feat(spark): deploy persistent Spark cluster with Web UI
- Add spark-cluster/base with Bitnami Spark chart 9.2.10 (master + 2 workers), spark-events PVC (RWO/local-path), and Ingress resources for spark.nowchess.janis-eccarius.de (master UI) and spark-history.nowchess.janis-eccarius.de (history placeholder) - Add spark-cluster/eu-central-1-prod overlay and ArgoCD Application (automated prune + selfHeal) - Migrate all spark-analytics CronJobs and streaming Deployment from K8s-native mode (k8s://...) to Spark standalone (spark://spark-master:7077); drop kubernetes-specific --conf flags; add eventLog confs; mount spark-events PVC on all job pods Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Janis Eccarius
@@ -0,0 +1,104 @@
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||
|
||||
Get the list of pods by executing:
|
||||
|
||||
kubectl get pods --namespace {{ include "common.names.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||
|
||||
Access the pod you want to debug by executing
|
||||
|
||||
kubectl exec --namespace {{ include "common.names.namespace" . }} -ti <NAME OF THE POD> -- bash
|
||||
|
||||
In order to replicate the container startup scripts execute this command:
|
||||
|
||||
/opt/bitnami/scripts/spark/entrypoint.sh /opt/bitnami/scripts/spark/run.sh
|
||||
|
||||
{{- else }}
|
||||
|
||||
1. Get the Spark master WebUI URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
|
||||
export HOSTNAME=$(kubectl get ingress --namespace {{ include "common.names.namespace" . }} {{ printf "%s-ingress" (include "common.names.fullname" .) }} -o jsonpath='{.spec.rules[0].host}')
|
||||
echo "Spark-master URL: http://$HOSTNAME/"
|
||||
|
||||
{{- else -}}
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
|
||||
export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].nodePort}" services {{ printf "%s-master-svc" (include "common.names.fullname" .) }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ include "common.names.namespace" . }} svc -w {{ printf "%s-master-svc" (include "common.names.fullname" .) }}'
|
||||
|
||||
export SERVICE_IP=$(kubectl get --namespace {{ include "common.names.namespace" . }} svc {{ printf "%s-master-svc" (include "common.names.fullname" .) }} -o jsonpath="{.status.loadBalancer.ingress[0]['ip', 'hostname'] }")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.ports.http }}
|
||||
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ printf "%s-master-svc" (include "common.names.fullname" .) }} {{ default "80" .Values.service.ports.http }}:{{ default "80" .Values.service.ports.http }}
|
||||
echo "Visit http://127.0.0.1:{{ .Values.service.ports.http }} to use your application"
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
2. Submit an application to the cluster:
|
||||
|
||||
To submit an application to the cluster the spark-submit script must be used. That script can be
|
||||
obtained at https://github.com/apache/spark/tree/master/bin. Also you can use kubectl run.
|
||||
|
||||
{{- if or (eq "NodePort" .Values.service.type) (eq "LoadBalancer" .Values.service.type) }}
|
||||
|
||||
Run the commands below to obtain the master IP and submit your application.
|
||||
{{- end }}
|
||||
|
||||
export EXAMPLE_JAR=$(kubectl exec -ti --namespace {{ include "common.names.namespace" . }} {{ printf "%s-worker-0" (include "common.names.fullname" .) }} -- find examples/jars/ -name 'spark-example*\.jar' | tr -d '\r')
|
||||
{{- if eq "NodePort" .Values.service.type }}
|
||||
export SUBMIT_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='cluster')].nodePort}" services {{ printf "%s-master-svc" (include "common.names.fullname" .) }})
|
||||
export SUBMIT_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
|
||||
kubectl run --namespace {{ include "common.names.namespace" . }} {{ printf "%s-client" (include "common.names.fullname" .) }} --rm --tty -i --restart='Never' \
|
||||
--image {{ template "spark.image" . }} \
|
||||
-- spark-submit --master spark://$SUBMIT_IP:$SUBMIT_PORT \
|
||||
--class org.apache.spark.examples.SparkPi \
|
||||
--deploy-mode cluster \
|
||||
$EXAMPLE_JAR 1000
|
||||
|
||||
{{- else if eq "LoadBalancer" .Values.service.type }}
|
||||
export SUBMIT_IP=$(kubectl get --namespace {{ include "common.names.namespace" . }} svc {{ printf "%s-master-svc" (include "common.names.fullname" .) }} -o jsonpath="{.status.loadBalancer.ingress[0]['ip', 'hostname'] }")
|
||||
|
||||
kubectl run --namespace {{ include "common.names.namespace" . }} {{ printf "%s-client" (include "common.names.fullname" .) }} --rm --tty -i --restart='Never' \
|
||||
--image {{ template "spark.image" . }} \
|
||||
-- spark-submit --master spark://$SUBMIT_IP:{{ .Values.service.ports.cluster }} \
|
||||
--deploy-mode cluster \
|
||||
--class org.apache.spark.examples.SparkPi \
|
||||
$EXAMPLE_JAR 1000
|
||||
|
||||
{{- else }}
|
||||
|
||||
kubectl exec -ti --namespace {{ include "common.names.namespace" . }} {{ printf "%s-worker-0" (include "common.names.fullname" .) }} -- spark-submit --master spark://{{ printf "%s-master-svc" (include "common.names.fullname" .) }}:{{ .Values.service.ports.cluster }} \
|
||||
--class org.apache.spark.examples.SparkPi \
|
||||
$EXAMPLE_JAR 5
|
||||
|
||||
** IMPORTANT: When submit an application from outside the cluster service type should be set to the NodePort or LoadBalancer. **
|
||||
|
||||
{{- end }}
|
||||
|
||||
** IMPORTANT: When submit an application the --master parameter should be set to the service IP, if not, the application will not resolve the master. **
|
||||
{{- end }}
|
||||
|
||||
{{ include "spark.checkRollingTags" . }}
|
||||
{{ include "spark.validateValues" . }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "master" "security.ssl" "worker") "context" $) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image) "context" $) }}
|
||||
@@ -0,0 +1,132 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- /* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Return the proper Spark image name
|
||||
*/}}
|
||||
{{- define "spark.image" -}}
|
||||
{{- include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "spark.imagePullSecrets" -}}
|
||||
{{- include "common.images.pullSecrets" (dict "images" (list .Values.image) "global" .Values.global) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spark.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Get the secret for passwords */}}
|
||||
{{- define "spark.passwordsSecretName" -}}
|
||||
{{- if .Values.security.passwordsSecretName -}}
|
||||
{{- printf "%s" .Values.security.passwordsSecretName -}}
|
||||
{{- else }}
|
||||
{{- printf "%s-secret" (include "common.names.fullname" .) -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the secret containing Spark TLS certificates
|
||||
*/}}
|
||||
{{- define "spark.tlsSecretName" -}}
|
||||
{{- $secretName := coalesce .Values.security.ssl.existingSecret .Values.security.certificatesSecretName -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-crt" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS secret object should be created
|
||||
*/}}
|
||||
{{- define "spark.createTlsSecret" -}}
|
||||
{{- if and .Values.security.ssl.autoGenerated .Values.security.ssl.enabled (not .Values.security.ssl.existingSecret) (not .Values.security.certificatesSecretName) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Check if there are rolling tags in the images */}}
|
||||
{{- define "spark.checkRollingTags" -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.image -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Spark - Incorrect extra volume settings */}}
|
||||
{{- define "spark.validateValues.extraVolumes" -}}
|
||||
{{- if and (.Values.worker.extraVolumes) (not .Values.worker.extraVolumeMounts) -}}
|
||||
spark: missing-worker-extra-volume-mounts
|
||||
You specified worker extra volumes but no mount points for them. Please set
|
||||
the extraVolumeMounts value
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{/* Validate values of Spark - number of workers must be greater than 0 */}}
|
||||
{{- define "spark.validateValues.workerCount" -}}
|
||||
{{- $replicaCount := int .Values.worker.replicaCount }}
|
||||
{{- if lt $replicaCount 1 -}}
|
||||
spark: workerCount
|
||||
Worker replicas must be greater than 0!!
|
||||
Please set a valid worker count size (--set worker.replicaCount=X)
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Spark - Security SSL enabled */}}
|
||||
{{- define "spark.validateValues.security.ssl" -}}
|
||||
{{- if and .Values.security.ssl.enabled (not .Values.security.ssl.autoGenerated) (not .Values.security.ssl.existingSecret) (not .Values.security.certificatesSecretName) }}
|
||||
spark: security.ssl.enabled
|
||||
In order to enable Security SSL, you also need to provide
|
||||
an existing secret containing the Keystore and Truststore or
|
||||
enable auto-generated certificates.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
{{- define "spark.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "spark.validateValues.extraVolumes" .) -}}
|
||||
{{- $messages := append $messages (include "spark.validateValues.workerCount" .) -}}
|
||||
{{- $messages := append $messages (include "spark.validateValues.security.ssl" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the initialization scripts volume name.
|
||||
*/}}
|
||||
{{- define "spark.initScripts" -}}
|
||||
{{- printf "%s-init-scripts" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the initialization scripts ConfigMap name.
|
||||
*/}}
|
||||
{{- define "spark.initScriptsCM" -}}
|
||||
{{- printf "%s" .Values.initScriptsCM -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the initialization scripts Secret name.
|
||||
*/}}
|
||||
{{- define "spark.initScriptsSecret" -}}
|
||||
{{- printf "%s" .Values.initScriptsSecret -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,9 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.service.headless.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
@@ -0,0 +1,49 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.worker.autoscaling.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ printf "%s-autoscaler" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: worker-autoscaler
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: statefulset
|
||||
name: {{ printf "%s-worker" (include "common.names.fullname" .) }}
|
||||
minReplicas: {{ .Values.worker.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.worker.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.worker.autoscaling.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.worker.autoscaling.targetMemory }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.autoscaling.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
|
||||
targetAverageUtilization: {{ .Values.worker.autoscaling.targetCPU }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.worker.autoscaling.targetCPU }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,60 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: {{ template "common.capabilities.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ printf "%s-ingress" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: ingress
|
||||
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.ingress.hostname }}
|
||||
- host: {{ .Values.ingress.hostname }}
|
||||
http:
|
||||
paths:
|
||||
{{- if .Values.ingress.extraPaths }}
|
||||
{{- toYaml .Values.ingress.extraPaths | nindent 10 }}
|
||||
{{- end }}
|
||||
- path: {{ .Values.ingress.path }}
|
||||
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
|
||||
pathType: {{ .Values.ingress.pathType }}
|
||||
{{- end }}
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (printf "%s-master-svc" (include "common.names.fullname" .)) "servicePort" "http" "context" $) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- range .Values.ingress.extraHosts }}
|
||||
- host: {{ .name | quote }}
|
||||
http:
|
||||
paths:
|
||||
- path: {{ default "/" .path }}
|
||||
{{- if eq "true" (include "common.ingress.supportsPathType" $) }}
|
||||
pathType: {{ default "ImplementationSpecific" .pathType }}
|
||||
{{- end }}
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (printf "%s-master-svc" (include "common.names.fullname" $)) "servicePort" "http" "context" $) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.extraRules }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned)) .Values.ingress.extraTls }}
|
||||
tls:
|
||||
{{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned) }}
|
||||
- hosts:
|
||||
- {{ .Values.ingress.hostname }}
|
||||
secretName: {{ printf "%s-tls" .Values.ingress.hostname }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.extraTls }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.ingress.extraTls "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.initScripts }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-init-scripts" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.initScripts "context" $ ) | nindent 2 }}
|
||||
{{- end }}
|
||||
+91
@@ -0,0 +1,91 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.master.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-master" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: master
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.master.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other worker pods
|
||||
- ports:
|
||||
- port: {{ .Values.worker.containerPorts.cluster }}
|
||||
- port: {{ ternary .Values.worker.containerPorts.https .Values.worker.containerPorts.http .Values.security.ssl.enabled }}
|
||||
to:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: worker
|
||||
# Allow outbound connections to other master pods
|
||||
- ports:
|
||||
- port: {{ .Values.service.ports.cluster }}
|
||||
- port: {{ ternary .Values.service.ports.https .Values.service.ports.http .Values.security.ssl.enabled }}
|
||||
- port: {{ .Values.master.containerPorts.cluster }}
|
||||
- port: {{ ternary .Values.master.containerPorts.https .Values.master.containerPorts.http .Values.security.ssl.enabled }}
|
||||
to:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- if .Values.master.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.master.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.service.ports.cluster }}
|
||||
- port: {{ ternary .Values.service.ports.https .Values.service.ports.http .Values.security.ssl.enabled }}
|
||||
- port: {{ .Values.master.containerPorts.cluster }}
|
||||
- port: {{ ternary .Values.master.containerPorts.https .Values.master.containerPorts.http .Values.security.ssl.enabled }}
|
||||
{{- if not .Values.master.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-master: "true"
|
||||
{{- if .Values.master.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.master.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.master.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.master.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+89
@@ -0,0 +1,89 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.worker.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-worker" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: worker
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: worker
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.worker.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other worker pods
|
||||
- ports:
|
||||
- port: {{ .Values.worker.containerPorts.cluster }}
|
||||
- port: {{ ternary .Values.worker.containerPorts.https .Values.worker.containerPorts.http .Values.security.ssl.enabled }}
|
||||
to:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: worker
|
||||
# Allow outbound connections to other master pods
|
||||
- ports:
|
||||
- port: {{ .Values.service.ports.cluster }}
|
||||
- port: {{ ternary .Values.service.ports.https .Values.service.ports.http .Values.security.ssl.enabled }}
|
||||
- port: {{ .Values.master.containerPorts.cluster }}
|
||||
- port: {{ ternary .Values.master.containerPorts.https .Values.master.containerPorts.http .Values.security.ssl.enabled }}
|
||||
to:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- if .Values.master.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.master.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.worker.containerPorts.cluster }}
|
||||
- port: {{ ternary .Values.worker.containerPorts.https .Values.worker.containerPorts.http .Values.security.ssl.enabled }}
|
||||
{{- if not .Values.worker.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-worker: "true"
|
||||
{{- if .Values.worker.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.worker.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.worker.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.master.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ printf "%s-master" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.master.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.master.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.master.pdb.maxUnavailable ( not .Values.master.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.master.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.worker.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ printf "%s-worker" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: worker
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.worker.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.worker.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.worker.pdb.maxUnavailable ( not .Values.worker.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.worker.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: worker
|
||||
{{- end }}
|
||||
@@ -0,0 +1,49 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.podMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
{{- if .Values.metrics.podMonitor.namespace }}
|
||||
namespace: {{ .Values.metrics.podMonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.metrics.podMonitor.additionalLabels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.podMonitor.additionalLabels "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podMetricsEndpoints:
|
||||
- port: http
|
||||
path: /metrics/
|
||||
{{- if .Values.metrics.podMonitor.interval }}
|
||||
interval: {{ .Values.metrics.podMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.podMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.podMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- range .Values.metrics.podMonitor.extraMetricsEndpoints }}
|
||||
- port: {{ .port }}
|
||||
path: {{ .path }}
|
||||
{{- if $.Values.metrics.podMonitor.interval }}
|
||||
interval: {{ $.Values.metrics.podMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if $.Values.metrics.podMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ $.Values.metrics.podMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . | quote }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.prometheusRule.namespace | quote}}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.metrics.prometheusRule.additionalLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups:
|
||||
- name: {{ include "common.names.fullname" . }}
|
||||
rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if not .Values.security.passwordsSecretName }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "spark.passwordsSecretName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.security.rpc.authenticationEnabled }}
|
||||
rpc-authentication-secret: {{ "RPCDefaultSecret" | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
ssl-keystore-password: {{ (.Values.security.ssl.keystorePassword | default (randAlphaNum 10)) | b64enc | quote }}
|
||||
ssl-truststore-password: {{ (.Values.security.ssl.truststorePassword | default (randAlphaNum 10)) | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spark.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
+373
@@ -0,0 +1,373 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ printf "%s-master" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }}
|
||||
replicas: 1
|
||||
{{- if .Values.master.updateStrategy }}
|
||||
updateStrategy: {{- toYaml .Values.master.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: master
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- if or .Values.master.podAnnotations (and .Values.metrics.enabled .Values.metrics.masterAnnotations) }}
|
||||
annotations:
|
||||
{{- if .Values.master.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.master.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.masterAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.masterAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "spark.imagePullSecrets" . | nindent 6 }}
|
||||
serviceAccountName: {{ template "spark.serviceAccountName" . }}
|
||||
{{- if .Values.master.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.master.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAffinityPreset "component" "master" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAntiAffinityPreset "component" "master" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.master.nodeAffinityPreset.type "key" .Values.master.nodeAffinityPreset.key "values" .Values.master.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.master.automountServiceAccountToken }}
|
||||
{{- if .Values.master.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.master.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.master.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.priorityClassName }}
|
||||
priorityClassName: {{ .Values.master.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.schedulerName }}
|
||||
schedulerName: {{ .Values.master.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.master.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.master.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.master.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- end }}
|
||||
{{- if or .Values.master.initContainers .Values.security.ssl.enabled }}
|
||||
initContainers:
|
||||
{{- if .Values.master.initContainers }}
|
||||
{{ include "common.tplvalues.render" (dict "value" .Values.master.initContainers "context" $) | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: init-certs
|
||||
image: {{ include "spark.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |-
|
||||
{{- if .Values.security.ssl.autoGenerated }}
|
||||
if [[ -f "/certs/tls.key" ]] && [[ -f "/certs/tls.crt" ]] && [[ -f "/certs/ca.crt" ]]; then
|
||||
openssl pkcs12 -export -in "/certs/tls.crt" \
|
||||
-passout pass:"${SPARK_SSL_KEYSTORE_PASSWORD}" \
|
||||
-inkey "/certs/tls.key" \
|
||||
-out "/tmp/keystore.p12"
|
||||
keytool -importkeystore -srckeystore "/tmp/keystore.p12" \
|
||||
-srcstoretype PKCS12 \
|
||||
-srcstorepass "${SPARK_SSL_KEYSTORE_PASSWORD}" \
|
||||
-deststorepass "${SPARK_SSL_KEYSTORE_PASSWORD}" \
|
||||
-destkeystore "/opt/bitnami/spark/conf/certs/spark-keystore.jks"
|
||||
rm "/tmp/keystore.p12"
|
||||
keytool -import -file "/certs/ca.crt" \
|
||||
-keystore "/opt/bitnami/spark/conf/certs/spark-truststore.jks" \
|
||||
-storepass "${SPARK_SSL_TRUSTSTORE_PASSWORD}" \
|
||||
-noprompt
|
||||
else
|
||||
echo "Couldn't find the expected PEM certificates! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- else }}
|
||||
if [[ -f "/certs/spark-truststore.jks" ]] && [[ -f "/certs/spark-keystore.jks" ]]; then
|
||||
cp "/certs/spark-truststore.jks" "/opt/bitnami/spark/conf/certs/spark-truststore.jks"
|
||||
cp "/certs/spark-keystore.jks" "/opt/bitnami/spark/conf/certs/spark-keystore.jks"
|
||||
else
|
||||
echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
env:
|
||||
- name: SPARK_SSL_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-truststore-password
|
||||
{{- if .Values.security.ssl.resources }}
|
||||
resources: {{- toYaml .Values.security.ssl.resources | nindent 12 }}
|
||||
{{- else if ne .Values.security.ssl.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.security.ssl.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
- name: shared-certs
|
||||
mountPath: /opt/bitnami/spark/conf/certs
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: spark-master
|
||||
image: {{ include "spark.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.master.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.master.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.master.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.master.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.master.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.master.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: https
|
||||
containerPort: {{ .Values.master.containerPorts.https }}
|
||||
protocol: TCP
|
||||
{{- else }}
|
||||
- name: http
|
||||
containerPort: {{ .Values.master.containerPorts.http }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- name: cluster
|
||||
containerPort: {{ .Values.master.containerPorts.cluster }}
|
||||
{{- if .Values.master.extraContainerPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.master.extraContainerPorts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/logs
|
||||
subPath: app-logs-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/work
|
||||
subPath: app-work-dir
|
||||
{{- if .Values.master.existingConfigmap }}
|
||||
- name: config
|
||||
mountPath: /bitnami/spark/conf/
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: shared-certs
|
||||
mountPath: /opt/bitnami/spark/conf/certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.master.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScripts }}
|
||||
- name: custom-init-scripts
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsCM }}
|
||||
- name: custom-init-scripts-cm
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-cm
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-secret
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: SPARK_MODE
|
||||
value: "master"
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: SPARK_METRICS_ENABLED
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: SPARK_DAEMON_MEMORY
|
||||
value: {{ .Values.master.daemonMemoryLimit | quote }}
|
||||
{{- if .Values.master.containerPorts.cluster }}
|
||||
- name: SPARK_MASTER_PORT
|
||||
value: {{ .Values.master.containerPorts.cluster | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.containerPorts.http }}
|
||||
- name: SPARK_MASTER_WEBUI_PORT
|
||||
value: {{ .Values.master.containerPorts.http | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.configOptions }}
|
||||
- name: SPARK_MASTER_OPTS
|
||||
value: {{ .Values.master.configOptions | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.rpc.authenticationEnabled }}
|
||||
- name: SPARK_RPC_AUTHENTICATION_ENABLED
|
||||
value: {{ .Values.security.rpc.authenticationEnabled | quote }}
|
||||
- name: SPARK_RPC_AUTHENTICATION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: rpc-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.security.rpc.encryptionEnabled }}
|
||||
- name: SPARK_RPC_ENCRYPTION_ENABLED
|
||||
value: {{ .Values.security.rpc.encryptionEnabled | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.storageEncryptionEnabled }}
|
||||
- name: SPARK_LOCAL_STORAGE_ENCRYPTION_ENABLED
|
||||
value: {{ .Values.security.storageEncryptionEnabled | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: SPARK_SSL_ENABLED
|
||||
value: {{ .Values.security.ssl.enabled | quote }}
|
||||
- name: SPARK_SSL_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-truststore-password
|
||||
- name: SPARK_SSL_NEED_CLIENT_AUTH
|
||||
value: {{ .Values.security.ssl.needClientAuth | quote }}
|
||||
- name: SPARK_SSL_PROTOCOL
|
||||
value: {{ .Values.security.ssl.protocol | quote }}
|
||||
- name: SPARK_WEBUI_SSL_PORT
|
||||
value: {{ .Values.master.containerPorts.https | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.master.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.master.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.master.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: {{ .Values.master.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.master.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: {{ .Values.master.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.master.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: {{ .Values.master.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.master.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.resources }}
|
||||
resources: {{- toYaml .Values.master.resources | nindent 12 }}
|
||||
{{- else if ne .Values.master.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.master.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.master.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if .Values.master.existingConfigmap }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ .Values.master.existingConfigmap }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: certs
|
||||
secret:
|
||||
secretName: {{ include "spark.tlsSecretName" . }}
|
||||
- name: shared-certs
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.master.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScripts }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ template "spark.initScripts" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsCM }}
|
||||
- name: custom-init-scripts-cm
|
||||
configMap:
|
||||
name: {{ template ".Values.initScriptsCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
secret:
|
||||
secretName: {{ template ".Values.initScriptsSecret" . }}
|
||||
defaultMode: 0755
|
||||
{{- end }}
|
||||
{{- if .Values.master.extraVolumeClaimTemplates }}
|
||||
volumeClaimTemplates: {{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumeClaimTemplates "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
+397
@@ -0,0 +1,397 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ printf "%s-worker" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: worker
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }}
|
||||
replicas: {{ .Values.worker.replicaCount }}
|
||||
podManagementPolicy: {{ .Values.worker.podManagementPolicy }}
|
||||
{{- if .Values.worker.updateStrategy }}
|
||||
updateStrategy: {{- toYaml .Values.worker.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.worker.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: worker
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: worker
|
||||
{{- if or .Values.worker.podAnnotations (and .Values.metrics.enabled .Values.metrics.workerAnnotations) }}
|
||||
annotations:
|
||||
{{- if .Values.worker.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.worker.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.workerAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.workerAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "spark.imagePullSecrets" . | nindent 6 }}
|
||||
serviceAccountName: {{ template "spark.serviceAccountName" . }}
|
||||
{{- if .Values.worker.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.worker.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.worker.podAffinityPreset "component" "worker" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.worker.podAntiAffinityPreset "component" "worker" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.worker.nodeAffinityPreset.type "key" .Values.worker.nodeAffinityPreset.key "values" .Values.worker.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.worker.automountServiceAccountToken }}
|
||||
{{- if .Values.worker.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.worker.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.worker.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.worker.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.priorityClassName }}
|
||||
priorityClassName: {{ .Values.worker.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.schedulerName }}
|
||||
schedulerName: {{ .Values.worker.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.worker.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- end }}
|
||||
{{- if or .Values.worker.initContainers .Values.security.ssl.enabled }}
|
||||
initContainers:
|
||||
{{- if .Values.worker.initContainers }}
|
||||
{{ include "common.tplvalues.render" (dict "value" .Values.worker.initContainers "context" $) | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: init-certs
|
||||
image: {{ include "spark.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/bash
|
||||
- -ec
|
||||
- |-
|
||||
{{- if .Values.security.ssl.autoGenerated }}
|
||||
if [[ -f "/certs/tls.key" ]] && [[ -f "/certs/tls.crt" ]] && [[ -f "/certs/ca.crt" ]]; then
|
||||
openssl rsa -aes256 -in /certs/tls.key -out /tmp/tls.key --passout pass:"$SPARK_SSL_KEY_PASSWORD"
|
||||
openssl pkcs12 -export -in "/certs/tls.crt" \
|
||||
-passout pass:"$SPARK_SSL_KEYSTORE_PASSWORD" \
|
||||
-inkey "/certs/tls.key" \
|
||||
-out "/tmp/keystore.p12"
|
||||
keytool -importkeystore -srckeystore "/tmp/keystore.p12" \
|
||||
-srcstoretype PKCS12 \
|
||||
-srcstorepass "$SPARK_SSL_KEYSTORE_PASSWORD" \
|
||||
-deststorepass "$SPARK_SSL_KEYSTORE_PASSWORD" \
|
||||
-destkeystore "/opt/bitnami/spark/conf/certs/spark-keystore.jks"
|
||||
rm "/tmp/keystore.p12"
|
||||
keytool -import -file "/certs/ca.crt" \
|
||||
-keystore "/opt/bitnami/spark/conf/certs/spark-truststore.jks" \
|
||||
-storepass "$SPARK_SSL_TRUSTSTORE_PASSWORD" \
|
||||
-noprompt
|
||||
else
|
||||
echo "Couldn't find the expected PEM certificates! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- else }}
|
||||
if [[ -f "/certs/spark-truststore.jks" ]] && [[ -f "/certs/spark-keystore.jks" ]]; then
|
||||
cp "/certs/spark-truststore.jks" "/opt/bitnami/spark/conf/certs/spark-truststore.jks"
|
||||
cp "/certs/spark-keystore.jks" "/opt/bitnami/spark/conf/certs/spark-keystore.jks"
|
||||
else
|
||||
echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled."
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
env:
|
||||
- name: SPARK_SSL_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-truststore-password
|
||||
{{- if .Values.security.ssl.resources }}
|
||||
resources: {{- toYaml .Values.security.ssl.resources | nindent 12 }}
|
||||
{{- else if ne .Values.security.ssl.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.security.ssl.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
- name: shared-certs
|
||||
mountPath: /opt/bitnami/spark/conf/certs
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: spark-worker
|
||||
image: {{ include "spark.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
{{- if .Values.worker.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.worker.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.worker.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.worker.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.worker.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: https
|
||||
containerPort: {{ .Values.worker.containerPorts.https }}
|
||||
protocol: TCP
|
||||
{{- else }}
|
||||
- name: http
|
||||
containerPort: {{ .Values.worker.containerPorts.http }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.worker.containerPorts.cluster }}
|
||||
- name: cluster
|
||||
containerPort: {{ .Values.worker.containerPorts.cluster }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.extraContainerPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraContainerPorts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/logs
|
||||
subPath: app-logs-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/spark/work
|
||||
subPath: app-work-dir
|
||||
{{- if .Values.worker.existingConfigmap }}
|
||||
- name: config
|
||||
mountPath: '/bitnami/spark/conf/'
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: shared-certs
|
||||
mountPath: '/opt/bitnami/spark/conf/certs'
|
||||
readOnly: true
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
{{- end }}
|
||||
{{- if .Values.worker.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScripts }}
|
||||
- name: custom-init-scripts
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsCM }}
|
||||
- name: custom-init-scripts-cm
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-cm
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-secret
|
||||
{{- end }}
|
||||
env:
|
||||
- name: SPARK_MODE
|
||||
value: "worker"
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: SPARK_DAEMON_MEMORY
|
||||
value: {{ .Values.worker.daemonMemoryLimit | quote }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: SPARK_METRICS_ENABLED
|
||||
value: "true"
|
||||
{{- end }}
|
||||
## There are some environment variables whose existence needs
|
||||
## to be checked because Spark checks if they are null instead of an
|
||||
## empty string
|
||||
{{- if .Values.worker.memoryLimit }}
|
||||
- name: SPARK_WORKER_MEMORY
|
||||
value: {{ .Values.worker.memoryLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.coreLimit }}
|
||||
- name: SPARK_WORKER_CORES
|
||||
value: {{ .Values.worker.coreLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.containerPorts.cluster }}
|
||||
- name: SPARK_WORKER_PORT
|
||||
value: {{ .Values.worker.containerPorts.cluster | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.containerPorts.http }}
|
||||
- name: SPARK_WORKER_WEBUI_PORT
|
||||
value: {{ .Values.worker.containerPorts.http | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.dir }}
|
||||
- name: SPARK_WORKER_DIR
|
||||
value: {{ .Values.worker.dir | quote }}
|
||||
{{- end }}
|
||||
- name: SPARK_DAEMON_JAVA_OPTS
|
||||
value: {{ .Values.worker.javaOptions | quote }}
|
||||
- name: SPARK_MASTER_URL
|
||||
value: {{ printf "spark://%s-master-svc:%d" (include "common.names.fullname" .) (int .Values.service.ports.cluster) }}
|
||||
# If you use a custom properties file, it must be loaded using a ConfigMap
|
||||
- name: SPARK_WORKER_OPTS
|
||||
value: {{ .Values.worker.configOptions }}
|
||||
{{- if .Values.security.rpc.authenticationEnabled }}
|
||||
- name: SPARK_RPC_AUTHENTICATION_ENABLED
|
||||
value: {{ .Values.security.rpc.authenticationEnabled | quote }}
|
||||
- name: SPARK_RPC_AUTHENTICATION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: rpc-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.security.rpc.encryptionEnabled }}
|
||||
- name: SPARK_RPC_ENCRYPTION_ENABLED
|
||||
value: {{ .Values.security.rpc.encryptionEnabled | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.storageEncryptionEnabled }}
|
||||
- name: SPARK_LOCAL_STORAGE_ENCRYPTION_ENABLED
|
||||
value: {{ .Values.security.storageEncryptionEnabled | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: SPARK_SSL_ENABLED
|
||||
value: {{ .Values.security.ssl.enabled | quote }}
|
||||
- name: SPARK_SSL_KEY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-keystore-password
|
||||
- name: SPARK_SSL_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "spark.passwordsSecretName" . }}
|
||||
key: ssl-truststore-password
|
||||
- name: SPARK_SSL_NEED_CLIENT_AUTH
|
||||
value: {{ .Values.security.ssl.needClientAuth | quote }}
|
||||
- name: SPARK_SSL_PROTOCOL
|
||||
value: {{ .Values.security.ssl.protocol | quote }}
|
||||
- name: SPARK_WEBUI_SSL_PORT
|
||||
value: {{ .Values.worker.containerPorts.https | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.worker.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsCM "context" $) }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsSecret "context" $) }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.worker.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.worker.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: {{ .Values.worker.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.worker.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: {{ .Values.worker.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.worker.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: {{ .Values.worker.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.worker.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.resources }}
|
||||
resources: {{- toYaml .Values.worker.resources | nindent 12 }}
|
||||
{{- else if ne .Values.worker.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.worker.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.worker.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if .Values.worker.existingConfigmap }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ .Values.worker.existingConfigmap }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- name: certs
|
||||
secret:
|
||||
secretName: {{ include "spark.tlsSecretName" . }}
|
||||
- name: shared-certs
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.worker.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScripts }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ template "spark.initScripts" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsCM }}
|
||||
- name: custom-init-scripts-cm
|
||||
configMap:
|
||||
name: {{ template ".Values.initScriptsCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.initScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
secret:
|
||||
secretName: {{ template ".Values.initScriptsSecret" . }}
|
||||
defaultMode: 0755
|
||||
{{- end }}
|
||||
{{- if .Values.worker.extraVolumeClaimTemplates }}
|
||||
volumeClaimTemplates: {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumeClaimTemplates "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,72 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-master-svc" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: master
|
||||
{{- if or .Values.commonAnnotations .Values.service.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.service.clusterIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
|
||||
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerSourceRanges)) }}
|
||||
loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: {{ .Values.service.ports.cluster }}
|
||||
targetPort: cluster
|
||||
name: cluster
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.cluster)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.cluster }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- if .Values.security.ssl.enabled }}
|
||||
- port: {{ .Values.service.ports.https }}
|
||||
targetPort: https
|
||||
name: https
|
||||
protocol: TCP
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.https }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- port: {{ .Values.service.ports.http }}
|
||||
targetPort: http
|
||||
name: http
|
||||
protocol: TCP
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.http }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: master
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- if .Values.ingress.secrets }}
|
||||
{{- range .Values.ingress.secrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
namespace: {{ include "common.names.namespace" $ | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if $.Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ .certificate | b64enc }}
|
||||
tls.key: {{ .key | b64enc }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
|
||||
{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
|
||||
{{- $ca := genCA "spark-ca" 365 }}
|
||||
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (include "spark.createTlsSecret" . ) }}
|
||||
{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }}
|
||||
{{- $ca := genCA "spark-internal-ca" 365 }}
|
||||
{{- $releaseNamespace := include "common.names.namespace" . }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $fullname := include "common.names.fullname" . }}
|
||||
{{- $headlessServiceName := printf "%s-headless" ( include "common.names.fullname" . ) }}
|
||||
{{- $masterServiceName := printf "%s-master-svc" (include "common.names.fullname" .) }}
|
||||
{{- $altNames := list (printf "*.%s.%s.svc.%s" $masterServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $masterServiceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) $fullname }}
|
||||
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user