First Commit
This commit is contained in:
Corrado Mulas
13
.helmignore
Normal file
13
.helmignore
Normal file
@@ -0,0 +1,13 @@
|
||||
# Patterns to ignore when building packages.
|
||||
.DS_Store
|
||||
.git/
|
||||
.gitignore
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
.idea/
|
||||
.vscode/
|
||||
# Argo CD examples live next to the chart but are not rendered by it.
|
||||
argocd/
|
||||
21
Chart.yaml
Normal file
21
Chart.yaml
Normal file
@@ -0,0 +1,21 @@
|
||||
apiVersion: v2
|
||||
name: redis-cluster
|
||||
description: >-
|
||||
Sharded, highly available Redis Cluster with multiple writable primaries,
|
||||
per-shard replicas, automatic failover, and Prometheus metrics.
|
||||
type: application
|
||||
version: 0.4.0
|
||||
appVersion: "7.4"
|
||||
kubeVersion: ">=1.25.0-0"
|
||||
home: https://git.mulas.me/corrado/redis-cluster
|
||||
sources:
|
||||
- https://git.mulas.me/corrado/redis-cluster
|
||||
- https://github.com/redis/redis
|
||||
keywords:
|
||||
- redis
|
||||
- redis-cluster
|
||||
- sharding
|
||||
- high-availability
|
||||
- cache
|
||||
maintainers:
|
||||
- name: corrado.mulas
|
||||
2
LICENSE
2
LICENSE
@@ -1,4 +1,4 @@
|
||||
Copyright (c) 2026 corrado.
|
||||
Copyright (c) 2026 Corrado Mulas <tlc (at) mulas.me>.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
|
||||
|
||||
|
||||
987
README.md
987
README.md
@@ -1,3 +1,988 @@
|
||||
# redis-cluster
|
||||
|
||||
Helm chart for Kubernetes Redis sharded cluster with cross-readers
|
||||
A production-oriented Helm chart for a native, sharded Redis Cluster on
|
||||
Kubernetes. It creates multiple independently writable shard primaries, one or
|
||||
more readable failover replicas for every shard, strict cross-node placement,
|
||||
persistent storage, optional external cluster-aware access, Prometheus metrics,
|
||||
and an optional RedisInsight UI.
|
||||
|
||||
This chart deploys Redis Cluster mode. It does not deploy Sentinel, a proxy, or
|
||||
an active-active database. Every hash slot has exactly one writable primary;
|
||||
write capacity scales because different slot ranges belong to different
|
||||
primaries.
|
||||
|
||||
## Contents
|
||||
|
||||
- [Architecture](#architecture)
|
||||
- [Requirements](#requirements)
|
||||
- [Quick start](#quick-start)
|
||||
- [Connecting clients](#connecting-clients)
|
||||
- [Authentication](#authentication)
|
||||
- [Persistence](#persistence)
|
||||
- [External access](#external-access)
|
||||
- [RedisInsight](#redisinsight)
|
||||
- [Metrics](#metrics)
|
||||
- [Network policy and service mesh](#network-policy-and-service-mesh)
|
||||
- [Scheduling and availability](#scheduling-and-availability)
|
||||
- [Safe upgrades](#safe-upgrades)
|
||||
- [Scaling and topology changes](#scaling-and-topology-changes)
|
||||
- [Backup and restore](#backup-and-restore)
|
||||
- [Argo CD](#argo-cd)
|
||||
- [Configuration reference](#configuration-reference)
|
||||
- [Troubleshooting](#troubleshooting)
|
||||
- [Uninstalling](#uninstalling)
|
||||
|
||||
## Architecture
|
||||
|
||||
The default topology is three shards with one replica per shard:
|
||||
|
||||
```text
|
||||
Kubernetes worker A Kubernetes worker B Kubernetes worker C
|
||||
------------------- ------------------- -------------------
|
||||
shard 0 member 0 shard 1 member 0 shard 2 member 0
|
||||
canonical primary canonical primary canonical primary
|
||||
|
||||
shard 2 member 1 shard 0 member 1 shard 1 member 1
|
||||
replica replica replica
|
||||
```
|
||||
|
||||
That produces six Redis instances:
|
||||
|
||||
```text
|
||||
3 writable primaries + 3 readable/failover replicas = 6 Redis pods
|
||||
```
|
||||
|
||||
Each persistent member is a separate one-replica StatefulSet with its own PVC.
|
||||
This design allows Kubernetes to enforce all of the following:
|
||||
|
||||
- all canonical primaries occupy different `kubernetes.io/hostname` domains;
|
||||
- the members of one shard never occupy the same node;
|
||||
- each replica is crossed onto the node containing another shard's primary;
|
||||
- member identities and Redis node IDs survive pod replacement.
|
||||
|
||||
At first boot, the shard-0 member-0 pod coordinates cluster creation. It waits
|
||||
for every pristine member, introduces all nodes, divides all 16,384 hash slots
|
||||
between the primaries, and attaches each replica to its intended primary. It
|
||||
refuses to overwrite partially initialized cluster state.
|
||||
|
||||
Redis can promote a replica after a primary failure. A reconciliation loop later
|
||||
returns the cluster to its canonical crossed layout after the failed node comes
|
||||
back. Redis Cluster replication is asynchronous; a narrow failure or partition
|
||||
window can still lose an acknowledged write.
|
||||
|
||||
## Requirements
|
||||
|
||||
- Kubernetes 1.25 or newer.
|
||||
- Helm 3.
|
||||
- At least `cluster.shards` schedulable worker nodes with distinct
|
||||
`kubernetes.io/hostname` labels. The default requires three workers.
|
||||
- Enough CPU and memory on those workers for every Redis and exporter pod.
|
||||
- A default StorageClass, or an explicit `persistence.storageClass`, when
|
||||
persistence is enabled.
|
||||
- Working pod DNS and unrestricted Redis client and cluster-bus traffic between
|
||||
members.
|
||||
|
||||
Optional features have additional requirements:
|
||||
|
||||
- external access requires a controller that implements `type: LoadBalancer`
|
||||
Services and populates `.status.loadBalancer.ingress`;
|
||||
- `metrics.serviceMonitor.enabled` requires the Prometheus Operator CRDs;
|
||||
- RedisInsight Istio ingress requires the Istio networking CRDs;
|
||||
- automatic RedisInsight certificate creation requires cert-manager.
|
||||
|
||||
## Quick start
|
||||
|
||||
Clone the repository and install an internal-only cluster:
|
||||
|
||||
```sh
|
||||
git clone https://git.mulas.me/corrado/redis-cluster.git
|
||||
cd redis-cluster
|
||||
|
||||
helm install redis . \
|
||||
--namespace redis \
|
||||
--create-namespace
|
||||
```
|
||||
|
||||
Wait for all six default members:
|
||||
|
||||
```sh
|
||||
kubectl get pods -n redis -w
|
||||
```
|
||||
|
||||
Check cluster health and slot coverage:
|
||||
|
||||
```sh
|
||||
kubectl exec -n redis redis-redis-cluster-s0-n0-0 -c redis -- \
|
||||
redis-cli cluster info
|
||||
|
||||
kubectl exec -n redis redis-redis-cluster-s0-n0-0 -c redis -- \
|
||||
redis-cli --cluster check 127.0.0.1:6379
|
||||
```
|
||||
|
||||
`cluster_state:ok`, `cluster_slots_ok:16384`, and zero failed slots indicate a
|
||||
healthy cluster.
|
||||
|
||||
### Recommended production values
|
||||
|
||||
Create a values file:
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
enabled: true
|
||||
existingSecret: redis-auth
|
||||
existingSecretKey: redis-password
|
||||
|
||||
persistence:
|
||||
storageClass: fast-storage
|
||||
size: 100Gi
|
||||
|
||||
redis:
|
||||
maxmemory: 80gb
|
||||
resources:
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 84Gi
|
||||
limits:
|
||||
memory: 88Gi
|
||||
|
||||
metrics:
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
allowExternal: false
|
||||
extraIngress:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: applications
|
||||
```
|
||||
|
||||
Create the password Secret without committing the password:
|
||||
|
||||
```sh
|
||||
kubectl create namespace redis
|
||||
kubectl create secret generic redis-auth \
|
||||
--namespace redis \
|
||||
--from-literal=redis-password="$(openssl rand -base64 32)"
|
||||
```
|
||||
|
||||
Install:
|
||||
|
||||
```sh
|
||||
helm upgrade --install redis . \
|
||||
--namespace redis \
|
||||
--create-namespace \
|
||||
--values production-values.yaml
|
||||
```
|
||||
|
||||
Keep `redis.maxmemory` below the container memory limit. Redis needs headroom
|
||||
for replication buffers, client buffers, fork/copy-on-write activity, AOF
|
||||
rewrites, allocator overhead, and the operating process.
|
||||
|
||||
## Connecting clients
|
||||
|
||||
Redis Cluster requires a cluster-aware client. A standalone or Sentinel client
|
||||
will not correctly follow `MOVED` and `ASK` redirects.
|
||||
|
||||
The internal balanced bootstrap endpoint is:
|
||||
|
||||
```text
|
||||
<release>-redis-cluster.<namespace>.svc:<redis.port>
|
||||
```
|
||||
|
||||
For the example release:
|
||||
|
||||
```text
|
||||
redis-redis-cluster.redis.svc:6379
|
||||
```
|
||||
|
||||
The bootstrap Service only provides an initial node. The client downloads the
|
||||
slot map and then connects directly to the member endpoints advertised by
|
||||
Redis.
|
||||
|
||||
### redis-cli
|
||||
|
||||
```sh
|
||||
kubectl run redis-cli --rm -it \
|
||||
--namespace redis \
|
||||
--image=redis:7.4-alpine \
|
||||
-- redis-cli -c -h redis-redis-cluster -p 6379
|
||||
```
|
||||
|
||||
Add `-a "$REDIS_PASSWORD"` when authentication is enabled.
|
||||
|
||||
### Python
|
||||
|
||||
```python
|
||||
from redis.cluster import RedisCluster
|
||||
|
||||
client = RedisCluster(
|
||||
host="redis-redis-cluster.redis.svc",
|
||||
port=6379,
|
||||
password="replace-me",
|
||||
decode_responses=True,
|
||||
)
|
||||
|
||||
client.set("hello", "world")
|
||||
print(client.get("hello"))
|
||||
```
|
||||
|
||||
Set `read_from_replicas=True` only if stale replica reads are acceptable.
|
||||
|
||||
### Multi-key operations
|
||||
|
||||
Transactions, Lua scripts, and multi-key commands can only span keys in one hash
|
||||
slot. Use a shared hash tag when keys must be colocated:
|
||||
|
||||
```text
|
||||
cart:{customer-42}
|
||||
cart-items:{customer-42}
|
||||
```
|
||||
|
||||
## Authentication
|
||||
|
||||
Authentication is disabled by default so the chart can be evaluated without
|
||||
secret bootstrapping. Enable it for production.
|
||||
|
||||
### Explicit password
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
enabled: true
|
||||
password: replace-me
|
||||
```
|
||||
|
||||
This places the password in Helm release data and is not recommended for Git.
|
||||
|
||||
### Existing Secret
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
enabled: true
|
||||
existingSecret: redis-auth
|
||||
existingSecretKey: redis-password
|
||||
```
|
||||
|
||||
The Secret must exist in the release namespace:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: redis-auth
|
||||
namespace: redis
|
||||
type: Opaque
|
||||
stringData:
|
||||
redis-password: CHANGE-ME
|
||||
```
|
||||
|
||||
Use SOPS, Sealed Secrets, External Secrets, or another secret manager rather
|
||||
than committing the cleartext example.
|
||||
|
||||
### Generated password
|
||||
|
||||
When `auth.enabled=true` and neither `password` nor `existingSecret` is set, the
|
||||
chart generates a password. A normal Helm upgrade uses `lookup` to reuse the
|
||||
existing Secret.
|
||||
|
||||
Retrieve it with:
|
||||
|
||||
```sh
|
||||
kubectl get secret -n redis redis-redis-cluster \
|
||||
-o jsonpath='{.data.redis-password}' | base64 -d
|
||||
echo
|
||||
```
|
||||
|
||||
Argo CD renders charts without live-cluster access, so generated passwords need
|
||||
the `ignoreDifferences` treatment shown in
|
||||
[`argocd/application.yaml`](argocd/application.yaml), or preferably an
|
||||
externally managed Secret.
|
||||
|
||||
The chart configures Redis `requirepass` and `masterauth`. It does not currently
|
||||
manage Redis ACL users or Redis TLS.
|
||||
|
||||
## Persistence
|
||||
|
||||
Persistence is enabled by default. Every Redis member receives an independent
|
||||
PVC and writes an append-only file using `appendfsync everysec`.
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: ""
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 3Gi
|
||||
```
|
||||
|
||||
An empty `storageClass` uses the cluster default. Any valid Kubernetes storage
|
||||
quantity is accepted, including `500Mi`, `100Gi`, and `2Ti`. The chart imposes
|
||||
no upper size limit. Actual capacity is controlled by the StorageClass,
|
||||
provisioner, namespace quotas, and infrastructure.
|
||||
|
||||
`persistence.size` is per member, not total capacity. With three shards and one
|
||||
replica, `100Gi` requests six 100 Gi volumes.
|
||||
|
||||
When persistence is disabled, Redis uses `emptyDir` and all data on a member is
|
||||
lost when its pod is rescheduled.
|
||||
|
||||
### Expanding existing volumes
|
||||
|
||||
Increasing the value for a new installation is straightforward. Existing
|
||||
StatefulSet `volumeClaimTemplates` are immutable, so changing
|
||||
`persistence.size` alone may be rejected and does not reliably resize existing
|
||||
claims.
|
||||
|
||||
To expand an existing deployment:
|
||||
|
||||
1. Confirm the StorageClass has `allowVolumeExpansion: true`.
|
||||
2. Back up the cluster.
|
||||
3. Patch each existing PVC to the new requested size.
|
||||
4. Wait for the storage controller and filesystem resize to complete.
|
||||
5. Keep `persistence.size` at the new value for future members.
|
||||
|
||||
Never shrink Redis PVCs in place.
|
||||
|
||||
## External access
|
||||
|
||||
External access is disabled by default because Redis Cluster cannot be exposed
|
||||
correctly through a single generic TCP LoadBalancer.
|
||||
|
||||
When enabled, the chart creates:
|
||||
|
||||
- one balanced bootstrap LoadBalancer Service; and
|
||||
- one LoadBalancer Service for every Redis member.
|
||||
|
||||
The default 3x1 topology therefore creates seven LoadBalancers. This can incur
|
||||
cloud-provider cost and consume seven addresses.
|
||||
|
||||
```yaml
|
||||
externalAccess:
|
||||
enabled: true
|
||||
port: 6379
|
||||
loadBalancerClass: ""
|
||||
externalTrafficPolicy: Cluster
|
||||
loadBalancerSourceRanges:
|
||||
- 203.0.113.0/24
|
||||
```
|
||||
|
||||
The chart does not assume MetalLB or a particular cloud provider. It waits for
|
||||
each member Service to publish either an IP or hostname under
|
||||
`.status.loadBalancer.ingress`, then makes that member advertise the discovered
|
||||
endpoint. All Services use the same Redis port; there is no fixed IP list and
|
||||
no port fan-out.
|
||||
|
||||
Get the bootstrap endpoint:
|
||||
|
||||
```sh
|
||||
kubectl get service -n redis redis-redis-cluster-external \
|
||||
-o jsonpath='{range .status.loadBalancer.ingress[*]}{.ip}{.hostname}{"\n"}{end}'
|
||||
```
|
||||
|
||||
External clients need only that bootstrap endpoint in their startup
|
||||
configuration, but they must be able to route to every per-member address
|
||||
returned in the slot map. A client that can reach the bootstrap address but not
|
||||
the member addresses will connect initially and then fail on redirected keys.
|
||||
|
||||
Keep the LoadBalancer Services instead of deleting and recreating them. If the
|
||||
controller assigns a new member address, restart that member's one-pod
|
||||
StatefulSet so its discovery init container records and advertises the new
|
||||
endpoint.
|
||||
|
||||
External Redis traffic is unencrypted. Restrict
|
||||
`loadBalancerSourceRanges`, use upstream firewalls/private routing, enable
|
||||
authentication, or provide network-layer encryption. Do not expose an
|
||||
unauthenticated cluster to the public Internet.
|
||||
|
||||
### Provider annotations
|
||||
|
||||
Bootstrap and member annotations are separate:
|
||||
|
||||
```yaml
|
||||
externalAccess:
|
||||
bootstrap:
|
||||
annotations:
|
||||
service.beta.kubernetes.io/example: bootstrap-value
|
||||
memberServices:
|
||||
annotations:
|
||||
service.beta.kubernetes.io/example: member-value
|
||||
```
|
||||
|
||||
Use these for provider-specific address pools, internal LoadBalancers, health
|
||||
checks, or DNS controllers.
|
||||
|
||||
## RedisInsight
|
||||
|
||||
RedisInsight is optional and disabled by default:
|
||||
|
||||
```yaml
|
||||
redisInsight:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
It creates one Deployment, one ClusterIP Service, and optionally a dedicated
|
||||
PVC. RedisInsight stores its SQLite state, saved connections, and logs under
|
||||
`/data`.
|
||||
|
||||
### Automatic cluster connection
|
||||
|
||||
No IP address is required. With `redisInsight.connection.host=""`, the chart
|
||||
preconfigures RedisInsight from the release-aware balanced bootstrap endpoint:
|
||||
|
||||
- with external access disabled, it uses the internal
|
||||
`<release>-redis-cluster` Service DNS;
|
||||
- with external access enabled, an init container reads the published IP or
|
||||
hostname from the `<release>-redis-cluster-external` LoadBalancer Service and
|
||||
injects that address before RedisInsight starts.
|
||||
|
||||
Kubernetes and the LoadBalancer controller therefore own the VIP lifecycle.
|
||||
RedisInsight follows the correct release and namespace without a hard-coded
|
||||
address. Port `0` automatically follows `redis.port` or
|
||||
`externalAccess.port`.
|
||||
|
||||
```yaml
|
||||
redisInsight:
|
||||
enabled: true
|
||||
connection:
|
||||
host: ""
|
||||
port: 0
|
||||
alias: redis-cluster
|
||||
tls: false
|
||||
```
|
||||
|
||||
Set `host` and `port` when RedisInsight should inspect another cluster, or when
|
||||
pods cannot hairpin through the external LoadBalancer endpoint. When chart
|
||||
authentication is enabled, RedisInsight reads the same password Secret
|
||||
automatically.
|
||||
|
||||
Port-forward the UI:
|
||||
|
||||
```sh
|
||||
kubectl port-forward -n redis \
|
||||
service/redis-redis-cluster-insight 5540:80
|
||||
```
|
||||
|
||||
Open <http://127.0.0.1:5540>.
|
||||
|
||||
### Istio HTTP ingress
|
||||
|
||||
The chart can create an Istio Gateway and VirtualService for RedisInsight:
|
||||
|
||||
```yaml
|
||||
redisInsight:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
host: redisinsight.example.com
|
||||
gatewaySelector:
|
||||
istio: ingressgateway
|
||||
requestTimeout: 60s
|
||||
tls:
|
||||
enabled: false
|
||||
```
|
||||
|
||||
The host is required when ingress is enabled. Hosting RedisInsight under a
|
||||
rewritten path prefix is not supported; give it a host and route `/`.
|
||||
|
||||
### Istio TLS with an existing Secret
|
||||
|
||||
```yaml
|
||||
redisInsight:
|
||||
ingress:
|
||||
enabled: true
|
||||
host: redisinsight.example.com
|
||||
tls:
|
||||
enabled: true
|
||||
credentialName: redisinsight-tls
|
||||
certificate:
|
||||
create: false
|
||||
```
|
||||
|
||||
The credential Secret must be available to the selected Istio ingress gateway.
|
||||
Exact Secret placement depends on the Istio installation.
|
||||
|
||||
### Istio TLS with cert-manager
|
||||
|
||||
```yaml
|
||||
redisInsight:
|
||||
ingress:
|
||||
enabled: true
|
||||
host: redisinsight.example.com
|
||||
tls:
|
||||
enabled: true
|
||||
credentialName: redisinsight-tls
|
||||
certificate:
|
||||
create: true
|
||||
issuerName: letsencrypt-production
|
||||
issuerKind: ClusterIssuer
|
||||
secretNamespace: istio-system
|
||||
```
|
||||
|
||||
Set `secretNamespace` to the namespace from which the ingress gateway reads
|
||||
credential Secrets. An empty value uses the Helm release namespace.
|
||||
|
||||
RedisInsight is an administrative interface and does not provide ingress
|
||||
authentication. Put an identity-aware proxy or Istio authorization policy in
|
||||
front of it and restrict network exposure.
|
||||
|
||||
## Metrics
|
||||
|
||||
The Redis exporter sidecar is enabled by default on every member:
|
||||
|
||||
```yaml
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 9121
|
||||
```
|
||||
|
||||
Enable a ServiceMonitor when the Prometheus Operator CRDs are installed:
|
||||
|
||||
```yaml
|
||||
metrics:
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
```
|
||||
|
||||
Use labels selected by your Prometheus installation.
|
||||
|
||||
## Network policy and service mesh
|
||||
|
||||
### NetworkPolicy
|
||||
|
||||
NetworkPolicy creation is disabled by default because policy enforcement and
|
||||
default-deny behavior vary between CNIs.
|
||||
|
||||
```yaml
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
allowExternal: false
|
||||
extraIngress:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: applications
|
||||
metricsFromNamespaces:
|
||||
- monitoring
|
||||
```
|
||||
|
||||
The generated policy always allows Redis client, replication, migration, and
|
||||
cluster-bus traffic between release pods. `allowExternal` refers to Redis client
|
||||
ingress from outside the selected pods; it does not create a LoadBalancer.
|
||||
|
||||
### Istio sidecars
|
||||
|
||||
Redis pods disable Istio injection by default:
|
||||
|
||||
```yaml
|
||||
istio:
|
||||
injectSidecar: false
|
||||
```
|
||||
|
||||
Redis Cluster uses direct node-to-node client and cluster-bus connections.
|
||||
Namespace-wide strict mTLS can break this traffic. Either keep the Redis
|
||||
workload outside strict mesh enforcement, create a scoped PERMISSIVE
|
||||
PeerAuthentication, or deliberately enable and validate sidecars before
|
||||
production use.
|
||||
|
||||
## Scheduling and availability
|
||||
|
||||
The chart uses required pod affinity and anti-affinity, not preferences. It will
|
||||
leave pods Pending rather than silently place a primary beside its own replica.
|
||||
|
||||
For the default topology:
|
||||
|
||||
- three workers are required;
|
||||
- losing one worker removes one primary and a replica of another shard;
|
||||
- the lost primary's replica is on a surviving worker;
|
||||
- two surviving primaries form the majority needed to authorize promotion.
|
||||
|
||||
Inspect placement:
|
||||
|
||||
```sh
|
||||
kubectl get pods -n redis \
|
||||
-L redis-cluster.shard,redis-cluster.member \
|
||||
-o wide
|
||||
```
|
||||
|
||||
The two members of each shard must have different `NODE` values. All member-0
|
||||
pods must also occupy different nodes.
|
||||
|
||||
The global PodDisruptionBudget defaults to `maxUnavailable: 1`. It limits
|
||||
cooperating voluntary disruptions but cannot prevent node crashes or an
|
||||
administrator from deleting multiple pods.
|
||||
|
||||
### Failure behavior
|
||||
|
||||
- Failure detection begins after approximately
|
||||
`cluster.nodeTimeoutMilliseconds`.
|
||||
- A healthy cross-node replica can be elected primary.
|
||||
- Cluster-aware clients refresh the slot map and reconnect.
|
||||
- Losing both members of one shard loses that slot range.
|
||||
- With `cluster.requireFullCoverage=true`, loss of any slot range makes the
|
||||
cluster unavailable until coverage returns.
|
||||
- Automatic failover requires a majority of current primaries to communicate.
|
||||
|
||||
## Safe upgrades
|
||||
|
||||
Every member StatefulSet uses `updateStrategy: OnDelete`. A Helm or Argo update
|
||||
changes the pod template but deliberately does not restart all independent
|
||||
members at once.
|
||||
|
||||
Restart exactly one member at a time:
|
||||
|
||||
1. Inspect `CLUSTER NODES` and choose a current replica first.
|
||||
2. Delete that one pod.
|
||||
3. Wait for the replacement to become Ready.
|
||||
4. Confirm `cluster_state:ok`.
|
||||
5. Continue with the next replica, then primaries one by one.
|
||||
|
||||
Example:
|
||||
|
||||
```sh
|
||||
kubectl exec -n redis redis-redis-cluster-s0-n0-0 -c redis -- \
|
||||
redis-cli cluster nodes
|
||||
|
||||
kubectl delete pod -n redis redis-redis-cluster-s0-n1-0
|
||||
|
||||
kubectl wait -n redis \
|
||||
--for=condition=Ready \
|
||||
pod/redis-redis-cluster-s0-n1-0 \
|
||||
--timeout=300s
|
||||
|
||||
kubectl exec -n redis redis-redis-cluster-s0-n0-0 -c redis -- \
|
||||
redis-cli cluster info
|
||||
```
|
||||
|
||||
The preStop hook asks a healthy replica to take over before an intentional
|
||||
primary restart. Never delete both members of one shard together.
|
||||
|
||||
## Scaling and topology changes
|
||||
|
||||
`cluster.shards` and `cluster.replicasPerShard` define the first-boot topology.
|
||||
Changing them in Helm on a populated cluster does not reshard existing data and
|
||||
is not a supported scaling procedure.
|
||||
|
||||
Adding a shard requires an explicit operational workflow:
|
||||
|
||||
1. create and persist the new members;
|
||||
2. join them with `CLUSTER MEET`;
|
||||
3. assign replicas;
|
||||
4. move slots with `redis-cli --cluster reshard`;
|
||||
5. verify slot coverage and failure placement.
|
||||
|
||||
Removing a shard requires moving all of its slots away before removing its
|
||||
nodes. Adding replicas requires joining the nodes and issuing
|
||||
`CLUSTER REPLICATE`. Back up first.
|
||||
|
||||
The chart enforces at least three shards, at least one replica per shard, and
|
||||
fewer replicas per shard than shards so the crossed placement remains valid.
|
||||
|
||||
## Backup and restore
|
||||
|
||||
This chart does not schedule backups. Redis Cluster stores different slot ranges
|
||||
on different primaries, so a backup strategy must cover every shard.
|
||||
|
||||
Common approaches include:
|
||||
|
||||
- crash-consistent snapshots of all member volumes;
|
||||
- coordinated AOF/RDB copies from one healthy member of every shard;
|
||||
- a Redis-aware backup product that understands cluster topology.
|
||||
|
||||
Test restore procedures. Restoring only one shard or one arbitrary member does
|
||||
not reconstruct the complete keyspace. Keep backups outside the cluster and
|
||||
verify both data and all 16,384 slots after recovery.
|
||||
|
||||
## Argo CD
|
||||
|
||||
[`argocd/application.yaml`](argocd/application.yaml) is a portable example using
|
||||
the public repository. Apply it once:
|
||||
|
||||
```sh
|
||||
kubectl apply -f argocd/application.yaml
|
||||
```
|
||||
|
||||
The file is outside `templates/`, so it is not part of the Helm release. If you
|
||||
edit its inline `valuesObject`, a normal sync of the Redis Application cannot
|
||||
update the Application's own spec. Reapply the file, manage it from an
|
||||
app-of-apps, or use an ApplicationSet:
|
||||
|
||||
```sh
|
||||
kubectl apply -f argocd/application.yaml
|
||||
```
|
||||
|
||||
For authentication, prefer an externally managed Secret. If the chart generates
|
||||
the password, retain `RespectIgnoreDifferences=true` and the Secret
|
||||
`ignoreDifferences` rule from the example.
|
||||
|
||||
Argo applies new StatefulSet templates, but `OnDelete` intentionally prevents
|
||||
automatic Redis pod rolls. Perform the one-member-at-a-time procedure after
|
||||
reviewing each change. Additional authentication, external access, and Istio
|
||||
examples are in [`argocd/README.md`](argocd/README.md).
|
||||
|
||||
## Configuration reference
|
||||
|
||||
The authoritative defaults are in [`values.yaml`](values.yaml), and
|
||||
[`values.schema.json`](values.schema.json) validates supported values.
|
||||
|
||||
### Release and image
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `nameOverride` | `""` | Override the chart name portion of resource names. |
|
||||
| `fullnameOverride` | `""` | Override the complete release resource prefix; maximum 53 characters. |
|
||||
| `image.repository` | `redis` | Redis image repository. |
|
||||
| `image.tag` | `7.4-alpine` | Redis image tag. |
|
||||
| `image.pullPolicy` | `IfNotPresent` | Redis image pull policy. |
|
||||
| `imagePullSecrets` | `[]` | Pod image pull Secret references. |
|
||||
|
||||
### Cluster
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `cluster.shards` | `3` | Independently writable primaries and slot ranges. |
|
||||
| `cluster.replicasPerShard` | `1` | Readable failover replicas per shard. |
|
||||
| `cluster.busPort` | `16379` | Redis node-to-node cluster bus port. |
|
||||
| `cluster.nodeTimeoutMilliseconds` | `10000` | Failure-detection timeout. |
|
||||
| `cluster.requireFullCoverage` | `true` | Stop serving when any slot is unavailable. |
|
||||
| `cluster.allowReadsWhenDown` | `false` | Permit reads while cluster state is down. |
|
||||
| `cluster.migrationBarrier` | `1` | Minimum healthy replicas retained during replica migration. |
|
||||
|
||||
### Redis and authentication
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `auth.enabled` | `false` | Enable password authentication. |
|
||||
| `auth.password` | `""` | Explicit password; generated when empty and no Secret is supplied. |
|
||||
| `auth.existingSecret` | `""` | Existing password Secret name. |
|
||||
| `auth.existingSecretKey` | `redis-password` | Password key in the existing Secret. |
|
||||
| `redis.port` | `6379` | Redis client port. |
|
||||
| `redis.maxmemory` | `384mb` | Redis memory ceiling. Empty disables the explicit ceiling. |
|
||||
| `redis.maxmemoryPolicy` | `noeviction` | Redis eviction policy. |
|
||||
| `redis.extraConfig` | `""` | Additional lines appended to `redis.conf`. |
|
||||
| `redis.resources` | see values | Redis container requests and limits. |
|
||||
|
||||
Do not use `redis.extraConfig` to override cluster identity, announce endpoints,
|
||||
data directory, authentication, or other settings managed by the chart.
|
||||
|
||||
### Probes
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `probes.redis.startup.initialDelaySeconds` | `10` | Delay before startup checks. |
|
||||
| `probes.redis.startup.periodSeconds` | `5` | Startup check interval. |
|
||||
| `probes.redis.startup.timeoutSeconds` | `4` | Startup check timeout. |
|
||||
| `probes.redis.startup.failureThreshold` | `180` | Failures allowed before restart. |
|
||||
| `probes.redis.liveness.periodSeconds` | `15` | Liveness check interval. |
|
||||
| `probes.redis.liveness.timeoutSeconds` | `8` | Liveness check timeout. |
|
||||
| `probes.redis.liveness.failureThreshold` | `10` | Liveness failures before restart. |
|
||||
| `probes.redis.readiness.periodSeconds` | `5` | Readiness check interval. |
|
||||
| `probes.redis.readiness.timeoutSeconds` | `4` | Readiness check timeout. |
|
||||
| `probes.redis.readiness.failureThreshold` | `3` | Readiness failures before removal from Services. |
|
||||
|
||||
### Persistence
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `persistence.enabled` | `true` | Create one PVC per Redis member. |
|
||||
| `persistence.storageClass` | `""` | StorageClass; empty uses the cluster default. |
|
||||
| `persistence.accessModes` | `[ReadWriteOnce]` | PVC access modes. |
|
||||
| `persistence.size` | `3Gi` | Capacity per member; no chart-side maximum. |
|
||||
| `persistence.annotations` | `{}` | PVC template annotations. |
|
||||
|
||||
### External access
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `externalAccess.enabled` | `false` | Create bootstrap and per-member LoadBalancers. |
|
||||
| `externalAccess.port` | `6379` | External Redis port on every Service. |
|
||||
| `externalAccess.bootstrap.annotations` | `{}` | Bootstrap Service annotations. |
|
||||
| `externalAccess.memberServices.annotations` | `{}` | Per-member Service annotations. |
|
||||
| `externalAccess.loadBalancerClass` | `""` | Optional LoadBalancer implementation class. |
|
||||
| `externalAccess.externalTrafficPolicy` | `Cluster` | Kubernetes external traffic policy. |
|
||||
| `externalAccess.loadBalancerSourceRanges` | `[]` | Allowed client CIDRs. |
|
||||
| `externalAccess.allocateLoadBalancerNodePorts` | `true` | Allocate backing NodePorts. |
|
||||
| `externalAccess.endpointDiscovery.*` | see values | Image/resources for endpoint discovery. |
|
||||
|
||||
### RedisInsight
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `redisInsight.enabled` | `false` | Deploy RedisInsight. |
|
||||
| `redisInsight.image.repository` | `redis/redisinsight` | RedisInsight image repository. |
|
||||
| `redisInsight.image.tag` | `3.8.0` | RedisInsight image tag. |
|
||||
| `redisInsight.image.pullPolicy` | `IfNotPresent` | RedisInsight image pull policy. |
|
||||
| `redisInsight.port` | `5540` | RedisInsight container port. |
|
||||
| `redisInsight.connection.host` | `""` | Empty discovers the balanced release bootstrap endpoint. |
|
||||
| `redisInsight.connection.port` | `0` | Zero follows the selected Redis Service port. |
|
||||
| `redisInsight.connection.alias` | `redis-cluster` | Display name in RedisInsight. |
|
||||
| `redisInsight.connection.tls` | `false` | Enable TLS for the Redis connection. |
|
||||
| `redisInsight.persistence.enabled` | `true` | Persist RedisInsight state. |
|
||||
| `redisInsight.persistence.storageClass` | `""` | StorageClass; empty uses default. |
|
||||
| `redisInsight.persistence.accessModes` | `[ReadWriteOnce]` | RedisInsight PVC access modes. |
|
||||
| `redisInsight.persistence.size` | `1Gi` | RedisInsight PVC size; no chart-side maximum. |
|
||||
| `redisInsight.persistence.annotations` | `{}` | RedisInsight PVC annotations. |
|
||||
| `redisInsight.resources` | see values | RedisInsight requests and limits. |
|
||||
| `redisInsight.podAnnotations` | `{}` | RedisInsight pod annotations. |
|
||||
| `redisInsight.nodeSelector` | `{}` | RedisInsight node selector. |
|
||||
| `redisInsight.tolerations` | `[]` | RedisInsight pod tolerations. |
|
||||
| `redisInsight.ingress.enabled` | `false` | Create Istio Gateway and VirtualService. |
|
||||
| `redisInsight.ingress.host` | `""` | Required hostname when ingress is enabled. |
|
||||
| `redisInsight.ingress.gatewaySelector` | `{istio: ingressgateway}` | Select the Istio gateway workload. |
|
||||
| `redisInsight.ingress.requestTimeout` | `60s` | Istio route timeout. |
|
||||
| `redisInsight.ingress.tls.enabled` | `false` | Serve HTTPS on the Gateway. |
|
||||
| `redisInsight.ingress.tls.credentialName` | `""` | Istio TLS credential Secret. |
|
||||
| `redisInsight.ingress.tls.certificate.create` | `false` | Create the Secret using cert-manager. |
|
||||
| `redisInsight.ingress.tls.certificate.*` | see values | Issuer and Secret namespace settings. |
|
||||
|
||||
### Metrics, policy, and pod settings
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `metrics.enabled` | `true` | Add redis_exporter to every member pod. |
|
||||
| `metrics.image.repository` | `ghcr.io/oliver006/redis_exporter` | Exporter image repository. |
|
||||
| `metrics.image.tag` | `v1.87.0-alpine` | Exporter image tag. |
|
||||
| `metrics.image.pullPolicy` | `IfNotPresent` | Exporter pull policy. |
|
||||
| `metrics.port` | `9121` | Exporter port. |
|
||||
| `metrics.resources` | see values | Exporter requests and limits. |
|
||||
| `metrics.serviceMonitor.enabled` | `false` | Create a Prometheus Operator ServiceMonitor. |
|
||||
| `metrics.serviceMonitor.interval` | `30s` | Prometheus scrape interval. |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | `10s` | Prometheus scrape timeout. |
|
||||
| `metrics.serviceMonitor.labels` | `{}` | Labels used by Prometheus to select the ServiceMonitor. |
|
||||
| `networkPolicy.enabled` | `false` | Create an ingress NetworkPolicy. |
|
||||
| `networkPolicy.allowExternal` | `true` | Allow Redis client ingress from all sources. |
|
||||
| `networkPolicy.extraIngress` | `[]` | Allowed peers when unrestricted ingress is disabled. |
|
||||
| `networkPolicy.metricsFromNamespaces` | `[]` | Namespaces allowed to scrape metrics. |
|
||||
| `podDisruptionBudget.enabled` | `true` | Create a global Redis PDB. |
|
||||
| `podDisruptionBudget.maxUnavailable` | `1` | Maximum voluntary unavailable Redis pods. |
|
||||
| `serviceAccount.create` | `true` | Create the endpoint-discovery ServiceAccount. |
|
||||
| `serviceAccount.name` | `""` | Existing or generated ServiceAccount name. |
|
||||
| `serviceAccount.annotations` | `{}` | ServiceAccount annotations. |
|
||||
| `nodeSelector` | `{}` | Redis pod node selector. |
|
||||
| `tolerations` | `[]` | Redis pod tolerations. |
|
||||
| `topologySpreadConstraints` | `[]` | Additional spread constraints. |
|
||||
| `priorityClassName` | `""` | Redis pod priority class. |
|
||||
| `podAnnotations` / `podLabels` | `{}` | Additional Redis pod metadata. |
|
||||
| `podSecurityContext` | see values | Redis pod-level security context. |
|
||||
| `containerSecurityContext` | see values | Redis/exporter container security context. |
|
||||
| `istio.injectSidecar` | `false` | Enable sidecars on Redis member pods. |
|
||||
| `terminationGracePeriodSeconds` | `30` | Pod shutdown grace period. |
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Pods remain Pending
|
||||
|
||||
Inspect scheduling events:
|
||||
|
||||
```sh
|
||||
kubectl describe pod -n redis <pending-pod>
|
||||
```
|
||||
|
||||
Common causes are:
|
||||
|
||||
- fewer schedulable workers than `cluster.shards`;
|
||||
- insufficient CPU or memory;
|
||||
- node taints without matching tolerations;
|
||||
- node selectors excluding required workers;
|
||||
- existing pods violating the required crossed affinity layout;
|
||||
- unbound PVCs or a missing default StorageClass.
|
||||
|
||||
The scheduler message `didn't match pod affinity/anti-affinity rules` means the
|
||||
availability invariant cannot currently be satisfied. Do not weaken it unless
|
||||
you accept a primary and its replica sharing a failure domain.
|
||||
|
||||
### External-access pods wait in init
|
||||
|
||||
```sh
|
||||
kubectl logs -n redis <pod> -c discover-external-endpoint
|
||||
kubectl get services -n redis
|
||||
```
|
||||
|
||||
The LoadBalancer controller must populate an IP or hostname for every member
|
||||
Service. Check controller events, address-pool capacity, provider annotations,
|
||||
quota, and `loadBalancerClass`.
|
||||
|
||||
### `cluster_state:fail`
|
||||
|
||||
```sh
|
||||
kubectl exec -n redis redis-redis-cluster-s0-n0-0 -c redis -- \
|
||||
redis-cli cluster nodes
|
||||
|
||||
kubectl exec -n redis redis-redis-cluster-s0-n0-0 -c redis -- \
|
||||
redis-cli cluster info
|
||||
```
|
||||
|
||||
Check for missing members, failed slot ranges, DNS failures, blocked port 16379,
|
||||
or a member that cannot read its PVC. Readiness intentionally remains false
|
||||
until the complete cluster is healthy; liveness does not restart Redis merely
|
||||
for `CLUSTERDOWN`.
|
||||
|
||||
### Authentication errors
|
||||
|
||||
Confirm the client is using the current Secret and that all pods reference the
|
||||
same password:
|
||||
|
||||
```sh
|
||||
kubectl get secret -n redis redis-redis-cluster \
|
||||
-o jsonpath='{.data.redis-password}' | base64 -d
|
||||
echo
|
||||
```
|
||||
|
||||
When using an existing Secret, verify its name/key match the Helm values. Restart
|
||||
members one at a time if a password Secret was deliberately changed.
|
||||
|
||||
### External client connects, then fails
|
||||
|
||||
This almost always means the bootstrap address is reachable but the member
|
||||
addresses in `CLUSTER SLOTS`/`CLUSTER SHARDS` are not. Route and permit every
|
||||
per-member LoadBalancer endpoint.
|
||||
|
||||
### RedisInsight is not rendered by Argo CD
|
||||
|
||||
Confirm the live Application contains `redisInsight.enabled: true`:
|
||||
|
||||
```sh
|
||||
kubectl get application -n argocd redis-cluster -o yaml
|
||||
```
|
||||
|
||||
Changing `argocd/application.yaml` in this repository does not update the live
|
||||
Application during its own Helm sync because the file is outside `templates/`.
|
||||
Reapply it or manage it from an app-of-apps.
|
||||
|
||||
### Inspect rendered manifests
|
||||
|
||||
```sh
|
||||
helm lint .
|
||||
helm template redis . --namespace redis --debug
|
||||
```
|
||||
|
||||
## Uninstalling
|
||||
|
||||
Back up first, then remove the release:
|
||||
|
||||
```sh
|
||||
helm uninstall redis --namespace redis
|
||||
```
|
||||
|
||||
PVCs created from StatefulSet volume claim templates are normally retained when
|
||||
the StatefulSets are deleted. Verify them before deleting anything:
|
||||
|
||||
```sh
|
||||
kubectl get pvc -n redis
|
||||
```
|
||||
|
||||
The directly managed RedisInsight PVC may be removed with the Helm release,
|
||||
depending on Helm and storage-policy behavior. Preserve or snapshot it if its UI
|
||||
state matters.
|
||||
|
||||
Delete retained Redis data PVCs only when data destruction is intentional.
|
||||
|
||||
## License
|
||||
|
||||
This project is distributed under the BSD 3-Clause License. See
|
||||
[`LICENSE`](LICENSE).
|
||||
|
||||
84
argocd/README.md
Normal file
84
argocd/README.md
Normal file
@@ -0,0 +1,84 @@
|
||||
# Argo CD examples
|
||||
|
||||
This directory is excluded from the packaged Helm chart. Its files are examples
|
||||
for managing the chart from Argo CD.
|
||||
|
||||
## Application
|
||||
|
||||
[`application.yaml`](application.yaml) deploys:
|
||||
|
||||
- three Redis shards;
|
||||
- one replica per shard;
|
||||
- authenticated Redis with a chart-generated initial password;
|
||||
- persistent volumes using the cluster's default StorageClass;
|
||||
- internal-only Redis Services;
|
||||
- RedisInsight connected automatically to the balanced bootstrap endpoint.
|
||||
|
||||
Apply it once:
|
||||
|
||||
```sh
|
||||
kubectl apply -f argocd/application.yaml
|
||||
```
|
||||
|
||||
Edit the destination namespace, target revision, and inline `valuesObject` as
|
||||
needed. Because this file is not a Helm template, changing it in the Redis
|
||||
Application's own repository does not change the live Application spec during a
|
||||
normal sync. Reapply it, or manage it from an app-of-apps/ApplicationSet.
|
||||
|
||||
## Password Secret
|
||||
|
||||
For production GitOps, use an externally managed Secret and set:
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
enabled: true
|
||||
existingSecret: redis-auth
|
||||
existingSecretKey: redis-password
|
||||
```
|
||||
|
||||
[`redis-auth-secret.example.yaml`](redis-auth-secret.example.yaml) documents the
|
||||
required Secret shape. Do not commit an actual cleartext password.
|
||||
|
||||
If the chart generates the password, retain
|
||||
`RespectIgnoreDifferences=true` and the Secret ignore rule from
|
||||
`application.yaml`; Argo's Helm renderer cannot use `lookup` to read the live
|
||||
Secret while comparing desired state.
|
||||
|
||||
## Enabling external access
|
||||
|
||||
Add this to `valuesObject`:
|
||||
|
||||
```yaml
|
||||
externalAccess:
|
||||
enabled: true
|
||||
loadBalancerClass: ""
|
||||
loadBalancerSourceRanges:
|
||||
- 203.0.113.0/24
|
||||
```
|
||||
|
||||
This creates one balanced bootstrap LoadBalancer and one LoadBalancer per Redis
|
||||
member. Every advertised member address must be routable from external clients.
|
||||
|
||||
## Exposing RedisInsight with Istio
|
||||
|
||||
Add:
|
||||
|
||||
```yaml
|
||||
redisInsight:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
host: redisinsight.example.com
|
||||
tls:
|
||||
enabled: true
|
||||
credentialName: redisinsight-tls
|
||||
certificate:
|
||||
create: true
|
||||
issuerName: letsencrypt-production
|
||||
issuerKind: ClusterIssuer
|
||||
secretNamespace: istio-system
|
||||
```
|
||||
|
||||
Replace the hostname, issuer, gateway selector, and Secret namespace with values
|
||||
from your environment. RedisInsight has no built-in ingress authentication; add
|
||||
an identity-aware proxy or Istio authorization policy before exposing it.
|
||||
77
argocd/application.yaml
Normal file
77
argocd/application.yaml
Normal file
@@ -0,0 +1,77 @@
|
||||
# Public Argo CD example. Adjust the destination namespace, revision and values
|
||||
# for your environment, then apply this file once (or manage it from an
|
||||
# app-of-apps). Files under argocd/ are examples and are not rendered by Helm.
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: redis-cluster
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://git.mulas.me/corrado/redis-cluster.git
|
||||
targetRevision: master
|
||||
path: .
|
||||
helm:
|
||||
releaseName: redis
|
||||
valuesObject:
|
||||
cluster:
|
||||
shards: 3
|
||||
replicasPerShard: 1
|
||||
|
||||
# Production deployments should authenticate even when Redis is only
|
||||
# reachable inside the cluster. This example lets the chart create the
|
||||
# initial password Secret; see the ignore rule below.
|
||||
auth:
|
||||
enabled: true
|
||||
|
||||
persistence:
|
||||
# Empty selects the cluster's default StorageClass.
|
||||
storageClass: ""
|
||||
# This is per Redis member. The chart imposes no maximum.
|
||||
size: 10Gi
|
||||
|
||||
# Disabled by default because this creates one LoadBalancer per member
|
||||
# plus one balanced bootstrap LoadBalancer.
|
||||
externalAccess:
|
||||
enabled: false
|
||||
|
||||
metrics:
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
|
||||
# RedisInsight automatically discovers the release's balanced
|
||||
# bootstrap endpoint. No IP address is required.
|
||||
redisInsight:
|
||||
enabled: true
|
||||
persistence:
|
||||
storageClass: ""
|
||||
size: 2Gi
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: redis
|
||||
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- RespectIgnoreDifferences=true
|
||||
|
||||
# Argo CD renders Helm without API access, so Helm's lookup cannot recover a
|
||||
# previously generated password during comparison. Ignore the generated
|
||||
# Secret data to keep the first password stable. Prefer an existing Secret
|
||||
# managed by SOPS, Sealed Secrets or External Secrets for serious GitOps use.
|
||||
ignoreDifferences:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: redis-redis-cluster
|
||||
namespace: redis
|
||||
jsonPointers:
|
||||
- /data/redis-password
|
||||
19
argocd/redis-auth-secret.example.yaml
Normal file
19
argocd/redis-auth-secret.example.yaml
Normal file
@@ -0,0 +1,19 @@
|
||||
# OPTIONAL — the clean GitOps way to handle the password: create the secret
|
||||
# out-of-band (or via SealedSecrets/SOPS/ExternalSecrets), then set
|
||||
# auth.existingSecret: redis-auth in the Application's valuesObject.
|
||||
#
|
||||
# Do NOT commit a real password to git. Either apply this once by hand with a
|
||||
# real value:
|
||||
#
|
||||
# kubectl create secret generic redis-auth -n redis \
|
||||
# --from-literal=redis-password="$(openssl rand -base64 24)"
|
||||
#
|
||||
# ...or encrypt this file with your secret-management tool of choice.
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: redis-auth
|
||||
namespace: redis
|
||||
type: Opaque
|
||||
stringData:
|
||||
redis-password: CHANGE-ME
|
||||
63
templates/NOTES.txt
Normal file
63
templates/NOTES.txt
Normal file
@@ -0,0 +1,63 @@
|
||||
Native Redis Cluster deployed: {{ .Values.cluster.shards }} writable shards,
|
||||
{{ .Values.cluster.replicasPerShard }} replica(s) per shard,
|
||||
{{ include "redis-cluster.nodeCount" . }} total Redis instances.
|
||||
|
||||
Every shard's persistent members have REQUIRED hostname anti-affinity. A shard
|
||||
cannot place two copies on one Kubernetes worker.
|
||||
|
||||
{{- if .Values.auth.enabled }}
|
||||
|
||||
Get the password:
|
||||
|
||||
kubectl get secret -n {{ .Release.Namespace }} {{ include "redis-cluster.secretName" . }} \
|
||||
-o jsonpath='{.data.{{ include "redis-cluster.secretKey" . }}}' | base64 -d
|
||||
{{- end }}
|
||||
{{- if .Values.redisInsight.enabled }}
|
||||
|
||||
RedisInsight:
|
||||
{{- if .Values.redisInsight.ingress.enabled }}
|
||||
{{ ternary "https" "http" .Values.redisInsight.ingress.tls.enabled }}://{{ .Values.redisInsight.ingress.host }}
|
||||
{{- else }}
|
||||
kubectl port-forward -n {{ .Release.Namespace }} service/{{ include "redis-cluster.redisInsightName" . }} 5540:80
|
||||
http://127.0.0.1:5540
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
Cluster-aware client startup endpoint:
|
||||
|
||||
{{ include "redis-cluster.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.redis.port }}
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
|
||||
External cluster-aware client startup endpoint:
|
||||
|
||||
kubectl get service -n {{ .Release.Namespace }} \
|
||||
{{ include "redis-cluster.fullname" . }}-external \
|
||||
-o jsonpath='{.status.loadBalancer.ingress[0].ip}{.status.loadBalancer.ingress[0].hostname}'
|
||||
|
||||
Use that returned address on port {{ .Values.externalAccess.port }}.
|
||||
|
||||
The external bootstrap LoadBalancer is discovery only. Redis advertises one
|
||||
dynamic LoadBalancer VIP per member on the same port, so MOVED/ASK redirects
|
||||
remain routable from outside Kubernetes without fixed addresses or port fan-out.
|
||||
{{- end }}
|
||||
|
||||
Check all 16384 slots and primary/replica assignments:
|
||||
|
||||
kubectl exec -n {{ .Release.Namespace }} \
|
||||
{{ include "redis-cluster.fullname" . }}-s0-n0-0 -c redis -- \
|
||||
redis-cli --cluster check 127.0.0.1:{{ .Values.redis.port }}
|
||||
|
||||
Do not use a standalone or Sentinel client. The client must support Redis
|
||||
Cluster redirects and connect to the per-node hostnames returned in the slot map.
|
||||
|
||||
StatefulSets use updateStrategy=OnDelete so independent members cannot all roll
|
||||
at once. Follow the one-member-at-a-time upgrade procedure in README.md.
|
||||
|
||||
{{- if .Values.metrics.enabled }}
|
||||
|
||||
Metrics: http://<pod>:{{ .Values.metrics.port }}/metrics (redis_exporter).
|
||||
{{- if not .Values.metrics.serviceMonitor.enabled }}
|
||||
Set metrics.serviceMonitor.enabled=true (plus the correct selector labels) when
|
||||
using Prometheus Operator.
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
154
templates/_helpers.tpl
Normal file
154
templates/_helpers.tpl
Normal file
@@ -0,0 +1,154 @@
|
||||
{{/* Chart name */}}
|
||||
{{- define "redis-cluster.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Fully qualified app name */}}
|
||||
{{- define "redis-cluster.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Chart label */}}
|
||||
{{- define "redis-cluster.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Common labels */}}
|
||||
{{- define "redis-cluster.labels" -}}
|
||||
helm.sh/chart: {{ include "redis-cluster.chart" . }}
|
||||
{{ include "redis-cluster.selectorLabels" . }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Selector labels */}}
|
||||
{{- define "redis-cluster.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "redis-cluster.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Headless service DNS name. Deliberately stop at .svc: the cluster DNS suffix is
|
||||
not necessarily cluster.local, and Kubernetes expands this portable name using
|
||||
the pod's search domains.
|
||||
*/}}
|
||||
{{- define "redis-cluster.headlessFqdn" -}}
|
||||
{{ include "redis-cluster.fullname" . }}-headless.{{ .Release.Namespace }}.svc
|
||||
{{- end -}}
|
||||
|
||||
{{/* Service account name */}}
|
||||
{{- define "redis-cluster.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{- default (include "redis-cluster.fullname" .) .Values.serviceAccount.name -}}
|
||||
{{- else -}}
|
||||
{{- default "default" .Values.serviceAccount.name -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Secret name holding the password */}}
|
||||
{{- define "redis-cluster.secretName" -}}
|
||||
{{- if .Values.auth.existingSecret -}}
|
||||
{{- .Values.auth.existingSecret -}}
|
||||
{{- else -}}
|
||||
{{- include "redis-cluster.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Secret key holding the password */}}
|
||||
{{- define "redis-cluster.secretKey" -}}
|
||||
{{- if .Values.auth.existingSecret -}}
|
||||
{{- .Values.auth.existingSecretKey -}}
|
||||
{{- else -}}
|
||||
redis-password
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Password: explicit value wins; otherwise reuse the one already in the cluster
|
||||
(so upgrades don't rotate it); otherwise generate.
|
||||
*/}}
|
||||
{{- define "redis-cluster.password" -}}
|
||||
{{- if .Values.auth.password -}}
|
||||
{{- .Values.auth.password -}}
|
||||
{{- else -}}
|
||||
{{- $existing := lookup "v1" "Secret" .Release.Namespace (include "redis-cluster.fullname" .) -}}
|
||||
{{- if and $existing $existing.data (index $existing.data "redis-password") -}}
|
||||
{{- index $existing.data "redis-password" | b64dec -}}
|
||||
{{- else -}}
|
||||
{{- randAlphaNum 24 -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Total Redis nodes: shards * (one primary + replicas per shard). */}}
|
||||
{{- define "redis-cluster.nodeCount" -}}
|
||||
{{- mul (int .Values.cluster.shards) (add (int .Values.cluster.replicasPerShard) 1) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Balanced bootstrap Service used by cluster-aware clients. */}}
|
||||
{{- define "redis-cluster.bootstrapServiceName" -}}
|
||||
{{- if .Values.externalAccess.enabled -}}
|
||||
{{- printf "%s-external" (include "redis-cluster.fullname" .) -}}
|
||||
{{- else -}}
|
||||
{{- include "redis-cluster.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* RedisInsight resource name. */}}
|
||||
{{- define "redis-cluster.redisInsightName" -}}
|
||||
{{- printf "%s-insight" (include "redis-cluster.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* RedisInsight labels deliberately do not match the Redis pod selector. */}}
|
||||
{{- define "redis-cluster.redisInsightLabels" -}}
|
||||
helm.sh/chart: {{ include "redis-cluster.chart" . }}
|
||||
app.kubernetes.io/name: redisinsight
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: insight
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "redis-cluster.redisInsightSelectorLabels" -}}
|
||||
app.kubernetes.io/name: redisinsight
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: insight
|
||||
{{- end -}}
|
||||
|
||||
{{/* Environment shared by Redis lifecycle scripts. */}}
|
||||
{{- define "redis-cluster.commonEnv" -}}
|
||||
- name: STS_NAME
|
||||
value: {{ include "redis-cluster.fullname" . | quote }}
|
||||
- name: HEADLESS_SERVICE
|
||||
value: {{ include "redis-cluster.headlessFqdn" . | quote }}
|
||||
- name: NODE_COUNT
|
||||
value: {{ include "redis-cluster.nodeCount" . | quote }}
|
||||
- name: SHARD_COUNT
|
||||
value: {{ .Values.cluster.shards | quote }}
|
||||
- name: REPLICAS_PER_SHARD
|
||||
value: {{ .Values.cluster.replicasPerShard | quote }}
|
||||
- name: REDIS_PORT
|
||||
value: {{ .Values.redis.port | quote }}
|
||||
- name: CLUSTER_BUS_PORT
|
||||
value: {{ .Values.cluster.busPort | quote }}
|
||||
{{- if .Values.auth.enabled }}
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "redis-cluster.secretName" . }}
|
||||
key: {{ include "redis-cluster.secretKey" . }}
|
||||
- name: REDISCLI_AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "redis-cluster.secretName" . }}
|
||||
key: {{ include "redis-cluster.secretKey" . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
381
templates/configmap.yaml
Normal file
381
templates/configmap.yaml
Normal file
@@ -0,0 +1,381 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
data:
|
||||
redis.conf: |
|
||||
port {{ .Values.redis.port }}
|
||||
dir /data
|
||||
appendonly yes
|
||||
appendfsync everysec
|
||||
save ""
|
||||
protected-mode no
|
||||
tcp-keepalive 60
|
||||
repl-diskless-sync yes
|
||||
replica-read-only yes
|
||||
cluster-enabled yes
|
||||
cluster-config-file nodes.conf
|
||||
cluster-port {{ .Values.cluster.busPort }}
|
||||
cluster-node-timeout {{ .Values.cluster.nodeTimeoutMilliseconds }}
|
||||
cluster-require-full-coverage {{ ternary "yes" "no" .Values.cluster.requireFullCoverage }}
|
||||
cluster-allow-reads-when-down {{ ternary "yes" "no" .Values.cluster.allowReadsWhenDown }}
|
||||
cluster-migration-barrier {{ .Values.cluster.migrationBarrier }}
|
||||
cluster-preferred-endpoint-type hostname
|
||||
{{- if .Values.redis.maxmemory }}
|
||||
maxmemory {{ .Values.redis.maxmemory }}
|
||||
maxmemory-policy {{ .Values.redis.maxmemoryPolicy }}
|
||||
{{- end }}
|
||||
{{- with .Values.redis.extraConfig }}
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
start-redis.sh: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
POD_FQDN="$(hostname).${HEADLESS_SERVICE}"
|
||||
if [ "$EXTERNAL_ACCESS_ENABLED" = "true" ]; then
|
||||
ANNOUNCE_HOSTNAME="$(cat /external-endpoint/hostname)"
|
||||
fi
|
||||
/scripts/repair-node-addresses.sh
|
||||
CONF=/etc/redis-runtime/redis.conf
|
||||
cp /etc/redis-ro/redis.conf "$CONF"
|
||||
{
|
||||
echo "cluster-announce-hostname $ANNOUNCE_HOSTNAME"
|
||||
echo "cluster-announce-human-nodename $(hostname)"
|
||||
echo "cluster-announce-port $ANNOUNCE_PORT"
|
||||
echo "cluster-announce-bus-port $CLUSTER_BUS_PORT"
|
||||
if [ -n "${REDIS_PASSWORD:-}" ]; then
|
||||
echo "requirepass $REDIS_PASSWORD"
|
||||
echo "masterauth $REDIS_PASSWORD"
|
||||
fi
|
||||
} >> "$CONF"
|
||||
|
||||
# Only the designated coordinator attempts first-time cluster creation.
|
||||
# The bootstrap runs beside Redis because every node must be listening
|
||||
# before CLUSTER MEET can form the topology.
|
||||
if [ "$POD_FQDN" = "$COORDINATOR_HOST" ]; then
|
||||
/scripts/bootstrap-cluster.sh &
|
||||
/scripts/reconcile-topology.sh &
|
||||
fi
|
||||
|
||||
exec redis-server "$CONF"
|
||||
|
||||
discover-external-endpoint.sh: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
token_file=/var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
ca_file=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
api="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
|
||||
url="${api}/api/v1/namespaces/${POD_NAMESPACE}/services/${EXTERNAL_SERVICE_NAME}"
|
||||
|
||||
while :; do
|
||||
response="$(curl --fail --silent --show-error --cacert "$ca_file" \
|
||||
-H "Authorization: Bearer $(cat "$token_file")" "$url" 2>/dev/null || true)"
|
||||
endpoint="$(printf '%s\n' "$response" |
|
||||
sed -n 's/.*"ip":[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)"
|
||||
if [ -z "$endpoint" ]; then
|
||||
endpoint="$(printf '%s\n' "$response" |
|
||||
sed -n 's/.*"hostname":[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)"
|
||||
fi
|
||||
if [ -n "$endpoint" ]; then
|
||||
printf '%s\n' "$endpoint" > /external-endpoint/hostname
|
||||
echo "Discovered external endpoint $endpoint for $EXTERNAL_SERVICE_NAME"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for LoadBalancer endpoint on $EXTERNAL_SERVICE_NAME"
|
||||
sleep 2
|
||||
done
|
||||
|
||||
start-redisinsight.sh: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
RI_REDIS_HOST="$(cat /bootstrap-endpoint/hostname)"
|
||||
export RI_REDIS_HOST
|
||||
echo "Starting RedisInsight with discovered Redis bootstrap endpoint $RI_REDIS_HOST"
|
||||
exec "$@"
|
||||
|
||||
repair-node-addresses.sh: |
|
||||
#!/bin/sh
|
||||
set -u
|
||||
# nodes.conf persists node IDs and membership on the PVC, but its cluster
|
||||
# bus endpoints include pod IPs. Refresh those IPs using each member's
|
||||
# unique human nodename before Redis starts so a full reschedule recovers
|
||||
# independently of the client endpoint Redis advertises.
|
||||
nodes=/data/nodes.conf
|
||||
[ -s "$nodes" ] || exit 0
|
||||
|
||||
resolve_host() {
|
||||
host=$1
|
||||
if command -v getent >/dev/null 2>&1; then
|
||||
getent hosts "$host" 2>/dev/null | awk 'NR == 1 { print $1 }'
|
||||
else
|
||||
nslookup "$host" 2>/dev/null |
|
||||
awk '/^Address: / && $2 !~ /#/ { address=$2 } END { print address }'
|
||||
fi
|
||||
}
|
||||
|
||||
while :; do
|
||||
resolved=0
|
||||
old_ifs=$IFS; IFS=','
|
||||
for host in $ALL_NODE_HOSTS; do
|
||||
[ -n "$(resolve_host "$host")" ] && resolved=$((resolved + 1))
|
||||
done
|
||||
IFS=$old_ifs
|
||||
[ "$resolved" = "$NODE_COUNT" ] && break
|
||||
echo "Waiting for all $NODE_COUNT persisted member hostnames to resolve ($resolved ready)"
|
||||
sleep 2
|
||||
done
|
||||
|
||||
old_ifs=$IFS; IFS=','
|
||||
for assignment in $NODE_ADDRESS_ASSIGNMENTS; do
|
||||
pod_name=${assignment%%=*}
|
||||
internal_host=${assignment#*=}
|
||||
ip="$(resolve_host "$internal_host")"
|
||||
[ -n "$ip" ] || continue
|
||||
awk -v target="$pod_name" -v new_ip="$ip" '
|
||||
{
|
||||
metadata_count = split($2, metadata, ",")
|
||||
nodename = ""
|
||||
for (i = 3; i <= metadata_count; i++) {
|
||||
split(metadata[i], auxiliary, "=")
|
||||
if (auxiliary[1] == "nodename") nodename = auxiliary[2]
|
||||
}
|
||||
if (nodename == target) {
|
||||
split(metadata[1], bus, "@")
|
||||
split(bus[1], endpoint, ":")
|
||||
suffix = substr($2, length(metadata[1]) + 1)
|
||||
$2 = new_ip ":" endpoint[2] "@" bus[2] suffix
|
||||
}
|
||||
print
|
||||
}
|
||||
' "$nodes" > "${nodes}.new" && mv "${nodes}.new" "$nodes"
|
||||
done
|
||||
IFS=$old_ifs
|
||||
|
||||
bootstrap-cluster.sh: |
|
||||
#!/bin/sh
|
||||
set -u
|
||||
|
||||
cli() {
|
||||
redis-cli --no-auth-warning "$@"
|
||||
}
|
||||
|
||||
resolve_host() {
|
||||
host=$1
|
||||
if command -v getent >/dev/null 2>&1; then
|
||||
getent hosts "$host" 2>/dev/null | awk 'NR == 1 { print $1 }'
|
||||
else
|
||||
nslookup "$host" 2>/dev/null |
|
||||
awk '/^Address: / && $2 !~ /#/ { address=$2 } END { print address }'
|
||||
fi
|
||||
}
|
||||
|
||||
node_value() {
|
||||
host=$1 field=$2
|
||||
cli -h "$host" -p "$REDIS_PORT" cluster info 2>/dev/null |
|
||||
tr -d '\r' | awk -F: -v field="$field" '$1 == field { print $2 }'
|
||||
}
|
||||
|
||||
echo "Redis Cluster bootstrap coordinator: $COORDINATOR_HOST"
|
||||
while :; do
|
||||
all_ready=true
|
||||
old_ifs=$IFS; IFS=','
|
||||
for host in $ALL_NODE_HOSTS; do
|
||||
if [ "$(cli -h "$host" -p "$REDIS_PORT" ping 2>/dev/null)" != PONG ]; then
|
||||
all_ready=false
|
||||
break
|
||||
fi
|
||||
done
|
||||
IFS=$old_ifs
|
||||
$all_ready && break
|
||||
sleep 2
|
||||
done
|
||||
|
||||
if [ "$(node_value "$COORDINATOR_HOST" cluster_state)" = ok ]; then
|
||||
echo "Redis Cluster already healthy; bootstrap is a no-op"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Never overwrite a partially configured or previously initialized
|
||||
# cluster. That state needs repair, not a destructive second bootstrap.
|
||||
pristine=true
|
||||
old_ifs=$IFS; IFS=','
|
||||
for host in $ALL_NODE_HOSTS; do
|
||||
known="$(node_value "$host" cluster_known_nodes)"
|
||||
assigned="$(node_value "$host" cluster_slots_assigned)"
|
||||
if [ "$known" != 1 ] || [ "$assigned" != 0 ]; then
|
||||
pristine=false
|
||||
break
|
||||
fi
|
||||
done
|
||||
IFS=$old_ifs
|
||||
if ! $pristine; then
|
||||
echo "Cluster has existing membership or slots but is not healthy; refusing to reinitialize it" >&2
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Creating a ${SHARD_COUNT}-shard cluster from ${NODE_COUNT} pristine nodes"
|
||||
old_ifs=$IFS; IFS=','
|
||||
for host in $ALL_NODE_HOSTS; do
|
||||
[ "$host" = "$COORDINATOR_HOST" ] && continue
|
||||
ip="$(resolve_host "$host")"
|
||||
if [ -z "$ip" ]; then
|
||||
echo "Could not resolve $host" >&2
|
||||
exit 1
|
||||
fi
|
||||
cli -h "$COORDINATOR_HOST" -p "$REDIS_PORT" \
|
||||
cluster meet "$ip" "$REDIS_PORT" "$CLUSTER_BUS_PORT" >/dev/null || exit 1
|
||||
done
|
||||
IFS=$old_ifs
|
||||
|
||||
# Wait until every node has learned the complete membership before roles
|
||||
# are assigned. This avoids CLUSTER REPLICATE racing gossip propagation.
|
||||
while :; do
|
||||
complete=true
|
||||
old_ifs=$IFS; IFS=','
|
||||
for host in $ALL_NODE_HOSTS; do
|
||||
[ "$(node_value "$host" cluster_known_nodes)" = "$NODE_COUNT" ] || complete=false
|
||||
done
|
||||
IFS=$old_ifs
|
||||
$complete && break
|
||||
sleep 1
|
||||
done
|
||||
|
||||
shard=0
|
||||
old_ifs=$IFS; IFS=','
|
||||
for primary in $PRIMARY_HOSTS; do
|
||||
start=$((16384 * shard / SHARD_COUNT))
|
||||
end=$((16384 * (shard + 1) / SHARD_COUNT - 1))
|
||||
echo "Assigning slots $start-$end to shard $shard ($primary)"
|
||||
cli -h "$primary" -p "$REDIS_PORT" cluster addslotsrange "$start" "$end" >/dev/null || exit 1
|
||||
shard=$((shard + 1))
|
||||
done
|
||||
IFS=$old_ifs
|
||||
|
||||
old_ifs=$IFS; IFS=','
|
||||
for assignment in $REPLICA_ASSIGNMENTS; do
|
||||
replica=${assignment%%=*}
|
||||
primary=${assignment#*=}
|
||||
primary_id="$(cli -h "$primary" -p "$REDIS_PORT" cluster myid 2>/dev/null | tr -d '\r')"
|
||||
[ -n "$primary_id" ] || exit 1
|
||||
echo "Attaching $replica as a replica of $primary"
|
||||
cli -h "$replica" -p "$REDIS_PORT" cluster replicate "$primary_id" >/dev/null || exit 1
|
||||
done
|
||||
IFS=$old_ifs
|
||||
|
||||
# Do not declare success merely because slots are covered. Wait for every
|
||||
# intended replica relationship and for every member to see a healthy
|
||||
# cluster, which prevents an early restart from racing topology gossip.
|
||||
while :; do
|
||||
converged=true
|
||||
old_ifs=$IFS; IFS=','
|
||||
for assignment in $REPLICA_ASSIGNMENTS; do
|
||||
replica=${assignment%%=*}
|
||||
role="$(cli -h "$replica" -p "$REDIS_PORT" role 2>/dev/null | head -n1)"
|
||||
[ "$role" = slave ] || converged=false
|
||||
done
|
||||
for host in $ALL_NODE_HOSTS; do
|
||||
[ "$(node_value "$host" cluster_state)" = ok ] || converged=false
|
||||
done
|
||||
IFS=$old_ifs
|
||||
$converged && break
|
||||
sleep 1
|
||||
done
|
||||
echo "Redis Cluster created: all 16384 slots covered"
|
||||
|
||||
reconcile-topology.sh: |
|
||||
#!/bin/sh
|
||||
set -u
|
||||
# Redis correctly promotes replicas but does not automatically fail back.
|
||||
# Restore the canonical member-0 primaries after a failed worker returns,
|
||||
# keeping the three current primaries distributed across workers.
|
||||
cli() { redis-cli --no-auth-warning "$@"; }
|
||||
cluster_state() {
|
||||
cli -h "$COORDINATOR_HOST" -p "$REDIS_PORT" cluster info 2>/dev/null |
|
||||
tr -d '\r' | awk -F: '$1 == "cluster_state" { print $2 }'
|
||||
}
|
||||
|
||||
while :; do
|
||||
[ -f /etc/redis-runtime/terminating ] && exit 0
|
||||
if [ "$(cluster_state)" = ok ]; then
|
||||
old_ifs=$IFS; IFS=','
|
||||
for primary_identity in $PRIMARY_HOSTS; do
|
||||
role="$(cli -h "$primary_identity" -p "$REDIS_PORT" role 2>/dev/null | head -n1)"
|
||||
if [ "$role" = slave ]; then
|
||||
link="$(cli -h "$primary_identity" -p "$REDIS_PORT" info replication 2>/dev/null |
|
||||
tr -d '\r' | awk -F: '$1 == "master_link_status" { print $2 }')"
|
||||
if [ "$link" = up ]; then
|
||||
echo "Restoring canonical primary role to $primary_identity"
|
||||
cli -h "$primary_identity" -p "$REDIS_PORT" cluster failover >/dev/null 2>&1 || true
|
||||
i=0
|
||||
while [ "$i" -lt 20 ]; do
|
||||
role="$(cli -h "$primary_identity" -p "$REDIS_PORT" role 2>/dev/null | head -n1)"
|
||||
[ "$role" = master ] && break
|
||||
sleep 1
|
||||
i=$((i + 1))
|
||||
done
|
||||
while [ "$(cluster_state)" != ok ]; do sleep 1; done
|
||||
fi
|
||||
fi
|
||||
done
|
||||
IFS=$old_ifs
|
||||
fi
|
||||
sleep 30
|
||||
done
|
||||
|
||||
startup-redis.sh: |
|
||||
#!/bin/sh
|
||||
[ "$(redis-cli -t 3 -p "$REDIS_PORT" --no-auth-warning ping 2>/dev/null)" = PONG ]
|
||||
|
||||
liveness-redis.sh: |
|
||||
#!/bin/sh
|
||||
resp="$(redis-cli -t 3 -p "$REDIS_PORT" --no-auth-warning ping 2>&1 || true)"
|
||||
case "$resp" in
|
||||
PONG|*LOADING*|*CLUSTERDOWN*) exit 0 ;;
|
||||
*) echo "$resp"; exit 1 ;;
|
||||
esac
|
||||
|
||||
readiness-redis.sh: |
|
||||
#!/bin/sh
|
||||
[ "$(redis-cli -t 3 -p "$REDIS_PORT" --no-auth-warning ping 2>/dev/null)" = PONG ] || exit 1
|
||||
state="$(redis-cli -t 3 -p "$REDIS_PORT" --no-auth-warning cluster info 2>/dev/null |
|
||||
tr -d '\r' | awk -F: '$1 == "cluster_state" { print $2 }')"
|
||||
[ "$state" = ok ] || { echo "cluster_state=$state"; exit 1; }
|
||||
|
||||
prestop-redis.sh: |
|
||||
#!/bin/sh
|
||||
# During an intentional restart, ask a healthy replica to take over first.
|
||||
# Replica identities remain on a different Kubernetes node because shard
|
||||
# anti-affinity is tied to persistent member identity, not current role.
|
||||
: > /etc/redis-runtime/terminating
|
||||
role="$(redis-cli -p "$REDIS_PORT" --no-auth-warning role 2>/dev/null | head -n1 || true)"
|
||||
[ "$role" = master ] || exit 0
|
||||
node_id="$(redis-cli -p "$REDIS_PORT" --no-auth-warning cluster myid 2>/dev/null | tr -d '\r')"
|
||||
[ -n "$node_id" ] || exit 0
|
||||
endpoint="$(redis-cli -p "$REDIS_PORT" --no-auth-warning cluster replicas "$node_id" 2>/dev/null |
|
||||
awk '$3 !~ /fail/ && $8 == "connected" { print $2; exit }')"
|
||||
[ -n "$endpoint" ] || exit 0
|
||||
address=${endpoint%%@*}
|
||||
metadata=${endpoint#*,}
|
||||
if [ "$metadata" != "$endpoint" ] && [ -n "$metadata" ]; then
|
||||
replica_host=$metadata
|
||||
else
|
||||
replica_host=${address%:*}
|
||||
fi
|
||||
replica_port=${address##*:}
|
||||
echo "Requesting graceful failover to $replica_host:$replica_port"
|
||||
redis-cli -h "$replica_host" -p "$replica_port" --no-auth-warning cluster failover >/dev/null 2>&1 || exit 0
|
||||
i=0
|
||||
while [ "$i" -lt 15 ]; do
|
||||
role="$(redis-cli -p "$REDIS_PORT" --no-auth-warning role 2>/dev/null | head -n1 || true)"
|
||||
[ "$role" != master ] && exit 0
|
||||
sleep 1
|
||||
i=$((i + 1))
|
||||
done
|
||||
exit 0
|
||||
37
templates/external-endpoint-rbac.yaml
Normal file
37
templates/external-endpoint-rbac.yaml
Normal file
@@ -0,0 +1,37 @@
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
{{- $fullname := include "redis-cluster.fullname" . }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ $fullname }}-endpoint-reader
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
verbs: ["get"]
|
||||
resourceNames:
|
||||
- {{ $fullname }}-external
|
||||
{{- range $shard := until (int .Values.cluster.shards) }}
|
||||
{{- range $member := until (int (add (int $.Values.cluster.replicasPerShard) 1)) }}
|
||||
- {{ printf "%s-s%d-n%d-x" $fullname $shard $member | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ $fullname }}-endpoint-reader
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "redis-cluster.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ $fullname }}-endpoint-reader
|
||||
{{- end }}
|
||||
51
templates/networkpolicy.yaml
Normal file
51
templates/networkpolicy.yaml
Normal file
@@ -0,0 +1,51 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
# Intra-release traffic: client protocol is also used for replication and
|
||||
# key migration; the cluster bus carries gossip and failover elections.
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" . | nindent 14 }}
|
||||
ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
- port: {{ .Values.cluster.busPort }}
|
||||
# Client traffic.
|
||||
{{- if .Values.networkPolicy.allowExternal }}
|
||||
- ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
{{- else if .Values.networkPolicy.extraIngress }}
|
||||
- from:
|
||||
{{- toYaml .Values.networkPolicy.extraIngress | nindent 8 }}
|
||||
ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
# Metrics scraping.
|
||||
{{- if .Values.networkPolicy.metricsFromNamespaces }}
|
||||
- from:
|
||||
{{- range .Values.networkPolicy.metricsFromNamespaces }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: {{ .Values.metrics.port }}
|
||||
{{- else }}
|
||||
- ports:
|
||||
- port: {{ .Values.metrics.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
14
templates/pdb.yaml
Normal file
14
templates/pdb.yaml
Normal file
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
spec:
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
87
templates/redisinsight-istio.yaml
Normal file
87
templates/redisinsight-istio.yaml
Normal file
@@ -0,0 +1,87 @@
|
||||
{{- if and .Values.redisInsight.enabled .Values.redisInsight.ingress.enabled }}
|
||||
{{- if not .Values.redisInsight.ingress.host }}
|
||||
{{- fail "redisInsight.ingress.host is required when RedisInsight ingress is enabled" }}
|
||||
{{- end }}
|
||||
{{- if and .Values.redisInsight.ingress.tls.enabled (not .Values.redisInsight.ingress.tls.credentialName) }}
|
||||
{{- fail "redisInsight.ingress.tls.credentialName is required when TLS is enabled" }}
|
||||
{{- end }}
|
||||
{{- if and .Values.redisInsight.ingress.tls.certificate.create (not .Values.redisInsight.ingress.tls.enabled) }}
|
||||
{{- fail "redisInsight.ingress.tls.enabled must be true when certificate.create is true" }}
|
||||
{{- end }}
|
||||
{{- if and .Values.redisInsight.ingress.tls.certificate.create (not .Values.redisInsight.ingress.tls.certificate.issuerName) }}
|
||||
{{- fail "redisInsight.ingress.tls.certificate.issuerName is required when certificate.create is true" }}
|
||||
{{- end }}
|
||||
{{- if and .Values.redisInsight.ingress.tls.enabled .Values.redisInsight.ingress.tls.certificate.create }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.redisInsightName" . }}-tls
|
||||
namespace: {{ default .Release.Namespace .Values.redisInsight.ingress.tls.certificate.secretNamespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
|
||||
spec:
|
||||
secretName: {{ .Values.redisInsight.ingress.tls.credentialName }}
|
||||
issuerRef:
|
||||
name: {{ .Values.redisInsight.ingress.tls.certificate.issuerName }}
|
||||
kind: {{ .Values.redisInsight.ingress.tls.certificate.issuerKind }}
|
||||
commonName: {{ .Values.redisInsight.ingress.host | quote }}
|
||||
dnsNames:
|
||||
- {{ .Values.redisInsight.ingress.host | quote }}
|
||||
---
|
||||
{{- end }}
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.redisInsightName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- toYaml .Values.redisInsight.ingress.gatewaySelector | nindent 4 }}
|
||||
servers:
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- {{ .Values.redisInsight.ingress.host | quote }}
|
||||
{{- if .Values.redisInsight.ingress.tls.enabled }}
|
||||
tls:
|
||||
httpsRedirect: true
|
||||
{{- end }}
|
||||
{{- if .Values.redisInsight.ingress.tls.enabled }}
|
||||
- port:
|
||||
number: 443
|
||||
name: https
|
||||
protocol: HTTPS
|
||||
hosts:
|
||||
- {{ .Values.redisInsight.ingress.host | quote }}
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
credentialName: {{ .Values.redisInsight.ingress.tls.credentialName }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.redisInsightName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
|
||||
spec:
|
||||
hosts:
|
||||
- {{ .Values.redisInsight.ingress.host | quote }}
|
||||
gateways:
|
||||
- {{ include "redis-cluster.redisInsightName" . }}
|
||||
http:
|
||||
- match:
|
||||
- uri:
|
||||
prefix: /
|
||||
timeout: {{ .Values.redisInsight.ingress.requestTimeout }}
|
||||
route:
|
||||
- destination:
|
||||
host: {{ include "redis-cluster.redisInsightName" . }}
|
||||
port:
|
||||
number: 80
|
||||
{{- end }}
|
||||
220
templates/redisinsight.yaml
Normal file
220
templates/redisinsight.yaml
Normal file
@@ -0,0 +1,220 @@
|
||||
{{- if .Values.redisInsight.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.redisInsightName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "redis-cluster.redisInsightSelectorLabels" . | nindent 4 }}
|
||||
{{- if .Values.redisInsight.persistence.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.redisInsightName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
|
||||
{{- with .Values.redisInsight.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- toYaml .Values.redisInsight.persistence.accessModes | nindent 4 }}
|
||||
{{- with .Values.redisInsight.persistence.storageClass }}
|
||||
storageClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.redisInsight.persistence.size }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.redisInsightName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.redisInsightLabels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: 1
|
||||
# RedisInsight stores its connection database under /data. Recreate avoids
|
||||
# two pods contending for the same ReadWriteOnce volume during an upgrade.
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.redisInsightSelectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "redis-cluster.redisInsightSelectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- with .Values.redisInsight.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
|
||||
serviceAccountName: {{ include "redis-cluster.serviceAccountName" . }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
|
||||
initContainers:
|
||||
- name: discover-bootstrap-endpoint
|
||||
image: "{{ .Values.externalAccess.endpointDiscovery.image.repository }}:{{ .Values.externalAccess.endpointDiscovery.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.externalAccess.endpointDiscovery.image.pullPolicy }}
|
||||
command: ["/bin/sh", "/scripts/discover-external-endpoint.sh"]
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: EXTERNAL_SERVICE_NAME
|
||||
value: {{ include "redis-cluster.bootstrapServiceName" . | quote }}
|
||||
resources:
|
||||
{{- toYaml .Values.externalAccess.endpointDiscovery.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
readOnly: true
|
||||
- name: bootstrap-endpoint
|
||||
mountPath: /external-endpoint
|
||||
- name: kube-api-access
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: redisinsight
|
||||
image: "{{ .Values.redisInsight.image.repository }}:{{ .Values.redisInsight.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.redisInsight.image.pullPolicy }}
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
|
||||
# Preserve the image CMD as arguments; this wrapper only injects the
|
||||
# dynamically discovered LoadBalancer endpoint before exec.
|
||||
command: ["/scripts/start-redisinsight.sh"]
|
||||
{{- end }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
env:
|
||||
- name: RI_APP_HOST
|
||||
value: "0.0.0.0"
|
||||
- name: RI_APP_PORT
|
||||
value: {{ .Values.redisInsight.port | quote }}
|
||||
# These variables register a connection inside RedisInsight only;
|
||||
# they do not alter the Redis cluster or its Kubernetes resources.
|
||||
- name: RI_REDIS_HOST
|
||||
value: {{ default (include "redis-cluster.bootstrapServiceName" .) .Values.redisInsight.connection.host | quote }}
|
||||
- name: RI_REDIS_PORT
|
||||
value: {{ default (ternary .Values.externalAccess.port .Values.redis.port .Values.externalAccess.enabled) .Values.redisInsight.connection.port | quote }}
|
||||
- name: RI_REDIS_ALIAS
|
||||
value: {{ .Values.redisInsight.connection.alias | quote }}
|
||||
- name: RI_REDIS_TLS
|
||||
value: {{ .Values.redisInsight.connection.tls | quote }}
|
||||
{{- if .Values.auth.enabled }}
|
||||
- name: RI_REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "redis-cluster.secretName" . }}
|
||||
key: {{ include "redis-cluster.secretKey" . }}
|
||||
{{- end }}
|
||||
- name: RI_STDOUT_LOGGER
|
||||
value: "true"
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.redisInsight.port }}
|
||||
protocol: TCP
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /api/health/
|
||||
port: http
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 60
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health/
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health/
|
||||
port: http
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 5
|
||||
resources:
|
||||
{{- toYaml .Values.redisInsight.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
readOnly: true
|
||||
- name: bootstrap-endpoint
|
||||
mountPath: /bootstrap-endpoint
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: data
|
||||
{{- if .Values.redisInsight.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "redis-cluster.redisInsightName" . }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.externalAccess.enabled (not .Values.redisInsight.connection.host) }}
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: {{ include "redis-cluster.fullname" . }}
|
||||
defaultMode: 0555
|
||||
- name: bootstrap-endpoint
|
||||
emptyDir: {}
|
||||
- name: kube-api-access
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
expirationSeconds: 3600
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
{{- end }}
|
||||
{{- with .Values.redisInsight.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.redisInsight.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
12
templates/secret.yaml
Normal file
12
templates/secret.yaml
Normal file
@@ -0,0 +1,12 @@
|
||||
{{- if and .Values.auth.enabled (not .Values.auth.existingSecret) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
redis-password: {{ include "redis-cluster.password" . | b64enc | quote }}
|
||||
{{- end }}
|
||||
75
templates/service-external.yaml
Normal file
75
templates/service-external.yaml
Normal file
@@ -0,0 +1,75 @@
|
||||
{{- if .Values.externalAccess.enabled }}
|
||||
{{- $root := . }}
|
||||
{{- $fullname := include "redis-cluster.fullname" . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $fullname }}-external
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
redis-cluster.external-role: bootstrap
|
||||
{{- with .Values.externalAccess.bootstrap.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: {{ .Values.externalAccess.externalTrafficPolicy }}
|
||||
allocateLoadBalancerNodePorts: {{ .Values.externalAccess.allocateLoadBalancerNodePorts }}
|
||||
{{- with .Values.externalAccess.loadBalancerClass }}
|
||||
loadBalancerClass: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.externalAccess.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "redis-cluster.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: {{ .Values.externalAccess.port }}
|
||||
targetPort: tcp-redis
|
||||
appProtocol: redis
|
||||
{{- range $shard := until (int .Values.cluster.shards) }}
|
||||
{{- range $member := until (int (add (int $.Values.cluster.replicasPerShard) 1)) }}
|
||||
{{- $memberName := printf "%s-s%d-n%d" $fullname $shard $member | trunc 63 | trimSuffix "-" }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $memberName }}-x
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" $root | nindent 4 }}
|
||||
redis-cluster.external-role: member
|
||||
redis-cluster.shard: {{ $shard | quote }}
|
||||
redis-cluster.member: {{ $member | quote }}
|
||||
{{- with $.Values.externalAccess.memberServices.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: {{ $.Values.externalAccess.externalTrafficPolicy }}
|
||||
allocateLoadBalancerNodePorts: {{ $.Values.externalAccess.allocateLoadBalancerNodePorts }}
|
||||
{{- with $.Values.externalAccess.loadBalancerClass }}
|
||||
loadBalancerClass: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $.Values.externalAccess.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "redis-cluster.selectorLabels" $root | nindent 4 }}
|
||||
redis-cluster.shard: {{ $shard | quote }}
|
||||
redis-cluster.member: {{ $member | quote }}
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: {{ $.Values.externalAccess.port }}
|
||||
targetPort: tcp-redis
|
||||
appProtocol: redis
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
22
templates/service-headless.yaml
Normal file
22
templates/service-headless.yaml
Normal file
@@ -0,0 +1,22 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.fullname" . }}-headless
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
spec:
|
||||
clusterIP: None
|
||||
# Pods must resolve each other during bootstrap, before they are Ready.
|
||||
publishNotReadyAddresses: true
|
||||
selector:
|
||||
{{- include "redis-cluster.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: {{ .Values.redis.port }}
|
||||
targetPort: tcp-redis
|
||||
appProtocol: redis
|
||||
- name: tcp-cluster
|
||||
port: {{ .Values.cluster.busPort }}
|
||||
targetPort: tcp-cluster
|
||||
appProtocol: redis
|
||||
24
templates/service.yaml
Normal file
24
templates/service.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
{{/* Any node is a valid startup node. Cluster-aware clients fetch the slot map
|
||||
and then connect directly to the stable per-member hostnames Redis advertises. */}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
{{- include "redis-cluster.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: {{ .Values.redis.port }}
|
||||
targetPort: tcp-redis
|
||||
appProtocol: redis
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: http-metrics
|
||||
port: {{ .Values.metrics.port }}
|
||||
targetPort: http-metrics
|
||||
appProtocol: http
|
||||
{{- end }}
|
||||
14
templates/serviceaccount.yaml
Normal file
14
templates/serviceaccount.yaml
Normal file
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end }}
|
||||
20
templates/servicemonitor.yaml
Normal file
20
templates/servicemonitor.yaml
Normal file
@@ -0,0 +1,20 @@
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "redis-cluster.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" . | nindent 4 }}
|
||||
{{- with .Values.metrics.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: http-metrics
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
311
templates/statefulset.yaml
Normal file
311
templates/statefulset.yaml
Normal file
@@ -0,0 +1,311 @@
|
||||
{{- $root := . -}}
|
||||
{{- $fullname := include "redis-cluster.fullname" . -}}
|
||||
{{- if gt (len $fullname) 53 -}}
|
||||
{{- fail (printf "release fullname %q is too long; use fullnameOverride with at most 53 characters" $fullname) -}}
|
||||
{{- end -}}
|
||||
{{- if ge (int .Values.cluster.replicasPerShard) (int .Values.cluster.shards) -}}
|
||||
{{- fail "cluster.replicasPerShard must be lower than cluster.shards so crossed placement never puts a shard replica with its own primary" -}}
|
||||
{{- end -}}
|
||||
{{- $headless := include "redis-cluster.headlessFqdn" . -}}
|
||||
{{- $nodeCount := include "redis-cluster.nodeCount" . -}}
|
||||
{{- $allHosts := list -}}
|
||||
{{- $primaryHosts := list -}}
|
||||
{{- $assignments := list -}}
|
||||
{{- $addressAssignments := list -}}
|
||||
{{- range $shard := until (int .Values.cluster.shards) -}}
|
||||
{{- range $member := until (int (add (int $.Values.cluster.replicasPerShard) 1)) -}}
|
||||
{{- $memberName := printf "%s-s%d-n%d" $fullname $shard $member | trunc 63 | trimSuffix "-" -}}
|
||||
{{- $podName := printf "%s-0" $memberName -}}
|
||||
{{- $host := printf "%s-0.%s" $memberName $headless -}}
|
||||
{{- $allHosts = append $allHosts $host -}}
|
||||
{{- $addressAssignments = append $addressAssignments (printf "%s=%s" $podName $host) -}}
|
||||
{{- if eq $member 0 -}}
|
||||
{{- $primaryHosts = append $primaryHosts $host -}}
|
||||
{{- else -}}
|
||||
{{- $primaryName := printf "%s-s%d-n0" $fullname $shard | trunc 63 | trimSuffix "-" -}}
|
||||
{{- $primaryHost := printf "%s-0.%s" $primaryName $headless -}}
|
||||
{{- $assignments = append $assignments (printf "%s=%s" $host $primaryHost) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $coordinator := first $primaryHosts -}}
|
||||
{{- range $shard := until (int .Values.cluster.shards) }}
|
||||
{{- range $member := until (int (add (int $.Values.cluster.replicasPerShard) 1)) }}
|
||||
{{- $memberName := printf "%s-s%d-n%d" $fullname $shard $member | trunc 63 | trimSuffix "-" }}
|
||||
{{- $memberIndex := add (mul $shard (add (int $.Values.cluster.replicasPerShard) 1)) $member }}
|
||||
{{- $announceHostname := printf "%s-0.%s" $memberName $headless }}
|
||||
{{- $externalServiceName := printf "%s-x" $memberName }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ $memberName }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "redis-cluster.labels" $root | nindent 4 }}
|
||||
redis-cluster.shard: {{ $shard | quote }}
|
||||
redis-cluster.member: {{ $member | quote }}
|
||||
spec:
|
||||
serviceName: {{ $fullname }}-headless
|
||||
replicas: 1
|
||||
podManagementPolicy: Parallel
|
||||
# Separate one-member StatefulSets would otherwise all roll concurrently.
|
||||
# OnDelete makes upgrades explicit and safe; see README.md.
|
||||
updateStrategy:
|
||||
type: OnDelete
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" $root | nindent 6 }}
|
||||
redis-cluster.shard: {{ $shard | quote }}
|
||||
redis-cluster.member: {{ $member | quote }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "redis-cluster.selectorLabels" $root | nindent 8 }}
|
||||
redis-cluster.shard: {{ $shard | quote }}
|
||||
redis-cluster.member: {{ $member | quote }}
|
||||
{{- with $.Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") $root | sha256sum }}
|
||||
{{- if not $.Values.istio.injectSidecar }}
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- else }}
|
||||
proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'
|
||||
{{- end }}
|
||||
{{- with $.Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "redis-cluster.serviceAccountName" $root }}
|
||||
automountServiceAccountToken: false
|
||||
terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
|
||||
{{- with $.Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $.Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml $.Values.podSecurityContext | nindent 8 }}
|
||||
affinity:
|
||||
{{- if gt $member 0 }}
|
||||
# Cross replicas onto the worker holding another shard's canonical
|
||||
# primary. For 3x1 this produces A:P0+R2, B:P1+R0, C:P2+R1.
|
||||
podAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" $root | nindent 18 }}
|
||||
redis-cluster.shard: {{ mod (add $shard $member) (int $.Values.cluster.shards) | quote }}
|
||||
redis-cluster.member: "0"
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- end }}
|
||||
podAntiAffinity:
|
||||
# Hard invariants: copies of one shard never share a worker, and
|
||||
# equivalent member identities are spread across workers. In the
|
||||
# canonical topology, this permits at most one primary per worker.
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" $root | nindent 18 }}
|
||||
redis-cluster.shard: {{ $shard | quote }}
|
||||
topologyKey: kubernetes.io/hostname
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
{{- include "redis-cluster.selectorLabels" $root | nindent 18 }}
|
||||
redis-cluster.member: {{ $member | quote }}
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- with $.Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $.Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $.Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if $.Values.externalAccess.enabled }}
|
||||
initContainers:
|
||||
- name: discover-external-endpoint
|
||||
image: "{{ $.Values.externalAccess.endpointDiscovery.image.repository }}:{{ $.Values.externalAccess.endpointDiscovery.image.tag }}"
|
||||
imagePullPolicy: {{ $.Values.externalAccess.endpointDiscovery.image.pullPolicy }}
|
||||
command: ["/bin/sh", "/scripts/discover-external-endpoint.sh"]
|
||||
securityContext:
|
||||
{{- toYaml $.Values.containerSecurityContext | nindent 12 }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: EXTERNAL_SERVICE_NAME
|
||||
value: {{ $externalServiceName | quote }}
|
||||
resources:
|
||||
{{- toYaml $.Values.externalAccess.endpointDiscovery.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
- name: external-endpoint
|
||||
mountPath: /external-endpoint
|
||||
- name: kube-api-access
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: redis
|
||||
image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"
|
||||
imagePullPolicy: {{ $.Values.image.pullPolicy }}
|
||||
command: ["/bin/sh", "/scripts/start-redis.sh"]
|
||||
securityContext:
|
||||
{{- toYaml $.Values.containerSecurityContext | nindent 12 }}
|
||||
env:
|
||||
{{- include "redis-cluster.commonEnv" $root | nindent 12 }}
|
||||
- name: COORDINATOR_HOST
|
||||
value: {{ $coordinator | quote }}
|
||||
- name: ALL_NODE_HOSTS
|
||||
value: {{ join "," $allHosts | quote }}
|
||||
- name: PRIMARY_HOSTS
|
||||
value: {{ join "," $primaryHosts | quote }}
|
||||
- name: REPLICA_ASSIGNMENTS
|
||||
value: {{ join "," $assignments | quote }}
|
||||
- name: NODE_ADDRESS_ASSIGNMENTS
|
||||
value: {{ join "," $addressAssignments | quote }}
|
||||
- name: ANNOUNCE_HOSTNAME
|
||||
value: {{ $announceHostname | quote }}
|
||||
- name: ANNOUNCE_PORT
|
||||
value: {{ ternary $.Values.externalAccess.port $.Values.redis.port $.Values.externalAccess.enabled | quote }}
|
||||
- name: EXTERNAL_ACCESS_ENABLED
|
||||
value: {{ $.Values.externalAccess.enabled | quote }}
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
containerPort: {{ $.Values.redis.port }}
|
||||
- name: tcp-cluster
|
||||
containerPort: {{ $.Values.cluster.busPort }}
|
||||
startupProbe:
|
||||
exec:
|
||||
command: ["/bin/sh", "/scripts/startup-redis.sh"]
|
||||
initialDelaySeconds: {{ $.Values.probes.redis.startup.initialDelaySeconds }}
|
||||
periodSeconds: {{ $.Values.probes.redis.startup.periodSeconds }}
|
||||
timeoutSeconds: {{ $.Values.probes.redis.startup.timeoutSeconds }}
|
||||
failureThreshold: {{ $.Values.probes.redis.startup.failureThreshold }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ["/bin/sh", "/scripts/liveness-redis.sh"]
|
||||
periodSeconds: {{ $.Values.probes.redis.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ $.Values.probes.redis.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ $.Values.probes.redis.liveness.failureThreshold }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["/bin/sh", "/scripts/readiness-redis.sh"]
|
||||
periodSeconds: {{ $.Values.probes.redis.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ $.Values.probes.redis.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ $.Values.probes.redis.readiness.failureThreshold }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["/bin/sh", "/scripts/prestop-redis.sh"]
|
||||
resources:
|
||||
{{- toYaml $.Values.redis.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
- name: config
|
||||
mountPath: /etc/redis-ro
|
||||
- name: redis-runtime
|
||||
mountPath: /etc/redis-runtime
|
||||
{{- if $.Values.externalAccess.enabled }}
|
||||
- name: external-endpoint
|
||||
mountPath: /external-endpoint
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $.Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
image: "{{ $.Values.metrics.image.repository }}:{{ $.Values.metrics.image.tag }}"
|
||||
imagePullPolicy: {{ $.Values.metrics.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml $.Values.containerSecurityContext | nindent 12 }}
|
||||
env:
|
||||
- name: REDIS_ADDR
|
||||
value: "redis://localhost:{{ $.Values.redis.port }}"
|
||||
{{- if $.Values.auth.enabled }}
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "redis-cluster.secretName" $root }}
|
||||
key: {{ include "redis-cluster.secretKey" $root }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http-metrics
|
||||
containerPort: {{ $.Values.metrics.port }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: http-metrics
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 15
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: http-metrics
|
||||
periodSeconds: 15
|
||||
resources:
|
||||
{{- toYaml $.Values.metrics.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: {{ $fullname }}
|
||||
defaultMode: 0555
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ $fullname }}
|
||||
items:
|
||||
- key: redis.conf
|
||||
path: redis.conf
|
||||
- name: redis-runtime
|
||||
emptyDir: {}
|
||||
{{- if $.Values.externalAccess.enabled }}
|
||||
- name: external-endpoint
|
||||
emptyDir: {}
|
||||
- name: kube-api-access
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
expirationSeconds: 3600
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
{{- end }}
|
||||
{{- if not $.Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if $.Values.persistence.enabled }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
{{- with $.Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- toYaml $.Values.persistence.accessModes | nindent 10 }}
|
||||
{{- with $.Values.persistence.storageClass }}
|
||||
storageClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ $.Values.persistence.size }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
230
values.schema.json
Normal file
230
values.schema.json
Normal file
@@ -0,0 +1,230 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft-07/schema#",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cluster": {
|
||||
"type": "object",
|
||||
"required": ["shards", "replicasPerShard", "busPort"],
|
||||
"properties": {
|
||||
"shards": { "type": "integer", "minimum": 3, "maximum": 99 },
|
||||
"replicasPerShard": { "type": "integer", "minimum": 1, "maximum": 9 },
|
||||
"busPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
||||
"nodeTimeoutMilliseconds": { "type": "integer", "minimum": 1000 },
|
||||
"requireFullCoverage": { "type": "boolean" },
|
||||
"allowReadsWhenDown": { "type": "boolean" },
|
||||
"migrationBarrier": { "type": "integer", "minimum": 0 }
|
||||
}
|
||||
},
|
||||
"auth": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"password": { "type": "string" },
|
||||
"existingSecret": { "type": "string" },
|
||||
"existingSecretKey": { "type": "string" }
|
||||
}
|
||||
},
|
||||
"redis": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
||||
"maxmemory": { "type": "string" },
|
||||
"maxmemoryPolicy": {
|
||||
"enum": [
|
||||
"noeviction",
|
||||
"allkeys-lru", "volatile-lru",
|
||||
"allkeys-lfu", "volatile-lfu",
|
||||
"allkeys-random", "volatile-random",
|
||||
"volatile-ttl"
|
||||
]
|
||||
},
|
||||
"extraConfig": { "type": "string" }
|
||||
}
|
||||
},
|
||||
"probes": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"redis": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"startup": { "$ref": "#/definitions/probe" },
|
||||
"liveness": { "$ref": "#/definitions/probe" },
|
||||
"readiness": { "$ref": "#/definitions/probe" }
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"externalAccess": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
||||
"bootstrap": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"annotations": { "type": "object" }
|
||||
}
|
||||
},
|
||||
"memberServices": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"annotations": { "type": "object" }
|
||||
}
|
||||
},
|
||||
"loadBalancerClass": { "type": "string" },
|
||||
"externalTrafficPolicy": { "enum": ["Cluster", "Local"] },
|
||||
"loadBalancerSourceRanges": {
|
||||
"type": "array",
|
||||
"items": { "type": "string", "minLength": 1 }
|
||||
},
|
||||
"allocateLoadBalancerNodePorts": { "type": "boolean" },
|
||||
"endpointDiscovery": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"image": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"repository": { "type": "string", "minLength": 1 },
|
||||
"tag": { "type": "string", "minLength": 1 },
|
||||
"pullPolicy": { "enum": ["Always", "IfNotPresent", "Never"] }
|
||||
}
|
||||
},
|
||||
"resources": { "type": "object" }
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"metrics": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"port": { "type": "integer", "minimum": 1, "maximum": 65535 }
|
||||
}
|
||||
},
|
||||
"redisInsight": {
|
||||
"type": "object",
|
||||
"required": ["enabled", "image", "port", "connection", "persistence", "ingress"],
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"image": {
|
||||
"type": "object",
|
||||
"required": ["repository", "tag", "pullPolicy"],
|
||||
"properties": {
|
||||
"repository": { "type": "string", "minLength": 1 },
|
||||
"tag": { "type": "string", "minLength": 1 },
|
||||
"pullPolicy": { "enum": ["Always", "IfNotPresent", "Never"] }
|
||||
}
|
||||
},
|
||||
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
||||
"connection": {
|
||||
"type": "object",
|
||||
"required": ["host", "port", "alias", "tls"],
|
||||
"properties": {
|
||||
"host": { "type": "string" },
|
||||
"port": { "type": "integer", "minimum": 0, "maximum": 65535 },
|
||||
"alias": { "type": "string", "minLength": 1 },
|
||||
"tls": { "type": "boolean" }
|
||||
}
|
||||
},
|
||||
"persistence": {
|
||||
"type": "object",
|
||||
"required": ["enabled", "size"],
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"storageClass": { "type": "string" },
|
||||
"accessModes": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": { "enum": ["ReadWriteOnce", "ReadOnlyMany", "ReadWriteMany", "ReadWriteOncePod"] }
|
||||
},
|
||||
"size": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"pattern": "^([0-9]+([.][0-9]+)?|[.][0-9]+)([eE][+-]?[0-9]+|[num]|[kKMGTP]i?|Ei?)?$"
|
||||
},
|
||||
"annotations": { "type": "object" }
|
||||
}
|
||||
},
|
||||
"resources": { "type": "object" },
|
||||
"podAnnotations": { "type": "object" },
|
||||
"nodeSelector": { "type": "object" },
|
||||
"tolerations": { "type": "array" },
|
||||
"ingress": {
|
||||
"type": "object",
|
||||
"required": ["enabled", "host", "gatewaySelector", "requestTimeout", "tls"],
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"host": { "type": "string" },
|
||||
"gatewaySelector": { "type": "object", "minProperties": 1 },
|
||||
"requestTimeout": { "type": "string", "minLength": 1 },
|
||||
"tls": {
|
||||
"type": "object",
|
||||
"required": ["enabled", "credentialName", "certificate"],
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"credentialName": { "type": "string" },
|
||||
"certificate": {
|
||||
"type": "object",
|
||||
"required": ["create", "issuerName", "issuerKind", "secretNamespace"],
|
||||
"properties": {
|
||||
"create": { "type": "boolean" },
|
||||
"issuerName": { "type": "string" },
|
||||
"issuerKind": { "enum": ["Issuer", "ClusterIssuer"] },
|
||||
"secretNamespace": { "type": "string" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"persistence": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"storageClass": { "type": "string" },
|
||||
"size": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"pattern": "^([0-9]+([.][0-9]+)?|[.][0-9]+)([eE][+-]?[0-9]+|[num]|[kKMGTP]i?|Ei?)?$"
|
||||
}
|
||||
}
|
||||
},
|
||||
"networkPolicy": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"allowExternal": { "type": "boolean" },
|
||||
"extraIngress": { "type": "array" },
|
||||
"metricsFromNamespaces": { "type": "array", "items": { "type": "string" } }
|
||||
}
|
||||
},
|
||||
"podDisruptionBudget": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": { "type": "boolean" },
|
||||
"maxUnavailable": { "type": "integer", "minimum": 0 }
|
||||
}
|
||||
},
|
||||
"istio": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"injectSidecar": { "type": "boolean" }
|
||||
}
|
||||
},
|
||||
"terminationGracePeriodSeconds": { "type": "integer", "minimum": 0 }
|
||||
},
|
||||
"definitions": {
|
||||
"probe": {
|
||||
"type": "object",
|
||||
"required": ["periodSeconds", "timeoutSeconds", "failureThreshold"],
|
||||
"properties": {
|
||||
"initialDelaySeconds": { "type": "integer", "minimum": 0 },
|
||||
"periodSeconds": { "type": "integer", "minimum": 1 },
|
||||
"timeoutSeconds": { "type": "integer", "minimum": 1 },
|
||||
"failureThreshold": { "type": "integer", "minimum": 1 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
247
values.yaml
Normal file
247
values.yaml
Normal file
@@ -0,0 +1,247 @@
|
||||
# Native Redis Cluster topology. The member StatefulSets contain
|
||||
# shards * (replicasPerShard + 1) pods. Changing either value after the cluster
|
||||
# contains data requires an explicit Redis reshard/add-node operation; a Helm
|
||||
# upgrade alone intentionally does not mutate the slot map.
|
||||
cluster:
|
||||
# -- Independently writable hash-slot primaries. Redis requires at least 3
|
||||
# for automatic failover elections.
|
||||
shards: 3
|
||||
# -- Readable, failover-capable replicas attached to every shard primary.
|
||||
replicasPerShard: 1
|
||||
# -- Dedicated node-to-node cluster bus port.
|
||||
busPort: 16379
|
||||
nodeTimeoutMilliseconds: 10000
|
||||
requireFullCoverage: true
|
||||
allowReadsWhenDown: false
|
||||
migrationBarrier: 1
|
||||
|
||||
image:
|
||||
repository: redis
|
||||
tag: 7.4-alpine
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
auth:
|
||||
enabled: false
|
||||
# -- Password. Leave empty to auto-generate one (persisted across upgrades
|
||||
# via helm lookup).
|
||||
password: ""
|
||||
# -- Use an existing secret instead of creating one.
|
||||
existingSecret: ""
|
||||
existingSecretKey: redis-password
|
||||
|
||||
redis:
|
||||
port: 6379
|
||||
# -- Cap Redis memory usage; keep it below the container memory limit.
|
||||
maxmemory: 384mb
|
||||
maxmemoryPolicy: noeviction
|
||||
# -- Extra lines appended verbatim to redis.conf.
|
||||
extraConfig: ""
|
||||
resources:
|
||||
requests:
|
||||
cpu: 70m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
|
||||
probes:
|
||||
redis:
|
||||
# -- Redis may need to recover AOF and rejoin the cluster after a worker or
|
||||
# storage outage. Startup failures are tolerated for 15 minutes.
|
||||
startup:
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 4
|
||||
failureThreshold: 180
|
||||
# -- Ten consecutive failed checks over 150 seconds are required before
|
||||
# Kubernetes restarts Redis. LOADING and CLUSTERDOWN remain live states.
|
||||
liveness:
|
||||
periodSeconds: 15
|
||||
timeoutSeconds: 8
|
||||
failureThreshold: 10
|
||||
# -- Readiness only controls traffic; it never restarts the container.
|
||||
readiness:
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 4
|
||||
failureThreshold: 3
|
||||
|
||||
# Redis Cluster clients must reach the exact member named by MOVED/ASK replies.
|
||||
# When enabled, the Kubernetes LoadBalancer implementation allocates one
|
||||
# endpoint per member plus a balanced bootstrap endpoint. Pods discover their
|
||||
# assigned endpoint from the Kubernetes API before Redis starts.
|
||||
externalAccess:
|
||||
# -- Disabled by default because this creates one LoadBalancer per Redis
|
||||
# member plus one bootstrap LoadBalancer and can incur provider charges.
|
||||
enabled: false
|
||||
port: 6379
|
||||
bootstrap:
|
||||
annotations: {}
|
||||
memberServices:
|
||||
annotations: {}
|
||||
loadBalancerClass: ""
|
||||
externalTrafficPolicy: Cluster
|
||||
# -- Strongly recommended: restrict this to the client networks. An empty
|
||||
# list leaves reachability to the LoadBalancer/firewall implementation.
|
||||
loadBalancerSourceRanges: []
|
||||
allocateLoadBalancerNodePorts: true
|
||||
endpointDiscovery:
|
||||
image:
|
||||
repository: curlimages/curl
|
||||
tag: 8.21.0
|
||||
pullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 8Mi
|
||||
limits:
|
||||
memory: 32Mi
|
||||
|
||||
metrics:
|
||||
enabled: true
|
||||
image:
|
||||
# -- redis_exporter's own release registry (upstream project; also mirrored
|
||||
# at quay.io/oliver006/redis_exporter and docker.io/oliver006/redis_exporter).
|
||||
# GHCR avoids Docker Hub pull rate limits.
|
||||
repository: ghcr.io/oliver006/redis_exporter
|
||||
tag: v1.87.0-alpine
|
||||
pullPolicy: IfNotPresent
|
||||
port: 9121
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
memory: 64Mi
|
||||
serviceMonitor:
|
||||
# -- Requires the Prometheus Operator CRDs (kube-prometheus-stack).
|
||||
enabled: false
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
# -- Extra labels so your Prometheus instance selects this ServiceMonitor,
|
||||
# e.g. release: kube-prometheus-stack
|
||||
labels: {}
|
||||
|
||||
# Optional browser UI for inspecting and operating this Redis Cluster. The
|
||||
# component is disabled by default; enabling it creates one RedisInsight pod,
|
||||
# its Service and storage, and (when requested) an Istio HTTP route.
|
||||
redisInsight:
|
||||
enabled: false
|
||||
image:
|
||||
repository: redis/redisinsight
|
||||
tag: 3.8.0
|
||||
pullPolicy: IfNotPresent
|
||||
port: 5540
|
||||
connection:
|
||||
# -- Empty automatically uses this release's balanced bootstrap endpoint:
|
||||
# internal Service DNS normally, or the discovered LoadBalancer ingress
|
||||
# address when external access is enabled. Set a hostname/IP to override.
|
||||
host: ""
|
||||
# -- Zero automatically follows externalAccess.port or redis.port.
|
||||
port: 0
|
||||
alias: redis-cluster
|
||||
tls: false
|
||||
persistence:
|
||||
enabled: true
|
||||
# -- Empty uses the cluster's default StorageClass.
|
||||
storageClass: ""
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 1Gi
|
||||
annotations: {}
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
podAnnotations: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
ingress:
|
||||
enabled: false
|
||||
host: ""
|
||||
gatewaySelector:
|
||||
istio: ingressgateway
|
||||
requestTimeout: 60s
|
||||
tls:
|
||||
enabled: false
|
||||
# -- Name of an existing TLS Secret available to the Istio ingress
|
||||
# gateway. Required when TLS is enabled.
|
||||
credentialName: ""
|
||||
certificate:
|
||||
# -- Ask cert-manager to create credentialName. Leave false when the
|
||||
# Secret is managed outside this chart.
|
||||
create: false
|
||||
issuerName: ""
|
||||
issuerKind: ClusterIssuer
|
||||
# -- Empty creates the Certificate in the release namespace. Some
|
||||
# Istio installations require gateway credentials in istio-system;
|
||||
# set that namespace explicitly when needed.
|
||||
secretNamespace: ""
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
# -- Empty uses the cluster's default StorageClass.
|
||||
storageClass: ""
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
# -- Requested capacity for every Redis member PVC. The chart imposes no
|
||||
# upper bound; the StorageClass and cluster quota decide what is available.
|
||||
size: 3Gi
|
||||
annotations: {}
|
||||
|
||||
istio:
|
||||
# -- Keep the Envoy sidecar OFF the Redis pods (recommended). Redis Cluster
|
||||
# uses direct pod-to-pod client and cluster-bus connections. Client pods can reach
|
||||
# Redis from inside the mesh (mTLS in PERMISSIVE mode, or add a
|
||||
# PeerAuthentication exception for this workload if you run STRICT).
|
||||
injectSidecar: false
|
||||
|
||||
networkPolicy:
|
||||
# -- Standard Kubernetes NetworkPolicy. Enforcement depends on the installed
|
||||
# CNI. Pod-to-pod client, replication, key-migration, and cluster-bus traffic
|
||||
# is always allowed.
|
||||
enabled: false
|
||||
# -- Allow any pod in the cluster to reach the Redis client port.
|
||||
# Set to false and fill extraIngress to lock down clients.
|
||||
allowExternal: true
|
||||
# -- Extra "from" peers allowed on the client ports when allowExternal=false,
|
||||
# e.g. [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: myapp}}}]
|
||||
extraIngress: []
|
||||
# -- Namespaces allowed to scrape metrics (empty = any).
|
||||
metricsFromNamespaces: []
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
maxUnavailable: 1
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: ""
|
||||
annotations: {}
|
||||
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
topologySpreadConstraints: []
|
||||
priorityClassName: ""
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 999
|
||||
runAsNonRoot: true
|
||||
|
||||
containerSecurityContext:
|
||||
runAsUser: 999
|
||||
runAsGroup: 999
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
terminationGracePeriodSeconds: 30
|
||||
Reference in New Issue
Block a user