From a586636e90119a39221a45f61af9b109ae7d89c1 Mon Sep 17 00:00:00 2001 From: Juan Ariza Toledano Date: Wed, 28 Aug 2024 10:22:36 +0200 Subject: [PATCH] New chart: KeyDB (#29025) --- .vib/keydb/ginkgo/go.mod | 57 + .vib/keydb/ginkgo/go.sum | 160 ++ .vib/keydb/ginkgo/keydb_suite_test.go | 109 ++ .vib/keydb/ginkgo/keydb_test.go | 113 ++ .vib/keydb/goss/goss.yaml | 59 + .vib/keydb/runtime-parameters.yaml | 51 + .vib/keydb/vib-publish.json | 38 + .vib/keydb/vib-verify.json | 71 + bitnami/keydb/.helmignore | 23 + bitnami/keydb/CHANGELOG.md | 5 + bitnami/keydb/Chart.lock | 6 + bitnami/keydb/Chart.yaml | 37 + bitnami/keydb/README.md | 681 ++++++++ bitnami/keydb/templates/NOTES.txt | 163 ++ bitnami/keydb/templates/_helpers.tpl | 213 +++ bitnami/keydb/templates/ca-cert.yaml | 53 + bitnami/keydb/templates/extra-list.yaml | 9 + bitnami/keydb/templates/health-configmap.yaml | 156 ++ bitnami/keydb/templates/master/cert.yaml | 44 + bitnami/keydb/templates/master/configmap.yaml | 54 + .../templates/master/headless-service.yaml | 28 + .../keydb/templates/master/networkpolicy.yaml | 73 + bitnami/keydb/templates/master/pdb.yaml | 30 + bitnami/keydb/templates/master/service.yaml | 53 + .../keydb/templates/master/statefulset.yaml | 436 +++++ bitnami/keydb/templates/master/vpa.yaml | 45 + bitnami/keydb/templates/metrics-svc.yaml | 28 + bitnami/keydb/templates/prometheusrule.yaml | 24 + bitnami/keydb/templates/replica/cert.yaml | 44 + .../keydb/templates/replica/configmap.yaml | 63 + .../templates/replica/headless-service.yaml | 30 + bitnami/keydb/templates/replica/hpa.yaml | 50 + .../templates/replica/networkpolicy.yaml | 82 + bitnami/keydb/templates/replica/pdb.yaml | 30 + bitnami/keydb/templates/replica/service.yaml | 55 + .../keydb/templates/replica/statefulset.yaml | 459 +++++ bitnami/keydb/templates/replica/vpa.yaml | 45 + bitnami/keydb/templates/secret.yaml | 20 + bitnami/keydb/templates/service-account.yaml | 19 + bitnami/keydb/templates/servicemonitor.yaml | 50 + bitnami/keydb/templates/tls-secret.yaml | 91 + bitnami/keydb/values.yaml | 1522 +++++++++++++++++ 42 files changed, 5379 insertions(+) create mode 100644 .vib/keydb/ginkgo/go.mod create mode 100644 .vib/keydb/ginkgo/go.sum create mode 100644 .vib/keydb/ginkgo/keydb_suite_test.go create mode 100644 .vib/keydb/ginkgo/keydb_test.go create mode 100644 .vib/keydb/goss/goss.yaml create mode 100644 .vib/keydb/runtime-parameters.yaml create mode 100644 .vib/keydb/vib-publish.json create mode 100644 .vib/keydb/vib-verify.json create mode 100644 bitnami/keydb/.helmignore create mode 100644 bitnami/keydb/CHANGELOG.md create mode 100644 bitnami/keydb/Chart.lock create mode 100644 bitnami/keydb/Chart.yaml create mode 100644 bitnami/keydb/README.md create mode 100644 bitnami/keydb/templates/NOTES.txt create mode 100644 bitnami/keydb/templates/_helpers.tpl create mode 100644 bitnami/keydb/templates/ca-cert.yaml create mode 100644 bitnami/keydb/templates/extra-list.yaml create mode 100644 bitnami/keydb/templates/health-configmap.yaml create mode 100644 bitnami/keydb/templates/master/cert.yaml create mode 100644 bitnami/keydb/templates/master/configmap.yaml create mode 100644 bitnami/keydb/templates/master/headless-service.yaml create mode 100644 bitnami/keydb/templates/master/networkpolicy.yaml create mode 100644 bitnami/keydb/templates/master/pdb.yaml create mode 100644 bitnami/keydb/templates/master/service.yaml create mode 100644 bitnami/keydb/templates/master/statefulset.yaml create mode 100644 bitnami/keydb/templates/master/vpa.yaml create mode 100644 bitnami/keydb/templates/metrics-svc.yaml create mode 100644 bitnami/keydb/templates/prometheusrule.yaml create mode 100644 bitnami/keydb/templates/replica/cert.yaml create mode 100644 bitnami/keydb/templates/replica/configmap.yaml create mode 100644 bitnami/keydb/templates/replica/headless-service.yaml create mode 100644 bitnami/keydb/templates/replica/hpa.yaml create mode 100644 bitnami/keydb/templates/replica/networkpolicy.yaml create mode 100644 bitnami/keydb/templates/replica/pdb.yaml create mode 100644 bitnami/keydb/templates/replica/service.yaml create mode 100644 bitnami/keydb/templates/replica/statefulset.yaml create mode 100644 bitnami/keydb/templates/replica/vpa.yaml create mode 100644 bitnami/keydb/templates/secret.yaml create mode 100644 bitnami/keydb/templates/service-account.yaml create mode 100644 bitnami/keydb/templates/servicemonitor.yaml create mode 100644 bitnami/keydb/templates/tls-secret.yaml create mode 100644 bitnami/keydb/values.yaml diff --git a/.vib/keydb/ginkgo/go.mod b/.vib/keydb/ginkgo/go.mod new file mode 100644 index 00000000000000..c5e4f798320427 --- /dev/null +++ b/.vib/keydb/ginkgo/go.mod @@ -0,0 +1,57 @@ +module test-keydb-chart + +go 1.20 + +replace github.com/bitnami/charts/.vib/common-tests/ginkgo-utils => ../../common-tests/ginkgo-utils + +require ( + github.com/bitnami/charts/.vib/common-tests/ginkgo-utils v0.0.0-00010101000000-000000000000 + github.com/onsi/ginkgo/v2 v2.11.0 + github.com/onsi/gomega v1.27.8 + k8s.io/api v0.28.0 + k8s.io/apimachinery v0.28.0 + k8s.io/client-go v0.28.0 +) + +require ( + github.com/davecgh/go-spew v1.1.1 // indirect + github.com/emicklei/go-restful/v3 v3.9.0 // indirect + github.com/go-logr/logr v1.2.4 // indirect + github.com/go-openapi/jsonpointer v0.19.6 // indirect + github.com/go-openapi/jsonreference v0.20.2 // indirect + github.com/go-openapi/swag v0.22.3 // indirect + github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect + github.com/gogo/protobuf v1.3.2 // indirect + github.com/golang/protobuf v1.5.3 // indirect + github.com/google/gnostic-models v0.6.8 // indirect + github.com/google/go-cmp v0.5.9 // indirect + github.com/google/gofuzz v1.2.0 // indirect + github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect + github.com/google/uuid v1.3.0 // indirect + github.com/imdario/mergo v0.3.6 // indirect + github.com/josharian/intern v1.0.0 // indirect + github.com/json-iterator/go v1.1.12 // indirect + github.com/mailru/easyjson v0.7.7 // indirect + github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect + github.com/modern-go/reflect2 v1.0.2 // indirect + github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect + github.com/spf13/pflag v1.0.5 // indirect + golang.org/x/net v0.23.0 // indirect + golang.org/x/oauth2 v0.8.0 // indirect + golang.org/x/sys v0.18.0 // indirect + golang.org/x/term v0.18.0 // indirect + golang.org/x/text v0.14.0 // indirect + golang.org/x/time v0.3.0 // indirect + golang.org/x/tools v0.9.3 // indirect + google.golang.org/appengine v1.6.7 // indirect + google.golang.org/protobuf v1.33.0 // indirect + gopkg.in/inf.v0 v0.9.1 // indirect + gopkg.in/yaml.v2 v2.4.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect + k8s.io/klog/v2 v2.100.1 // indirect + k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect + k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect + sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect + sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect + sigs.k8s.io/yaml v1.3.0 // indirect +) diff --git a/.vib/keydb/ginkgo/go.sum b/.vib/keydb/ginkgo/go.sum new file mode 100644 index 00000000000000..5d481c1be1d259 --- /dev/null +++ b/.vib/keydb/ginkgo/go.sum @@ -0,0 +1,160 @@ +github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= +github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= +github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= +github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE= +github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= +github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= +github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= +github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= +github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= +github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= +github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls= +github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= +github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= +github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= +github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= +github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= +github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= +github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= +github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= +github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= +github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= +github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28= +github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA= +github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= +github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= +github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= +github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= +github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= +github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= +github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= +github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M= +github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= +github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU= +github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM= +github.com/onsi/gomega v1.27.8 h1:gegWiwZjBsf2DgiSbf5hpokZ98JVDMcWkUiigk6/KXc= +github.com/onsi/gomega v1.27.8/go.mod h1:2J8vzI/s+2shY9XHRApDkdgPo1TKT7P2u6fXeJKFnNQ= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= +github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= +github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= +github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs= +golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= +golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8= +golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4= +golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8= +golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= +golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= +golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= +golang.org/x/tools v0.9.3 h1:Gn1I8+64MsuTb/HpH+LmQtNas23LhUVr3rYZ0eKuaMM= +golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= +google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= +google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= +google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI= +google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= +gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= +gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +k8s.io/api v0.28.0 h1:3j3VPWmN9tTDI68NETBWlDiA9qOiGJ7sdKeufehBYsM= +k8s.io/api v0.28.0/go.mod h1:0l8NZJzB0i/etuWnIXcwfIv+xnDOhL3lLW919AWYDuY= +k8s.io/apimachinery v0.28.0 h1:ScHS2AG16UlYWk63r46oU3D5y54T53cVI5mMJwwqFNA= +k8s.io/apimachinery v0.28.0/go.mod h1:X0xh/chESs2hP9koe+SdIAcXWcQ+RM5hy0ZynB+yEvw= +k8s.io/client-go v0.28.0 h1:ebcPRDZsCjpj62+cMk1eGNX1QkMdRmQ6lmz5BLoFWeM= +k8s.io/client-go v0.28.0/go.mod h1:0Asy9Xt3U98RypWJmU1ZrRAGKhP6NqDPmptlAzK2kMc= +k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg= +k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ= +k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM= +k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk= +k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= +sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE= +sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E= +sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo= +sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8= diff --git a/.vib/keydb/ginkgo/keydb_suite_test.go b/.vib/keydb/ginkgo/keydb_suite_test.go new file mode 100644 index 00000000000000..f1620cc305c594 --- /dev/null +++ b/.vib/keydb/ginkgo/keydb_suite_test.go @@ -0,0 +1,109 @@ +package keydb_test + +import ( + "context" + "flag" + "fmt" + "testing" + "time" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + batchv1 "k8s.io/api/batch/v1" + v1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/kubernetes" +) + +var ( + kubeconfig string + stsName string + namespace string + password string + timeoutSeconds int + timeout time.Duration +) + +func init() { + flag.StringVar(&kubeconfig, "kubeconfig", "", "absolute path to the kubeconfig file") + flag.StringVar(&stsName, "name", "", "name of the master statefulset") + flag.StringVar(&namespace, "namespace", "", "namespace where the application is running") + flag.StringVar(&password, "password", "", "database password") + flag.IntVar(&timeoutSeconds, "timeout", 120, "timeout in seconds") + timeout = time.Duration(timeoutSeconds) * time.Second +} + +func TestKeyDB(t *testing.T) { + RegisterFailHandler(Fail) + RunSpecs(t, "KeyDB Persistence Test Suite") +} + +func createJob(ctx context.Context, c kubernetes.Interface, name, port, image, stmt string) error { + securityContext := &v1.SecurityContext{ + Privileged: &[]bool{false}[0], + AllowPrivilegeEscalation: &[]bool{false}[0], + RunAsNonRoot: &[]bool{true}[0], + Capabilities: &v1.Capabilities{ + Drop: []v1.Capability{"ALL"}, + }, + SeccompProfile: &v1.SeccompProfile{ + Type: "RuntimeDefault", + }, + } + job := &batchv1.Job{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + }, + TypeMeta: metav1.TypeMeta{ + Kind: "Job", + }, + Spec: batchv1.JobSpec{ + Template: v1.PodTemplateSpec{ + Spec: v1.PodSpec{ + RestartPolicy: "Never", + Containers: []v1.Container{ + { + Name: "keydb", + Image: image, + Command: []string{ + "keydb-cli", + "--tls", + "--cacert", "/certs/ca.crt", + "-h", stsName, + "-p", port, + stmt, + }, + Env: []v1.EnvVar{ + { + Name: "REDISCLI_AUTH", + Value: password, + }, + }, + SecurityContext: securityContext, + VolumeMounts: []v1.VolumeMount{ + { + Name: "keydb-certificates", + MountPath: "/certs", + }, + }, + }, + }, + Volumes: []v1.Volume{ + { + Name: "keydb-certificates", + VolumeSource: v1.VolumeSource{ + Secret: &v1.SecretVolumeSource{ + SecretName: fmt.Sprintf("%s-crt", stsName), + }, + }, + }, + }, + }, + }, + }, + } + + _, err := c.BatchV1().Jobs(namespace).Create(ctx, job, metav1.CreateOptions{}) + + return err +} diff --git a/.vib/keydb/ginkgo/keydb_test.go b/.vib/keydb/ginkgo/keydb_test.go new file mode 100644 index 00000000000000..af92f6f6876008 --- /dev/null +++ b/.vib/keydb/ginkgo/keydb_test.go @@ -0,0 +1,113 @@ +package keydb_test + +import ( + "context" + "fmt" + "time" + + utils "github.com/bitnami/charts/.vib/common-tests/ginkgo-utils" + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + appsv1 "k8s.io/api/apps/v1" + batchv1 "k8s.io/api/batch/v1" + v1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/kubernetes" +) + +const ( + PollingInterval = 1 * time.Second +) + +var _ = Describe("KeyDB", Ordered, func() { + var c *kubernetes.Clientset + var ctx context.Context + var cancel context.CancelFunc + + BeforeEach(func() { + ctx, cancel = context.WithCancel(context.Background()) + + conf := utils.MustBuildClusterConfig(kubeconfig) + c = kubernetes.NewForConfigOrDie(conf) + }) + + When("a key-value is created and KeyDB is rollout restarted", func() { + It("should have access to the created key-value", func() { + + getAvailableReplicas := func(ss *appsv1.StatefulSet) int32 { return ss.Status.AvailableReplicas } + getRestartedAtAnnotation := func(pod *v1.Pod) string { return pod.Annotations["kubectl.kubernetes.io/restartedAt"] } + getSucceededJobs := func(j *batchv1.Job) int32 { return j.Status.Succeeded } + getOpts := metav1.GetOptions{} + + By("checking all the replicas are available") + ss, err := c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) + Expect(err).NotTo(HaveOccurred()) + Expect(ss.Status.Replicas).NotTo(BeZero()) + origReplicas := *ss.Spec.Replicas + + Eventually(func() (*appsv1.StatefulSet, error) { + return c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) + }, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas))) + + svc, err := c.CoreV1().Services(namespace).Get(ctx, stsName, getOpts) + Expect(err).NotTo(HaveOccurred()) + + port, err := utils.SvcGetPortByName(svc, "tcp-keydb") + Expect(err).NotTo(HaveOccurred()) + + image, err := utils.StsGetContainerImageByName(ss, "keydb") + Expect(err).NotTo(HaveOccurred()) + + jobSuffix := time.Now().Format("20060102150405") + + By("creating a job to create a new test key-value") + createKEYJobName := fmt.Sprintf("%s-createkey-%s", + stsName, jobSuffix) + keyName := fmt.Sprintf("test%s", jobSuffix) + keyValue := fmt.Sprintf("v%s", jobSuffix) + + err = createJob(ctx, c, createKEYJobName, port, image, fmt.Sprintf("SET %s %s", keyName, keyValue)) + Expect(err).NotTo(HaveOccurred()) + + Eventually(func() (*batchv1.Job, error) { + return c.BatchV1().Jobs(namespace).Get(ctx, createKEYJobName, getOpts) + }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) + + By("deleting the job once it has succeeded") + err = c.BatchV1().Jobs(namespace).Delete(ctx, createKEYJobName, metav1.DeleteOptions{}) + Expect(err).NotTo(HaveOccurred()) + + By("rollout restart the statefulset") + _, err = utils.StsRolloutRestart(ctx, c, ss) + Expect(err).NotTo(HaveOccurred()) + + for i := 0; i < int(origReplicas); i++ { + Eventually(func() (*v1.Pod, error) { + return c.CoreV1().Pods(namespace).Get(ctx, fmt.Sprintf("%s-%d", stsName, i), getOpts) + }, timeout, PollingInterval).Should(WithTransform(getRestartedAtAnnotation, Not(BeEmpty()))) + } + + Eventually(func() (*appsv1.StatefulSet, error) { + return c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) + }, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas))) + + By("creating a job to drop the test key-value") + deleteKeyJobName := fmt.Sprintf("%s-deletekey-%s", + stsName, jobSuffix) + err = createJob(ctx, c, deleteKeyJobName, port, image, fmt.Sprintf("DEL %s", keyName)) + Expect(err).NotTo(HaveOccurred()) + + Eventually(func() (*batchv1.Job, error) { + return c.BatchV1().Jobs(namespace).Get(ctx, deleteKeyJobName, getOpts) + }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) + + By("deleting the job once it has succeeded") + err = c.BatchV1().Jobs(namespace).Delete(ctx, deleteKeyJobName, metav1.DeleteOptions{}) + Expect(err).NotTo(HaveOccurred()) + }) + }) + + AfterEach(func() { + cancel() + }) +}) diff --git a/.vib/keydb/goss/goss.yaml b/.vib/keydb/goss/goss.yaml new file mode 100644 index 00000000000000..ff35611d8fb0f3 --- /dev/null +++ b/.vib/keydb/goss/goss.yaml @@ -0,0 +1,59 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +{{- $auth := printf "REDISCLI_AUTH='%s'" .Vars.auth.password }} +{{- $tls := print "--tls --cacert /opt/bitnami/keydb/certs/ca.crt" }} +{{- $master_endpoint := printf "-h keydb-master -p %d" .Vars.master.service.ports.keydb }} +{{- $replicas_endpoint := printf "-h keydb-replica -p %d" .Vars.replica.service.ports.keydb }} +{{- $replicas := .Vars.replica.replicaCount }} +command: + {{- $key := printf "key_%s" (randAlpha 5) }} + {{- $value := printf "value_%s" (randAlpha 5) }} + keydb-set-key-value-pairs: + exec: export {{ $auth }} && keydb-cli {{ $tls }} {{ $master_endpoint }} SET {{ $key }} {{ $value }} {{ range $e, $i := until $replicas }} && keydb-cli {{ $tls }} -h keydb-replica-{{ $i }}.keydb-replica-hl -p {{ $.Vars.replica.containerPorts.keydb }} GET {{ $key }} | grep -q {{ $value }}{{ end }} + exit-status: 0 + {{ range $command := .Vars.master.disableCommands }} + keydb-disabled-{{ $command }}: + exec: export {{ $auth }} && keydb-cli {{ $tls }} {{ $master_endpoint }} {{ $command }} + exit-status: 0 + stdout: + - "ERR unknown command" + {{ end }} + keydb-master-role: + exec: export {{ $auth }} && keydb-cli {{ $tls }} {{ $master_endpoint }} ROLE + exit-status: 0 + stdout: + - "master" + {{ range $e, $i := until $replicas }} + - "keydb-replica-{{ $i }}" + {{ end }} + keydb-replicas-role: + exec: export {{ $auth }} && keydb-cli {{ $tls }} {{ $replicas_endpoint }} ROLE + exit-status: 0 + stdout: + - "active-replica" + {{- $uid := .Vars.master.containerSecurityContext.runAsUser }} + {{- $gid := .Vars.master.podSecurityContext.fsGroup }} + check-user-info: + # The UID and GID should always be either the one specified as vars (always a bigger number that the default) + # or the one randomly defined by openshift (larger values). Otherwise, the chart is still using the default value. + exec: if [ $(id -u) -lt {{ $uid }} ] || [ $(id -G | awk '{print $2}') -lt {{ $gid }} ]; then exit 1; fi + exit-status: 0 + {{ if .Vars.master.automountServiceAccountToken }} + check-sa: + exec: cat /var/run/secrets/kubernetes.io/serviceaccount/token | cut -d '.' -f 2 | xargs -I '{}' echo '{}====' | fold -w 4 | sed '$ d' | tr -d '\n' | base64 -d + exit-status: 0 + stdout: + - /serviceaccount.*name.*{{.Env.BITNAMI_APP_NAME }}/ + {{ end }} +file: + {{ .Vars.master.persistence.mountPath }}: + filetype: directory + exists: true + mode: "2775" + owner: root + /opt/bitnami/keydb/etc: + filetype: directory + exists: true + mode: "2777" + owner: root diff --git a/.vib/keydb/runtime-parameters.yaml b/.vib/keydb/runtime-parameters.yaml new file mode 100644 index 00000000000000..857655accc54a1 --- /dev/null +++ b/.vib/keydb/runtime-parameters.yaml @@ -0,0 +1,51 @@ +architecture: replication +auth: + enabled: true + password: ComplicatedPassword123!4 +tls: + enabled: true + autoGenerated: + enabled: true +master: + replicaCount: 1 + disableCommands: + - FLUSHALL + - FLUSHDB + containerPorts: + keydb: 6380 + podSecurityContext: + enabled: true + fsGroup: 1002 + containerSecurityContext: + enabled: true + runAsUser: 1002 + persistence: + enabled: true + mountPath: /data + service: + ports: + keydb: 80 + type: LoadBalancer + serviceAccount: + create: true + automountServiceAccountToken: true +replica: + replicaCount: 3 + activeReplica: true + containerPorts: + keydb: 6380 + podSecurityContext: + enabled: true + fsGroup: 1002 + containerSecurityContext: + enabled: true + runAsUser: 1002 + persistence: + enabled: true + mountPath: /data + service: + ports: + keydb: 6378 + type: ClusterIP +metrics: + enabled: true diff --git a/.vib/keydb/vib-publish.json b/.vib/keydb/vib-publish.json new file mode 100644 index 00000000000000..8660cc2107095f --- /dev/null +++ b/.vib/keydb/vib-publish.json @@ -0,0 +1,38 @@ +{ + "phases": { + "package": { + "context": { + "resources": { + "url": "{SHA_ARCHIVE}", + "path": "/bitnami/keydb" + } + }, + "actions": [ + { + "action_id": "helm-package" + }, + { + "action_id": "helm-lint" + } + ] + }, + "publish": { + "actions": [ + { + "action_id": "helm-publish", + "params": { + "repository": { + "kind": "S3", + "url": "{VIB_ENV_S3_URL}", + "authn": { + "access_key_id": "{VIB_ENV_S3_ACCESS_KEY_ID}", + "secret_access_key": "{VIB_ENV_S3_SECRET_ACCESS_KEY}", + "role": "{VIB_ENV_S3_ROLE_ARN}" + } + } + } + } + ] + } + } +} diff --git a/.vib/keydb/vib-verify.json b/.vib/keydb/vib-verify.json new file mode 100644 index 00000000000000..b31d0aa9bed49a --- /dev/null +++ b/.vib/keydb/vib-verify.json @@ -0,0 +1,71 @@ +{ + "phases": { + "package": { + "context": { + "resources": { + "url": "{SHA_ARCHIVE}", + "path": "/bitnami/keydb" + } + }, + "actions": [ + { + "action_id": "helm-package" + }, + { + "action_id": "helm-lint" + } + ] + }, + "verify": { + "context": { + "resources": { + "url": "{SHA_ARCHIVE}", + "path": "/bitnami/keydb" + }, + "target_platform": { + "target_platform_id": "{VIB_ENV_TARGET_PLATFORM}", + "size": { + "name": "S4" + } + } + }, + "actions": [ + { + "action_id": "goss", + "params": { + "resources": { + "path": "/.vib" + }, + "tests_file": "keydb/goss/goss.yaml", + "vars_file": "keydb/runtime-parameters.yaml", + "remote": { + "pod": { + "workload": "sts-keydb-master" + } + } + } + }, + { + "action_id": "ginkgo", + "params": { + "resources": { + "path": "/.vib/keydb/ginkgo" + }, + "params": { + "kubeconfig": "{{kubeconfig}}", + "namespace": "{{namespace}}", + "name": "keydb-master", + "password": "ComplicatedPassword123!4" + } + } + }, + { + "action_id": "kubescape", + "params": { + "threshold": {VIB_ENV_KUBESCAPE_SCORE_THRESHOLD} + } + } + ] + } + } +} diff --git a/bitnami/keydb/.helmignore b/bitnami/keydb/.helmignore new file mode 100644 index 00000000000000..a0a332a53c8243 --- /dev/null +++ b/bitnami/keydb/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Changelog +CHANGELOG.md diff --git a/bitnami/keydb/CHANGELOG.md b/bitnami/keydb/CHANGELOG.md new file mode 100644 index 00000000000000..8f35aca478b598 --- /dev/null +++ b/bitnami/keydb/CHANGELOG.md @@ -0,0 +1,5 @@ +# Changelog + +## 0.1.0 (2024-08-28) + +* New chart: KeyDB ([#29025](https://github.com/bitnami/charts/pull/29025)) diff --git a/bitnami/keydb/Chart.lock b/bitnami/keydb/Chart.lock new file mode 100644 index 00000000000000..92772c8a575d68 --- /dev/null +++ b/bitnami/keydb/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: oci://registry-1.docker.io/bitnamicharts + version: 2.22.0 +digest: sha256:a8fb2fc887ead658a89598a48acde5324196fbc0509503a3eaed50a710fbfe74 +generated: "2024-08-23T13:42:25.992897+02:00" diff --git a/bitnami/keydb/Chart.yaml b/bitnami/keydb/Chart.yaml new file mode 100644 index 00000000000000..48fa597ea8228d --- /dev/null +++ b/bitnami/keydb/Chart.yaml @@ -0,0 +1,37 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +annotations: + category: Database + licenses: Apache-2.0 + images: | + - name: keydb + image: docker.io/bitnami/keydb:6.3.4-debian-12-r0 + - name: redis-exporter + image: docker.io/bitnami/redis-exporter:1.62.0-debian-12-r3 + - name: os-shell + image: docker.io/bitnami/os-shell:12-debian-12-r27 +apiVersion: v2 +appVersion: 6.3.4 +dependencies: + - name: common + repository: oci://registry-1.docker.io/bitnamicharts + tags: + - bitnami-common + version: 2.x.x +description: KeyDB is a high performance fork of Redis with a focus on multithreading, memory efficiency, and high throughput. +home: https://bitnami.com +icon: https://bitnami.com/assets/stacks/keydb/img/keydb-stack-220x234.png +keywords: + - keydb + - keyvalue + - database + - cache +maintainers: + - name: Broadcom, Inc. All Rights Reserved. + url: https://github.com/bitnami/charts +name: keydb +sources: + - https://github.com/bitnami/charts/tree/main/bitnami/keydb + - https://github.com/bitnami/containers/tree/main/bitnami/keydb +version: 0.1.0 diff --git a/bitnami/keydb/README.md b/bitnami/keydb/README.md new file mode 100644 index 00000000000000..12d6216e69722b --- /dev/null +++ b/bitnami/keydb/README.md @@ -0,0 +1,681 @@ + + +# KeyDB + +KeyDB is a high performance fork of Redis with a focus on multithreading, memory efficiency, and high throughput. + +[Overview of KeyDB](https://github.com/Snapchat/KeyDB) + +Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. + +## TL;DR + +```console +helm install my-release oci://registry-1.docker.io/bitnamicharts/keydb +``` + +Looking to use KeyDB in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog. + +## Introduction + +Bitnami charts for Helm are carefully engineered, actively maintained and are the quickest and easiest way to deploy containers on a Kubernetes cluster that are ready to handle production workloads. + +This chart bootstraps a [KeyDB](https://github.com/Snapchat/KeyDB) deployment in a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.23+ +- Helm 3.8.0+ +- PV provisioner support in the underlying infrastructure + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/keydb +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The command deploys KeyDB on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Configuration and installation details + +### Cluster topologies + +#### Default: Master - Replicas + +When installing the chart with `architecture=replication`, it will deploy a KeyDB Master statefulset and a KeyDB Replica statefulset. The master is responsible for all write operations, while the replicas replicate the write operations from the master and serve read operations. Two services will be exposed: + +- KeyDB Master service: Points to the master, where read-write operations can be performed +- KeyDB Replicas service: Points to the replicas, where only read operations are allowed by default. + +In case the master crashes, the replicas will wait until the master node is respawned again by the Kubernetes Controller Manager. + +#### Active Replicas + +Similar to the Master-Replicas architecture, but with the ability to perform read and write operations on the replicas. This is achieved by setting `replica.activeReplica=true`. Find more information about how this mechanism works at the [KeyDB documentation](https://docs.keydb.dev/docs/active-rep). + +#### Standalone + +When installing the chart with `architecture=standalone`, it will deploy a standalone KeyDB Master statefulset. A single service will be exposed: + +- KeyDB Master service: Points to the master, where read-write operations can be performed + +#### Multi Master - Replicas + +Similar to the Master-Replicas architecture, this architectures deploys both a KeyDB Master statefulset and a KeyDB Replica statefulset. However, in this architecture N Master replicas can be deployed, and KeyDB replicas are configured to follow multiple masters. This can be achieved by setting `master.replicaCount` to a value greater than 1 and setting `replica.activeReplica=true` (please note active replication is mandatory when using multi-master). + +Find more information about how this mechanism works at the [KeyDB documentation](https://docs.keydb.dev/docs/multi-master). + +### Using a password file + +To use a password file for KeyDB you need to create a secret containing the password and then deploy the chart using that secret. Follow these instructions: + +- Create the secret: + +```console +kubectl create secret generic keydb-password-secret --from-literal=keydb-password=KEYDB_PASSWORD +``` + +> Note: the replace the KEYDB_PASSWORD placeholder with the actual password to use. + +- Deploy the Helm Chart using the secret name as parameter: + +```text +auth.enabled=true +auth.existingSecret=keydb-password-secret +auth.existingSecretPasswordKey=keydb-password +auth.usePasswordFiles=true +``` + +### TLS + +This chart supports encrypting communications using TLS. To enable this feature, set the `tls.enabled`. + +It is necessary to create a secret containing the TLS certificates and pass it to the chart via the `tls.existingCASecret`, `tls.master.existingSecret` and `tls.replica.existingSecret` (only for replication architecture) parameters. Every secret should contain a `tls.crt` and `tls.key` keys including the certificate and key files respectively. For example: create the CA secret with the certificates files: + +```console +kubectl create secret generic ca-tls-secret --from-file=./tls.crt --from-file=./tls.key +``` + +You can manually create the required TLS certificates or relying on the chart auto-generation capabilities. The chart supports two different ways to auto-generate the required certificates: + +- Using Helm capabilities. Enable this feature by setting `tls.autoGenerated.enabled` to `true` and `tls.autoGenerated.engine` to `helm`. +- Relying on CertManager (please note it's required to have CertManager installed in your K8s cluster). Enable this feature by setting `tls.autoGenerated.enabled` to `true` and `tls.autoGenerated.engine` to `cert-manager`. Please note it's supported to use an existing Issuer/ClusterIssuer for issuing the TLS certificates by setting the `tls.autoGenerated.certManager.existingIssuer` and `tls.autoGenerated.certManager.existingIssuerKind` parameters. + +### Metrics + +The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). Metrics can be scraped from within the cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). If metrics are to be scraped from outside the cluster, the Kubernetes API proxy can be utilized to access the endpoint. + +If you have enabled TLS by specifying `tls.enabled=true` you also need to specify TLS options to the metrics exporter. You can do that via `metrics.extraArgs`. You can find the metrics exporter CLI flags for TLS [here](https://github.com/oliver006/redis_exporter#command-line-flags). For example: + +You can either specify `metrics.extraArgs.skip-tls-verification=true` to skip TLS verification or providing the following values under `metrics.extraArgs` for TLS client authentication: + +```console +tls-client-key-file +tls-client-cert-file +tls-ca-cert-file +``` + +### [Rolling VS Immutable tags](https://docs.vmware.com/en/VMware-Tanzu-Application-Catalog/services/tutorials/GUID-understand-rolling-tags-containers-index.html) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Resource requests and limits + +Bitnami charts allow setting resource requests and limits for all containers inside the chart deployment. These are inside the `resources` value (check parameter table). Setting requests is essential for production workloads and these should be adapted to your specific use case. + +To make this process easier, the chart contains the `resourcesPreset` values, which automatically sets the `resources` section according to different presets. Check these presets in [the bitnami/common chart](https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15). However, in production workloads using `resourcePreset` is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). + +### Additional environment variables + +In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property. + +```yaml +master: + extraEnvVars: + - name: LOG_LEVEL + value: error +``` + +Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values. + +### Sidecars + +If additional containers are needed in the same pod as KeyDB (such as additional metrics or logging exporters), they can be defined using the `sidecars` parameter. + +```yaml +master: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +If these sidecars export extra ports, extra port definitions can be added using the `service.extraPorts` parameter (where available), as shown in the example below: + +```yaml +master: + service: + extraPorts: + - name: extraPort + port: 11311 + targetPort: 11311 +``` + +> NOTE: This Helm chart already includes sidecar containers for the Prometheus exporters (where applicable). These can be activated by setting the `metrics.enabled` parameter to `true` at deployment time. The `sidecars` parameter should therefore only be used for any extra sidecar containers. + +If additional init containers are needed in the same pod, they can be defined using the `initContainers` parameter. Here is an example: + +```yaml +master: + initContainers: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +Learn more about [sidecar containers](https://kubernetes.io/docs/concepts/workloads/pods/) and [init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/). + +### Pod affinity + +This chart allows you to set your custom affinity using the `affinity` parameter. Find more information about Pod affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, use one of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters. + +## Persistence + +The [Bitnami KeyDB](https://github.com/bitnami/containers/tree/main/bitnami/keydb) image stores the KeyDB data and configurations at the `/bitnami/keydb/data` path of the container. Persistent Volume Claims are used to keep the data across deployments. + +If you encounter errors when working with persistent volumes, refer to our [troubleshooting guide for persistent volumes](https://docs.bitnami.com/kubernetes/faq/troubleshooting/troubleshooting-persistence-volumes/). + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | +| `global.keydb.password` | Global KeyDB password (overrides `auth.password`) | `""` | +| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.name | `""` | +| `fullnameOverride` | String to fully override common.names.fullname | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the chart release | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the chart release | `["infinity"]` | + +### KeyDB Image parameters + +| Name | Description | Value | +| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------- | +| `image.registry` | KeyDB image registry | `REGISTRY_NAME` | +| `image.repository` | KeyDB image repository | `REPOSITORY_NAME/keydb` | +| `image.digest` | KeyDB image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | +| `image.pullPolicy` | KeyDB image pull policy | `IfNotPresent` | +| `image.pullSecrets` | KeyDB image pull secrets | `[]` | +| `image.debug` | Enable KeyDB image debug mode | `false` | + +### KeyDB common configuration parameters + +| Name | Description | Value | +| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------- | +| `architecture` | KeyDB architecture. Allowed values: `standalone` or `replication` | `replication` | +| `auth.enabled` | Enable password authentication | `true` | +| `auth.password` | KeyDB password | `""` | +| `auth.existingSecret` | The name of an existing secret with KeyDB credentials | `""` | +| `auth.existingSecretPasswordKey` | Password key to be retrieved from existing secret | `""` | +| `auth.usePasswordFiles` | Mount credentials as files instead of using an environment variable | `false` | +| `tls.enabled` | Enable TLS communications | `false` | +| `tls.autoGenerated.enabled` | Enable automatic generation of certificates for TLS | `true` | +| `tls.autoGenerated.engine` | Mechanism to generate the certificates (allowed values: helm, cert-manager) | `helm` | +| `tls.autoGenerated.certManager.existingIssuer` | The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine) | `""` | +| `tls.autoGenerated.certManager.existingIssuerKind` | Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine) | `""` | +| `tls.autoGenerated.certManager.keyAlgorithm` | Key algorithm for the certificates (only for `cert-manager` engine) | `RSA` | +| `tls.autoGenerated.certManager.keySize` | Key size for the certificates (only for `cert-manager` engine) | `2048` | +| `tls.autoGenerated.certManager.duration` | Duration for the certificates (only for `cert-manager` engine) | `2160h` | +| `tls.autoGenerated.certManager.renewBefore` | Renewal period for the certificates (only for `cert-manager` engine) | `360h` | +| `tls.ca` | CA certificate for TLS. Ignored if `tls.existingCASecret` is set | `""` | +| `tls.existingCASecret` | The name of an existing Secret containing the CA certificate for TLS | `""` | +| `tls.master.cert` | TLS certificate for KeyDB master nodes. Ignored if `tls.master.existingSecret` is set | `""` | +| `tls.master.key` | TLS key for KeyDB master nodes. Ignored if `tls.master.existingSecret` is set | `""` | +| `tls.master.existingSecret` | The name of an existing Secret containing the KeyDB master nodes certificates for TLS | `""` | +| `tls.replica.cert` | TLS certificate for KeyDB replica nodes. Ignored if `tls.replica.existingSecret` is set | `""` | +| `tls.replica.key` | TLS key for KeyDB replica nodes. Ignored if `tls.replica.existingSecret` is set | `""` | +| `tls.replica.existingSecret` | The name of an existing Secret containing the KeyDB replica nodes certificates for TLS | `""` | +| `commonConfiguration` | Common configuration to be added to both master and replica nodes | `""` | + +### KeyDB Master Configuration Parameters + +| Name | Description | Value | +| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `master.replicaCount` | Number of KeyDB master replicas to deploy | `1` | +| `master.containerPorts.keydb` | Container port to open on KeyDB master nodes | `6379` | +| `master.extraContainerPorts` | Optionally specify extra list of additional ports for KeyDB master containers | `[]` | +| `master.livenessProbe.enabled` | Enable livenessProbe on KeyDB master containers | `true` | +| `master.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `master.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `master.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `master.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | +| `master.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `master.readinessProbe.enabled` | Enable readinessProbe on KeyDB master containers | `true` | +| `master.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `master.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `master.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `master.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | +| `master.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `master.startupProbe.enabled` | Enable startupProbe on KeyDB master containers | `false` | +| `master.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `20` | +| `master.startupProbe.periodSeconds` | Period seconds for startupProbe | `5` | +| `master.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `master.startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` | +| `master.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `master.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `master.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `master.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `master.resourcesPreset` | Set KeyDB master container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `nano` | +| `master.resources` | Set KeyDB master container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `master.podSecurityContext.enabled` | Enable KeyDB master pods' Security Context | `true` | +| `master.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for KeyDB master pods | `Always` | +| `master.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for KeyDB master pods | `[]` | +| `master.podSecurityContext.supplementalGroups` | Set filesystem extra groups for KeyDB master pods | `[]` | +| `master.podSecurityContext.fsGroup` | Set fsGroup in KeyDB master pods' Security Context | `1001` | +| `master.containerSecurityContext.enabled` | Enabled KeyDB master container' Security Context | `true` | +| `master.containerSecurityContext.seLinuxOptions` | Set SELinux options in KeyDB master container | `{}` | +| `master.containerSecurityContext.runAsUser` | Set runAsUser in KeyDB master container' Security Context | `1001` | +| `master.containerSecurityContext.runAsGroup` | Set runAsGroup in KeyDB master container' Security Context | `1001` | +| `master.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in KeyDB master container' Security Context | `true` | +| `master.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in KeyDB master container' Security Context | `true` | +| `master.containerSecurityContext.privileged` | Set privileged in KeyDB master container' Security Context | `false` | +| `master.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in KeyDB master container' Security Context | `false` | +| `master.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in KeyDB master container | `["ALL"]` | +| `master.containerSecurityContext.seccompProfile.type` | Set seccomp profile in KeyDB master container | `RuntimeDefault` | +| `master.configuration` | Exclusive configuration for KeyDB master nodes (appended to common one) | `""` | +| `master.existingConfigmap` | The name of an existing ConfigMap with your custom configuration for KeyDB master | `""` | +| `master.disableCommands` | Array with KeyDB commands to disable on master nodes | `["FLUSHDB","FLUSHALL"]` | +| `master.command` | Override default KeyDB master container command (useful when using custom images) | `[]` | +| `master.args` | Override default KeyDB master container args (useful when using custom images) | `[]` | +| `master.automountServiceAccountToken` | Mount Service Account token in KeyDB master pods | `false` | +| `master.hostAliases` | KeyDB master pods host aliases | `[]` | +| `master.statefulsetAnnotations` | Annotations for KeyDB master statefulset | `{}` | +| `master.podLabels` | Extra labels for KeyDB master pods | `{}` | +| `master.podAnnotations` | Annotations for KeyDB master pods | `{}` | +| `master.podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `master.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `master.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `master.nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set | `""` | +| `master.nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set | `[]` | +| `master.affinity` | Affinity for KeyDB master pods assignment | `{}` | +| `master.nodeSelector` | Node labels for KeyDB master pods assignment | `{}` | +| `master.tolerations` | Tolerations for KeyDB master pods assignment | `[]` | +| `master.updateStrategy.type` | KeyDB master strategy type | `RollingUpdate` | +| `master.priorityClassName` | KeyDB master pods' priorityClassName | `""` | +| `master.topologySpreadConstraints` | Topology Spread Constraints for KeyDB master pod assignment spread across your cluster among failure-domains | `[]` | +| `master.schedulerName` | Name of the k8s scheduler (other than default) for KeyDB master pods | `""` | +| `master.terminationGracePeriodSeconds` | Seconds KeyDB master pods need to terminate gracefully | `""` | +| `master.lifecycleHooks` | for KeyDB master containers to automate configuration before or after startup | `{}` | +| `master.extraEnvVars` | Array with extra environment variables to add to KeyDB master containers | `[]` | +| `master.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for KeyDB master containers | `""` | +| `master.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for KeyDB master containers | `""` | +| `master.extraVolumes` | Optionally specify extra list of additional volumes for the KeyDB master pods | `[]` | +| `master.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the KeyDB master containers | `[]` | +| `master.sidecars` | Add additional sidecar containers to the KeyDB master pods | `[]` | +| `master.initContainers` | Add additional init containers to the KeyDB master pods | `[]` | +| `master.pdb.create` | Enable/disable a Pod Disruption Budget creation for KeyDB master pods | `true` | +| `master.pdb.minAvailable` | Minimum number/percentage of KeyDB master pods that should remain scheduled | `""` | +| `master.pdb.maxUnavailable` | Maximum number/percentage of KeyDB master pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty. | `""` | +| `master.autoscaling.vpa.enabled` | Enable VPA for KeyDB master pods | `false` | +| `master.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `master.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `master.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `master.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `master.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | + +### KeyDB Master Persistence Parameters + +| Name | Description | Value | +| --------------------------------------------------------- | ---------------------------------------------------------------------------------- | --------------------- | +| `master.persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` | +| `master.persistence.mountPath` | Path to mount the data volume at on KeyDB master containers | `/bitnami/keydb/data` | +| `master.persistence.subPath` | The subdirectory of the volume to mount on KeyDB master containers | `""` | +| `master.persistence.medium` | Provide a medium for `emptyDir` volumes | `""` | +| `master.persistence.sizeLimit` | Set this to enable a size limit for `emptyDir` volumes | `""` | +| `master.persistence.storageClass` | Storage class of backing PVC | `""` | +| `master.persistence.annotations` | Additional Persistent Volume Claim annotations | `{}` | +| `master.persistence.accessModes` | Persistent Volume Access Modes | `["ReadWriteOnce"]` | +| `master.persistence.size` | Size of data volume | `8Gi` | +| `master.persistence.selector` | Selector to match an existing Persistent Volume for WordPress data PVC | `{}` | +| `master.persistence.dataSource` | Custom PVC data source | `{}` | +| `master.persistence.existingClaim` | The name of an existing PVC to use for persistence (only if master.replicaCount=1) | `""` | +| `master.persistentVolumeClaimRetentionPolicy.enabled` | Controls if and how PVCs are deleted during the lifecycle of a StatefulSet | `false` | +| `master.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `master.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### KeyDB Master Traffic Exposure Parameters + +| Name | Description | Value | +| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ----------- | +| `master.service.type` | KeyDB master service type | `ClusterIP` | +| `master.service.ports.keydb` | KeyDB master service port | `6379` | +| `master.service.nodePorts.keydb` | Node port for KeyDB master | `""` | +| `master.service.clusterIP` | KeyDB master service Cluster IP | `""` | +| `master.service.loadBalancerIP` | KeyDB master service Load Balancer IP | `""` | +| `master.service.loadBalancerSourceRanges` | KeyDB master service Load Balancer sources | `[]` | +| `master.service.externalTrafficPolicy` | KeyDB master service external traffic policy | `Cluster` | +| `master.service.annotations` | Additional custom annotations for KeyDB master service | `{}` | +| `master.service.extraPorts` | Extra ports to expose in KeyDB master service (normally used with the `sidecars` value) | `[]` | +| `master.service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | +| `master.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `master.service.headless.annotations` | Annotations for the headless service. | `{}` | +| `master.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created for KeyDB master | `true` | +| `master.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `master.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `master.networkPolicy.addExternalClientAccess` | Allow access from pods with client label set to "true". Ignored if `networkPolicy.allowExternal` is true. | `true` | +| `master.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `master.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `master.networkPolicy.ingressPodMatchLabels` | Labels to match to allow traffic from other pods. Ignored if `networkPolicy.allowExternal` is true. | `{}` | +| `master.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. | `{}` | +| `master.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. | `{}` | + +### KeyDB Replicas Configuration Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `replica.replicaCount` | Number of KeyDB replicas to deploy | `1` | +| `replica.containerPorts.keydb` | Container port to open on KeyDB replicas nodes | `6379` | +| `replica.extraContainerPorts` | Optionally specify extra list of additional ports for KeyDB replicas containers | `[]` | +| `replica.livenessProbe.enabled` | Enable livenessProbe on KeyDB replicas containers | `true` | +| `replica.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | +| `replica.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `replica.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `replica.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | +| `replica.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `replica.readinessProbe.enabled` | Enable readinessProbe on KeyDB replicas containers | `true` | +| `replica.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | +| `replica.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `replica.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `replica.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | +| `replica.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `replica.startupProbe.enabled` | Enable startupProbe on KeyDB replicas containers | `false` | +| `replica.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `20` | +| `replica.startupProbe.periodSeconds` | Period seconds for startupProbe | `5` | +| `replica.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `replica.startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` | +| `replica.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `replica.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `replica.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `replica.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `replica.resourcesPreset` | Set KeyDB replicas container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `nano` | +| `replica.resources` | Set KeyDB replicas container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `replica.podSecurityContext.enabled` | Enable KeyDB replicas pods' Security Context | `true` | +| `replica.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for KeyDB replicas pods | `Always` | +| `replica.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for KeyDB replicas pods | `[]` | +| `replica.podSecurityContext.supplementalGroups` | Set filesystem extra groups for KeyDB replicas pods | `[]` | +| `replica.podSecurityContext.fsGroup` | Set fsGroup in KeyDB replicas pods' Security Context | `1001` | +| `replica.containerSecurityContext.enabled` | Enabled KeyDB replicas container' Security Context | `true` | +| `replica.containerSecurityContext.seLinuxOptions` | Set SELinux options in KeyDB replicas container | `{}` | +| `replica.containerSecurityContext.runAsUser` | Set runAsUser in KeyDB replicas container' Security Context | `1001` | +| `replica.containerSecurityContext.runAsGroup` | Set runAsGroup in KeyDB replicas container' Security Context | `1001` | +| `replica.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in KeyDB replicas container' Security Context | `true` | +| `replica.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in KeyDB replicas container' Security Context | `true` | +| `replica.containerSecurityContext.privileged` | Set privileged in KeyDB replicas container' Security Context | `false` | +| `replica.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in KeyDB replicas container' Security Context | `false` | +| `replica.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in KeyDB replicas container | `["ALL"]` | +| `replica.containerSecurityContext.seccompProfile.type` | Set seccomp profile in KeyDB replicas container | `RuntimeDefault` | +| `replica.activeReplica` | Configure replica as an active replica | `false` | +| `replica.configuration` | Exclusive configuration for KeyDB replicas nodes (appended to common one) | `""` | +| `replica.existingConfigmap` | The name of an existing ConfigMap with your custom configuration for KeyDB replicas | `""` | +| `replica.disableCommands` | Array with KeyDB commands to disable on master nodes | `["FLUSHDB","FLUSHALL"]` | +| `replica.command` | Override default KeyDB replicas container command (useful when using custom images) | `[]` | +| `replica.args` | Override default KeyDB replicas container args (useful when using custom images) | `[]` | +| `replica.automountServiceAccountToken` | Mount Service Account token in KeyDB replicas pods | `false` | +| `replica.hostAliases` | KeyDB replicas pods host aliases | `[]` | +| `replica.statefulsetAnnotations` | Annotations for KeyDB replicas statefulset | `{}` | +| `replica.podLabels` | Extra labels for KeyDB replicas pods | `{}` | +| `replica.podAnnotations` | Annotations for KeyDB replicas pods | `{}` | +| `replica.podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `replica.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `replica.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `replica.nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set | `""` | +| `replica.nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set | `[]` | +| `replica.affinity` | Affinity for KeyDB replicas pods assignment | `{}` | +| `replica.nodeSelector` | Node labels for KeyDB replicas pods assignment | `{}` | +| `replica.tolerations` | Tolerations for KeyDB replicas pods assignment | `[]` | +| `replica.updateStrategy.type` | KeyDB replicas strategy type | `RollingUpdate` | +| `replica.priorityClassName` | KeyDB replicas pods' priorityClassName | `""` | +| `replica.topologySpreadConstraints` | Topology Spread Constraints for KeyDB replicas pod assignment spread across your cluster among failure-domains | `[]` | +| `replica.schedulerName` | Name of the k8s scheduler (other than default) for KeyDB replicas pods | `""` | +| `replica.terminationGracePeriodSeconds` | Seconds KeyDB replicas pods need to terminate gracefully | `""` | +| `replica.lifecycleHooks` | for KeyDB replicas containers to automate configuration before or after startup | `{}` | +| `replica.extraEnvVars` | Array with extra environment variables to add to KeyDB replicas containers | `[]` | +| `replica.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for KeyDB replicas containers | `""` | +| `replica.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for KeyDB replicas containers | `""` | +| `replica.extraVolumes` | Optionally specify extra list of additional volumes for the KeyDB replicas pods | `[]` | +| `replica.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the KeyDB replicas containers | `[]` | +| `replica.sidecars` | Add additional sidecar containers to the KeyDB replicas pods | `[]` | +| `replica.initContainers` | Add additional init containers to the KeyDB replicas pods | `[]` | +| `replica.pdb.create` | Enable/disable a Pod Disruption Budget creation for KeyDB replicas pods | `true` | +| `replica.pdb.minAvailable` | Minimum number/percentage of KeyDB replicas pods that should remain scheduled | `""` | +| `replica.pdb.maxUnavailable` | Maximum number/percentage of KeyDB replicas pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty. | `""` | +| `replica.autoscaling.vpa.enabled` | Enable VPA for KeyDB replicas pods | `false` | +| `replica.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` | +| `replica.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` | +| `replica.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` | +| `replica.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` | +| `replica.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` | +| `replica.autoscaling.hpa.enabled` | Enable HPA for KeyDB Replicas pods | `false` | +| `replica.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` | +| `replica.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` | +| `replica.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` | +| `replica.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` | + +### KeyDB Replicas Persistence Parameters + +| Name | Description | Value | +| ---------------------------------------------------------- | ----------------------------------------------------------------------------------- | --------------------- | +| `replica.persistence.enabled` | Enable persistence using Persistent Volume Claims | `true` | +| `replica.persistence.mountPath` | Path to mount the data volume at on KeyDB replicas containers | `/bitnami/keydb/data` | +| `replica.persistence.subPath` | The subdirectory of the volume to mount on KeyDB replicas containers | `""` | +| `replica.persistence.medium` | Provide a medium for `emptyDir` volumes | `""` | +| `replica.persistence.sizeLimit` | Set this to enable a size limit for `emptyDir` volumes | `""` | +| `replica.persistence.storageClass` | Storage class of backing PVC | `""` | +| `replica.persistence.annotations` | Additional Persistent Volume Claim annotations | `{}` | +| `replica.persistence.accessModes` | Persistent Volume Access Modes | `["ReadWriteOnce"]` | +| `replica.persistence.size` | Size of data volume | `8Gi` | +| `replica.persistence.selector` | Selector to match an existing Persistent Volume for WordPress data PVC | `{}` | +| `replica.persistence.dataSource` | Custom PVC data source | `{}` | +| `replica.persistence.existingClaim` | The name of an existing PVC to use for persistence (only if replica.replicaCount=1) | `""` | +| `replica.persistentVolumeClaimRetentionPolicy.enabled` | Controls if and how PVCs are deleted during the lifecycle of a StatefulSet | `false` | +| `replica.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `replica.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### KeyDB Replicas Traffic Exposure Parameters + +| Name | Description | Value | +| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ----------- | +| `replica.service.type` | KeyDB replicas service type | `ClusterIP` | +| `replica.service.ports.keydb` | KeyDB replicas service port | `6379` | +| `replica.service.nodePorts.keydb` | Node port for KeyDB replicas | `""` | +| `replica.service.clusterIP` | KeyDB replicas service Cluster IP | `""` | +| `replica.service.loadBalancerIP` | KeyDB replicas service Load Balancer IP | `""` | +| `replica.service.loadBalancerSourceRanges` | KeyDB replicas service Load Balancer sources | `[]` | +| `replica.service.externalTrafficPolicy` | KeyDB replicas service external traffic policy | `Cluster` | +| `replica.service.annotations` | Additional custom annotations for KeyDB replicas service | `{}` | +| `replica.service.extraPorts` | Extra ports to expose in KeyDB replicas service (normally used with the `sidecars` value) | `[]` | +| `replica.service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | +| `replica.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `replica.service.headless.annotations` | Annotations for the headless service. | `{}` | +| `replica.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created for KeyDB replicas | `true` | +| `replica.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `replica.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `replica.networkPolicy.addExternalClientAccess` | Allow access from pods with client label set to "true". Ignored if `networkPolicy.allowExternal` is true. | `true` | +| `replica.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `replica.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `replica.networkPolicy.ingressPodMatchLabels` | Labels to match to allow traffic from other pods. Ignored if `networkPolicy.allowExternal` is true. | `{}` | +| `replica.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. | `{}` | +| `replica.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. | `{}` | + +### Metrics Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | +| `metrics.enabled` | Start a sidecar Prometheus exporter to expose KeyDB metrics | `false` | +| `metrics.image.registry` | Redis Exporter image registry | `REGISTRY_NAME` | +| `metrics.image.repository` | Redis Exporter image repository | `REPOSITORY_NAME/redis-exporter` | +| `metrics.image.digest` | Redis Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `metrics.image.pullPolicy` | Redis Exporter image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Redis Exporter image pull secrets | `[]` | +| `metrics.containerPorts.http` | Metrics HTTP container port | `9121` | +| `metrics.startupProbe.enabled` | Enable startupProbe on KeyDB replicas nodes | `false` | +| `metrics.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `metrics.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `metrics.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `metrics.startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` | +| `metrics.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `metrics.livenessProbe.enabled` | Enable livenessProbe on KeyDB replicas nodes | `true` | +| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | +| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `metrics.readinessProbe.enabled` | Enable readinessProbe on KeyDB replicas nodes | `true` | +| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `metrics.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `metrics.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `metrics.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `metrics.command` | Override default metrics container init command (useful when using custom images) | `[]` | +| `metrics.keydbHost` | A way to specify an alternative KeyDB hostname | `localhost` | +| `metrics.extraArgs` | Extra arguments for KeyDB metrics exporter, for example: | `{}` | +| `metrics.extraEnvVars` | Array with extra environment variables to add to KeyDB metrics exporter | `[]` | +| `metrics.containerSecurityContext.enabled` | Enabled KeyDB metrics exporter containers' Security Context | `true` | +| `metrics.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `metrics.containerSecurityContext.runAsUser` | Set KeyDB metrics exporter containers' Security Context runAsUser | `1001` | +| `metrics.containerSecurityContext.runAsGroup` | Set KeyDB metrics exporter containers' Security Context runAsGroup | `1001` | +| `metrics.containerSecurityContext.runAsNonRoot` | Set KeyDB metrics exporter containers' Security Context runAsNonRoot | `true` | +| `metrics.containerSecurityContext.allowPrivilegeEscalation` | Set KeyDB metrics exporter containers' Security Context allowPrivilegeEscalation | `false` | +| `metrics.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context read-only root filesystem | `true` | +| `metrics.containerSecurityContext.seccompProfile.type` | Set KeyDB metrics exporter containers' Security Context seccompProfile | `RuntimeDefault` | +| `metrics.containerSecurityContext.capabilities.drop` | Set KeyDB metrics exporter containers' Security Context capabilities to drop | `["ALL"]` | +| `metrics.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the KeyDB metrics sidecar | `[]` | +| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` | +| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `metrics.podLabels` | Extra labels for KeyDB metrics exporter pods | `{}` | +| `metrics.podAnnotations` | Annotations for KeyDB metrics exporter pods | `{}` | +| `metrics.service.port` | Metrics service port | `9121` | +| `metrics.service.annotations` | Annotations for the metrics service | `{}` | +| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | +| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `""` | +| `metrics.serviceMonitor.annotations` | Additional custom annotations for the ServiceMonitor | `{}` | +| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | +| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` | +| `metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels | `false` | +| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` | +| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | +| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | +| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | +| `metrics.prometheusRule.enabled` | Create a custom prometheusRule Resource for scraping metrics using PrometheusOperator | `false` | +| `metrics.prometheusRule.namespace` | The namespace in which the prometheusRule will be created | `""` | +| `metrics.prometheusRule.annotations` | Additional custom annotations for the prometheusRule | `{}` | +| `metrics.prometheusRule.labels` | Extra labels for the prometheusRule | `{}` | +| `metrics.prometheusRule.rules` | Custom Prometheus rules | `[]` | + +### Other Parameters + +| Name | Description | Value | +| --------------------------------------------- | ---------------------------------------------------------------------------- | ------ | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created for KeyDB replicas pods | `true` | +| `serviceAccount.name` | The name of the ServiceAccount to use | `""` | +| `serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | +| `serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | + +### Init Container Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | +| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | OS Shell + Utility image registry | `REGISTRY_NAME` | +| `volumePermissions.image.repository` | OS Shell + Utility image repository | `REPOSITORY_NAME/os-shell` | +| `volumePermissions.image.pullPolicy` | OS Shell + Utility image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | OS Shell + Utility image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.enabled` | Enabled init container' Security Context | `true` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in init container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | + +The above parameters map to the env variables defined in [bitnami/keydb](https://github.com/bitnami/containers/tree/main/bitnami/keydb). For more information please refer to the [bitnami/keydb](https://github.com/bitnami/containers/tree/main/bitnami/keydb) image documentation. + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +helm install my-release \ + --set auth.enabled=true \ + --set auth.password=secretpassword \ + oci://REGISTRY_NAME/REPOSITORY_NAME/keydb +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The above command sets the KeyDB server password to `secretpassword`. + +> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```console +helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/keydb +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. +> **Tip**: You can use the default [values.yaml](https://github.com/bitnami/charts/tree/main/bitnami/keydb/values.yaml) + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## License + +Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/bitnami/keydb/templates/NOTES.txt b/bitnami/keydb/templates/NOTES.txt new file mode 100644 index 00000000000000..17f8baad5bbe05 --- /dev/null +++ b/bitnami/keydb/templates/NOTES.txt @@ -0,0 +1,163 @@ +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +** Please be patient while the chart is being deployed ** + +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ include "common.names.namespace" . | quote }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ include "common.names.namespace" . | quote }} -ti -- bash + +In order to replicate the container startup scripts execute this command: + + keydb-server /opt/bitnami/keydb/etc/keydb.conf + +{{- else }} + +{{- if contains .Values.master.service.type "LoadBalancer" }} +{{- if not .Values.auth.enabled }} +{{- if or (not .Values.master.networkPolicy.enabled) (and .Values.master.networkPolicy.enabled .Values.master.networkPolicy.allowExternal) }} + +------------------------------------------------------------------------------- + WARNING + + By specifying "master.service.type=LoadBalancer" and "auth.enabled=false" you have + most likely exposed the KeyDB service externally without any authentication + mechanism. + + For security reasons, we strongly suggest that you switch to "ClusterIP" or + "NodePort". As alternative, you can also switch to "auth.enabled=true" + providing a valid password on "password" parameter. + +------------------------------------------------------------------------------- +{{- end }} +{{- end }} +{{- end }} + +{{- if eq .Values.architecture "replication" }} + +KeyDB can be accessed on the following DNS names from within your cluster: + + {{ printf "%s.%s.svc.%s" (include "keydb.master.fullname" .) (include "common.names.namespace" . ) .Values.clusterDomain }} (port {{ .Values.master.service.ports.keydb }}) + {{ printf "%s.%s.svc.%s" (include "keydb.replica.fullname" .) (include "common.names.namespace" . ) .Values.clusterDomain }} (port {{ .Values.replica.service.ports.keydb }}){{ if not .Values.replica.activeReplica }} only for read operations{{ end }} + +{{- else }} + +KeyDB can be accessed via port {{ .Values.master.service.ports.keydb }} on the following DNS name from within your cluster: + + {{ include "keydb.master.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }} + +{{- end }} + +{{ if .Values.auth.enabled }} + +To get your password run: + + export KEYDB_PASSWORD=$(kubectl get secret --namespace {{ include "common.names.namespace" . }} {{ include "keydb.secretName" . }} -o jsonpath="{.data.{{ include "keydb.secretPasswordKey" . }}}" | base64 -d) + +{{- end }} + +To connect to your KeyDB server: + +1. Run a KeyDB pod that you can use as a client: + + kubectl run --namespace {{ include "common.names.namespace" . }} keydb-client --restart='Never' {{ if .Values.auth.enabled }} --env KEYDB_PASSWORD=$KEYDB_PASSWORD {{ end }} --image {{ template "keydb.image" . }} --command -- sleep infinity + +{{- if .Values.tls.enabled }} + + Copy your TLS certificates to the client pod: + + kubectl cp --namespace {{ include "common.names.namespace" . }} /path/to/client.cert keydb-client:/tmp/client.cert + kubectl cp --namespace {{ include "common.names.namespace" . }} /path/to/client.key keydb-client:/tmp/client.key + kubectl cp --namespace {{ include "common.names.namespace" . }} /path/to/CA.cert keydb-client:/tmp/CA.cert + +{{- end }} + + Use the following command to attach to the client pod: + + kubectl exec --tty -i keydb-client \ + {{- if and .Values.master.networkPolicy.enabled (not .Values.master.networkPolicy.allowExternal) }}--labels="{{ template "common.names.fullname" . }}-client=true" \{{- end }} + --namespace {{ include "common.names.namespace" . }} -- bash + +2. Connect using the KeyDB CLI: + +{{- if eq .Values.architecture "replication" }} + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h {{ include "keydb.master.fullname" . }} -p {{ .Values.master.service.ports.keydb }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h {{ include "keydb.replica.fullname" . }} -p {{ .Values.replica.service.ports.keydb }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} +{{- else }} + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h {{ include "keydb.master.fullname" . }} -p {{ .Values.master.service.ports.keydb }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} +{{- end }} + +{{- if and .Values.master.networkPolicy.enabled (not .Values.master.networkPolicy.allowExternal) }} + +Note: Since NetworkPolicy is enabled, only pods with label {{ template "common.names.fullname" . }}-client=true" will be able to connect to KeyDB. + +{{- else }} + +To connect to your Master nodes from outside the cluster execute the following commands: + +{{- if contains "NodePort" .Values.master.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "keydb.master.fullname" . }}) + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "LoadBalancer" .Values.master.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ include "common.names.namespace" . }} -w {{ include "keydb.master.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ include "keydb.master.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h $SERVICE_IP -p {{ .Values.master.service.ports.keydb }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "ClusterIP" .Values.master.service.type }} + + kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "keydb.master.fullname" . }} {{ .Values.master.service.ports.keydb }}:{{ .Values.master.service.ports.keydb }} & + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h 127.0.0.1 -p {{ .Values.master.service.ports.keydb }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- end }} + +{{- if eq .Values.architecture "replication" }} + +To connect to your Replica nodes from outside the cluster execute the following commands: + +{{- if contains "NodePort" .Values.replica.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "keydb.replica.fullname" . }}) + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "LoadBalancer" .Values.replica.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ include "common.names.namespace" . }} -w {{ include "keydb.replica.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ include "keydb.replica.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h $SERVICE_IP -p {{ .Values.replica.service.ports.keydb }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "ClusterIP" .Values.replica.service.type }} + + kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "keydb.replica.fullname" . }} {{ .Values.replica.service.ports.keydb }}:{{ .Values.replica.service.ports.keydb }} & + {{ if .Values.auth.enabled }}REDISCLI_AUTH="$KEYDB_PASSWORD" {{ end }}keydb-cli -h 127.0.0.1 -p {{ .Values.replica.service.ports.keydb }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- include "common.warnings.rollingTag" .Values.image }} +{{- include "common.warnings.rollingTag" .Values.metrics.image }} +{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} +{{- include "keydb.validateValues" . }} +{{- include "common.warnings.resources" (dict "sections" (list "master" "replica" "metrics" "volumePermissions") "context" $) }} +{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image) "context" $) }} diff --git a/bitnami/keydb/templates/_helpers.tpl b/bitnami/keydb/templates/_helpers.tpl new file mode 100644 index 00000000000000..f5462a436b74af --- /dev/null +++ b/bitnami/keydb/templates/_helpers.tpl @@ -0,0 +1,213 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* +Return the proper KeyDB Master fullname +*/}} +{{- define "keydb.master.fullname" -}} +{{- printf "%s-master" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper KeyDB Replicas fullname +*/}} +{{- define "keydb.replica.fullname" -}} +{{- printf "%s-replica" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper KeyDB image name +*/}} +{{- define "keydb.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper KeyDB metrics exporter name +*/}} +{{- define "keydb.metrics.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.metrics.image "global" .Values.global ) -}} +{{- end -}} + + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "keydb.volumePermissions.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "keydb.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image) "context" $) -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "keydb.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the name of the configmap with KeyDB master configuration +*/}} +{{- define "keydb.master.configmapName" -}} +{{- if .Values.master.existingConfigmap -}} + {{- print (tpl .Values.master.existingConfigmap $) -}} +{{- else -}} + {{- printf "%s-config" (include "keydb.master.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the name of the configmap with KeyDB replica configuration +*/}} +{{- define "keydb.replica.configmapName" -}} +{{- if .Values.replica.existingConfigmap -}} + {{- print (tpl .Values.replica.existingConfigmap $) -}} +{{- else -}} + {{- printf "%s-config" (include "keydb.replica.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the name of the secret with KeyDB credentials +*/}} +{{- define "keydb.secretName" -}} +{{- if .Values.auth.existingSecret -}} + {{- print (tpl .Values.auth.existingSecret $) -}} +{{- else -}} + {{- print (include "common.names.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the password key to be retrieved from KeyDB secret +*/}} +{{- define "keydb.secretPasswordKey" -}} +{{- if and .Values.auth.existingSecret .Values.auth.existingSecretPasswordKey -}} + {{- print (tpl .Values.auth.existingSecretPasswordKey $) -}} +{{- else -}} + {{- print "keydb-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the name of the secret containing the TLS certificates for KeyDB master nodes +*/}} +{{- define "keydb.tls.master.secretName" -}} +{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.master.cert)) (not (empty .Values.tls.master.key))) -}} + {{- printf "%s-crt" (include "keydb.master.fullname" .) -}} +{{- else -}} + {{- required "An existing secret name must be provided with TLS certs for KeyDB master if cert and key are not provided!" (tpl .Values.tls.master.existingSecret .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the name of the secret containing the TLS certificates for KeyDB replica nodes +*/}} +{{- define "keydb.tls.replica.secretName" -}} +{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.replica.cert)) (not (empty .Values.tls.replica.key))) -}} + {{- printf "%s-crt" (include "keydb.replica.fullname" .) -}} +{{- else -}} + {{- required "An existing secret name must be provided with TLS certs for KeyDB replica if cert and key are not provided!" (tpl .Values.tls.replica.existingSecret .) -}} +{{- end -}} +{{- end -}} + +{{/* +Compile all warnings into a single message. +*/}} +{{- define "keydb.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "keydb.validateValues.architecture" .) -}} +{{- $messages := append $messages (include "keydb.validateValues.master.replicaCount" .) -}} +{{- $messages := append $messages (include "keydb.validateValues.replica.replicaCount" .) -}} +{{- $messages := append $messages (include "keydb.validateValues.tls" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message -}} +{{- end -}} +{{- end -}} + +{{/* +Validate values of KeyDB - must provide a valid architecture +*/}} +{{- define "keydb.validateValues.architecture" -}} +{{- if and (ne .Values.architecture "standalone") (ne .Values.architecture "replication") -}} +architecture + Invalid architecture selected. Valid values are "standalone" and + "replication". Please set a valid architecture (--set architecture="xxxx") +{{- end -}} +{{- end -}} + +{{/* +Validate values of KeyDB - number of Master replicas +*/}} +{{- define "keydb.validateValues.master.replicaCount" -}} +{{- $masterReplicaCount := int .Values.master.replicaCount }} +{{- $replicaReplicaCount := int .Values.replica.replicaCount }} +{{- if and .Values.master.persistence.enabled .Values.master.persistence.existingClaim (gt $masterReplicaCount 1) -}} +master.replicaCount + A single existing PVC cannot be shared between multiple Master replicas. + Please set a valid number of replicas (--set master.replicaCount=1), disable persistence + (--set master.persistence.enabled=false) or rely on dynamic provisioning via Persistent + Volume Claims (--set master.persistence.existingClaim=""). +{{- end -}} +{{- if and (eq .Values.architecture "replication") (gt $masterReplicaCount 1) (gt $replicaReplicaCount 0) (not .Values.replica.activeReplica) -}} +master.replicaCount + Multipe Master replicas are only supported when replicas are configured as active replicas. + Please set a valid number of replicas (--set master.replicaCount=1), set replicas as active + (--set replica.activeReplica=true) or disable replication (--set architecture="standalone"). +{{- end -}} +{{- end -}} + +{{/* +Validate values of KeyDB - number of Replicas +*/}} +{{- define "keydb.validateValues.replica.replicaCount" -}} +{{- $replicaReplicaCount := int .Values.replica.replicaCount }} +{{- if and .Values.replica.persistence.enabled .Values.replica.persistence.existingClaim (or (gt $replicaReplicaCount 1) .Values.replica.autoscaling.hpa.enabled) -}} +replica.replicaCount + A single existing PVC cannot be shared between multiple Replicas. + Please set a valid number of replicas (--set replica.replicaCount=1), + disable HPA (--set replica.autoscaling.hpa.enabled=false), disable persistence + (--set replica.persistence.enabled=false) or rely on dynamic provisioning via Persistent + Volume Claims (--set replica.persistence.existingClaim=""). +{{- end -}} +{{- end -}} + +{{/* +Validate values of KeyDB - TLS +*/}} +{{- define "keydb.validateValues.tls" -}} +{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled -}} +{{- if or (not (empty .Values.tls.ca)) (not (empty .Values.tls.master.cert)) (not (empty .Values.tls.master.key)) (not (empty .Values.tls.replica.cert)) (not (empty .Values.tls.replica.key)) -}} +tls.autoGenerated + When enabling auto-generated TLS certificates, all certificate and key fields must be empty. + Please disable auto-generated TLS certificates (--set tls.autoGenerated.enabled=false) or + remove the certificate and key fields. +{{- end -}} +{{- if or (not (empty .Values.tls.existingCASecret) ) (not (empty .Values.tls.master.existingSecret)) (not (empty .Values.tls.replica.existingSecret)) -}} +tls.autoGenerated + When enabling auto-generated TLS certificates, all existing secret fields must be empty. + Please disable auto-generated TLS certificates (--set tls.autoGenerated.enabled=false) or + remove the existing secret fields. +{{- end -}} +{{- if and (ne .Values.tls.autoGenerated.engine "helm") (ne .Values.tls.autoGenerated.engine "cert-manager") -}} +tls.autoGenerated.engine + Invalid mechanism to generate the TLS certificates selected. Valid values are "helm" and + "cert-manager". Please set a valid one (--set tls.autoGenerated.engine="xxx") +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/keydb/templates/ca-cert.yaml b/bitnami/keydb/templates/ca-cert.yaml new file mode 100644 index 00000000000000..ff2f2983c63abc --- /dev/null +++ b/bitnami/keydb/templates/ca-cert.yaml @@ -0,0 +1,53 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") }} +{{- if empty .Values.tls.autoGenerated.certManager.existingIssuer }} +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ printf "%s-clusterissuer" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + selfSigned: {} +--- +{{- end }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + secretName: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }} + commonName: {{ printf "%s-root-ca" (include "common.names.fullname" .) }} + isCA: true + issuerRef: + name: {{ default (printf "%s-clusterissuer" (include "common.names.fullname" .)) .Values.tls.autoGenerated.certManager.existingIssuer }} + kind: {{ default "Issuer" .Values.tls.autoGenerated.certManager.existingIssuerKind }} +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + ca: + secretName: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }} +{{- end }} diff --git a/bitnami/keydb/templates/extra-list.yaml b/bitnami/keydb/templates/extra-list.yaml new file mode 100644 index 00000000000000..329f5c653a440f --- /dev/null +++ b/bitnami/keydb/templates/extra-list.yaml @@ -0,0 +1,9 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/bitnami/keydb/templates/health-configmap.yaml b/bitnami/keydb/templates/health-configmap.yaml new file mode 100644 index 00000000000000..9c0efaa6c90df6 --- /dev/null +++ b/bitnami/keydb/templates/health-configmap.yaml @@ -0,0 +1,156 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-health" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + ping_readiness_local.sh: |- + #!/bin/bash + + . /opt/bitnami/scripts/keydb-env.sh + . /opt/bitnami/scripts/liblog.sh + + response=$( + timeout -s 15 $1 \ + keydb-cli \ + -h localhost \ + {{- if .Values.auth.enabled }} + -a "$KEYDB_PASSWORD" \ + {{- end }} + {{- if .Values.tls.enabled }} + --tls \ + --cacert /opt/bitnami/keydb/certs/ca.crt \ + --cert /opt/bitnami/keydb/certs/tls.crt \ + --key /opt/bitnami/keydb/certs/tls.key \ + {{- end }} + -p $KEYDB_PORT_NUMBER \ + ping + ) + if [[ "$?" -eq "124" ]]; then + error "Timed out" + exit 1 + fi + if [[ "$response" != "PONG" ]]; then + error "$response" + exit 1 + fi + ping_liveness_local.sh: |- + #!/bin/bash + + . /opt/bitnami/scripts/keydb-env.sh + . /opt/bitnami/scripts/liblog.sh + + response=$( + timeout -s 15 $1 \ + keydb-cli \ + -h localhost \ + {{- if .Values.auth.enabled }} + -a "$KEYDB_PASSWORD" \ + {{- end }} + {{- if .Values.tls.enabled }} + --tls \ + --cacert /opt/bitnami/keydb/certs/ca.crt \ + --cert /opt/bitnami/keydb/certs/tls.crt \ + --key /opt/bitnami/keydb/certs/tls.key \ + {{- end }} + -p $KEYDB_PORT_NUMBER \ + ping + ) + if [[ "$?" -eq "124" ]]; then + error "Timed out" + exit 1 + fi + responseFirstWord="$(echo "$response" | head -n1 | awk '{print $1;}')" + if [[ "$response" != "PONG" ]] && [[ "$responseFirstWord" != "LOADING" ]] && [[ "$responseFirstWord" != "MASTERDOWN" ]]; then + error "$response" + exit 1 + fi +{{- if eq .Values.architecture "replication" }} + ping_readiness_master.sh: |- + #!/bin/bash + + . /opt/bitnami/scripts/keydb-env.sh + . /opt/bitnami/scripts/liblog.sh + + response=$( + timeout -s 15 $1 \ + keydb-cli \ + -h {{ include "keydb.master.fullname" . }} \ + -p {{ .Values.master.service.ports.keydb }} \ + {{- if .Values.auth.enabled }} + -a "$KEYDB_MASTER_PASSWORD" \ + {{- end }} + {{- if .Values.tls.enabled }} + --tls \ + --cacert /opt/bitnami/keydb/certs/ca.crt \ + --cert /opt/bitnami/keydb/certs/tls.crt \ + --key /opt/bitnami/keydb/certs/tls.key \ + {{- end }} + ping + ) + if [[ "$?" -eq "124" ]]; then + error "Timed out" + exit 1 + fi + if [[ "$response" != "PONG" ]]; then + error "$response" + exit 1 + fi + ping_liveness_master.sh: |- + #!/bin/bash + + . /opt/bitnami/scripts/keydb-env.sh + . /opt/bitnami/scripts/liblog.sh + + response=$( + timeout -s 15 $1 \ + keydb-cli \ + -h {{ include "keydb.master.fullname" . }} \ + -p {{ .Values.master.service.ports.keydb }} \ + {{- if .Values.auth.enabled }} + -a "$KEYDB_MASTER_PASSWORD" \ + {{- end }} + {{- if .Values.tls.enabled }} + --tls \ + --cacert /opt/bitnami/keydb/certs/ca.crt \ + --cert /opt/bitnami/keydb/certs/tls.crt \ + --key /opt/bitnami/keydb/certs/tls.key \ + {{- end }} + ping + ) + if [[ "$?" -eq "124" ]]; then + error "Timed out" + exit 1 + fi + responseFirstWord="$(echo "$response" | head -n1 | awk '{print $1;}')" + if [[ "$response" != "PONG" ]] && [[ "$responseFirstWord" != "LOADING" ]]; then + error "$response" + exit 1 + fi + ping_readiness_local_and_master.sh: |- + #!/bin/bash + + script_dir="$(dirname "$0")" + exit_status=0 + "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? + "$script_dir/ping_readiness_master.sh" $1 || exit_status=$? + exit $exit_status + ping_liveness_local_and_master.sh: |- + #!/bin/bash + + script_dir="$(dirname "$0")" + exit_status=0 + "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? + "$script_dir/ping_liveness_master.sh" $1 || exit_status=$? + exit $exit_status +{{- end }} diff --git a/bitnami/keydb/templates/master/cert.yaml b/bitnami/keydb/templates/master/cert.yaml new file mode 100644 index 00000000000000..3684b4334e74f3 --- /dev/null +++ b/bitnami/keydb/templates/master/cert.yaml @@ -0,0 +1,44 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ printf "%s-crt" (include "keydb.master.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + secretName: {{ template "keydb.tls.master.secretName" . }} + commonName: {{ printf "%s.%s.svc.%s" (include "keydb.master.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain }} + issuerRef: + name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }} + kind: Issuer + subject: + organizations: + - "KeyDB" + dnsNames: + - '*.{{ include "common.names.namespace" . }}' + - '*.{{ include "common.names.namespace" . }}.svc' + - '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}' + - '*.{{ include "keydb.master.fullname" . }}' + - '*.{{ include "keydb.master.fullname" . }}.{{ include "common.names.namespace" . }}' + - '*.{{ include "keydb.master.fullname" . }}.{{ include "common.names.namespace" . }}.svc' + - '*.{{ include "keydb.master.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}' + - '*.{{ printf "%s-hl" (include "keydb.master.fullname" .) }}' + - '*.{{ printf "%s-hl" (include "keydb.master.fullname" .) }}.{{ include "common.names.namespace" . }}' + - '*.{{ printf "%s-hl" (include "keydb.master.fullname" .) }}.{{ include "common.names.namespace" . }}.svc' + - '*.{{ printf "%s-hl" (include "keydb.master.fullname" .) }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}' + privateKey: + algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }} + size: {{ int .Values.tls.autoGenerated.certManager.keySize }} + duration: {{ .Values.tls.autoGenerated.certManager.duration }} + renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }} +{{- end }} diff --git a/bitnami/keydb/templates/master/configmap.yaml b/bitnami/keydb/templates/master/configmap.yaml new file mode 100644 index 00000000000000..f01fedd8598d5b --- /dev/null +++ b/bitnami/keydb/templates/master/configmap.yaml @@ -0,0 +1,54 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if not .Values.master.existingConfigmap }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "keydb.master.configmapName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + keydb.conf: |- + {{- if .Values.commonConfiguration }} + {{- include "common.tplvalues.render" (dict "value" .Values.commonConfiguration "context" .) | nindent 4 }} + {{- else }} + # Enable AOF + # ref: https://docs.keydb.dev/docs/persistence/#append-only-file + appendonly yes + # Disable RDB persistence, AOF persistence already enabled + # ref: https://docs.keydb.dev/docs/persistence/#rdb-disadvantages + save "" + loglevel notice + {{- end }} + {{- if .Values.master.configuration }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.configuration "context" $ ) | nindent 4 }} + {{- else }} + bind 0.0.0.0 :: + dir {{ .Values.master.persistence.mountPath }} + {{- if not .Values.auth.enabled }} + protected-mode no + {{- end }} + {{- if .Values.tls.enabled }} + port 0 + tls-port {{ .Values.master.containerPorts.keydb }} + tls-cert-file /opt/bitnami/keydb/certs/tls.crt + tls-key-file /opt/bitnami/keydb/certs/tls.key + tls-ca-cert-file /opt/bitnami/keydb/certs/ca.crt + tls-auth-clients optional + {{- else }} + port {{ .Values.master.containerPorts.keydb }} + {{- end }} + {{- range .Values.master.disableCommands }} + rename-command {{ . }} "" + {{- end }} + {{- end }} + +{{- end }} diff --git a/bitnami/keydb/templates/master/headless-service.yaml b/bitnami/keydb/templates/master/headless-service.yaml new file mode 100644 index 00000000000000..ca8e734cfea457 --- /dev/null +++ b/bitnami/keydb/templates/master/headless-service.yaml @@ -0,0 +1,28 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-hl" (include "keydb.master.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if or .Values.master.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.master.service.headless.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + clusterIP: None + ports: + - name: tcp-keydb + port: {{ .Values.master.containerPorts.keydb }} + targetPort: keydb + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.master.podLabels .Values.commonLabels) "context" .) | fromYaml }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master diff --git a/bitnami/keydb/templates/master/networkpolicy.yaml b/bitnami/keydb/templates/master/networkpolicy.yaml new file mode 100644 index 00000000000000..d5ce079b08fbe2 --- /dev/null +++ b/bitnami/keydb/templates/master/networkpolicy.yaml @@ -0,0 +1,73 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.master.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "keydb.master.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.master.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + - ports: + # Allow dns resolution + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + {{- if .Values.master.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: {{ .Values.master.containerPorts.keydb }} + {{- range .Values.master.extraContainerPorts }} + - port: {{ .containerPort }} + {{- end }} + {{- if not .Values.master.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} + {{- if .Values.master.networkPolicy.addExternalClientAccess }} + - podSelector: + matchLabels: + {{ template "common.names.fullname" . }}-client: "true" + {{- end }} + {{- if .Values.master.networkPolicy.ingressPodMatchLabels }} + - podSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.master.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }} + {{- end }} + {{- if .Values.master.networkPolicy.ingressNSMatchLabels }} + - namespaceSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.master.networkPolicy.ingressNSMatchLabels "context" $ ) | nindent 14 }} + {{- if .Values.master.networkPolicy.ingressNSPodMatchLabels }} + podSelector: + matchLabels: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.master.networkPolicy.ingressNSPodMatchLabels "context" $ ) | nindent 14 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.master.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/bitnami/keydb/templates/master/pdb.yaml b/bitnami/keydb/templates/master/pdb.yaml new file mode 100644 index 00000000000000..ebe83b5e34a674 --- /dev/null +++ b/bitnami/keydb/templates/master/pdb.yaml @@ -0,0 +1,30 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.master.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ template "keydb.master.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.master.pdb.minAvailable }} + minAvailable: {{ .Values.master.pdb.minAvailable }} + {{- end }} + {{- if or .Values.master.pdb.maxUnavailable ( not .Values.master.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.master.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master +{{- end }} diff --git a/bitnami/keydb/templates/master/service.yaml b/bitnami/keydb/templates/master/service.yaml new file mode 100644 index 00000000000000..687baeb230db90 --- /dev/null +++ b/bitnami/keydb/templates/master/service.yaml @@ -0,0 +1,53 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ template "keydb.master.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if or .Values.master.service.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.master.service.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.master.service.type }} + {{- if and .Values.master.service.clusterIP (eq .Values.master.service.type "ClusterIP") }} + clusterIP: {{ .Values.master.service.clusterIP }} + {{- end }} + {{- if .Values.master.service.sessionAffinity }} + sessionAffinity: {{ .Values.master.service.sessionAffinity }} + {{- end }} + {{- if .Values.master.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.master.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + {{- if or (eq .Values.master.service.type "LoadBalancer") (eq .Values.master.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.master.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.master.service.type "LoadBalancer") (not (empty .Values.master.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.master.service.loadBalancerSourceRanges }} + {{- end }} + {{- if and (eq .Values.master.service.type "LoadBalancer") (not (empty .Values.master.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.master.service.loadBalancerIP }} + {{- end }} + ports: + - name: tcp-keydb + port: {{ .Values.master.service.ports.keydb }} + targetPort: keydb + {{- if and (or (eq .Values.master.service.type "NodePort") (eq .Values.master.service.type "LoadBalancer")) (not (empty .Values.master.service.nodePorts.keydb)) }} + nodePort: {{ .Values.master.service.nodePorts.keydb }} + {{- else if eq .Values.master.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.master.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.master.podLabels .Values.commonLabels) "context" .) | fromYaml }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master diff --git a/bitnami/keydb/templates/master/statefulset.yaml b/bitnami/keydb/templates/master/statefulset.yaml new file mode 100644 index 00000000000000..9ce2cd07188a14 --- /dev/null +++ b/bitnami/keydb/templates/master/statefulset.yaml @@ -0,0 +1,436 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ template "keydb.master.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if or .Values.master.statefulsetAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.master.statefulsetAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.master.replicaCount }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.master.podLabels .Values.commonLabels) "context" .) }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- $podLabels = include "common.tplvalues.merge" (dict "values" (list .Values.metrics.podLabels $podLabels) "context" .) }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + serviceName: {{ printf "%s-hl" (include "keydb.master.fullname" .) }} + {{- if .Values.master.updateStrategy }} + updateStrategy: {{- toYaml .Values.master.updateStrategy | nindent 4 }} + {{- end }} + template: + metadata: + annotations: + {{- if empty .Values.master.existingConfigmap }} + checksum/configmap: {{ include (print $.Template.BasePath "/master/configmap.yaml") . | sha256sum }} + {{- end }} + checksum/health: {{ pick ( include (print $.Template.BasePath "/health-configmap.yaml") . | fromYaml ) "data" | toYaml | sha256sum }} + {{- if or .Values.master.podAnnotations (and .Values.metrics.enabled .Values.metrics.podAnnotations) }} + {{- $podAnnotations := include "common.tplvalues.merge" (dict "values" (list .Values.master.podAnnotations .Values.metrics.podAnnotations) "context" .) }} + {{- include "common.tplvalues.render" (dict "value" $podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + spec: + {{- include "keydb.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "keydb.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.master.automountServiceAccountToken }} + {{- if .Values.master.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.master.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.master.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + {{- if not (empty .Values.master.podAffinityPreset) }} + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAffinityPreset "component" "master" "customLabels" $podLabels "context" $) | nindent 10 }} + {{- end }} + {{- if not (empty .Values.master.podAntiAffinityPreset) }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAntiAffinityPreset "component" "master" "customLabels" $podLabels "context" $) | nindent 10 }} + {{- end }} + {{- if not (empty .Values.master.nodeAffinityPreset.type) }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.master.nodeAffinityPreset.type "key" .Values.master.nodeAffinityPreset.key "values" .Values.master.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- end }} + {{- if .Values.master.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.master.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.master.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.master.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.master.priorityClassName }} + priorityClassName: {{ .Values.master.priorityClassName | quote }} + {{- end }} + {{- if .Values.master.schedulerName }} + schedulerName: {{ .Values.master.schedulerName | quote }} + {{- end }} + {{- if .Values.master.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.master.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.master.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.master.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.master.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.master.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if and .Values.volumePermissions.enabled .Values.master.persistence.enabled }} + - name: volume-permissions + image: {{ include "keydb.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + find {{ .Values.master.persistence.path }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs chown -R {{ printf "%d:%d" (int .Values.master.containerSecurityContext.runAsUser) (int .Values.master.podSecurityContext.fsGroup) }} + {{- if .Values.volumePermissions.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} + {{- end }} + volumeMounts: + - name: data + mountPath: {{ .Values.master.persistence.mountPath }} + {{- if .Values.master.persistence.subPath }} + subPath: {{ .Values.master.persistence.subPath }} + {{- end }} + {{- end }} + {{- if .Values.master.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: keydb + image: {{ template "keydb.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.master.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.master.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.master.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.master.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.master.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.master.args "context" $) | nindent 12 }} + {{- else }} + args: + - -ec + - | + . /opt/bitnami/scripts/keydb-env.sh + + args=("/opt/bitnami/keydb/etc/keydb.conf") + {{- if .Values.auth.enabled }} + args+=("--requirepass" "$KEYDB_PASSWORD") + args+=("--masterauth" "$KEYDB_PASSWORD") + {{- end }} + + exec keydb-server "${args[@]}" + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: KEYDB_PORT_NUMBER + value: {{ .Values.master.containerPorts.keydb | quote }} + {{- if .Values.auth.enabled }} + {{- if .Values.auth.usePasswordFiles }} + - name: KEYDB_PASSWORD_FILE + value: {{ printf "/opt/bitnami/keydb/secrets/%s" (include "keydb.secretPasswordKey" .) }} + {{- else }} + - name: KEYDB_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "keydb.secretName" . }} + key: {{ template "keydb.secretPasswordKey" . }} + {{- end }} + {{- end }} + {{- if .Values.master.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.master.extraEnvVarsCM .Values.master.extraEnvVarsSecret }} + envFrom: + {{- if .Values.master.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.master.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- end }} + {{- if .Values.master.resources }} + resources: {{- toYaml .Values.master.resources | nindent 12 }} + {{- else if ne .Values.master.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.master.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: keydb + containerPort: {{ .Values.master.containerPorts.keydb }} + {{- if .Values.master.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.master.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.master.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - sh + - -c + - /opt/bitnami/scripts/health/ping_liveness_local.sh {{ .Values.master.livenessProbe.timeoutSeconds }} + {{- end }} + {{- if .Values.master.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.master.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - sh + - -c + - /opt/bitnami/scripts/health/ping_readiness_local.sh {{ .Values.master.readinessProbe.timeoutSeconds }} + {{- end }} + {{- if .Values.master.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.master.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: keydb + {{- end }} + {{- end }} + {{- if .Values.master.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.master.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: data + mountPath: {{ .Values.master.persistence.mountPath }} + {{- if .Values.master.persistence.subPath }} + subPath: {{ .Values.master.persistence.subPath }} + {{- end }} + - name: health-scripts + mountPath: /opt/bitnami/scripts/health + readOnly: true + {{- if .Values.auth.usePasswordFiles }} + - name: keydb-password + mountPath: /opt/bitnami/keydb/secrets + readOnly: true + {{- end }} + {{- if .Values.tls.enabled }} + - name: keydb-certificates + mountPath: /opt/bitnami/keydb/certs + readOnly: true + {{- end }} + - name: config + mountPath: /opt/bitnami/keydb/etc + readOnly: true + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.master.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "keydb.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.metrics.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + - -c + - | + if [[ -f "$REDIS_PASSWORD_FILE" ]]; then + export REDIS_PASSWORD=$(cat "$REDIS_PASSWORD_FILE") + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "common.names.fullname" . }} + - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS + value: {{ printf ":%v" .Values.metrics.containerPorts.http }} + {{- if .Values.auth.enabled }} + - name: REDIS_USER + value: default + {{- if .Values.auth.usePasswordFiles }} + - name: REDIS_PASSWORD_FILE + value: {{ printf "/secrets/%s" (include "keydb.secretPasswordKey" .) }} + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "keydb.secretName" . }} + key: {{ template "keydb.secretPasswordKey" . }} + {{- end }} + {{- end }} + - name: REDIS_ADDR + value: redis://{{ .Values.metrics.keydbHost }}:{{ .Values.master.containerPorts.keydb }} + {{- if .Values.tls.enabled }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: "/certs/tls.key" + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: "/certs/tls.crt" + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: "/certs/ca.crt" + {{- end }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: metrics + containerPort: {{ .Values.metrics.containerPorts.http }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: metrics + {{- end }} + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- else if ne .Values.metrics.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: app-tmp-dir + {{- if .Values.auth.usePasswordFiles }} + - name: keydb-password + mountPath: /secrets + readOnly: true + {{- end }} + {{- if .Values.tls.enabled }} + - name: keydb-certificates + mountPath: /certs + readOnly: true + {{- end }} + {{- if .Values.metrics.extraVolumeMounts }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumeMounts "context" $ ) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.master.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + - name: health-scripts + configMap: + name: {{ printf "%s-health" (include "common.names.fullname" .) }} + defaultMode: 0755 + - name: config + configMap: + name: {{ template "keydb.master.configmapName" . }} + {{- if .Values.auth.usePasswordFiles }} + - name: keydb-password + secret: + secretName: {{ template "keydb.secretName" . }} + items: + - key: {{ template "keydb.secretPasswordKey" . }} + path: keydb-password + {{- end }} + {{- if .Values.tls.enabled }} + - name: keydb-certificates + secret: + secretName: {{ template "keydb.tls.master.secretName" . }} + defaultMode: 256 + {{- end }} + {{- if .Values.master.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumes "context" $) | nindent 8 }} + {{- end }} + {{- if or (not .Values.master.persistence.enabled) (not (empty .Values.master.persistence.existingClaim)) }} + - name: data + {{- if not (empty .Values.master.persistence.existingClaim) }} + persistentVolumeClaim: + claimName: {{ tpl .Values.master.persistence.existingClaim . }} + {{- else }} + {{- if or .Values.master.persistence.medium .Values.master.persistence.sizeLimit }} + emptyDir: + {{- if .Values.master.persistence.medium }} + medium: {{ .Values.master.persistence.medium | quote }} + {{- end }} + {{- if .Values.master.persistence.sizeLimit }} + sizeLimit: {{ .Values.master.persistence.sizeLimit | quote }} + {{- end }} + {{- else }} + emptyDir: {} + {{- end }} + {{- end }} + {{- else }} + {{- if .Values.master.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.master.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.master.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - metadata: + name: data + {{- if or .Values.master.persistence.annotations .Values.commonAnnotations }} + {{- $claimAnnotations := include "common.tplvalues.merge" (dict "values" .Values.master.persistence.annotations .Values.commonAnnotations "context" .) | fromYaml }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $claimAnnotations "context" $ ) | nindent 10 }} + {{- end }} + {{- if .Values.commonLabels }} + labels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.master.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.master.persistence.size | quote }} + {{- if .Values.master.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.master.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.master.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.master.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.master.persistence "global" .Values.global) | nindent 8 }} + {{- end }} diff --git a/bitnami/keydb/templates/master/vpa.yaml b/bitnami/keydb/templates/master/vpa.yaml new file mode 100644 index 00000000000000..5b35e1f6d7b246 --- /dev/null +++ b/bitnami/keydb/templates/master/vpa.yaml @@ -0,0 +1,45 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.master.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ template "keydb.master.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if or .Values.master.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: master + {{- with .Values.master.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.master.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.master.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} + kind: Statefulset + name: {{ template "keydb.master.fullname" . }} + {{- if .Values.master.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.master.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/bitnami/keydb/templates/metrics-svc.yaml b/bitnami/keydb/templates/metrics-svc.yaml new file mode 100644 index 00000000000000..72ed2effef5c56 --- /dev/null +++ b/bitnami/keydb/templates/metrics-svc.yaml @@ -0,0 +1,28 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.metrics.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-metrics" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + app.kubernetes.io/part-of: keydb + {{- if or .Values.metrics.service.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http-metrics + port: {{ .Values.metrics.service.port }} + protocol: TCP + targetPort: metrics + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb +{{- end }} diff --git a/bitnami/keydb/templates/prometheusrule.yaml b/bitnami/keydb/templates/prometheusrule.yaml new file mode 100644 index 00000000000000..bf186d6ec31a98 --- /dev/null +++ b/bitnami/keydb/templates/prometheusrule.yaml @@ -0,0 +1,24 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ default (include "common.names.namespace" .) .Values.metrics.prometheusRule.namespace | quote }} + {{- $labels := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.prometheusRule.labels .Values.commonLabels) "context" .) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + app.kubernetes.io/part-of: keydb + {{- if or .Values.metrics.prometheusRule.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.prometheusRule.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + groups: + - name: {{ include "common.names.fullname" . }} + rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 8 }} +{{- end }} diff --git a/bitnami/keydb/templates/replica/cert.yaml b/bitnami/keydb/templates/replica/cert.yaml new file mode 100644 index 00000000000000..f2ef11b3ab80f3 --- /dev/null +++ b/bitnami/keydb/templates/replica/cert.yaml @@ -0,0 +1,44 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (eq .Values.architecture "replication") .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ printf "%s-crt" (include "keydb.replica.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + secretName: {{ template "keydb.tls.replica.secretName" . }} + commonName: {{ printf "%s.%s.svc.%s" (include "keydb.replica.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain }} + issuerRef: + name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }} + kind: Issuer + subject: + organizations: + - "KeyDB" + dnsNames: + - '*.{{ include "common.names.namespace" . }}' + - '*.{{ include "common.names.namespace" . }}.svc' + - '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}' + - '*.{{ include "keydb.replica.fullname" . }}' + - '*.{{ include "keydb.replica.fullname" . }}.{{ include "common.names.namespace" . }}' + - '*.{{ include "keydb.replica.fullname" . }}.{{ include "common.names.namespace" . }}.svc' + - '*.{{ include "keydb.replica.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}' + - '*.{{ printf "%s-hl" (include "keydb.replica.fullname" .) }}' + - '*.{{ printf "%s-hl" (include "keydb.replica.fullname" .) }}.{{ include "common.names.namespace" . }}' + - '*.{{ printf "%s-hl" (include "keydb.replica.fullname" .) }}.{{ include "common.names.namespace" . }}.svc' + - '*.{{ printf "%s-hl" (include "keydb.replica.fullname" .) }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}' + privateKey: + algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }} + size: {{ int .Values.tls.autoGenerated.certManager.keySize }} + duration: {{ .Values.tls.autoGenerated.certManager.duration }} + renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }} +{{- end }} diff --git a/bitnami/keydb/templates/replica/configmap.yaml b/bitnami/keydb/templates/replica/configmap.yaml new file mode 100644 index 00000000000000..6f3c3d8eea535d --- /dev/null +++ b/bitnami/keydb/templates/replica/configmap.yaml @@ -0,0 +1,63 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (eq .Values.architecture "replication") (not .Values.replica.existingConfigmap) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "keydb.replica.configmapName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + keydb.conf: |- + {{- if .Values.commonConfiguration }} + {{- include "common.tplvalues.render" (dict "value" .Values.commonConfiguration "context" .) | nindent 4 }} + {{- else }} + # Enable AOF + # ref: https://docs.keydb.dev/docs/persistence/#append-only-file + appendonly yes + # Disable RDB persistence, AOF persistence already enabled + # ref: https://docs.keydb.dev/docs/persistence/#rdb-disadvantages + save "" + loglevel notice + {{- end }} + {{- if .Values.replica.configuration }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.configuration "context" $ ) | nindent 4 }} + {{- else }} + bind 0.0.0.0 :: + dir {{ .Values.replica.persistence.mountPath }} + {{- if not .Values.auth.enabled }} + protected-mode no + {{- end }} + {{- if .Values.tls.enabled }} + port 0 + tls-port {{ .Values.replica.containerPorts.keydb }} + tls-cert-file /opt/bitnami/keydb/certs/tls.crt + tls-key-file /opt/bitnami/keydb/certs/tls.key + tls-ca-cert-file /opt/bitnami/keydb/certs/ca.crt + tls-replication yes + tls-auth-clients optional + {{- else }} + port {{ .Values.replica.containerPorts.keydb }} + {{- end }} + replica-announce-port {{ .Values.replica.service.ports.keydb }} + {{- if .Values.replica.activeReplica }} + active-replica yes + {{- $masterReplicaCount := int .Values.master.replicaCount }} + {{- if gt $masterReplicaCount 1 }} + multi-master yes + {{- end }} + {{- end }} + {{- range .Values.replica.disableCommands }} + rename-command {{ . }} "" + {{- end }} + {{- end }} + +{{- end }} diff --git a/bitnami/keydb/templates/replica/headless-service.yaml b/bitnami/keydb/templates/replica/headless-service.yaml new file mode 100644 index 00000000000000..ad48972fdb8056 --- /dev/null +++ b/bitnami/keydb/templates/replica/headless-service.yaml @@ -0,0 +1,30 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-hl" (include "keydb.replica.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if or .Values.replica.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.replica.service.headless.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + clusterIP: None + ports: + - name: tcp-keydb + port: {{ .Values.replica.containerPorts.keydb }} + targetPort: keydb + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.replica.podLabels .Values.commonLabels) "context" .) | fromYaml }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica +{{- end }} diff --git a/bitnami/keydb/templates/replica/hpa.yaml b/bitnami/keydb/templates/replica/hpa.yaml new file mode 100644 index 00000000000000..eecfe002a0d173 --- /dev/null +++ b/bitnami/keydb/templates/replica/hpa.yaml @@ -0,0 +1,50 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (eq .Values.architecture "replication") .Values.replica.autoscaling.hpa.enabled }} +apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ template "keydb.replica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} + kind: Statefulset + name: {{ template "keydb.replica.fullname" . }} + minReplicas: {{ .Values.replica.autoscaling.hpa.minReplicas }} + maxReplicas: {{ .Values.replica.autoscaling.hpa.maxReplicas }} + metrics: + {{- if .Values.replica.autoscaling.hpa.targetMemory }} + - type: Resource + resource: + name: memory + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.replica.autoscaling.hpa.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetMemory }} + {{- end }} + {{- end }} + {{- if .Values.replica.autoscaling.hpa.targetCPU }} + - type: Resource + resource: + name: cpu + {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} + targetAverageUtilization: {{ .Values.replica.autoscaling.hpa.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.worker.autoscaling.hpa.targetCPU }} + {{- end }} + {{- end }} +{{- end }} diff --git a/bitnami/keydb/templates/replica/networkpolicy.yaml b/bitnami/keydb/templates/replica/networkpolicy.yaml new file mode 100644 index 00000000000000..09c8a789341159 --- /dev/null +++ b/bitnami/keydb/templates/replica/networkpolicy.yaml @@ -0,0 +1,82 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (eq .Values.architecture "replication") .Values.replica.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "keydb.replica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.replica.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + policyTypes: + - Ingress + - Egress + egress: + {{- if .Values.replica.networkPolicy.allowExternalEgress }} + - {} + {{- else }} + # Allow dns resolution + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + # Allow outbound connections to master pods + - ports: + - port: {{ .Values.master.containerPorts.redis }} + to: + - podSelector: + {{- $masterPodLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.master.podLabels .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $masterPodLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if .Values.replica.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: {{ .Values.replica.containerPorts.keydb }} + {{- range .Values.replica.extraContainerPorts }} + - port: {{ .containerPort }} + {{- end }} + {{- if not .Values.replica.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} + {{- if .Values.replica.networkPolicy.addExternalClientAccess }} + - podSelector: + matchLabels: + {{ template "common.names.fullname" . }}-client: "true" + {{- end }} + {{- if .Values.replica.networkPolicy.ingressPodMatchLabels }} + - podSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.replica.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }} + {{- end }} + {{- if .Values.replica.networkPolicy.ingressNSMatchLabels }} + - namespaceSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.replica.networkPolicy.ingressNSMatchLabels "context" $ ) | nindent 14 }} + {{- if .Values.replica.networkPolicy.ingressNSPodMatchLabels }} + podSelector: + matchLabels: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.replica.networkPolicy.ingressNSPodMatchLabels "context" $ ) | nindent 14 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.replica.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/bitnami/keydb/templates/replica/pdb.yaml b/bitnami/keydb/templates/replica/pdb.yaml new file mode 100644 index 00000000000000..381f4c7319c49f --- /dev/null +++ b/bitnami/keydb/templates/replica/pdb.yaml @@ -0,0 +1,30 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (eq .Values.architecture "replication") .Values.replica.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ template "keydb.replica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.replica.pdb.minAvailable }} + minAvailable: {{ .Values.replica.pdb.minAvailable }} + {{- end }} + {{- if or .Values.replica.pdb.maxUnavailable ( not .Values.replica.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.replica.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.replica.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica +{{- end }} diff --git a/bitnami/keydb/templates/replica/service.yaml b/bitnami/keydb/templates/replica/service.yaml new file mode 100644 index 00000000000000..fb51af9c616d9c --- /dev/null +++ b/bitnami/keydb/templates/replica/service.yaml @@ -0,0 +1,55 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "keydb.replica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if or .Values.replica.service.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.replica.service.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.replica.service.type }} + {{- if and .Values.replica.service.clusterIP (eq .Values.replica.service.type "ClusterIP") }} + clusterIP: {{ .Values.replica.service.clusterIP }} + {{- end }} + {{- if .Values.replica.service.sessionAffinity }} + sessionAffinity: {{ .Values.replica.service.sessionAffinity }} + {{- end }} + {{- if .Values.replica.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.replica.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + {{- if or (eq .Values.replica.service.type "LoadBalancer") (eq .Values.replica.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.replica.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.replica.service.type "LoadBalancer") (not (empty .Values.replica.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.replica.service.loadBalancerSourceRanges }} + {{- end }} + {{- if and (eq .Values.replica.service.type "LoadBalancer") (not (empty .Values.replica.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.replica.service.loadBalancerIP }} + {{- end }} + ports: + - name: tcp-keydb + port: {{ .Values.replica.service.ports.keydb }} + targetPort: keydb + {{- if and (or (eq .Values.replica.service.type "NodePort") (eq .Values.replica.service.type "LoadBalancer")) (not (empty .Values.replica.service.nodePorts.keydb)) }} + nodePort: {{ .Values.replica.service.nodePorts.keydb }} + {{- else if eq .Values.replica.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.replica.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.replica.podLabels .Values.commonLabels) "context" .) | fromYaml }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica +{{- end }} diff --git a/bitnami/keydb/templates/replica/statefulset.yaml b/bitnami/keydb/templates/replica/statefulset.yaml new file mode 100644 index 00000000000000..a0cf6271e330a8 --- /dev/null +++ b/bitnami/keydb/templates/replica/statefulset.yaml @@ -0,0 +1,459 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ template "keydb.replica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if or .Values.replica.statefulsetAnnotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.replica.statefulsetAnnotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.replica.autoscaling.hpa.enabled }} + replicas: {{ .Values.replica.replicaCount }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.replica.podLabels .Values.commonLabels) "context" .) }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- $podLabels = include "common.tplvalues.merge" (dict "values" (list .Values.metrics.podLabels $podLabels) "context" .) }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + serviceName: {{ printf "%s-hl" (include "keydb.replica.fullname" .) }} + {{- if .Values.replica.updateStrategy }} + updateStrategy: {{- toYaml .Values.replica.updateStrategy | nindent 4 }} + {{- end }} + template: + metadata: + annotations: + {{- if empty .Values.replica.existingConfigmap }} + checksum/configmap: {{ include (print $.Template.BasePath "/replica/configmap.yaml") . | sha256sum }} + {{- end }} + checksum/health: {{ pick ( include (print $.Template.BasePath "/health-configmap.yaml") . | fromYaml ) "data" | toYaml | sha256sum }} + {{- if or .Values.replica.podAnnotations (and .Values.metrics.enabled .Values.metrics.podAnnotations) }} + {{- $podAnnotations := include "common.tplvalues.merge" (dict "values" (list .Values.replica.podAnnotations .Values.metrics.podAnnotations) "context" .) }} + {{- include "common.tplvalues.render" (dict "value" $podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + spec: + {{- include "keydb.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "keydb.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.replica.automountServiceAccountToken }} + {{- if .Values.replica.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.replica.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.replica.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + {{- if not (empty .Values.replica.podAffinityPreset) }} + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAffinityPreset "component" "replica" "customLabels" $podLabels "context" $) | nindent 10 }} + {{- end }} + {{- if not (empty .Values.replica.podAntiAffinityPreset) }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAntiAffinityPreset "component" "replica" "customLabels" $podLabels "context" $) | nindent 10 }} + {{- end }} + {{- if not (empty .Values.replica.nodeAffinityPreset.type) }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.replica.nodeAffinityPreset.type "key" .Values.replica.nodeAffinityPreset.key "values" .Values.replica.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- end }} + {{- if .Values.replica.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.replica.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.replica.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.replica.priorityClassName }} + priorityClassName: {{ .Values.replica.priorityClassName | quote }} + {{- end }} + {{- if .Values.replica.schedulerName }} + schedulerName: {{ .Values.replica.schedulerName | quote }} + {{- end }} + {{- if .Values.replica.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.replica.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.replica.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.replica.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.replica.terminationGracePeriodSeconds }} + {{- end }} + initContainers: + {{- if and .Values.volumePermissions.enabled .Values.replica.persistence.enabled }} + - name: volume-permissions + image: {{ include "keydb.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + find {{ .Values.replica.persistence.path }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs chown -R {{ printf "%d:%d" (int .Values.replica.containerSecurityContext.runAsUser) (int .Values.replica.podSecurityContext.fsGroup) }} + {{- if .Values.volumePermissions.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} + {{- end }} + volumeMounts: + - name: data + mountPath: {{ .Values.replica.persistence.mountPath }} + {{- if .Values.replica.persistence.subPath }} + subPath: {{ .Values.replica.persistence.subPath }} + {{- end }} + {{- end }} + {{- if .Values.replica.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: keydb + image: {{ template "keydb.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.replica.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.replica.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.replica.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.replica.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.replica.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.replica.args "context" $) | nindent 12 }} + {{- else }} + args: + - -ec + - | + . /opt/bitnami/scripts/keydb-env.sh + + args=("/opt/bitnami/keydb/etc/keydb.conf") + {{- if .Values.auth.enabled }} + args+=("--requirepass" "$KEYDB_PASSWORD") + args+=("--masterauth" "$KEYDB_MASTER_PASSWORD") + {{- end }} + + {{- $masterReplicaCount := int .Values.master.replicaCount }} + {{- $masterFullname := include "keydb.master.fullname" . }} + {{- $masterHlSvcName := printf "%s-hl" (include "keydb.master.fullname" .) }} + {{- $replicaHlSvcName := printf "%s-hl" (include "keydb.replica.fullname" .) }} + {{- $releaseNamespace := include "common.names.namespace" . }} + {{- $clusterDomain := .Values.clusterDomain }} + {{- $masterPort := int .Values.master.containerPorts.keydb }} + {{- range $i := until $masterReplicaCount }} + args+=("--replicaof" "{{ printf "%s-%d.%s.%s.svc.%s" $masterFullname $i $masterHlSvcName $releaseNamespace $clusterDomain }}" {{ $masterPort }}) + {{- end }} + args+=("--replica-announce-ip" "${HOSTNAME}.{{ printf "%s.%s.svc.%s" $replicaHlSvcName $releaseNamespace $clusterDomain }}") + + exec keydb-server "${args[@]}" + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: KEYDB_PORT_NUMBER + value: {{ .Values.replica.containerPorts.keydb | quote }} + {{- if .Values.auth.enabled }} + {{- if .Values.auth.usePasswordFiles }} + - name: KEYDB_PASSWORD_FILE + value: {{ printf "/opt/bitnami/keydb/secrets/%s" (include "keydb.secretPasswordKey" .) }} + - name: KEYDB_MASTER_PASSWORD_FILE + value: {{ printf "/opt/bitnami/keydb/secrets/%s" (include "keydb.secretPasswordKey" .) }} + {{- else }} + - name: KEYDB_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "keydb.secretName" . }} + key: {{ template "keydb.secretPasswordKey" . }} + - name: KEYDB_MASTER_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "keydb.secretName" . }} + key: {{ template "keydb.secretPasswordKey" . }} + {{- end }} + {{- end }} + {{- if .Values.replica.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.replica.extraEnvVarsCM .Values.replica.extraEnvVarsSecret }} + envFrom: + {{- if .Values.replica.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.replica.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.replica.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.replica.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- end }} + {{- if .Values.replica.resources }} + resources: {{- toYaml .Values.replica.resources | nindent 12 }} + {{- else if ne .Values.replica.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.replica.resourcesPreset) | nindent 12 }} + {{- end }} + ports: + - name: keydb + containerPort: {{ .Values.replica.containerPorts.keydb }} + {{- if .Values.replica.extraContainerPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.extraContainerPorts "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.replica.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.replica.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.replica.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - sh + - -c + - /opt/bitnami/scripts/health/ping_liveness_local_and_master.sh {{ .Values.replica.livenessProbe.timeoutSeconds }} + {{- end }} + {{- if .Values.replica.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.replica.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.replica.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - sh + - -c + - /opt/bitnami/scripts/health/ping_readiness_local_and_master.sh {{ .Values.replica.readinessProbe.timeoutSeconds }} + {{- end }} + {{- if .Values.replica.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.replica.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.replica.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: keydb + {{- end }} + {{- end }} + {{- if .Values.replica.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.replica.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: data + mountPath: {{ .Values.replica.persistence.mountPath }} + {{- if .Values.replica.persistence.subPath }} + subPath: {{ .Values.replica.persistence.subPath }} + {{- end }} + - name: health-scripts + mountPath: /opt/bitnami/scripts/health + readOnly: true + {{- if .Values.auth.usePasswordFiles }} + - name: keydb-password + mountPath: /opt/bitnami/keydb/secrets + readOnly: true + {{- end }} + {{- if .Values.tls.enabled }} + - name: keydb-certificates + mountPath: /opt/bitnami/keydb/certs + readOnly: true + {{- end }} + - name: config + mountPath: /opt/bitnami/keydb/etc + readOnly: true + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.replica.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "keydb.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.metrics.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + - -c + - | + if [[ -f "$REDIS_PASSWORD_FILE" ]]; then + export REDIS_PASSWORD=$(cat "$REDIS_PASSWORD_FILE") + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "common.names.fullname" . }} + - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS + value: {{ printf ":%v" .Values.metrics.containerPorts.http }} + {{- if .Values.auth.enabled }} + - name: REDIS_USER + value: default + {{- if .Values.auth.usePasswordFiles }} + - name: REDIS_PASSWORD_FILE + value: {{ printf "/secrets/%s" (include "keydb.secretPasswordKey" .) }} + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "keydb.secretName" . }} + key: {{ template "keydb.secretPasswordKey" . }} + {{- end }} + {{- end }} + - name: REDIS_ADDR + value: redis://{{ .Values.metrics.keydbHost }}:{{ .Values.master.containerPorts.keydb }} + {{- if .Values.tls.enabled }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: "/certs/tls.key" + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: "/certs/tls.crt" + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: "/certs/ca.crt" + {{- end }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: metrics + containerPort: {{ .Values.metrics.containerPorts.http }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: metrics + {{- end }} + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- else if ne .Values.metrics.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: app-tmp-dir + {{- if .Values.auth.usePasswordFiles }} + - name: keydb-password + mountPath: /secrets + readOnly: true + {{- end }} + {{- if .Values.tls.enabled }} + - name: keydb-certificates + mountPath: /certs + readOnly: true + {{- end }} + {{- if .Values.metrics.extraVolumeMounts }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumeMounts "context" $ ) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.replica.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + - name: health-scripts + configMap: + name: {{ printf "%s-health" (include "common.names.fullname" .) }} + defaultMode: 0755 + - name: config + configMap: + name: {{ template "keydb.replica.configmapName" . }} + {{- if .Values.auth.usePasswordFiles }} + - name: keydb-password + secret: + secretName: {{ template "keydb.secretName" . }} + items: + - key: {{ template "keydb.secretPasswordKey" . }} + path: keydb-password + {{- end }} + {{- if .Values.tls.enabled }} + - name: keydb-certificates + secret: + secretName: {{ template "keydb.tls.replica.secretName" . }} + defaultMode: 256 + {{- end }} + {{- if .Values.replica.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.extraVolumes "context" $) | nindent 8 }} + {{- end }} + {{- if or (not .Values.replica.persistence.enabled) (not (empty .Values.replica.persistence.existingClaim)) }} + - name: data + {{- if not (empty .Values.replica.persistence.existingClaim) }} + persistentVolumeClaim: + claimName: {{ tpl .Values.replica.persistence.existingClaim . }} + {{- else }} + {{- if or .Values.replica.persistence.medium .Values.replica.persistence.sizeLimit }} + emptyDir: + {{- if .Values.replica.persistence.medium }} + medium: {{ .Values.replica.persistence.medium | quote }} + {{- end }} + {{- if .Values.replica.persistence.sizeLimit }} + sizeLimit: {{ .Values.replica.persistence.sizeLimit | quote }} + {{- end }} + {{- else }} + emptyDir: {} + {{- end }} + {{- end }} + {{- else }} + {{- if .Values.replica.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.replica.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.replica.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - metadata: + name: data + {{- if or .Values.replica.persistence.annotations .Values.commonAnnotations }} + {{- $claimAnnotations := include "common.tplvalues.merge" (dict "values" .Values.replica.persistence.annotations .Values.commonAnnotations "context" .) | fromYaml }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $claimAnnotations "context" $ ) | nindent 10 }} + {{- end }} + {{- if .Values.commonLabels }} + labels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.replica.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.replica.persistence.size | quote }} + {{- if .Values.replica.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.replica.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.replica.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.replica.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.replica.persistence "global" .Values.global) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/bitnami/keydb/templates/replica/vpa.yaml b/bitnami/keydb/templates/replica/vpa.yaml new file mode 100644 index 00000000000000..4371eb26143b75 --- /dev/null +++ b/bitnami/keydb/templates/replica/vpa.yaml @@ -0,0 +1,45 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (eq .Values.architecture "replication") (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.replica.autoscaling.vpa.enabled }} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ template "keydb.replica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if or .Values.replica.autoscaling.vpa.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.replica.autoscaling.vpa.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + resourcePolicy: + containerPolicies: + - containerName: replica + {{- with .Values.replica.autoscaling.vpa.controlledResources }} + controlledResources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.replica.autoscaling.vpa.maxAllowed }} + maxAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.replica.autoscaling.vpa.minAllowed }} + minAllowed: + {{- toYaml . | nindent 8 }} + {{- end }} + targetRef: + apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} + kind: Statefulset + name: {{ template "keydb.replica.fullname" . }} + {{- if .Values.replica.autoscaling.vpa.updatePolicy }} + updatePolicy: + {{- with .Values.replica.autoscaling.vpa.updatePolicy.updateMode }} + updateMode: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/bitnami/keydb/templates/secret.yaml b/bitnami/keydb/templates/secret.yaml new file mode 100644 index 00000000000000..b27c3e475444bf --- /dev/null +++ b/bitnami/keydb/templates/secret.yaml @@ -0,0 +1,20 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.auth.enabled (not .Values.auth.existingSecret) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "keydb.secretName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + keydb-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "keydb.secretName" .) "key" "keydb-password" "providedValues" (list "global.keydb.password" "auth.password") "length" 10 "context" $) }} +{{- end }} diff --git a/bitnami/keydb/templates/service-account.yaml b/bitnami/keydb/templates/service-account.yaml new file mode 100644 index 00000000000000..94171cbaddc86c --- /dev/null +++ b/bitnami/keydb/templates/service-account.yaml @@ -0,0 +1,19 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "keydb.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.serviceAccount.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/bitnami/keydb/templates/servicemonitor.yaml b/bitnami/keydb/templates/servicemonitor.yaml new file mode 100644 index 00000000000000..04d6b35635c519 --- /dev/null +++ b/bitnami/keydb/templates/servicemonitor.yaml @@ -0,0 +1,50 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace | quote }} + {{- $labels := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.serviceMonitor.labels .Values.commonLabels) "context" .) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + app.kubernetes.io/part-of: keydb + {{- if or .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations) "context" .) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel | quote }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: metrics + app.kubernetes.io/part-of: keydb + {{- if .Values.metrics.serviceMonitor.selector }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }} + {{- end }} + endpoints: + - port: tcp-metrics + path: "/metrics" + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "common.names.namespace" . | quote }} +{{- end }} diff --git a/bitnami/keydb/templates/tls-secret.yaml b/bitnami/keydb/templates/tls-secret.yaml new file mode 100644 index 00000000000000..890090a09631ab --- /dev/null +++ b/bitnami/keydb/templates/tls-secret.yaml @@ -0,0 +1,91 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "helm") -}} +{{- $ca := genCA "keydb-ca" 365 }} +{{- $releaseNamespace := include "common.names.namespace" . }} +{{- $clusterDomain := .Values.clusterDomain }} +{{- $masterFullname := include "keydb.master.fullname" . }} +{{- $masterHlSvcName := printf "%s-hl" (include "keydb.master.fullname" .) }} +{{- $masterAltNames := list (printf "*.%s.%s.svc.%s" $masterHlSvcName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $masterHlSvcName $releaseNamespace $clusterDomain) $masterHlSvcName (printf "%s.%s.svc.%s" $masterFullname $releaseNamespace $clusterDomain) $masterFullname "127.0.0.1" "localhost" }} +{{- $masterCert := genSignedCert $masterFullname nil $masterAltNames 365 $ca }} +{{- $masterSecretName := include "keydb.tls.master.secretName" . }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $masterSecretName }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + ca.crt: {{ include "common.secrets.lookup" (dict "secret" $masterSecretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} + tls.crt: {{ include "common.secrets.lookup" (dict "secret" $masterSecretName "key" "tls.crt" "defaultValue" $masterCert.Cert "context" $) }} + tls.key: {{ include "common.secrets.lookup" (dict "secret" $masterSecretName "key" "tls.key" "defaultValue" $masterCert.Key "context" $) }} +--- +{{- if eq .Values.architecture "replication" }} +{{- $replicaFullname := include "keydb.replica.fullname" . }} +{{- $replicaAltNames := list (printf "%s.%s.svc.%s" $replicaFullname $releaseNamespace $clusterDomain) $replicaFullname "127.0.0.1" "localhost" }} +{{- $replicaCert := genSignedCert $replicaFullname nil $replicaAltNames 365 $ca }} +{{- $replicaSecretName := include "keydb.tls.replica.secretName" . }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $replicaSecretName }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + ca.crt: {{ include "common.secrets.lookup" (dict "secret" $replicaSecretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} + tls.crt: {{ include "common.secrets.lookup" (dict "secret" $replicaSecretName "key" "tls.crt" "defaultValue" $replicaCert.Cert "context" $) }} + tls.key: {{ include "common.secrets.lookup" (dict "secret" $replicaSecretName "key" "tls.key" "defaultValue" $replicaCert.Key "context" $) }} +{{- end }} +{{- else if and .Values.tls.enabled (not .Values.tls.autoGenerated.enabled) (empty .Values.tls.existingCASecret) (empty .Values.tls.master.existingSecret) (empty .Values.tls.replica.existingSecret) -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "keydb.tls.master.secretName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: master + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + ca.crt: {{ required "A valid .Values.tls.ca entry required!" .Values.tls.ca | b64enc | quote }} + tls.crt: {{ required "A valid .Values.tls.master.cert entry required!" .Values.tls.master.cert | b64enc | quote }} + tls.key: {{ required "A valid .Values.tls.master.key entry required!" .Values.tls.master.key | b64enc | quote }} +--- +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "keydb.tls.replica.secretName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: keydb + app.kubernetes.io/component: replica + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + ca.crt: {{ required "A valid .Values.tls.ca entry required!" .Values.tls.ca | b64enc | quote }} + tls.crt: {{ required "A valid .Values.tls.replica.cert entry required!" .Values.tls.replica.cert | b64enc | quote }} + tls.key: {{ required "A valid .Values.tls.replica.key entry required!" .Values.tls.replica.key | b64enc | quote }} +{{- end }} +{{- end }} + diff --git a/bitnami/keydb/values.yaml b/bitnami/keydb/values.yaml new file mode 100644 index 00000000000000..12f2f075c94398 --- /dev/null +++ b/bitnami/keydb/values.yaml @@ -0,0 +1,1522 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +## @section Global parameters +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass +## + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s) +## @param global.keydb.password Global KeyDB password (overrides `auth.password`) +## +global: + imageRegistry: "" + ## e.g: + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + defaultStorageClass: "" + keydb: + password: "" + ## Compatibility adaptations for Kubernetes platforms + ## + compatibility: + ## Compatibility adaptations for Openshift + ## + openshift: + ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) + ## + adaptSecurityContext: auto + +## @section Common parameters +## + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.name +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname +## +fullnameOverride: "" +## @param namespaceOverride String to fully override common.names.namespace +## +namespaceOverride: "" +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} +## @param clusterDomain Kubernetes cluster domain name +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release +## +extraDeploy: [] +## Diagnostic mode +## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) +## @param diagnosticMode.command Command to override all containers in the chart release +## @param diagnosticMode.args Args to override all containers in the chart release +## +diagnosticMode: + enabled: false + command: + - sleep + args: + - infinity + +## @section KeyDB Image parameters +## ref: https://hub.docker.com/r/bitnami/keydb/tags/ +## @param image.registry [default: REGISTRY_NAME] KeyDB image registry +## @param image.repository [default: REPOSITORY_NAME/keydb] KeyDB image repository +## @skip image.tag KeyDB image tag (immutable tags are recommended) +## @param image.digest KeyDB image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) +## @param image.pullPolicy KeyDB image pull policy +## @param image.pullSecrets KeyDB image pull secrets +## @param image.debug Enable KeyDB image debug mode +## +image: + registry: docker.io + repository: bitnami/keydb + tag: 6.3.4-debian-12-r0 + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + debug: false + +## @section KeyDB common configuration parameters +## https://github.com/bitnami/containers/tree/main/bitnami/keydb#configuration +## + +## @param architecture KeyDB architecture. Allowed values: `standalone` or `replication` +## ref: https://docs.keydb.dev/docs/replication +## ref: https://docs.keydb.dev/docs/active-rep +## ref: https://docs.keydb.dev/docs/multi-master +## +architecture: replication +## KeyDB Authentication parameters +## ref: https://github.com/bitnami/containers/tree/main/bitnami/keydb#setting-the-server-password-on-first-run +## +auth: + ## @param auth.enabled Enable password authentication + ## + enabled: true + ## @param auth.password KeyDB password + ## Defaults to a random 10-character alphanumeric string if not set + ## + password: "" + ## @param auth.existingSecret The name of an existing secret with KeyDB credentials + ## NOTE: When it's set, the previous `auth.password` parameter is ignored + ## + existingSecret: "" + ## @param auth.existingSecretPasswordKey Password key to be retrieved from existing secret + ## NOTE: ignored unless `auth.existingSecret` parameter is set + ## + existingSecretPasswordKey: "" + ## @param auth.usePasswordFiles Mount credentials as files instead of using an environment variable + ## + usePasswordFiles: false +## TLS configuration +## +tls: + ## @param tls.enabled Enable TLS communications + ## + enabled: false + ## @param tls.autoGenerated.enabled Enable automatic generation of certificates for TLS + ## @param tls.autoGenerated.engine Mechanism to generate the certificates (allowed values: helm, cert-manager) + autoGenerated: + enabled: true + engine: helm + ## @param tls.autoGenerated.certManager.existingIssuer The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine) + ## @param tls.autoGenerated.certManager.existingIssuerKind Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine) + ## @param tls.autoGenerated.certManager.keyAlgorithm Key algorithm for the certificates (only for `cert-manager` engine) + ## @param tls.autoGenerated.certManager.keySize Key size for the certificates (only for `cert-manager` engine) + ## @param tls.autoGenerated.certManager.duration Duration for the certificates (only for `cert-manager` engine) + ## @param tls.autoGenerated.certManager.renewBefore Renewal period for the certificates (only for `cert-manager` engine) + certManager: + existingIssuer: "" + existingIssuerKind: "" + keySize: 2048 + keyAlgorithm: RSA + duration: 2160h + renewBefore: 360h + ## @param tls.ca CA certificate for TLS. Ignored if `tls.existingCASecret` is set + ## @param tls.existingCASecret The name of an existing Secret containing the CA certificate for TLS + ## @param tls.master.cert TLS certificate for KeyDB master nodes. Ignored if `tls.master.existingSecret` is set + ## @param tls.master.key TLS key for KeyDB master nodes. Ignored if `tls.master.existingSecret` is set + ## @param tls.master.existingSecret The name of an existing Secret containing the KeyDB master nodes certificates for TLS + ## @param tls.replica.cert TLS certificate for KeyDB replica nodes. Ignored if `tls.replica.existingSecret` is set + ## @param tls.replica.key TLS key for KeyDB replica nodes. Ignored if `tls.replica.existingSecret` is set + ## @param tls.replica.existingSecret The name of an existing Secret containing the KeyDB replica nodes certificates for TLS + ## + ca: "" + existingCASecret: "" + master: + cert: "" + key: "" + existingSecret: "" + replica: + cert: "" + key: "" + existingSecret: "" +## @param commonConfiguration [string] Common configuration to be added to both master and replica nodes +## ref: https://docs.keydb.dev/docs/config-file +## +commonConfiguration: "" + +## @section KeyDB Master Configuration Parameters +## +master: + ## @param master.replicaCount Number of KeyDB master replicas to deploy + ## + replicaCount: 1 + ## @param master.containerPorts.keydb Container port to open on KeyDB master nodes + ## + containerPorts: + keydb: 6379 + ## @param master.extraContainerPorts Optionally specify extra list of additional ports for KeyDB master containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] + ## Configure extra options for KeyDB master containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param master.livenessProbe.enabled Enable livenessProbe on KeyDB master containers + ## @param master.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param master.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param master.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param master.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param master.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## @param master.readinessProbe.enabled Enable readinessProbe on KeyDB master containers + ## @param master.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param master.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param master.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param master.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param master.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + ## @param master.startupProbe.enabled Enable startupProbe on KeyDB master containers + ## @param master.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param master.startupProbe.periodSeconds Period seconds for startupProbe + ## @param master.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param master.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param master.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 20 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## @param master.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param master.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param master.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## KeyDB master resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param master.resourcesPreset Set KeyDB master container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param master.resources Set KeyDB master container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param master.podSecurityContext.enabled Enable KeyDB master pods' Security Context + ## @param master.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for KeyDB master pods + ## @param master.podSecurityContext.sysctls Set kernel settings using the sysctl interface for KeyDB master pods + ## @param master.podSecurityContext.supplementalGroups Set filesystem extra groups for KeyDB master pods + ## @param master.podSecurityContext.fsGroup Set fsGroup in KeyDB master pods' Security Context + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param master.containerSecurityContext.enabled Enabled KeyDB master container' Security Context + ## @param master.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in KeyDB master container + ## @param master.containerSecurityContext.runAsUser Set runAsUser in KeyDB master container' Security Context + ## @param master.containerSecurityContext.runAsGroup Set runAsGroup in KeyDB master container' Security Context + ## @param master.containerSecurityContext.runAsNonRoot Set runAsNonRoot in KeyDB master container' Security Context + ## @param master.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in KeyDB master container' Security Context + ## @param master.containerSecurityContext.privileged Set privileged in KeyDB master container' Security Context + ## @param master.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in KeyDB master container' Security Context + ## @param master.containerSecurityContext.capabilities.drop List of capabilities to be dropped in KeyDB master container + ## @param master.containerSecurityContext.seccompProfile.type Set seccomp profile in KeyDB master container + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param master.configuration Exclusive configuration for KeyDB master nodes (appended to common one) + ## ref: https://docs.keydb.dev/docs/config-file + ## + configuration: "" + ## @param master.existingConfigmap The name of an existing ConfigMap with your custom configuration for KeyDB master + ## + existingConfigmap: "" + ## @param master.disableCommands Array with KeyDB commands to disable on master nodes + ## Commands will be completely disabled by renaming each to an empty string. + ## ref: https://docs.keydb.dev/docs/commands + ## + disableCommands: + - FLUSHDB + - FLUSHALL + ## @param master.command Override default KeyDB master container command (useful when using custom images) + ## + command: [] + ## @param master.args Override default KeyDB master container args (useful when using custom images) + ## + args: [] + ## @param master.automountServiceAccountToken Mount Service Account token in KeyDB master pods + ## + automountServiceAccountToken: false + ## @param master.hostAliases KeyDB master pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param master.statefulsetAnnotations Annotations for KeyDB master statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param master.podLabels Extra labels for KeyDB master pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param master.podAnnotations Annotations for KeyDB master pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param master.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param master.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param master.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param master.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set + ## + key: "" + ## @param master.nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param master.affinity Affinity for KeyDB master pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `podAffinityPreset`, `podAntiAffinityPreset`, and `nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param master.nodeSelector Node labels for KeyDB master pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param master.tolerations Tolerations for KeyDB master pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param master.updateStrategy.type KeyDB master strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## @param master.priorityClassName KeyDB master pods' priorityClassName + ## + priorityClassName: "" + ## @param master.topologySpreadConstraints Topology Spread Constraints for KeyDB master pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param master.schedulerName Name of the k8s scheduler (other than default) for KeyDB master pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param master.terminationGracePeriodSeconds Seconds KeyDB master pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param master.lifecycleHooks for KeyDB master containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param master.extraEnvVars Array with extra environment variables to add to KeyDB master containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param master.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for KeyDB master containers + ## + extraEnvVarsCM: "" + ## @param master.extraEnvVarsSecret Name of existing Secret containing extra env vars for KeyDB master containers + ## + extraEnvVarsSecret: "" + ## @param master.extraVolumes Optionally specify extra list of additional volumes for the KeyDB master pods + ## + extraVolumes: [] + ## @param master.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the KeyDB master containers + ## + extraVolumeMounts: [] + ## @param master.sidecars Add additional sidecar containers to the KeyDB master pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param master.initContainers Add additional init containers to the KeyDB master pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param master.pdb.create Enable/disable a Pod Disruption Budget creation for KeyDB master pods + ## @param master.pdb.minAvailable Minimum number/percentage of KeyDB master pods that should remain scheduled + ## @param master.pdb.maxUnavailable Maximum number/percentage of KeyDB master pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param master.autoscaling.vpa.enabled Enable VPA for KeyDB master pods + ## @param master.autoscaling.vpa.annotations Annotations for VPA resource + ## @param master.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param master.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param master.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param master.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @section KeyDB Master Persistence Parameters + ## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes + ## + persistence: + ## @param master.persistence.enabled Enable persistence using Persistent Volume Claims + ## + enabled: true + ## @param master.persistence.mountPath Path to mount the data volume at on KeyDB master containers + ## + mountPath: /bitnami/keydb/data + ## @param master.persistence.subPath The subdirectory of the volume to mount on KeyDB master containers + ## + subPath: "" + ## @param master.persistence.medium Provide a medium for `emptyDir` volumes + ## + medium: "" + ## @param master.persistence.sizeLimit Set this to enable a size limit for `emptyDir` volumes + ## + sizeLimit: "" + ## @param master.persistence.storageClass Storage class of backing PVC + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "" + ## @param master.persistence.annotations Additional Persistent Volume Claim annotations + ## + annotations: {} + ## @param master.persistence.accessModes Persistent Volume Access Modes + ## + accessModes: + - ReadWriteOnce + ## @param master.persistence.size Size of data volume + ## + size: 8Gi + ## @param master.persistence.selector Selector to match an existing Persistent Volume for WordPress data PVC + ## If set, the PVC can't have a PV dynamically provisioned for it + ## E.g. + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param master.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## @param master.persistence.existingClaim The name of an existing PVC to use for persistence (only if master.replicaCount=1) + ## + existingClaim: "" + ## persistentVolumeClaimRetentionPolicy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## @param master.persistentVolumeClaimRetentionPolicy.enabled Controls if and how PVCs are deleted during the lifecycle of a StatefulSet + ## @param master.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## @param master.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + persistentVolumeClaimRetentionPolicy: + enabled: false + whenScaled: Retain + whenDeleted: Retain + ## @section KeyDB Master Traffic Exposure Parameters + ## KeyDB Master service parameters + ## + service: + ## @param master.service.type KeyDB master service type + ## + type: ClusterIP + ## @param master.service.ports.keydb KeyDB master service port + ## + ports: + keydb: 6379 + ## Node ports to expose + ## @param master.service.nodePorts.keydb Node port for KeyDB master + ## NOTE: choose port between <30000-32767> + ## + nodePorts: + keydb: "" + ## @param master.service.clusterIP KeyDB master service Cluster IP + ## e.g.: + ## clusterIP: None + ## + clusterIP: "" + ## @param master.service.loadBalancerIP KeyDB master service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer + ## + loadBalancerIP: "" + ## @param master.service.loadBalancerSourceRanges KeyDB master service Load Balancer sources + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g: + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param master.service.externalTrafficPolicy KeyDB master service external traffic policy + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param master.service.annotations Additional custom annotations for KeyDB master service + ## + annotations: {} + ## @param master.service.extraPorts Extra ports to expose in KeyDB master service (normally used with the `sidecars` value) + ## + extraPorts: [] + ## @param master.service.sessionAffinity Control where client requests go, to the same pod or round-robin + ## Values: ClientIP or None + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/ + ## + sessionAffinity: None + ## @param master.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param master.service.headless.annotations Annotations for the headless service. + ## + annotations: {} + ## KeyDB Master Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param master.networkPolicy.enabled Specifies whether a NetworkPolicy should be created for KeyDB master + ## + enabled: true + ## @param master.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param master.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param master.networkPolicy.addExternalClientAccess Allow access from pods with client label set to "true". Ignored if `networkPolicy.allowExternal` is true. + ## + addExternalClientAccess: true + ## @param master.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param master.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param master.networkPolicy.ingressPodMatchLabels [object] Labels to match to allow traffic from other pods. Ignored if `networkPolicy.allowExternal` is true. + ## e.g: + ## ingressPodMatchLabels: + ## my-client: "true" + # + ingressPodMatchLabels: {} + ## @param master.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. + ## @param master.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + +## @section KeyDB Replicas Configuration Parameters +## +replica: + ## @param replica.replicaCount Number of KeyDB replicas to deploy + ## + replicaCount: 1 + ## @param replica.containerPorts.keydb Container port to open on KeyDB replicas nodes + ## + containerPorts: + keydb: 6379 + ## @param replica.extraContainerPorts Optionally specify extra list of additional ports for KeyDB replicas containers + ## e.g: + ## extraContainerPorts: + ## - name: myservice + ## containerPort: 9090 + ## + extraContainerPorts: [] + ## Configure extra options for KeyDB replicas containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param replica.livenessProbe.enabled Enable livenessProbe on KeyDB replicas containers + ## @param replica.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param replica.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param replica.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param replica.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param replica.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## @param replica.readinessProbe.enabled Enable readinessProbe on KeyDB replicas containers + ## @param replica.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param replica.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param replica.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param replica.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param replica.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 20 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + ## @param replica.startupProbe.enabled Enable startupProbe on KeyDB replicas containers + ## @param replica.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param replica.startupProbe.periodSeconds Period seconds for startupProbe + ## @param replica.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param replica.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param replica.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 20 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## @param replica.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param replica.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param replica.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## KeyDB replicas resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param replica.resourcesPreset Set KeyDB replicas container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param replica.resources Set KeyDB replicas container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param replica.podSecurityContext.enabled Enable KeyDB replicas pods' Security Context + ## @param replica.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for KeyDB replicas pods + ## @param replica.podSecurityContext.sysctls Set kernel settings using the sysctl interface for KeyDB replicas pods + ## @param replica.podSecurityContext.supplementalGroups Set filesystem extra groups for KeyDB replicas pods + ## @param replica.podSecurityContext.fsGroup Set fsGroup in KeyDB replicas pods' Security Context + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param replica.containerSecurityContext.enabled Enabled KeyDB replicas container' Security Context + ## @param replica.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in KeyDB replicas container + ## @param replica.containerSecurityContext.runAsUser Set runAsUser in KeyDB replicas container' Security Context + ## @param replica.containerSecurityContext.runAsGroup Set runAsGroup in KeyDB replicas container' Security Context + ## @param replica.containerSecurityContext.runAsNonRoot Set runAsNonRoot in KeyDB replicas container' Security Context + ## @param replica.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in KeyDB replicas container' Security Context + ## @param replica.containerSecurityContext.privileged Set privileged in KeyDB replicas container' Security Context + ## @param replica.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in KeyDB replicas container' Security Context + ## @param replica.containerSecurityContext.capabilities.drop List of capabilities to be dropped in KeyDB replicas container + ## @param replica.containerSecurityContext.seccompProfile.type Set seccomp profile in KeyDB replicas container + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param replica.activeReplica Configure replica as an active replica + ## + activeReplica: false + ## @param replica.configuration Exclusive configuration for KeyDB replicas nodes (appended to common one) + ## ref: https://docs.keydb.dev/docs/config-file + ## + configuration: "" + ## @param replica.existingConfigmap The name of an existing ConfigMap with your custom configuration for KeyDB replicas + ## + existingConfigmap: "" + ## @param replica.disableCommands Array with KeyDB commands to disable on master nodes + ## Commands will be completely disabled by renaming each to an empty string. + ## ref: https://docs.keydb.dev/docs/commands + ## + disableCommands: + - FLUSHDB + - FLUSHALL + ## @param replica.command Override default KeyDB replicas container command (useful when using custom images) + ## + command: [] + ## @param replica.args Override default KeyDB replicas container args (useful when using custom images) + ## + args: [] + ## @param replica.automountServiceAccountToken Mount Service Account token in KeyDB replicas pods + ## + automountServiceAccountToken: false + ## @param replica.hostAliases KeyDB replicas pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param replica.statefulsetAnnotations Annotations for KeyDB replicas statefulset + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + statefulsetAnnotations: {} + ## @param replica.podLabels Extra labels for KeyDB replicas pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param replica.podAnnotations Annotations for KeyDB replicas pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param replica.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param replica.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param replica.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param replica.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set + ## + key: "" + ## @param replica.nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param replica.affinity Affinity for KeyDB replicas pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `podAffinityPreset`, `podAntiAffinityPreset`, and `nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param replica.nodeSelector Node labels for KeyDB replicas pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param replica.tolerations Tolerations for KeyDB replicas pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param replica.updateStrategy.type KeyDB replicas strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + ## @param replica.priorityClassName KeyDB replicas pods' priorityClassName + ## + priorityClassName: "" + ## @param replica.topologySpreadConstraints Topology Spread Constraints for KeyDB replicas pod assignment spread across your cluster among failure-domains + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param replica.schedulerName Name of the k8s scheduler (other than default) for KeyDB replicas pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param replica.terminationGracePeriodSeconds Seconds KeyDB replicas pods need to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param replica.lifecycleHooks for KeyDB replicas containers to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param replica.extraEnvVars Array with extra environment variables to add to KeyDB replicas containers + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param replica.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for KeyDB replicas containers + ## + extraEnvVarsCM: "" + ## @param replica.extraEnvVarsSecret Name of existing Secret containing extra env vars for KeyDB replicas containers + ## + extraEnvVarsSecret: "" + ## @param replica.extraVolumes Optionally specify extra list of additional volumes for the KeyDB replicas pods + ## + extraVolumes: [] + ## @param replica.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the KeyDB replicas containers + ## + extraVolumeMounts: [] + ## @param replica.sidecars Add additional sidecar containers to the KeyDB replicas pods + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param replica.initContainers Add additional init containers to the KeyDB replicas pods + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param replica.pdb.create Enable/disable a Pod Disruption Budget creation for KeyDB replicas pods + ## @param replica.pdb.minAvailable Minimum number/percentage of KeyDB replicas pods that should remain scheduled + ## @param replica.pdb.maxUnavailable Maximum number/percentage of KeyDB replicas pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## Autoscaling configuration + ## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/ + ## + autoscaling: + ## @param replica.autoscaling.vpa.enabled Enable VPA for KeyDB replicas pods + ## @param replica.autoscaling.vpa.annotations Annotations for VPA resource + ## @param replica.autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory + ## @param replica.autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod + ## @param replica.autoscaling.vpa.minAllowed VPA Min allowed resources for the pod + ## + vpa: + enabled: false + annotations: {} + controlledResources: [] + maxAllowed: {} + minAllowed: {} + ## @param replica.autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy + ## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod + ## Possible values are "Off", "Initial", "Recreate", and "Auto". + ## + updatePolicy: + updateMode: Auto + ## @param replica.autoscaling.hpa.enabled Enable HPA for KeyDB Replicas pods + ## @param replica.autoscaling.hpa.minReplicas Minimum number of replicas + ## @param replica.autoscaling.hpa.maxReplicas Maximum number of replicas + ## @param replica.autoscaling.hpa.targetCPU Target CPU utilization percentage + ## @param replica.autoscaling.hpa.targetMemory Target Memory utilization percentage + ## + hpa: + enabled: false + minReplicas: "" + maxReplicas: "" + targetCPU: "" + targetMemory: "" + ## @section KeyDB Replicas Persistence Parameters + ## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes + ## + persistence: + ## @param replica.persistence.enabled Enable persistence using Persistent Volume Claims + ## + enabled: true + ## @param replica.persistence.mountPath Path to mount the data volume at on KeyDB replicas containers + ## + mountPath: /bitnami/keydb/data + ## @param replica.persistence.subPath The subdirectory of the volume to mount on KeyDB replicas containers + ## + subPath: "" + ## @param replica.persistence.medium Provide a medium for `emptyDir` volumes + ## + medium: "" + ## @param replica.persistence.sizeLimit Set this to enable a size limit for `emptyDir` volumes + ## + sizeLimit: "" + ## @param replica.persistence.storageClass Storage class of backing PVC + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "" + ## @param replica.persistence.annotations Additional Persistent Volume Claim annotations + ## + annotations: {} + ## @param replica.persistence.accessModes Persistent Volume Access Modes + ## + accessModes: + - ReadWriteOnce + ## @param replica.persistence.size Size of data volume + ## + size: 8Gi + ## @param replica.persistence.selector Selector to match an existing Persistent Volume for WordPress data PVC + ## If set, the PVC can't have a PV dynamically provisioned for it + ## E.g. + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param replica.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## @param replica.persistence.existingClaim The name of an existing PVC to use for persistence (only if replica.replicaCount=1) + ## + existingClaim: "" + ## persistentVolumeClaimRetentionPolicy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## @param replica.persistentVolumeClaimRetentionPolicy.enabled Controls if and how PVCs are deleted during the lifecycle of a StatefulSet + ## @param replica.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## @param replica.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + persistentVolumeClaimRetentionPolicy: + enabled: false + whenScaled: Retain + whenDeleted: Retain + ## @section KeyDB Replicas Traffic Exposure Parameters + ## KeyDB Replicas service parameters + ## + service: + ## @param replica.service.type KeyDB replicas service type + ## + type: ClusterIP + ## @param replica.service.ports.keydb KeyDB replicas service port + ## + ports: + keydb: 6379 + ## Node ports to expose + ## @param replica.service.nodePorts.keydb Node port for KeyDB replicas + ## NOTE: choose port between <30000-32767> + ## + nodePorts: + keydb: "" + ## @param replica.service.clusterIP KeyDB replicas service Cluster IP + ## e.g.: + ## clusterIP: None + ## + clusterIP: "" + ## @param replica.service.loadBalancerIP KeyDB replicas service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer + ## + loadBalancerIP: "" + ## @param replica.service.loadBalancerSourceRanges KeyDB replicas service Load Balancer sources + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g: + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param replica.service.externalTrafficPolicy KeyDB replicas service external traffic policy + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param replica.service.annotations Additional custom annotations for KeyDB replicas service + ## + annotations: {} + ## @param replica.service.extraPorts Extra ports to expose in KeyDB replicas service (normally used with the `sidecars` value) + ## + extraPorts: [] + ## @param replica.service.sessionAffinity Control where client requests go, to the same pod or round-robin + ## Values: ClientIP or None + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/ + ## + sessionAffinity: None + ## @param replica.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param replica.service.headless.annotations Annotations for the headless service. + ## + annotations: {} + ## KeyDB Replicas Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param replica.networkPolicy.enabled Specifies whether a NetworkPolicy should be created for KeyDB replicas + ## + enabled: true + ## @param replica.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param replica.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param replica.networkPolicy.addExternalClientAccess Allow access from pods with client label set to "true". Ignored if `networkPolicy.allowExternal` is true. + ## + addExternalClientAccess: true + ## @param replica.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param replica.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param replica.networkPolicy.ingressPodMatchLabels [object] Labels to match to allow traffic from other pods. Ignored if `networkPolicy.allowExternal` is true. + ## e.g: + ## ingressPodMatchLabels: + ## my-client: "true" + # + ingressPodMatchLabels: {} + ## @param replica.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. + ## @param replica.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces. Ignored if `networkPolicy.allowExternal` is true. + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + +## @section Metrics Parameters +## +metrics: + ## @param metrics.enabled Start a sidecar Prometheus exporter to expose KeyDB metrics + ## + enabled: false + ## Bitnami Redis Exporter image + ## ref: https://hub.docker.com/r/bitnami/redis-exporter/tags/ + ## @param metrics.image.registry [default: REGISTRY_NAME] Redis Exporter image registry + ## @param metrics.image.repository [default: REPOSITORY_NAME/redis-exporter] Redis Exporter image repository + ## @skip metrics.image.tag Redis Exporter image tag (immutable tags are recommended) + ## @param metrics.image.digest Redis Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param metrics.image.pullPolicy Redis Exporter image pull policy + ## @param metrics.image.pullSecrets Redis Exporter image pull secrets + ## + image: + registry: docker.io + repository: bitnami/redis-exporter + tag: 1.62.0-debian-12-r3 + digest: "" + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param metrics.containerPorts.http Metrics HTTP container port + ## + containerPorts: + http: 9121 + ## Configure extra options for KeyDB containers' liveness, readiness & startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ + ## @param metrics.startupProbe.enabled Enable startupProbe on KeyDB replicas nodes + ## @param metrics.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param metrics.startupProbe.periodSeconds Period seconds for startupProbe + ## @param metrics.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param metrics.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param metrics.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## @param metrics.livenessProbe.enabled Enable livenessProbe on KeyDB replicas nodes + ## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## @param metrics.readinessProbe.enabled Enable readinessProbe on KeyDB replicas nodes + ## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + ## @param metrics.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param metrics.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param metrics.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param metrics.command Override default metrics container init command (useful when using custom images) + ## + command: [] + ## @param metrics.keydbHost A way to specify an alternative KeyDB hostname + ## Useful for certificate CN/SAN matching + ## + keydbHost: "localhost" + ## @param metrics.extraArgs Extra arguments for KeyDB metrics exporter, for example: + ## e.g.: + ## extraArgs: + ## check-keys: myKey,myOtherKey + ## + extraArgs: {} + ## @param metrics.extraEnvVars Array with extra environment variables to add to KeyDB metrics exporter + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param metrics.containerSecurityContext.enabled Enabled KeyDB metrics exporter containers' Security Context + ## @param metrics.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param metrics.containerSecurityContext.runAsUser Set KeyDB metrics exporter containers' Security Context runAsUser + ## @param metrics.containerSecurityContext.runAsGroup Set KeyDB metrics exporter containers' Security Context runAsGroup + ## @param metrics.containerSecurityContext.runAsNonRoot Set KeyDB metrics exporter containers' Security Context runAsNonRoot + ## @param metrics.containerSecurityContext.allowPrivilegeEscalation Set KeyDB metrics exporter containers' Security Context allowPrivilegeEscalation + ## @param metrics.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context read-only root filesystem + ## @param metrics.containerSecurityContext.seccompProfile.type Set KeyDB metrics exporter containers' Security Context seccompProfile + ## @param metrics.containerSecurityContext.capabilities.drop Set KeyDB metrics exporter containers' Security Context capabilities to drop + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + capabilities: + drop: ["ALL"] + ## @param metrics.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the KeyDB metrics sidecar + ## + extraVolumeMounts: [] + ## KeyDB metrics exporter resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## @param metrics.podLabels Extra labels for KeyDB metrics exporter pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param metrics.podAnnotations [object] Annotations for KeyDB metrics exporter pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "{{ .Values.metrics.containerPorts.http }}" + ## KeyDB metrics exporter service properties + ## + service: + ## @param metrics.service.port Metrics service port + ## + port: 9121 + ## @param metrics.service.annotations Annotations for the metrics service + ## + annotations: {} + ## Prometheus Operator ServiceMonitor configuration + ## + serviceMonitor: + ## @param metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) + ## + enabled: false + ## @param metrics.serviceMonitor.namespace Namespace in which Prometheus is running + ## + namespace: "" + ## @param metrics.serviceMonitor.annotations Additional custom annotations for the ServiceMonitor + ## + annotations: {} + ## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor + ## + labels: {} + ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus + ## + jobLabel: "" + ## @param metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels + ## + honorLabels: false + ## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped. + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## e.g: + ## interval: 10s + ## + interval: "" + ## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## e.g: + ## scrapeTimeout: 10s + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.relabelings Specify general relabeling + ## + relabelings: [] + ## @param metrics.serviceMonitor.selector Prometheus instance selector labels + ## ref: https://github.com/bitnami/charts/tree/main/bitnami/prometheus-operator#prometheus-configuration + ## selector: + ## prometheus: my-prometheus + ## + selector: {} + ## Custom PrometheusRule to be defined + ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions + ## + prometheusRule: + ## @param metrics.prometheusRule.enabled Create a custom prometheusRule Resource for scraping metrics using PrometheusOperator + ## + enabled: false + ## @param metrics.prometheusRule.namespace The namespace in which the prometheusRule will be created + ## + namespace: "" + ## @param metrics.prometheusRule.annotations Additional custom annotations for the prometheusRule + ## + annotations: {} + ## @param metrics.prometheusRule.labels Extra labels for the prometheusRule + ## + labels: {} + ## @param metrics.prometheusRule.rules Custom Prometheus rules + ## e.g: + ## rules: + ## - alert: KeyDBDown + ## expr: redis_up{service="{{ include "common.names.fullname" . }}-metrics"} == 0 + ## for: 2m + ## labels: + ## severity: error + ## annotations: + ## summary: KeyDB instance {{ "{{ $labels.instance }}" }} down + ## description: KeyDB instance {{ "{{ $labels.instance }}" }} is down + ## - alert: KeyDBMemoryHigh + ## expr: > + ## redis_memory_used_bytes{service="{{ include "common.names.fullname" . }}-metrics"} * 100 + ## / + ## redis_memory_max_bytes{service="{{ include "common.names.fullname" . }}-metrics"} + ## > 90 + ## for: 2m + ## labels: + ## severity: error + ## annotations: + ## summary: KeyDB instance {{ "{{ $labels.instance }}" }} is using too much memory + ## description: | + ## KeyDB instance {{ "{{ $labels.instance }}" }} is using {{ "{{ $value }}" }}% of its available memory. + ## - alert: KeyDBKeyEviction + ## expr: | + ## increase(redis_evicted_keys_total{service="{{ include "common.names.fullname" . }}-metrics"}[5m]) > 0 + ## for: 1s + ## labels: + ## severity: error + ## annotations: + ## summary: KeyDB instance {{ "{{ $labels.instance }}" }} has evicted keys + ## description: | + ## KeyDB instance {{ "{{ $labels.instance }}" }} has evicted {{ "{{ $value }}" }} keys in the last 5 minutes. + ## + rules: [] + +## @section Other Parameters + +## ServiceAccount configuration +## +serviceAccount: + ## @param serviceAccount.create Specifies whether a ServiceAccount should be created for KeyDB replicas pods + ## + create: true + ## @param serviceAccount.name The name of the ServiceAccount to use + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param serviceAccount.annotations Additional Service Account annotations (evaluated as a template) + ## + annotations: {} + ## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## + automountServiceAccountToken: true + +## @section Init Container Parameters +## + +## 'volumePermissions' init container parameters +## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values +## based on the *podSecurityContext/*containerSecurityContext parameters +## +volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` + ## + enabled: false + ## OS Shell + Utility image + ## ref: https://hub.docker.com/r/bitnami/os-shell/tags/ + ## @param volumePermissions.image.registry [default: REGISTRY_NAME] OS Shell + Utility image registry + ## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] OS Shell + Utility image repository + ## @skip volumePermissions.image.tag OS Shell + Utility image tag (immutable tags are recommended) + ## @param volumePermissions.image.pullPolicy OS Shell + Utility image pull policy + ## @param volumePermissions.image.pullSecrets OS Shell + Utility image pull secrets + ## + image: + registry: docker.io + repository: bitnami/os-shell + tag: 12-debian-12-r27 + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Init container's resource requests and limits + ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param volumePermissions.resourcesPreset Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param volumePermissions.resources Set init container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Init container Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param volumePermissions.containerSecurityContext.enabled Enabled init container' Security Context + ## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in init container + ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser + ## NOTE: when runAsUser is set to special value "auto", init container will try to chown the + ## data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` + ## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed) + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 0