update lakekeeper/0.11.0
- chart 0.8.1 → 0.11.0 (appVersion 0.10.4 → 0.12.2) - deps: postgres 1.5.8 → 1.5.13, openfga 0.2.44 → 0.2.62 - ingress: Kong → APISIX (use-regex + path /.*, cluster-issuer) - openfga.playground 비활성화 (preshared 인증 패닉 방지) - breaking=false, custom-values 키 전부 호환 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
wbsong111
@@ -0,0 +1,257 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "iceberg-catalog.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.catalog.annotations }}
|
||||
annotations:
|
||||
{{- toYaml .Values.catalog.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "iceberg-catalog.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: catalog
|
||||
spec:
|
||||
replicas: {{ .Values.catalog.replicas }}
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "iceberg-catalog.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: catalog
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/secret-config-envs: {{ include (print $.Template.BasePath "/config/secret-config-envs.yaml") . | sha256sum }}
|
||||
{{- if .Values.OPABridge.enabled }}
|
||||
checksum/opa-config: {{ include (print $.Template.BasePath "/config/opa-bridge-config-secret.yaml") . | sha256sum }}
|
||||
checksum/opa-policies: {{ include (print $.Template.BasePath "/config/opa-bridge-policies.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.podAnnotations -}}
|
||||
{{- toYaml .Values.catalog.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.safeToEvict }}
|
||||
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.prometheus.setScrapeAnnotations }}
|
||||
prometheus.io/port: {{ .Values.catalog.prometheus.port | quote }}
|
||||
prometheus.io/scrape: "true"
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "iceberg-catalog.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: catalog
|
||||
{{- with .Values.catalog.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
restartPolicy: Always
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml .Values.catalog.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml .Values.catalog.topologySpreadConstraints | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.catalog.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml .Values.catalog.tolerations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.priorityClassName }}
|
||||
priorityClassName: {{ .Values.catalog.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "iceberg-catalog.serviceAccountName" . }}
|
||||
{{- if .Values.catalog.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.catalog.podSecurityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if .Values.catalog.extraInitContainers }}
|
||||
{{- toYaml .Values.catalog.extraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "iceberg-catalog.init_container.check_db" (dict "Release" .Release "Values" .Values "Chart" .Chart "awaitMigration" true) | indent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
{{- include "iceberg-catalog.image" . | indent 10 }}
|
||||
env:
|
||||
{{- include "iceberg-catalog.env" . | indent 12 }}
|
||||
envFrom:
|
||||
{{- include "iceberg-catalog.envFrom" . | indent 12 }}
|
||||
{{- if .Values.catalog.extraEnvFrom -}}
|
||||
{{- tpl (toYaml .Values.catalog.extraEnvFrom) . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8181
|
||||
protocol: TCP
|
||||
- name: metrics
|
||||
containerPort: 9000
|
||||
protocol: TCP
|
||||
{{- if .Values.catalog.command }}
|
||||
command:
|
||||
{{- toYaml .Values.catalog.command | nindent 12 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- serve
|
||||
{{- if .Values.catalog.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
initialDelaySeconds: {{ .Values.catalog.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.catalog.livenessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.catalog.livenessProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.catalog.livenessProbe.timeoutSeconds }}
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8181
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
initialDelaySeconds: {{ .Values.catalog.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.catalog.readinessProbe.periodSeconds }}
|
||||
failureThreshold: {{ .Values.catalog.readinessProbe.failureThreshold }}
|
||||
timeoutSeconds: {{ .Values.catalog.readinessProbe.timeoutSeconds }}
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8181
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.catalog.resources | nindent 12 }}
|
||||
{{- with .Values.catalog.extraVolumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.OPABridge.enabled }}
|
||||
- name: opa
|
||||
image: {{ .Values.OPABridge.image.repository }}:{{ .Values.OPABridge.image.tag }}
|
||||
imagePullPolicy: {{ .Values.OPABridge.image.pullPolicy }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.OPABridge.image.uid }}
|
||||
runAsGroup: {{ .Values.OPABridge.image.gid }}
|
||||
readOnlyRootFilesystem: false
|
||||
env:
|
||||
- name: TRINO_ALLOW_UNMANAGED_CATALOGS
|
||||
value: {{ .Values.OPABridge.allowUnmanagedCatalogs | quote }}
|
||||
- name: LAKEKEEPER_URL
|
||||
value: {{ .Values.OPABridge.lakekeeper.url | quote }}
|
||||
- name: LAKEKEEPER_MAX_BATCH_CHECK_SIZE
|
||||
value: {{ .Values.OPABridge.maxBatchCheckSize | quote }}
|
||||
{{- if .Values.OPABridge.adminUsers }}
|
||||
- name: TRINO_ADMIN_USERS
|
||||
value: {{ .Values.OPABridge.adminUsers | join "," | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.OPABridge.lakekeeper.existingSecret }}
|
||||
{{- /* Read credentials from existing secret */ -}}
|
||||
- name: LAKEKEEPER_TOKEN_ENDPOINT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
||||
key: {{ .Values.OPABridge.lakekeeper.tokenEndpointSecretKey }}
|
||||
- name: LAKEKEEPER_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
||||
key: {{ .Values.OPABridge.lakekeeper.clientIdSecretKey }}
|
||||
- name: LAKEKEEPER_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
||||
key: {{ .Values.OPABridge.lakekeeper.clientSecretSecretKey }}
|
||||
- name: LAKEKEEPER_SCOPE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
||||
key: {{ .Values.OPABridge.lakekeeper.scopeSecretKey }}
|
||||
{{- else }}
|
||||
{{- /* Read credentials from values */ -}}
|
||||
{{- if .Values.OPABridge.lakekeeper.tokenEndpoint }}
|
||||
- name: LAKEKEEPER_TOKEN_ENDPOINT
|
||||
value: {{ .Values.OPABridge.lakekeeper.tokenEndpoint | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.OPABridge.lakekeeper.clientId }}
|
||||
- name: LAKEKEEPER_CLIENT_ID
|
||||
value: {{ .Values.OPABridge.lakekeeper.clientId | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.OPABridge.lakekeeper.clientSecret }}
|
||||
- name: LAKEKEEPER_CLIENT_SECRET
|
||||
value: {{ .Values.OPABridge.lakekeeper.clientSecret | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.OPABridge.lakekeeper.scope }}
|
||||
- name: LAKEKEEPER_SCOPE
|
||||
value: {{ .Values.OPABridge.lakekeeper.scope | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.OPABridge.extraEnv }}
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.OPABridge.extraEnvFrom }}
|
||||
envFrom:
|
||||
{{- tpl (toYaml .Values.OPABridge.extraEnvFrom) . | nindent 12 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- "run"
|
||||
- "--server"
|
||||
- "--ignore=.*" # exclude hidden dirs created by Kubernetes
|
||||
- "--addr=:8282"
|
||||
- "--config-file=/etc/opa/opa-config.yaml"
|
||||
{{- range .Values.OPABridge.extraArgs }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
- "/policies"
|
||||
ports:
|
||||
- name: opa
|
||||
containerPort: 8282
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
scheme: HTTP
|
||||
port: 8282
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
scheme: HTTP
|
||||
port: 8282
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.OPABridge.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: opa-config
|
||||
mountPath: /etc/opa
|
||||
readOnly: true
|
||||
- name: opa-policies
|
||||
mountPath: /policies
|
||||
readOnly: true
|
||||
- name: opa-var-run
|
||||
mountPath: /var/run/secrets
|
||||
{{- end }}
|
||||
{{- if .Values.catalog.extraContainers }}
|
||||
{{- toYaml .Values.catalog.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.OPABridge.enabled .Values.catalog.extraVolumes }}
|
||||
volumes:
|
||||
{{- if .Values.OPABridge.enabled }}
|
||||
- name: opa-config
|
||||
secret:
|
||||
secretName: {{ include "iceberg-catalog.fullname" . }}-opa-config
|
||||
- name: opa-policies
|
||||
configMap:
|
||||
name: {{ include "iceberg-catalog.fullname" . }}-opa-policies
|
||||
- name: opa-var-run
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- with .Values.catalog.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user