You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
273 lines
11 KiB
273 lines
11 KiB
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ include "unitycatalog.server.fullname" . }}
|
|
labels:
|
|
{{- include "unitycatalog.server.labels" . | nindent 4 }}
|
|
spec:
|
|
serviceName: unitycatalog-server
|
|
replicas: {{ .Values.server.statefulset.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "unitycatalog.server.selectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: {{ include "unitycatalog.server.configTemplate" . | sha256sum }}
|
|
{{- with .Values.server.statefulset.podAnnotations }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "unitycatalog.server.labels" . | nindent 8 }}
|
|
{{- with .Values.server.statefulset.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- with .Values.server.statefulset.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
serviceAccountName: {{ include "unitycatalog.serviceAccountName" . }}
|
|
{{- with .Values.server.statefulset.podSecurityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
initContainers:
|
|
{{- if .Values.privateCA.enabled }}
|
|
- name: generate-truststore
|
|
image: eclipse-temurin:17-alpine
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
echo "[INFO] Checking for CA file at /ca/ca.crt..."
|
|
if [ ! -f /ca/ca.crt ]; then
|
|
echo "[ERROR] /ca/ca.crt not found. Make sure the 'my-private-ca' Secret contains 'ca.crt'."
|
|
exit 1
|
|
fi
|
|
|
|
TRUSTSTORE_PATH="/truststore/truststore.jks"
|
|
|
|
if [ -f "$TRUSTSTORE_PATH" ]; then
|
|
echo "[INFO] Existing truststore found. Removing..."
|
|
rm -f "$TRUSTSTORE_PATH"
|
|
fi
|
|
|
|
echo "[INFO] Copying default Java truststore to $TRUSTSTORE_PATH..."
|
|
cp "$JAVA_HOME/lib/security/cacerts" "$TRUSTSTORE_PATH"
|
|
|
|
echo "[INFO] Importing private CA into truststore..."
|
|
keytool -importcert -noprompt \
|
|
-alias private-ca \
|
|
-file /ca/ca.crt \
|
|
-keystore "$TRUSTSTORE_PATH" \
|
|
-storepass changeit
|
|
|
|
echo "[INFO] Truststore created successfully with private CA."
|
|
volumeMounts:
|
|
- name: ca-tls
|
|
mountPath: /ca
|
|
- name: truststore-volume
|
|
mountPath: /truststore
|
|
{{- end }}
|
|
- name: render-config
|
|
image: "{{ .Values.server.statefulset.initContainer.image.repository }}:{{ .Values.server.statefulset.initContainer.image.tag }}"
|
|
imagePullPolicy: {{ .Values.server.statefulset.initContainer.image.pullPolicy }}
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |-
|
|
envsubst < /home/unitycatalog/etc/confTemplates/server.properties.template > /home/unitycatalog/etc/conf/server.properties
|
|
envsubst < /home/unitycatalog/etc/confTemplates/server.log4j2.properties.template > /home/unitycatalog/etc/conf/server.log4j2.properties
|
|
envsubst < /home/unitycatalog/etc/confTemplates/hibernate.properties.template > /home/unitycatalog/etc/conf/hibernate.properties
|
|
volumeMounts:
|
|
- name: config-templates
|
|
mountPath: /home/unitycatalog/etc/confTemplates
|
|
- name: config-volume
|
|
mountPath: /home/unitycatalog/etc/conf
|
|
env:
|
|
{{- range $index, $config := .Values.storage.credentials.s3 }}
|
|
- name: S3_ACCESS_KEY_{{ $index }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $config.credentialsSecretName }}
|
|
key: accessKey
|
|
- name: S3_SECRET_KEY_{{ $index }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $config.credentialsSecretName }}
|
|
key: secretKey
|
|
{{- end }}
|
|
{{- range $index, $config := .Values.storage.credentials.adls }}
|
|
- name: ADLS_TENANT_ID_{{ $index }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $config.credentialsSecretName }}
|
|
key: tenantId
|
|
- name: ADLS_CLIENT_ID_{{ $index }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $config.credentialsSecretName }}
|
|
key: clientId
|
|
- name: ADLS_CLIENT_SECRET_{{ $index }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $config.credentialsSecretName }}
|
|
key: clientSecret
|
|
{{- end }}
|
|
{{- if .Values.auth.enabled }}
|
|
- name: OAUTH_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.auth.clientSecretName }}
|
|
key: clientId
|
|
- name: OAUTH_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.auth.clientSecretName }}
|
|
key: clientSecret
|
|
{{- end }}
|
|
containers:
|
|
- name: server
|
|
{{- with .Values.server.statefulset.securityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
image: "{{ .Values.server.statefulset.image.repository }}:{{ .Values.server.statefulset.image.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.server.statefulset.image.pullPolicy }}
|
|
ports:
|
|
- name: api
|
|
containerPort: {{ .Values.server.statefulset.port }}
|
|
protocol: TCP
|
|
{{- with .Values.server.statefulset.livenessProbe }}
|
|
livenessProbe:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.server.statefulset.readinessProbe }}
|
|
readinessProbe:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.server.statefulset.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: config-volume
|
|
mountPath: /home/unitycatalog/etc/conf
|
|
- name: db-volume
|
|
mountPath: /home/unitycatalog/etc/db
|
|
{{- range $index, $config := .Values.storage.credentials.gcs }}
|
|
- name: gcs-credentials-{{ $index }}
|
|
mountPath: /home/unitycatalog/etc/conf/gcs-credentials-{{ $index }}.json
|
|
subPath: jsonKey
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.privateCA.enabled }}
|
|
- name: truststore-volume
|
|
mountPath: /truststore
|
|
env:
|
|
- name: JAVA_TOOL_OPTIONS
|
|
value: "-Djavax.net.ssl.trustStore=/truststore/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit"
|
|
{{- end }}
|
|
{{- with .Values.server.statefulset.volumeMounts }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{ if and .Values.auth.enabled .Values.auth.users }}
|
|
- name: create-users
|
|
image: "{{ .Values.server.createUsersJob.image.repository }}:{{ .Values.server.createUsersJob.image.tag }}"
|
|
imagePullPolicy: {{ .Values.server.createUsersJob.image.pullPolicy }}
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |-
|
|
set -ex
|
|
|
|
until curl -H "Authorization: Bearer $(cat /home/unitycatalog/etc/conf/token.txt)" \
|
|
-X GET "http://localhost:{{ .Values.server.statefulset.port }}/api/1.0/unity-control/scim2/Users" \
|
|
-H "Content-Type: application/json"
|
|
do
|
|
echo "Waiting for Unity Catalog server API to be available..."
|
|
sleep 1
|
|
done
|
|
|
|
{{- range $index, $user := .Values.auth.users }}
|
|
if curl -H "Authorization: Bearer $(cat /home/unitycatalog/etc/conf/token.txt)" \
|
|
-X GET "http://localhost:{{ $.Values.server.statefulset.port }}/api/1.0/unity-control/scim2/Users" \
|
|
-H "Content-Type: application/json" | jq -e '.Resources[] | select(.emails[0].value == "{{ $user.email }}")'
|
|
then
|
|
echo "User {{ $user.email }} already exists"
|
|
else
|
|
echo "User {{ $user.email }} is being created"
|
|
curl -H "Authorization: Bearer $(cat /home/unitycatalog/etc/conf/token.txt)" \
|
|
-X POST "http://localhost:{{ $.Values.server.statefulset.port }}/api/1.0/unity-control/scim2/Users" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"displayName": "{{ $user.name }}", "emails": [{"primary": true, "value": "{{ $user.email }}"}]}'
|
|
echo "User {{ $user.email }} created"
|
|
fi
|
|
{{- end }}
|
|
|
|
tail -f /dev/null
|
|
volumeMounts:
|
|
- name: config-volume
|
|
mountPath: /home/unitycatalog/etc/conf
|
|
{{- end }}
|
|
volumes:
|
|
- configMap:
|
|
name: {{ include "unitycatalog.fullname" . }}-server-config-templates
|
|
name: config-templates
|
|
{{- if not .Values.server.config.persistence.enabled }}
|
|
- name: config-volume
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- if not (and (eq .Values.db.type "file") .Values.db.fileConfig.persistence.enabled) }}
|
|
- name: db-volume
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- range $index, $config := .Values.storage.credentials.gcs }}
|
|
- name: gcs-credentials-{{ $index }}
|
|
secret:
|
|
secretName: {{ $config.credentialsSecretName }}
|
|
{{- end }}
|
|
{{- with .Values.server.statefulset.volumes }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.privateCA.enabled }}
|
|
- name: ca-tls
|
|
secret:
|
|
secretName: {{ .Values.privateCA.secretName }}
|
|
- name: truststore-volume
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- with .Values.server.statefulset.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.server.statefulset.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.server.statefulset.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumeClaimTemplates:
|
|
{{- if and (eq .Values.db.type "file") .Values.db.fileConfig.persistence.enabled }}
|
|
- metadata:
|
|
name: db-volume
|
|
spec:
|
|
accessModes: {{ .Values.db.fileConfig.persistence.accessModes }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.db.fileConfig.persistence.size }}
|
|
storageClassName: {{ .Values.db.fileConfig.persistence.storageClassName }}
|
|
{{- end }}
|
|
{{- if .Values.server.config.persistence.enabled }}
|
|
- metadata:
|
|
name: config-volume
|
|
spec:
|
|
accessModes: {{ .Values.server.config.persistence.accessModes }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.server.config.persistence.size }}
|
|
storageClassName: {{ .Values.server.config.persistence.storageClassName }}
|
|
{{- end }}
|
|
|