You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
257 lines
10 KiB
257 lines
10 KiB
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "iceberg-catalog.fullname" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- if .Values.catalog.annotations }}
|
|
annotations:
|
|
{{- toYaml .Values.catalog.annotations | nindent 4 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "iceberg-catalog.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: catalog
|
|
spec:
|
|
replicas: {{ .Values.catalog.replicas }}
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 25%
|
|
maxUnavailable: 0
|
|
selector:
|
|
matchLabels:
|
|
{{- include "iceberg-catalog.selectorLabels" . | nindent 6 }}
|
|
app.kubernetes.io/component: catalog
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/secret-config-envs: {{ include (print $.Template.BasePath "/config/secret-config-envs.yaml") . | sha256sum }}
|
|
{{- if .Values.OPABridge.enabled }}
|
|
checksum/opa-config: {{ include (print $.Template.BasePath "/config/opa-bridge-config-secret.yaml") . | sha256sum }}
|
|
checksum/opa-policies: {{ include (print $.Template.BasePath "/config/opa-bridge-policies.yaml") . | sha256sum }}
|
|
{{- end }}
|
|
{{- if .Values.catalog.podAnnotations -}}
|
|
{{- toYaml .Values.catalog.podAnnotations | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.catalog.safeToEvict }}
|
|
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
|
|
{{- end }}
|
|
{{- if .Values.catalog.prometheus.setScrapeAnnotations }}
|
|
prometheus.io/port: {{ .Values.catalog.prometheus.port | quote }}
|
|
prometheus.io/scrape: "true"
|
|
{{- end }}
|
|
labels:
|
|
{{- include "iceberg-catalog.labels" . | nindent 8 }}
|
|
app.kubernetes.io/component: catalog
|
|
{{- with .Values.catalog.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
restartPolicy: Always
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.catalog.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml .Values.catalog.nodeSelector | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.catalog.topologySpreadConstraints }}
|
|
topologySpreadConstraints:
|
|
{{- toYaml .Values.catalog.topologySpreadConstraints | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.catalog.affinity }}
|
|
affinity:
|
|
{{- toYaml .Values.catalog.affinity | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.catalog.tolerations }}
|
|
tolerations:
|
|
{{- toYaml .Values.catalog.tolerations | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.catalog.priorityClassName }}
|
|
priorityClassName: {{ .Values.catalog.priorityClassName | quote }}
|
|
{{- end }}
|
|
serviceAccountName: {{ include "iceberg-catalog.serviceAccountName" . }}
|
|
{{- if .Values.catalog.podSecurityContext }}
|
|
securityContext:
|
|
{{- toYaml .Values.catalog.podSecurityContext | nindent 8 }}
|
|
{{- end }}
|
|
initContainers:
|
|
{{- if .Values.catalog.extraInitContainers }}
|
|
{{- toYaml .Values.catalog.extraInitContainers | nindent 8 }}
|
|
{{- end }}
|
|
{{- include "iceberg-catalog.init_container.check_db" (dict "Release" .Release "Values" .Values "Chart" .Chart "awaitMigration" true) | indent 8 }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}
|
|
{{- include "iceberg-catalog.image" . | indent 10 }}
|
|
env:
|
|
{{- include "iceberg-catalog.env" . | indent 12 }}
|
|
envFrom:
|
|
{{- include "iceberg-catalog.envFrom" . | indent 12 }}
|
|
{{- if .Values.catalog.extraEnvFrom -}}
|
|
{{- tpl (toYaml .Values.catalog.extraEnvFrom) . | nindent 12 }}
|
|
{{- end }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8181
|
|
protocol: TCP
|
|
- name: metrics
|
|
containerPort: 9000
|
|
protocol: TCP
|
|
{{- if .Values.catalog.command }}
|
|
command:
|
|
{{- toYaml .Values.catalog.command | nindent 12 }}
|
|
{{- end }}
|
|
args:
|
|
- serve
|
|
{{- if .Values.catalog.livenessProbe.enabled }}
|
|
livenessProbe:
|
|
initialDelaySeconds: {{ .Values.catalog.livenessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.catalog.livenessProbe.periodSeconds }}
|
|
failureThreshold: {{ .Values.catalog.livenessProbe.failureThreshold }}
|
|
timeoutSeconds: {{ .Values.catalog.livenessProbe.timeoutSeconds }}
|
|
httpGet:
|
|
path: /health
|
|
port: 8181
|
|
{{- end }}
|
|
{{- if .Values.catalog.readinessProbe.enabled }}
|
|
readinessProbe:
|
|
initialDelaySeconds: {{ .Values.catalog.readinessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.catalog.readinessProbe.periodSeconds }}
|
|
failureThreshold: {{ .Values.catalog.readinessProbe.failureThreshold }}
|
|
timeoutSeconds: {{ .Values.catalog.readinessProbe.timeoutSeconds }}
|
|
httpGet:
|
|
path: /health
|
|
port: 8181
|
|
{{- end }}
|
|
resources:
|
|
{{- toYaml .Values.catalog.resources | nindent 12 }}
|
|
{{- with .Values.catalog.extraVolumeMounts }}
|
|
volumeMounts:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- if .Values.OPABridge.enabled }}
|
|
- name: opa
|
|
image: {{ .Values.OPABridge.image.repository }}:{{ .Values.OPABridge.image.tag }}
|
|
imagePullPolicy: {{ .Values.OPABridge.image.pullPolicy }}
|
|
securityContext:
|
|
runAsUser: {{ .Values.OPABridge.image.uid }}
|
|
runAsGroup: {{ .Values.OPABridge.image.gid }}
|
|
readOnlyRootFilesystem: false
|
|
env:
|
|
- name: TRINO_ALLOW_UNMANAGED_CATALOGS
|
|
value: {{ .Values.OPABridge.allowUnmanagedCatalogs | quote }}
|
|
- name: LAKEKEEPER_URL
|
|
value: {{ .Values.OPABridge.lakekeeper.url | quote }}
|
|
- name: LAKEKEEPER_MAX_BATCH_CHECK_SIZE
|
|
value: {{ .Values.OPABridge.maxBatchCheckSize | quote }}
|
|
{{- if .Values.OPABridge.adminUsers }}
|
|
- name: TRINO_ADMIN_USERS
|
|
value: {{ .Values.OPABridge.adminUsers | join "," | quote }}
|
|
{{- end }}
|
|
{{- if .Values.OPABridge.lakekeeper.existingSecret }}
|
|
{{- /* Read credentials from existing secret */ -}}
|
|
- name: LAKEKEEPER_TOKEN_ENDPOINT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
|
key: {{ .Values.OPABridge.lakekeeper.tokenEndpointSecretKey }}
|
|
- name: LAKEKEEPER_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
|
key: {{ .Values.OPABridge.lakekeeper.clientIdSecretKey }}
|
|
- name: LAKEKEEPER_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
|
key: {{ .Values.OPABridge.lakekeeper.clientSecretSecretKey }}
|
|
- name: LAKEKEEPER_SCOPE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.OPABridge.lakekeeper.existingSecret }}
|
|
key: {{ .Values.OPABridge.lakekeeper.scopeSecretKey }}
|
|
{{- else }}
|
|
{{- /* Read credentials from values */ -}}
|
|
{{- if .Values.OPABridge.lakekeeper.tokenEndpoint }}
|
|
- name: LAKEKEEPER_TOKEN_ENDPOINT
|
|
value: {{ .Values.OPABridge.lakekeeper.tokenEndpoint | quote }}
|
|
{{- end }}
|
|
{{- if .Values.OPABridge.lakekeeper.clientId }}
|
|
- name: LAKEKEEPER_CLIENT_ID
|
|
value: {{ .Values.OPABridge.lakekeeper.clientId | quote }}
|
|
{{- end }}
|
|
{{- if .Values.OPABridge.lakekeeper.clientSecret }}
|
|
- name: LAKEKEEPER_CLIENT_SECRET
|
|
value: {{ .Values.OPABridge.lakekeeper.clientSecret | quote }}
|
|
{{- end }}
|
|
{{- if .Values.OPABridge.lakekeeper.scope }}
|
|
- name: LAKEKEEPER_SCOPE
|
|
value: {{ .Values.OPABridge.lakekeeper.scope | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.OPABridge.extraEnv }}
|
|
{{- tpl (toYaml .) $ | nindent 12 }}
|
|
{{- end }}
|
|
{{- if .Values.OPABridge.extraEnvFrom }}
|
|
envFrom:
|
|
{{- tpl (toYaml .Values.OPABridge.extraEnvFrom) . | nindent 12 }}
|
|
{{- end }}
|
|
args:
|
|
- "run"
|
|
- "--server"
|
|
- "--ignore=.*" # exclude hidden dirs created by Kubernetes
|
|
- "--addr=:8282"
|
|
- "--config-file=/etc/opa/opa-config.yaml"
|
|
{{- range .Values.OPABridge.extraArgs }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
- "/policies"
|
|
ports:
|
|
- name: opa
|
|
containerPort: 8282
|
|
protocol: TCP
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
scheme: HTTP
|
|
port: 8282
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
scheme: HTTP
|
|
port: 8282
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
resources:
|
|
{{- toYaml .Values.OPABridge.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: opa-config
|
|
mountPath: /etc/opa
|
|
readOnly: true
|
|
- name: opa-policies
|
|
mountPath: /policies
|
|
readOnly: true
|
|
- name: opa-var-run
|
|
mountPath: /var/run/secrets
|
|
{{- end }}
|
|
{{- if .Values.catalog.extraContainers }}
|
|
{{- toYaml .Values.catalog.extraContainers | nindent 8 }}
|
|
{{- end }}
|
|
{{- if or .Values.OPABridge.enabled .Values.catalog.extraVolumes }}
|
|
volumes:
|
|
{{- if .Values.OPABridge.enabled }}
|
|
- name: opa-config
|
|
secret:
|
|
secretName: {{ include "iceberg-catalog.fullname" . }}-opa-config
|
|
- name: opa-policies
|
|
configMap:
|
|
name: {{ include "iceberg-catalog.fullname" . }}-opa-policies
|
|
- name: opa-var-run
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- with .Values.catalog.extraVolumes }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|