/bitnami/kafka/config/secrets
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.controller.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
- name: jmx-exporter
|
||||
image: {{ include "kafka.metrics.jmx.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.jmx.image.pullPolicy | quote }}
|
||||
{{- if .Values.metrics.jmx.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.jmx.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- java
|
||||
args:
|
||||
- -XX:MaxRAMPercentage=100
|
||||
- -XshowSettings:vm
|
||||
- -jar
|
||||
- jmx_prometheus_standalone.jar
|
||||
- {{ .Values.metrics.jmx.containerPorts.metrics | quote }}
|
||||
- /etc/jmx-kafka/jmx-kafka-prometheus.yml
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.jmx.containerPorts.metrics }}
|
||||
{{- if .Values.metrics.jmx.resources }}
|
||||
resources: {{- toYaml .Values.metrics.jmx.resources | nindent 12 }}
|
||||
{{- else if ne .Values.metrics.jmx.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.jmx.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.livenessProbe.enabled }}
|
||||
livenessProbe: {{- omit .Values.metrics.jmx.livenessProbe "enabled" | toYaml | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.readinessProbe.enabled }}
|
||||
readinessProbe: {{- omit .Values.metrics.jmx.readinessProbe "enabled" | toYaml | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: jmx-config
|
||||
mountPath: /etc/jmx-kafka
|
||||
{{- end }}
|
||||
{{- if .Values.controller.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.controller.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: kafka-configmaps
|
||||
configMap:
|
||||
name: {{ include "kafka.controller.configmapName" . }}
|
||||
- name: kafka-secret-config
|
||||
{{- if (include "kafka.controller.secretConfigExists" .) }}
|
||||
secret:
|
||||
secretName: {{ include "kafka.controller.secretConfigName" . }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
- name: kafka-config
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: init-shared
|
||||
emptyDir: {}
|
||||
{{- if or .Values.log4j2 .Values.existingLog4j2ConfigMap }}
|
||||
- name: log4j2-config
|
||||
configMap:
|
||||
name: {{ include "kafka.log4j2.configMapName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
- name: jmx-config
|
||||
configMap:
|
||||
name: {{ include "kafka.metrics.jmx.configmapName" . }}
|
||||
{{- end }}
|
||||
{{- if include "kafka.sslEnabled" . }}
|
||||
- name: kafka-shared-certs
|
||||
emptyDir: {}
|
||||
{{- if or .Values.tls.existingSecret .Values.tls.autoGenerated.enabled }}
|
||||
- name: kafka-certs
|
||||
projected:
|
||||
defaultMode: 256
|
||||
sources:
|
||||
- secret:
|
||||
name: {{ include "kafka.tlsSecretName" . }}
|
||||
{{- if .Values.tls.jksTruststoreSecret }}
|
||||
- secret:
|
||||
name: {{ .Values.tls.jksTruststoreSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.usePasswordFiles (include "kafka.saslEnabled" .) }}
|
||||
- name: kafka-sasl
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.controller.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.controller.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if .Values.controller.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ printf "%s" (tpl .Values.controller.persistence.existingClaim .) }}
|
||||
{{- end }}
|
||||
{{- if not .Values.controller.logPersistence.enabled }}
|
||||
- name: logs
|
||||
emptyDir: {}
|
||||
{{- else if .Values.controller.logPersistence.existingClaim }}
|
||||
- name: logs
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ printf "%s" (tpl .Values.controller.logPersistence.existingClaim .) }}
|
||||
{{- end }}
|
||||
{{- if or (and .Values.controller.persistence.enabled (not .Values.controller.persistence.existingClaim)) (and .Values.controller.logPersistence.enabled (not .Values.controller.logPersistence.existingClaim)) }}
|
||||
{{- if .Values.controller.persistentVolumeClaimRetentionPolicy.enabled }}
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: {{ .Values.controller.persistentVolumeClaimRetentionPolicy.whenDeleted }}
|
||||
whenScaled: {{ .Values.controller.persistentVolumeClaimRetentionPolicy.whenScaled }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
{{- if and .Values.controller.persistence.enabled (not .Values.controller.persistence.existingClaim) }}
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
{{- if .Values.controller.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.controller.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.controller.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.controller.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.controller.persistence.size | quote }}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.controller.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- if .Values.controller.persistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.controller.persistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- if and .Values.controller.logPersistence.enabled (not .Values.controller.logPersistence.existingClaim) }}
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: logs
|
||||
{{- if .Values.controller.logPersistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.controller.logPersistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.controller.logPersistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.controller.logPersistence.size | quote }}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.controller.logPersistence "global" .Values.global) | nindent 8 }}
|
||||
{{- if .Values.controller.logPersistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.controller.logPersistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,77 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
{{- $fullname := include "kafka.controller.fullname" . }}
|
||||
{{- if or .Values.externalAccess.controller.forceExpose (not .Values.controller.controllerOnly)}}
|
||||
{{- $replicaCount := .Values.controller.replicaCount | int }}
|
||||
{{- range $i := until $replicaCount }}
|
||||
{{- $targetPod := printf "%s-%d" $fullname $i }}
|
||||
{{- $_ := set $ "targetPod" $targetPod }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-%d-external" $fullname $i | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" $ | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.externalAccess.controller.service.labels $.Values.commonLabels ) "context" $ ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
pod: {{ $targetPod }}
|
||||
{{- if or $.Values.externalAccess.controller.service.annotations $.Values.commonAnnotations $.Values.externalAccess.controller.service.loadBalancerAnnotations }}
|
||||
annotations:
|
||||
{{- if and (not (empty $.Values.externalAccess.controller.service.loadBalancerAnnotations)) (eq (len $.Values.externalAccess.controller.service.loadBalancerAnnotations) $replicaCount) }}
|
||||
{{ include "common.tplvalues.render" ( dict "value" (index $.Values.externalAccess.controller.service.loadBalancerAnnotations $i) "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or $.Values.externalAccess.controller.service.annotations $.Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list $.Values.externalAccess.controller.service.annotations $.Values.commonAnnotations ) "context" $ ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ $.Values.externalAccess.controller.service.type }}
|
||||
{{- if eq $.Values.externalAccess.controller.service.type "LoadBalancer" }}
|
||||
allocateLoadBalancerNodePorts: {{ $.Values.externalAccess.controller.service.allocateLoadBalancerNodePorts }}
|
||||
{{- if (not (empty $.Values.externalAccess.controller.service.loadBalancerClass)) }}
|
||||
loadBalancerClass: {{ $.Values.externalAccess.controller.service.loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- if and (not (empty $.Values.externalAccess.controller.service.loadBalancerIPs)) (eq (len $.Values.externalAccess.controller.service.loadBalancerIPs) $replicaCount) }}
|
||||
loadBalancerIP: {{ index $.Values.externalAccess.controller.service.loadBalancerIPs $i }}
|
||||
{{- end }}
|
||||
{{- if $.Values.externalAccess.controller.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{- toYaml $.Values.externalAccess.controller.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
publishNotReadyAddresses: {{ $.Values.externalAccess.controller.service.publishNotReadyAddresses }}
|
||||
ports:
|
||||
- name: tcp-kafka
|
||||
port: {{ $.Values.externalAccess.controller.service.ports.external }}
|
||||
{{- if le (add $i 1) (len $.Values.externalAccess.controller.service.nodePorts) }}
|
||||
nodePort: {{ index $.Values.externalAccess.controller.service.nodePorts $i }}
|
||||
{{- else }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
targetPort: external
|
||||
{{- if $.Values.externalAccess.controller.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" $.Values.externalAccess.controller.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and (eq $.Values.externalAccess.controller.service.type "NodePort") (le (add $i 1) (len $.Values.externalAccess.controller.service.externalIPs)) }}
|
||||
externalIPs: [{{ index $.Values.externalAccess.controller.service.externalIPs $i | quote }}]
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.controller.podLabels $.Values.commonLabels ) "context" $ ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
statefulset.kubernetes.io/pod-name: {{ $targetPod }}
|
||||
{{- with $.Values.externalAccess.controller.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $.Values.externalAccess.controller.service.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "kafka.controller.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.controller.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if or .Values.service.headless.controller.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.controller.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
{{- if not .Values.controller.controllerOnly }}
|
||||
- name: tcp-interbroker
|
||||
port: {{ .Values.service.ports.interbroker }}
|
||||
protocol: TCP
|
||||
targetPort: interbroker
|
||||
- name: tcp-client
|
||||
port: {{ .Values.service.ports.client }}
|
||||
protocol: TCP
|
||||
targetPort: client
|
||||
{{- end }}
|
||||
- name: tcp-controller
|
||||
protocol: TCP
|
||||
port: {{ .Values.service.ports.controller }}
|
||||
targetPort: controller
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.controller.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- with .Values.service.headless.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.headless.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,45 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (include "common.capabilities.apiVersions.has" ( dict "version" "autoscaling.k8s.io/v1/VerticalPodAutoscaler" "context" . )) .Values.controller.autoscaling.vpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.vpa.apiVersion" . }}
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "kafka.controller.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: controller-eligible
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if or .Values.controller.autoscaling.vpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.controller.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
resourcePolicy:
|
||||
containerPolicies:
|
||||
- containerName: kafka
|
||||
{{- with .Values.controller.autoscaling.vpa.controlledResources }}
|
||||
controlledResources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.autoscaling.vpa.maxAllowed }}
|
||||
maxAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.autoscaling.vpa.minAllowed }}
|
||||
minAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
targetRef:
|
||||
apiVersion: {{ (include "common.capabilities.statefulset.apiVersion" .) }}
|
||||
kind: StatefulSet
|
||||
name: {{ template "kafka.controller.fullname" . }}
|
||||
{{- if .Values.controller.autoscaling.vpa.updatePolicy }}
|
||||
updatePolicy:
|
||||
{{- with .Values.controller.autoscaling.vpa.updatePolicy.updateMode }}
|
||||
updateMode: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,9 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.log4j2 (not .Values.existingLog4j2ConfigMap) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-log4j2-configuration" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
log4j2.yaml: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.log4j2 "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,70 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if include "kafka.metrics.jmx.createConfigmap" . }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-jmx-configuration" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
jmx-kafka-prometheus.yml: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.jmx.config "context" $ ) | nindent 4 }}
|
||||
rules:
|
||||
- pattern: kafka.controller<type=(ControllerChannelManager), name=(QueueSize), broker-id=(\d+)><>(Value)
|
||||
name: kafka_controller_$1_$2_$4
|
||||
labels:
|
||||
broker_id: "$3"
|
||||
- pattern: kafka.controller<type=(ControllerChannelManager), name=(TotalQueueSize)><>(Value)
|
||||
name: kafka_controller_$1_$2_$3
|
||||
- pattern: kafka.controller<type=(KafkaController), name=(.+)><>(Value)
|
||||
name: kafka_controller_$1_$2_$3
|
||||
- pattern: kafka.controller<type=(ControllerStats), name=(.+)><>(Count)
|
||||
name: kafka_controller_$1_$2_$3
|
||||
- pattern : kafka.network<type=(Processor), name=(IdlePercent), networkProcessor=(.+)><>(Value)
|
||||
name: kafka_network_$1_$2_$4
|
||||
labels:
|
||||
network_processor: $3
|
||||
- pattern : kafka.network<type=(RequestMetrics), name=(.+), request=(.+)><>(Count|Value)
|
||||
name: kafka_network_$1_$2_$4
|
||||
labels:
|
||||
request: $3
|
||||
- pattern : kafka.network<type=(SocketServer), name=(.+)><>(Count|Value)
|
||||
name: kafka_network_$1_$2_$3
|
||||
- pattern : kafka.network<type=(RequestChannel), name=(.+)><>(Count|Value)
|
||||
name: kafka_network_$1_$2_$3
|
||||
- pattern: kafka.server<type=(.+), name=(.+), topic=(.+)><>(Count|OneMinuteRate)
|
||||
name: kafka_server_$1_$2_$4
|
||||
labels:
|
||||
topic: $3
|
||||
- pattern: kafka.server<type=(ReplicaFetcherManager), name=(.+), clientId=(.+)><>(Value)
|
||||
name: kafka_server_$1_$2_$4
|
||||
labels:
|
||||
client_id: "$3"
|
||||
- pattern: kafka.server<type=(DelayedOperationPurgatory), name=(.+), delayedOperation=(.+)><>(Value)
|
||||
name: kafka_server_$1_$2_$3_$4
|
||||
- pattern: kafka.server<type=(.+), name=(.+)><>(Count|Value|OneMinuteRate)
|
||||
name: kafka_server_$1_total_$2_$3
|
||||
- pattern: kafka.server<type=(.+)><>(queue-size)
|
||||
name: kafka_server_$1_$2
|
||||
- pattern: java.lang<type=(.+), name=(.+)><(.+)>(\w+)
|
||||
name: java_lang_$1_$4_$3_$2
|
||||
- pattern: java.lang<type=(.+), name=(.+)><>(\w+)
|
||||
name: java_lang_$1_$3_$2
|
||||
- pattern : java.lang<type=(.*)>
|
||||
- pattern: kafka.log<type=(.+), name=(.+), topic=(.+), partition=(.+)><>Value
|
||||
name: kafka_log_$1_$2
|
||||
labels:
|
||||
topic: $3
|
||||
partition: $4
|
||||
{{- if .Values.metrics.jmx.extraRules }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.jmx.extraRules "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,49 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.jmx.enabled .Values.metrics.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ printf "%s-jmx-metrics" (include "common.names.fullname" .) }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: metrics
|
||||
endpoints:
|
||||
- port: http-metrics
|
||||
path: {{ .Values.metrics.serviceMonitor.path }}
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,38 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.metrics.jmx.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-jmx-metrics" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if or .Values.metrics.jmx.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.jmx.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
sessionAffinity: {{ .Values.metrics.jmx.service.sessionAffinity }}
|
||||
{{- if .Values.metrics.jmx.service.clusterIP }}
|
||||
clusterIP: {{ .Values.metrics.jmx.service.clusterIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http-metrics
|
||||
port: {{ .Values.metrics.jmx.service.ports.metrics }}
|
||||
protocol: TCP
|
||||
targetPort: metrics
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- with .Values.metrics.jmx.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.metrics.jmx.service.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.jmx.enabled .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.groups }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.prometheusRule.namespace }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.prometheusRule.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.groups "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,348 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.provisioning.enabled }}
|
||||
kind: Job
|
||||
apiVersion: batch/v1
|
||||
metadata:
|
||||
name: {{ printf "%s-provisioning" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka-provisioning
|
||||
annotations:
|
||||
{{- if .Values.provisioning.useHelmHooks }}
|
||||
helm.sh/hook: post-install,post-upgrade
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.provisioning.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: kafka-provisioning
|
||||
{{- if .Values.provisioning.podAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "kafka.provisioning.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.provisioning.automountServiceAccountToken }}
|
||||
enableServiceLinks: {{ .Values.provisioning.enableServiceLinks }}
|
||||
{{- include "kafka.imagePullSecrets" . | nindent 6 }}
|
||||
{{- if .Values.provisioning.schedulerName }}
|
||||
schedulerName: {{ .Values.provisioning.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.provisioning.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
terminationGracePeriodSeconds: 0
|
||||
{{- if .Values.provisioning.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
- name: prepare-config
|
||||
image: {{ include "kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.provisioning.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.provisioning.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
. /opt/bitnami/scripts/libkafka.sh
|
||||
|
||||
if [[ ! -f "$KAFKA_CONF_FILE" ]]; then
|
||||
touch $KAFKA_CONF_FILE
|
||||
|
||||
kafka_server_conf_set security.protocol {{ .Values.listeners.client.protocol | quote }}
|
||||
{{- if regexFind "SSL" (upper .Values.listeners.client.protocol) }}
|
||||
kafka_server_conf_set ssl.keystore.type {{ upper .Values.provisioning.auth.tls.type | quote }}
|
||||
kafka_server_conf_set ssl.truststore.type {{ upper .Values.provisioning.auth.tls.type | quote }}
|
||||
! is_empty_value "$KAFKA_CLIENT_KEY_PASSWORD" && kafka_server_conf_set ssl.key.password "$KAFKA_CLIENT_KEY_PASSWORD"
|
||||
{{- if eq (upper .Values.provisioning.auth.tls.type) "PEM" }}
|
||||
{{- if .Values.provisioning.auth.tls.caCert }}
|
||||
file_to_multiline_property() {
|
||||
awk 'NR > 1{print line" \\"}{line=$0;}END{print $0" "}' <"${1:?missing file}"
|
||||
}
|
||||
# Convert the PEM key to PKCS#8 Format for Java compatibility
|
||||
openssl pkcs8 -topk8 -nocrypt -passin pass:"${KAFKA_TLS_PEM_KEY_PASSWORD:-}" -in "/certs/{{ .Values.provisioning.auth.tls.key }}" -out "/shared/tls.key"
|
||||
kafka_server_conf_set ssl.keystore.key "$(file_to_multiline_property "/shared/tls.key")"
|
||||
kafka_server_conf_set ssl.keystore.certificate.chain "$(file_to_multiline_property "/certs/{{ .Values.provisioning.auth.tls.cert }}")"
|
||||
kafka_server_conf_set ssl.truststore.certificates "$(file_to_multiline_property "/certs/{{ .Values.provisioning.auth.tls.caCert }}")"
|
||||
{{- else }}
|
||||
kafka_server_conf_set ssl.keystore.location "/certs/{{ .Values.provisioning.auth.tls.keystore }}"
|
||||
kafka_server_conf_set ssl.truststore.location "/certs/{{ .Values.provisioning.auth.tls.truststore }}"
|
||||
{{- end }}
|
||||
{{- else if eq (upper .Values.provisioning.auth.tls.type) "JKS" }}
|
||||
kafka_server_conf_set ssl.keystore.location "/certs/{{ .Values.provisioning.auth.tls.keystore }}"
|
||||
kafka_server_conf_set ssl.truststore.location "/certs/{{ .Values.provisioning.auth.tls.truststore }}"
|
||||
! is_empty_value "$KAFKA_CLIENT_KEYSTORE_PASSWORD" && kafka_server_conf_set ssl.keystore.password "$KAFKA_CLIENT_KEYSTORE_PASSWORD"
|
||||
! is_empty_value "$KAFKA_CLIENT_TRUSTSTORE_PASSWORD" && kafka_server_conf_set ssl.truststore.password "$KAFKA_CLIENT_TRUSTSTORE_PASSWORD"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.client.protocol) }}
|
||||
{{- if regexFind "PLAIN" ( upper .Values.sasl.enabledMechanisms) }}
|
||||
kafka_server_conf_set sasl.mechanism PLAIN
|
||||
kafka_server_conf_set sasl.jaas.config "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"$SASL_USERNAME\" password=\"$SASL_USER_PASSWORD\";"
|
||||
{{- else if regexFind "SCRAM-SHA-256" ( upper .Values.sasl.enabledMechanisms) }}
|
||||
kafka_server_conf_set sasl.mechanism SCRAM-SHA-256
|
||||
kafka_server_conf_set sasl.jaas.config "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"$SASL_USERNAME\" password=\"$SASL_USER_PASSWORD\";"
|
||||
{{- else if regexFind "SCRAM-SHA-512" ( upper .Values.sasl.enabledMechanisms) }}
|
||||
kafka_server_conf_set sasl.mechanism SCRAM-SHA-512
|
||||
kafka_server_conf_set sasl.jaas.config "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"$SASL_USERNAME\" password=\"$SASL_USER_PASSWORD\";"
|
||||
{{- else if regexFind "OAUTHBEARER" ( upper .Values.sasl.enabledMechanisms) }}
|
||||
kafka_server_conf_set sasl.mechanism OAUTHBEARER
|
||||
kafka_server_conf_set sasl.jaas.config "org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required clientId=\"$SASL_CLIENT_ID\" password=\"$SASL_CLIENT_SECRET\";"
|
||||
kafka_server_conf_set sasl.login.callback.handler.class "org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler"
|
||||
kafka_server_conf_set sasl.oauthbearer.token.endpoint.url {{ .Values.sasl.oauthbearer.tokenEndpointUrl | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
fi
|
||||
env:
|
||||
- name: KAFKA_CONF_FILE
|
||||
value: /shared/client.properties
|
||||
{{- if and (regexFind "SSL" (upper .Values.listeners.client.protocol)) .Values.provisioning.auth.tls.passwordsSecret }}
|
||||
- name: KAFKA_CLIENT_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
key: {{ .Values.provisioning.auth.tls.keyPasswordSecretKey }}
|
||||
- name: KAFKA_CLIENT_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
key: {{ .Values.provisioning.auth.tls.keystorePasswordSecretKey }}
|
||||
- name: KAFKA_CLIENT_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
key: {{ .Values.provisioning.auth.tls.truststorePasswordSecretKey }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.tls.autoGenerated.enabled) (or .Values.tls.keyPassword (and .Values.tls.passwordsSecret .Values.tls.passwordsSecretPemPasswordKey)) }}
|
||||
- name: KAFKA_TLS_PEM_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.tlsPasswordsSecretName" .context }}
|
||||
key: {{ default "key-password" .context.Values.tls.passwordsSecretPemPasswordKey | quote }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.client.protocol) }}
|
||||
{{- if include "kafka.saslUserPasswordsEnabled" . }}
|
||||
- name: SASL_USERNAME
|
||||
value: {{ index .Values.sasl.client.users 0 | quote }}
|
||||
- name: SASL_USER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
key: system-user-password
|
||||
{{- end }}
|
||||
{{- if include "kafka.saslClientSecretsEnabled" . }}
|
||||
- name: SASL_CLIENT_ID
|
||||
value: {{ .Values.sasl.interbroker.clientId | quote }}
|
||||
- name: SASL_USER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "kafka.saslSecretName" . }}
|
||||
key: inter-broker-client-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.resources }}
|
||||
resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
|
||||
{{- else if ne .Values.provisioning.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.provisioning.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: shared
|
||||
mountPath: /shared
|
||||
{{- if (regexFind "SSL" (upper .Values.listeners.client.protocol)) }}
|
||||
{{- if not (empty .Values.provisioning.auth.tls.certificatesSecret) }}
|
||||
- name: kafka-client-certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.waitForKafka }}
|
||||
- name: wait-for-available-kafka
|
||||
image: {{ include "kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.provisioning.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.provisioning.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
. /opt/bitnami/scripts/libos.sh
|
||||
|
||||
exit_code=0
|
||||
if ! retry_while "/opt/bitnami/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server ${KAFKA_SERVICE} --command-config /shared/client.properties"; then
|
||||
echo "Kafka is not ready"
|
||||
exit_code=1
|
||||
else
|
||||
echo "Kafka ready"
|
||||
fi
|
||||
|
||||
exit "$exit_code"
|
||||
env:
|
||||
- name: KAFKA_SERVICE
|
||||
value: {{ printf "%s:%d" (include "common.names.fullname" .) (.Values.service.ports.client | int64) }}
|
||||
{{- if .Values.provisioning.resources }}
|
||||
resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
|
||||
{{- else if ne .Values.provisioning.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.provisioning.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: shared
|
||||
mountPath: /shared
|
||||
{{- if (regexFind "SSL" (upper .Values.listeners.client.protocol)) }}
|
||||
{{- if not (empty .Values.provisioning.auth.tls.certificatesSecret) }}
|
||||
- name: kafka-client-certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kafka-provisioning
|
||||
image: {{ include "kafka.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.provisioning.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.provisioning.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.provisioning.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- /bin/bash
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.provisioning.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
{{- if .Values.provisioning.preScript }}
|
||||
echo "Running pre-provisioning script"
|
||||
{{ .Values.provisioning.preScript | nindent 14 }}
|
||||
{{- end }}
|
||||
|
||||
kafka_provisioning_commands=(
|
||||
{{- range $topic := .Values.provisioning.topics }}
|
||||
"/opt/bitnami/kafka/bin/kafka-topics.sh \
|
||||
--create \
|
||||
--if-not-exists \
|
||||
--bootstrap-server ${KAFKA_SERVICE} \
|
||||
--replication-factor {{ $topic.replicationFactor | default $.Values.provisioning.replicationFactor }} \
|
||||
--partitions {{ $topic.partitions | default $.Values.provisioning.numPartitions }} \
|
||||
{{- range $name, $value := $topic.config }}
|
||||
--config {{ $name }}={{ $value }} \
|
||||
{{- end }}
|
||||
--command-config /shared/client.properties \
|
||||
--topic {{ $topic.name }}"
|
||||
{{- end }}
|
||||
{{- range $command := .Values.provisioning.extraProvisioningCommands }}
|
||||
{{- $command | quote | nindent 16 }}
|
||||
{{- end }}
|
||||
)
|
||||
|
||||
echo "Starting provisioning"
|
||||
for ((index=0; index < ${#kafka_provisioning_commands[@]}; index+={{ .Values.provisioning.parallel }})); do
|
||||
for j in $(seq ${index} $((${index}+{{ .Values.provisioning.parallel }}-1))); do
|
||||
${kafka_provisioning_commands[j]} &
|
||||
done
|
||||
# Wait the end of the jobs
|
||||
wait
|
||||
done
|
||||
|
||||
{{- if .Values.provisioning.postScript }}
|
||||
echo "Running post-provisioning script"
|
||||
{{ .Values.provisioning.postScript | nindent 14 }}
|
||||
{{- end }}
|
||||
|
||||
echo "Provisioning succeeded"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: KAFKA_SERVICE
|
||||
value: {{ printf "%s:%d" (include "common.names.fullname" .) (.Values.service.ports.client | int64) }}
|
||||
{{- if .Values.provisioning.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.provisioning.extraEnvVarsCM .Values.provisioning.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.provisioning.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.provisioning.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.provisioning.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.resources }}
|
||||
resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
|
||||
{{- else if ne .Values.provisioning.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.provisioning.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if or .Values.log4j2 .Values.existingLog4j2ConfigMap }}
|
||||
- name: log4j2-config
|
||||
mountPath: /opt/bitnami/kafka/config/log4j2.yaml
|
||||
subPath: log4j2.yaml
|
||||
{{- end }}
|
||||
{{- if (regexFind "SSL" (upper .Values.listeners.client.protocol)) }}
|
||||
{{- if not (empty .Values.provisioning.auth.tls.certificatesSecret) }}
|
||||
- name: kafka-client-certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: shared
|
||||
mountPath: /shared
|
||||
{{- if .Values.provisioning.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.provisioning.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if or .Values.log4j2 .Values.existingLog4j2ConfigMap }}
|
||||
- name: log4j2-config
|
||||
configMap:
|
||||
name: {{ include "kafka.log4j2.configMapName" . }}
|
||||
{{- end }}
|
||||
{{- if (regexFind "SSL" (upper .Values.listeners.client.protocol)) }}
|
||||
{{- if not (empty .Values.provisioning.auth.tls.certificatesSecret) }}
|
||||
- name: kafka-client-certs
|
||||
secret:
|
||||
secretName: {{ .Values.provisioning.auth.tls.certificatesSecret }}
|
||||
defaultMode: 256
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: shared
|
||||
emptyDir: {}
|
||||
{{- if .Values.provisioning.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.provisioning.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kafka.provisioning.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.provisioning.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.provisioning.enabled (regexFind "SSL" (upper .Values.listeners.client.protocol)) (not .Values.provisioning.auth.tls.passwordsSecret) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kafka.client.passwordsSecretName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
truststore-password: {{ default "" .Values.provisioning.auth.tls.keystorePassword | b64enc | quote }}
|
||||
keystore-password: {{ default "" .Values.provisioning.auth.tls.truststorePassword | b64enc | quote }}
|
||||
key-password: {{ default "" .Values.provisioning.auth.tls.keyPassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kafka.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kafka.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,132 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "kafka.createSaslSecret" .) }}
|
||||
{{- $secretName := printf "%s-user-passwords" (include "common.names.fullname" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if (include "kafka.client.saslEnabled" .) }}
|
||||
{{- $secretValue := "" }}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .) $secretName).data }}
|
||||
{{- if and $secretData (hasKey $secretData "client-passwords")}}
|
||||
{{- $secretValue = index $secretData "client-passwords" }}
|
||||
{{- end }}
|
||||
{{- if not (empty .Values.sasl.client.passwords) }}
|
||||
{{- $secretValue = join "," .Values.sasl.client.passwords | toString | b64enc }}
|
||||
{{- else if or (empty $secretValue) (not (eq (len .Values.sasl.client.users) (len (splitList "," (b64dec $secretValue))))) }}
|
||||
{{- $clientPasswords := list }}
|
||||
{{- range .Values.sasl.client.users }}
|
||||
{{- $clientPasswords = append $clientPasswords (randAlphaNum 10) }}
|
||||
{{- end }}
|
||||
{{- $secretValue = join "," $clientPasswords | toString | b64enc }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.saslUserPasswordsEnabled" .) }}
|
||||
client-passwords: {{ $secretValue | quote }}
|
||||
system-user-password: {{ index (splitList "," (b64dec $secretValue)) 0 | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.interbroker.protocol) }}
|
||||
{{- if (include "kafka.saslUserPasswordsEnabled" .) }}
|
||||
inter-broker-password: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" "inter-broker-password" "providedValues" (list "sasl.interbroker.password") "failOnNew" false "context" $) }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.saslClientSecretsEnabled" .) }}
|
||||
inter-broker-client-secret: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" "inter-broker-client-secret" "providedValues" (list "sasl.interbroker.clientSecret") "failOnNew" false "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if regexFind "SASL" (upper .Values.listeners.controller.protocol) }}
|
||||
{{- if (include "kafka.saslUserPasswordsEnabled" .) }}
|
||||
controller-password: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" "controller-password" "providedValues" (list "sasl.controller.password") "failOnNew" false "context" $) }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.saslClientSecretsEnabled" .) }}
|
||||
controller-client-secret: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" "controller-client-secret" "providedValues" (list "sasl.controller.clientSecret") "failOnNew" false "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not .Values.existingKraftSecret }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-kraft" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
cluster-id: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-kraft" (include "common.names.fullname" .)) "key" "cluster-id" "providedValues" (list "clusterId") "length" 22 "context" $) }}
|
||||
{{- range $i := until (int .Values.controller.replicaCount) }}
|
||||
{{- $key := printf "controller-%d-id" $i }}
|
||||
{{ $key }}: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-kraft" (include "common.names.fullname" $)) "key" $key "providedValues" (list "") "length" 22 "failOnNew" false "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.serviceBindings.enabled }}
|
||||
{{- if (include "kafka.client.saslEnabled" .) }}
|
||||
{{- $host := list }}
|
||||
{{- $port := .Values.service.ports.client }}
|
||||
{{- $bootstrapServers := list }}
|
||||
{{- if not .Values.controller.controllerOnly }}
|
||||
{{- range $i, $e := until (int .Values.controller.replicaCount) }}
|
||||
{{- $controller := printf "%s-controller-%s.%s-headless.%s.svc.%s" (include "common.names.fullname" $) (print $i) (include "common.names.fullname" $) $.Release.Namespace $.Values.clusterDomain }}
|
||||
{{- $host = append $host $controller }}
|
||||
{{- $bootstrapServers = append $bootstrapServers (printf "%s:%s" $controller $.Values.service.ports.client) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $i, $e := until (int .Values.broker.replicaCount) }}
|
||||
{{- $broker := printf "%s-broker-%s.%s-headless.%s.svc.%s" (include "common.names.fullname" $) (print $i) (include "common.names.fullname" $) $.Release.Namespace $.Values.clusterDomain }}
|
||||
{{- $host = append $host $broker }}
|
||||
{{- $bootstrapServers = append $bootstrapServers (printf "%s:%s" $broker $.Values.service.ports.client) }}
|
||||
{{- end }}
|
||||
{{- range $i, $e := until (len .Values.sasl.client.users) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" $ }}-svcbind-user-{{ $i }}
|
||||
namespace: {{ $.Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if $.Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: servicebinding.io/kafka
|
||||
data:
|
||||
provider: {{ print "bitnami" | b64enc | quote }}
|
||||
type: {{ print "kafka" | b64enc | quote }}
|
||||
username: {{ index $.Values.sasl.client.users $i | b64enc | quote }}
|
||||
password: {{ index $.Values.sasl.client.passwords $i | b64enc | quote }}
|
||||
host: {{ join "," $host | b64enc | quote }}
|
||||
port: {{ print $port | b64enc | quote }}
|
||||
bootstrap-servers: {{ join "," $bootstrapServers | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}-svcbind
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: servicebinding.io/kafka
|
||||
data:
|
||||
provider: {{ print "bitnami" | b64enc | quote }}
|
||||
type: {{ print "kafka" | b64enc | quote }}
|
||||
host: {{ join "," $host | b64enc | quote }}
|
||||
port: {{ print $port | b64enc | quote }}
|
||||
bootstrap-servers: {{ join "," $bootstrapServers | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,76 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kafka
|
||||
{{- if or .Values.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.service.clusterIP }}
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
|
||||
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if (eq .Values.service.type "LoadBalancer") }}
|
||||
allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
|
||||
{{- if (not (empty .Values.service.loadBalancerClass)) }}
|
||||
loadBalancerClass: {{ .Values.service.loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- if (not (empty .Values.service.loadBalancerSourceRanges)) }}
|
||||
loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
|
||||
{{- end }}
|
||||
{{- if (not (empty .Values.service.loadBalancerIP)) }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: tcp-client
|
||||
port: {{ .Values.service.ports.client }}
|
||||
protocol: TCP
|
||||
targetPort: client
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.client)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.client }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
- name: tcp-external
|
||||
port: {{ .Values.service.ports.external }}
|
||||
protocol: TCP
|
||||
targetPort: external
|
||||
{{- if (not (empty .Values.service.nodePorts.external)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.external }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.controller.controllerOnly }}
|
||||
app.kubernetes.io/component: broker
|
||||
{{- end }}
|
||||
{{- with .Values.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if include "kafka.createTlsSecret" . }}
|
||||
{{- $releaseNamespace := include "common.names.namespace" . }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $secretName := include "kafka.tlsSecretName" . }}
|
||||
{{- $altNames := list (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s" $fullname $releaseNamespace) $fullname "127.0.0.1" "localhost" }}
|
||||
{{- $controllerSvcName := printf "%s-headless" (include "kafka.controller.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $brokerSvcName := printf "%s-headless" (include "kafka.broker.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $altNames = concat $altNames (list (printf "*.%s.%s.svc.%s" $controllerSvcName $releaseNamespace $clusterDomain) (printf "*.%s.%s" $controllerSvcName $releaseNamespace) (printf "*.%s" $controllerSvcName)) }}
|
||||
{{- $altNames = concat $altNames (list (printf "*.%s.%s.svc.%s" $brokerSvcName $releaseNamespace $clusterDomain) (printf "*.%s.%s" $brokerSvcName $releaseNamespace) (printf "*.%s" $brokerSvcName)) }}
|
||||
{{- if .Values.externalAccess.enabled -}}
|
||||
{{- with .Values.externalAccess.broker.service.domain }}
|
||||
{{- $altNames = append $altNames . }}
|
||||
{{- end }}
|
||||
{{- with .Values.externalAccess.controller.service.domain }}
|
||||
{{- $altNames = append $altNames . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.tls.autoGenerated.customAltNames }}
|
||||
{{- $altNames = concat $altNames . }}
|
||||
{{- end }}
|
||||
{{- $ca := genCA "kafka-ca" 365 }}
|
||||
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- if include "kafka.createTlsPasswordsSecret" . }}
|
||||
{{- $secretName := include "kafka.tlsPasswordsSecretName" . }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: kafka
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{ .Values.tls.passwordsSecretKeystoreKey }}: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" .Values.tls.passwordsSecretKeystoreKey "providedValues" (list "tls.keystorePassword") "context" $) }}
|
||||
{{ .Values.tls.passwordsSecretTruststoreKey }}: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" .Values.tls.passwordsSecretTruststoreKey "providedValues" (list "tls.truststorePassword") "context" $) }}
|
||||
{{- if .Values.tls.keyPassword }}
|
||||
{{ default "key-password" .Values.tls.passwordsSecretPemPasswordKey }}: {{ .Values.tls.keyPassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user