Fail if partitions enabled with federation #892
Conversation
thisisnotashwin
force-pushed
the
fail-if-partitions-enabled-with-federation
branch
from
6e9a73f
to
0e4d3a0
Compare
thisisnotashwin
requested review from
ishustava,
a team and
ndhanushkodi
and removed request for
a team
| @@ -2,6 +2,7 @@ | |||
| {{- if (and (and .Values.global.tls.enabled .Values.global.tls.httpsOnly) (and .Values.global.metrics.enabled .Values.global.metrics.enableAgentMetrics))}}{{ fail "global.metrics.enableAgentMetrics cannot be enabled if TLS (HTTPS only) is enabled" }}{{ end -}} | |||
| {{- $serverEnabled := (or (and (ne (.Values.server.enabled | toString) "-") .Values.server.enabled) (and (eq (.Values.server.enabled | toString) "-") .Values.global.enabled)) -}} | |||
| {{- if (and .Values.global.adminPartitions.enabled $serverEnabled (ne .Values.global.adminPartitions.name "default"))}}{{ fail "global.adminPartitions.name has to be \"default\" in the server cluster" }}{{ end -}} | |||
| {{- if and .Values.global.federation.enabled .Values.global.adminPartitions.enabled }}{{ fail "If global.federation.enabled is true, global.adminPartitions.enabled must be false because they are mutually exclusive" }}{{ end }} | |||
There was a problem hiding this comment.
do we need this check on the clients? I think federation is only possible if servers are also enabled
There was a problem hiding this comment.
That is true. I put a check on clients in case someone was using a values file with federation set to enabled on a non-default admin partition.
There was a problem hiding this comment.
I think federation is only possible if servers are also enabled
I think actually we require federation: true if doing HCP federation. I can double check.
There was a problem hiding this comment.
So we have a situation where we might have federation enabled and partitions enabled? Consul Core intends on disabling this. https://github.com/hashicorp/consul-enterprise/pull/1391
Am I confusing specifics?
There was a problem hiding this comment.
I'm saying that I think we need to keep this check here rather than on the server statefulset since potentially someone has:
server:
enabled: false
global:
federation:
enabled: true
Although that being said I haven't had time to find out if we actually do use this for HCP fed.
thisisnotashwin
deleted the
fail-if-partitions-enabled-with-federation
branch
Changes proposed in this PR:
How I've tested this PR:
How I expect reviewers to test this PR:
Checklist: