etcd-statefulset.yaml

{{ if or (and (not .Values.embeddedEtcd.enabled) (not .Values.headless ) (not .Values.etcd.disabled )) .Values.embeddedEtcd.migrateFromEtcd }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ .Release.Name }}-etcd
  namespace: {{ .Release.Namespace }}
  labels:
    app: vcluster-etcd
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
{{- if .Values.etcd.labels }}
{{ toYaml .Values.etcd.labels | indent 4 }}
{{- end }}
  {{- $annotations := merge .Values.globalAnnotations .Values.etcd.annotations }}
  {{- if $annotations }}
  annotations:
{{ toYaml $annotations | indent 4 }}
  {{- end }}
spec:
  serviceName: {{ .Release.Name }}-etcd-headless
  {{- if .Values.autoDeletePersistentVolumeClaims }}
  {{- if ge (int .Capabilities.KubeVersion.Minor) 27 }}
  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Delete
  {{- end }}
  {{- end }}
  replicas: {{ .Values.etcd.replicas }}
  podManagementPolicy: Parallel
  selector:
    matchLabels:
      app: vcluster-etcd
      release: {{ .Release.Name }}
  {{- if (hasKey .Values.etcd "volumeClaimTemplates") }}
  volumeClaimTemplates:
{{ toYaml .Values.etcd.volumeClaimTemplates | indent 4 }}
  {{- else if .Values.etcd.storage.persistence }}
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: [ "ReadWriteOnce" ]
        {{- if .Values.etcd.storage.className}}
        storageClassName: {{ .Values.etcd.storage.className }}
        {{- end }}
        resources:
          requests:
            storage: {{ .Values.etcd.storage.size }}
  {{- end }}
  template:
    metadata:
  {{- if .Values.etcd.podAnnotations }}
      annotations:
{{ toYaml .Values.etcd.podAnnotations | indent 8 }}
  {{- end }}
      labels:
        app: vcluster-etcd
        release: {{ .Release.Name }}
      {{- range $k, $v := .Values.etcd.podLabels }}
        {{ $k }}: {{ $v | quote }}
      {{- end }}
    spec:
      terminationGracePeriodSeconds: 10
      {{- if .Values.etcd.affinity }}
      affinity:
{{ toYaml .Values.etcd.affinity | indent 8 }}
      {{- else }}
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          # if possible avoid scheduling more than one pod on one node
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - vcluster-etcd
                - key: release
                  operator: In
                  values:
                  - {{ .Release.Name }}
              topologyKey: "kubernetes.io/hostname"
          # if possible avoid scheduling pod onto node that is in the same zone as one or more vcluster pods are running
          - weight: 50
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - vcluster-etcd
                - key: release
                  operator: In
                  values:
                  - {{ .Release.Name }}
              topologyKey: topology.kubernetes.io/zone
      {{- end }}
      {{- if .Values.etcd.topologySpreadConstraints }}
      topologySpreadConstraints:
{{ toYaml .Values.etcd.topologySpreadConstraints | indent 8 }}
      {{- end }}
      nodeSelector:
{{ toYaml .Values.etcd.nodeSelector | indent 8 }}
      tolerations:
{{ toYaml .Values.etcd.tolerations | indent 8 }}
      automountServiceAccountToken: false
      {{- if .Values.serviceAccount.name }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      {{- else }}
      serviceAccountName: vc-{{ .Release.Name }}
      {{- end }}
      volumes:
        - name: certs
          secret:
            secretName: {{ .Release.Name }}-certs
      {{- if .Values.etcd.volumes }}
{{ toYaml .Values.etcd.volumes | indent 8 }}
      {{- end }}
      {{- if not .Values.etcd.storage.persistence }}
        - name: data
          emptyDir: {}
      {{- end }}
      {{- if .Values.etcd.priorityClassName }}
      priorityClassName: {{ .Values.etcd.priorityClassName }}
      {{- end }}
      {{- if .Values.etcd.fsGroup }}
      securityContext:
        fsGroup: {{ .Values.etcd.fsGroup }}
      {{- end }}
      containers:
      - name: etcd
        image: "{{ .Values.defaultImageRegistry }}{{ .Values.etcd.image }}"
        command:
          - etcd
          - '--cert-file=/run/config/pki/etcd-server.crt'
          - '--client-cert-auth=true'
          - '--data-dir=/var/lib/etcd'
          - '--advertise-client-urls=https://$(NAME).{{ .Release.Name }}-etcd-headless.{{ .Release.Namespace }}:2379'
          - '--initial-advertise-peer-urls=https://$(NAME).{{ .Release.Name }}-etcd-headless.{{ .Release.Namespace }}:2380'
          {{- $releaseName := .Release.Name -}}
          {{- $releaseNamespace := .Release.Namespace }}
          - '--initial-cluster={{ range $index := untilStep 0 (int .Values.etcd.replicas) 1 }}{{ if (ne (int $index) 0) }},{{ end }}{{ $releaseName }}-etcd-{{ $index }}=https://{{ $releaseName }}-etcd-{{ $index }}.{{ $releaseName }}-etcd-headless.{{ $releaseNamespace }}:2380{{ end }}'
          - '--initial-cluster-token={{ .Release.Name }}'
          - '--initial-cluster-state=new'
          - '--listen-client-urls=https://0.0.0.0:2379'
          - '--listen-metrics-urls=http://0.0.0.0:2381'
          - '--listen-peer-urls=https://0.0.0.0:2380'
          - '--key-file=/run/config/pki/etcd-server.key'
          - '--name=$(NAME)'
          - '--peer-cert-file=/run/config/pki/etcd-peer.crt'
          - '--peer-client-cert-auth=true'
          - '--peer-key-file=/run/config/pki/etcd-peer.key'
          - '--peer-trusted-ca-file=/run/config/pki/etcd-ca.crt'
          - '--snapshot-count=10000'
          - '--trusted-ca-file=/run/config/pki/etcd-ca.crt'
          {{- range $f := .Values.etcd.extraArgs }}
          - {{ $f | quote }}
          {{- end }}
        securityContext:
{{ toYaml .Values.etcd.securityContext | indent 10 }}
        env:
        - name: NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        {{- if .Values.etcd.env }}
{{ toYaml .Values.etcd.env | indent 10 }}
        {{- end }}
        volumeMounts:
          - name: data
            mountPath: /var/lib/etcd
          - mountPath: /run/config/pki
            name: certs
            readOnly: true
        {{- if .Values.etcd.volumeMounts }}
{{ toYaml .Values.etcd.volumeMounts | indent 10 }}
        {{- end }}
        resources:
{{ toYaml .Values.etcd.resources | indent 10 }}
        livenessProbe:
          httpGet:
            path: /health
            port: 2381
            scheme: HTTP
          initialDelaySeconds: 10
          timeoutSeconds: 15
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 8
        startupProbe:
          httpGet:
            path: /health
            port: 2381
            scheme: HTTP
          initialDelaySeconds: 10
          timeoutSeconds: 15
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 24
        {{- if .Values.etcd.imagePullPolicy }}
        imagePullPolicy: {{ .Values.etcd.imagePullPolicy }}
        {{- end }}
{{ end }}