Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/nats] NATS chart based on scratch image (#31516)

Browse Source
This commit is contained in:
Juan Ariza Toledano
2025-01-23 13:51:51 +01:00
committed by GitHub
parent d6e96ac15f
commit 37c61ed57f
24 changed files with 878 additions and 642 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/nats/CHANGELOG.md
+6 -2
View File
@@ -1,8 +1,12 @@
# Changelog
## 8.5.4 (2025-01-23)
## 9.0.0 (2025-01-23)
* [bitnami/nats] Improve NATS routes configuration ([#31523](https://github.com/bitnami/charts/pull/31523))
* [bitnami/nats] NATS chart based on scratch image ([#31516](https://github.com/bitnami/charts/pull/31516))
## <small>8.5.4 (2025-01-23)</small>
* [bitnami/nats] Improve NATS routes configuration (#31523) ([293d9e2](https://github.com/bitnami/charts/commit/293d9e20aa93cf76f020561a38f5380f55e5567b)), closes [#31523](https://github.com/bitnami/charts/issues/31523) [#30124](https://github.com/bitnami/charts/issues/30124)
## <small>8.5.3 (2025-01-17)</small>
bitnami/nats/Chart.yaml
+2 -2
View File
@@ -6,7 +6,7 @@ annotations:
licenses: Apache-2.0
images: |
- name: nats
image: docker.io/bitnami/nats:2.10.24-debian-12-r2
image: docker.io/bitnami/nats:2.10.24-debian-12-r3
- name: nats-exporter
image: docker.io/bitnami/nats-exporter:0.16.0-debian-12-r2
apiVersion: v2
@@ -31,4 +31,4 @@ maintainers:
name: nats
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/nats
version: 8.5.4
version: 9.0.0
bitnami/nats/README.md
+130 -88
View File
@@ -53,7 +53,7 @@ To make this process easier, the chart contains the `resourcesPreset` values, wh
The Bitnami NATS chart, when upgrading, reuses the secret previously rendered by the chart or the one specified in `existingSecret`. To update credentials, use one of the following:
- Run `helm upgrade` specifying a new password in `auth.password`
- Run `helm upgrade` specifying new credentials via `auth.token` or `auth.credentials` parameters
- Run `helm upgrade` specifying a new secret in `existingSecret`
### Backup and restore
@@ -160,58 +160,73 @@ As an alternative, you can use of the preset configurations for pod affinity, po
### Common parameters
| Name | Description | Value |
| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- |
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` |
| `fullnameOverride` | String to fully override common.names.fullname template | `""` |
| `commonLabels` | Add labels to all the deployed resources | `{}` |
| `commonAnnotations` | Add annotations to all the deployed resources | `{}` |
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
| Name | Description | Value |
| ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
| `kubeVersion` | Override Kubernetes version | `""` |
| `nameOverride` | String to partially override common.names.name | `""` |
| `fullnameOverride` | String to fully override common.names.fullname | `""` |
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
| `commonLabels` | Add labels to all the deployed resources | `{}` |
| `commonAnnotations` | Add annotations to all the deployed resources | `{}` |
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
### NATS parameters
| Name | Description | Value |
| ------------------------ | ----------------------------------------------------------------------------------------------------- | ---------------------- |
| `image.registry` | NATS image registry | `REGISTRY_NAME` |
| `image.repository` | NATS image repository | `REPOSITORY_NAME/nats` |
| `image.digest` | NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `image.pullPolicy` | NATS image pull policy | `IfNotPresent` |
| `image.pullSecrets` | NATS image pull secrets | `[]` |
| `image.debug` | Enable NATS image debug mode | `false` |
| `auth.enabled` | Switch to enable/disable client authentication | `true` |
| `auth.user` | Client authentication user | `nats_client` |
| `auth.password` | Client authentication password | `""` |
| `auth.token` | Client authentication token | `""` |
| `auth.timeout` | Client authentication timeout (seconds) | `1` |
| `auth.usersCredentials` | Client authentication users credentials collection | `[]` |
| `auth.noAuthUser` | Client authentication username from auth.usersCredentials map to be used when no credentials provided | `""` |
| `cluster.name` | Cluster name | `nats` |
| `cluster.connectRetries` | Configure number of connect retries for implicit routes, otherwise leave blank | `""` |
| `cluster.auth.enabled` | Switch to enable/disable cluster authentication | `true` |
| `cluster.auth.user` | Cluster authentication user | `nats_cluster` |
| `cluster.auth.password` | Cluster authentication password | `""` |
| `jetstream.enabled` | Switch to enable/disable JetStream | `false` |
| `jetstream.maxMemory` | Max memory usage for JetStream | `1G` |
| `debug.enabled` | Switch to enable/disable debug on logging | `false` |
| `debug.trace` | Switch to enable/disable trace debug level on logging | `false` |
| `debug.logtime` | Switch to enable/disable logtime on logging | `false` |
| `maxConnections` | Max. number of client connections | `""` |
| `maxControlLine` | Max. protocol control line | `""` |
| `maxPayload` | Max. payload | `""` |
| `writeDeadline` | Duration the server can block on a socket write to a client | `""` |
| `natsFilename` | Filename used by several NATS files (binary, configuration file, and pid file) | `nats-server` |
| `configuration` | Specify content for NATS configuration file (generated based on other parameters otherwise) | `""` |
| `existingSecret` | The name of an existing Secret with your custom configuration for NATS | `""` |
| `command` | Override default container command (useful when using custom images) | `[]` |
| `args` | Override default container args (useful when using custom images) | `[]` |
| `extraEnvVars` | Extra environment variables to be set on NATS container | `[]` |
| `extraEnvVarsCM` | ConfigMap with extra environment variables | `""` |
| `extraEnvVarsSecret` | Secret with extra environment variables | `""` |
| Name | Description | Value |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- |
| `image.registry` | NATS image registry | `REGISTRY_NAME` |
| `image.repository` | NATS image repository | `REPOSITORY_NAME/nats` |
| `image.digest` | NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `image.pullPolicy` | NATS image pull policy | `IfNotPresent` |
| `image.pullSecrets` | NATS image pull secrets | `[]` |
| `auth.enabled` | Switch to enable/disable client authentication | `true` |
| `auth.token` | Client authentication token | `""` |
| `auth.credentials` | Client authentication users credentials collection. Ignored if `auth.token` is set | `[]` |
| `auth.noAuthUser` | No authenticated access will be associated with this user. It must be one of the available under `auth.credentials` map array. No authenticated access will be denied if unset. | `""` |
| `auth.timeout` | Client authentication timeout (seconds) | `1` |
| `tls.enabled` | Enable TLS configuration for NATS | `false` |
| `tls.autoGenerated.enabled` | Enable automatic generation of TLS certificates | `true` |
| `tls.autoGenerated.engine` | Mechanism to generate the certificates (allowed values: helm, cert-manager) | `helm` |
| `tls.autoGenerated.certManager.existingIssuer` | The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine) | `""` |
| `tls.autoGenerated.certManager.existingIssuerKind` | Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine) | `""` |
| `tls.autoGenerated.certManager.keyAlgorithm` | Key algorithm for the certificates (only for `cert-manager` engine) | `RSA` |
| `tls.autoGenerated.certManager.keySize` | Key size for the certificates (only for `cert-manager` engine) | `2048` |
| `tls.autoGenerated.certManager.duration` | Duration for the certificates (only for `cert-manager` engine) | `2160h` |
| `tls.autoGenerated.certManager.renewBefore` | Renewal period for the certificates (only for `cert-manager` engine) | `360h` |
| `tls.ca` | CA certificate for TLS. Ignored if `tls.existingCASecret` is set | `""` |
| `tls.existingCASecret` | The name of an existing Secret containing the CA certificate for TLS | `""` |
| `tls.server.cert` | TLS certificate for NATS servers. Ignored if `tls.server.existingSecret` is set | `""` |
| `tls.server.key` | TLS key for NATS servers. Ignored if `tls.server.existingSecret` is set | `""` |
| `tls.server.existingSecret` | The name of an existing Secret containing the TLS certificates for NATS servers | `""` |
| `tls.client.cert` | TLS certificate for NATS clients. Ignored if `tls.client.existingSecret` is set | `""` |
| `tls.client.key` | TLS key for NATS clients. Ignored if `tls.client.existingSecret` is set | `""` |
| `tls.client.existingSecret` | The name of an existing Secret containing the TLS certificates for NATS clients | `""` |
| `cluster.name` | Cluster name | `nats` |
| `cluster.connectRetries` | Configure number of connect retries for implicit routes, otherwise leave blank | `""` |
| `cluster.auth.enabled` | Switch to enable/disable cluster authentication | `true` |
| `cluster.auth.user` | Cluster authentication user | `nats_cluster` |
| `cluster.auth.password` | Cluster authentication password | `""` |
| `jetstream.enabled` | Switch to enable/disable JetStream | `false` |
| `jetstream.maxMemory` | Max memory usage for JetStream | `1G` |
| `debug.enabled` | Switch to enable/disable debug on logging | `false` |
| `debug.trace` | Switch to enable/disable trace debug level on logging | `false` |
| `debug.logtime` | Switch to enable/disable logtime on logging | `false` |
| `maxConnections` | Max. number of client connections | `""` |
| `maxControlLine` | Max. protocol control line | `""` |
| `maxPayload` | Max. payload | `""` |
| `writeDeadline` | Duration the server can block on a socket write to a client | `""` |
| `natsFilename` | Filename used by several NATS files (binary, configuration file, and pid file) | `nats-server` |
| `configuration` | Specify content for NATS configuration file (generated based on other parameters otherwise) | `""` |
| `existingSecret` | Name of an existing secret with your custom configuration for NATS | `""` |
| `command` | Override default container command (useful when using custom images) | `[]` |
| `args` | Override default container args (useful when using custom images) | `[]` |
| `extraEnvVars` | Extra environment variables to be set on NATS container | `[]` |
| `extraEnvVarsCM` | ConfigMap with extra environment variables | `""` |
| `extraEnvVarsSecret` | Secret with extra environment variables | `""` |
### NATS deployment/statefulset parameters
@@ -221,7 +236,7 @@ As an alternative, you can use of the preset configurations for pod affinity, po
| `replicaCount` | Number of NATS nodes | `1` |
| `schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` |
| `priorityClassName` | Name of pod priority class | `""` |
| `updateStrategy.type` | StrategyType. Can be set to RollingUpdate or OnDelete | `RollingUpdate` |
| `updateStrategy.type` | NATS deployment/statefulset update strategy type | `RollingUpdate` |
| `podManagementPolicy` | StatefulSet pod management policy | `OrderedReady` |
| `containerPorts.client` | NATS client container port | `4222` |
| `containerPorts.cluster` | NATS cluster container port | `6222` |
@@ -332,46 +347,62 @@ As an alternative, you can use of the preset configurations for pod affinity, po
### Metrics parameters
| Name | Description | Value |
| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
| `metrics.enabled` | Enable Prometheus metrics via exporter side-car | `false` |
| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` |
| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` |
| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `metrics.customLivenessProbe` | Override default liveness probe | `{}` |
| `metrics.customReadinessProbe` | Override default readiness probe | `{}` |
| `metrics.image.registry` | Prometheus metrics exporter image registry | `REGISTRY_NAME` |
| `metrics.image.repository` | Prometheus metrics exporter image repository | `REPOSITORY_NAME/nats-exporter` |
| `metrics.image.digest` | NATS Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `metrics.image.pullPolicy` | Prometheus metrics image pull policy | `IfNotPresent` |
| `metrics.image.pullSecrets` | Prometheus metrics image pull secrets | `[]` |
| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` |
| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `metrics.containerPorts.http` | Prometheus metrics exporter port | `7777` |
| `metrics.flags` | Flags to be passed to Prometheus metrics | `[]` |
| `metrics.service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` |
| `metrics.service.port` | Prometheus metrics service port | `7777` |
| `metrics.service.loadBalancerIP` | Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank | `""` |
| `metrics.service.annotations` | Annotations for Prometheus metrics service | `{}` |
| `metrics.service.labels` | Labels for Prometheus metrics service | `{}` |
| `metrics.serviceMonitor.enabled` | Specify if a ServiceMonitor will be deployed for Prometheus Operator | `false` |
| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `monitoring` |
| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` |
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` |
| `metrics.serviceMonitor.interval` | How frequently to scrape metrics | `""` |
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` |
| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` |
| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` |
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
| Name | Description | Value |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
| `metrics.enabled` | Enable Prometheus metrics via exporter side-car | `false` |
| `metrics.image.registry` | Prometheus metrics exporter image registry | `REGISTRY_NAME` |
| `metrics.image.repository` | Prometheus metrics exporter image repository | `REPOSITORY_NAME/nats-exporter` |
| `metrics.image.digest` | NATS Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `metrics.image.pullPolicy` | Prometheus metrics image pull policy | `IfNotPresent` |
| `metrics.image.pullSecrets` | Prometheus metrics image pull secrets | `[]` |
| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` |
| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` |
| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `metrics.customLivenessProbe` | Override default liveness probe | `{}` |
| `metrics.customReadinessProbe` | Override default readiness probe | `{}` |
| `metrics.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `metrics.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
| `metrics.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `metrics.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` |
| `metrics.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `metrics.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `metrics.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` |
| `metrics.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` |
| `metrics.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
| `metrics.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` |
| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `metrics.containerPorts.http` | Prometheus metrics exporter port | `7777` |
| `metrics.flags` | Flags to be passed to Prometheus metrics | `[]` |
| `metrics.service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` |
| `metrics.service.port` | Prometheus metrics service port | `7777` |
| `metrics.service.loadBalancerIP` | Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank | `""` |
| `metrics.service.annotations` | Annotations for Prometheus metrics service | `{}` |
| `metrics.service.labels` | Labels for Prometheus metrics service | `{}` |
| `metrics.serviceMonitor.enabled` | Specify if a ServiceMonitor will be deployed for Prometheus Operator | `false` |
| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `monitoring` |
| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` |
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` |
| `metrics.serviceMonitor.interval` | How frequently to scrape metrics | `""` |
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` |
| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` |
| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` |
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
### Persistence parameters
| Name | Description | Value |
| -------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------- |
| `persistence.enabled` | Enable NATS data persistence using PVC(s) | `false` |
| `persistence.enabled` | Enable NATS data persistence using PVCs (only for statefulset resourceType) | `false` |
| `persistence.storageClass` | PVC Storage Class for NATS data volume | `""` |
| `persistence.accessModes` | PVC Access modes | `["ReadWriteOnce"]` |
| `persistence.size` | PVC Storage Request for NATS data volume | `8Gi` |
@@ -393,7 +424,7 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm
```console
helm install my-release \
--set auth.enabled=true,auth.user=my-user,auth.password=T0pS3cr3t \
--set auth.enabled=true,auth.credentials[0].user=my-user,auth.credentials[0].password=T0pS3cr3t \
oci://REGISTRY_NAME/REPOSITORY_NAME/nats
```
@@ -418,6 +449,17 @@ Find more information about how to deal with common errors related to Bitnami's
## Upgrading
### To 9.0.0
This major versions ships by default a new NATS image version that dramatically reduces the image given there's no distro and it simply includes the NATS binary on top of a scratch base image. As a consequence, there's no shell available in the image and debugging actions must be performed using sidecars or equivalent mechanisms.
Also, the default path for storing JetStream data is `/data/jetstream` instead of `/data/jetstream/jetstream` to avoid stuttering. If you're upgrading from an existing installation with persisted data, you'll have to edit the JetStream's "store_dir" configuration property so it's compatible with your previous data.
Finally, the following changes are also introduced on chart parameters in this major version update:
- `auth.usersCredentials` is renamed to `auth.credentials`.
- `auth.user` and `auth.password` are deprecated in favor of `auth.credentials`.
### To 8.5.0
This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850).
@@ -500,4 +542,4 @@ Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
limitations under the License.
bitnami/nats/templates/NOTES.txt
+63 -24
View File
@@ -7,6 +7,7 @@ Did you know there are enterprise versions of the Bitnami catalog? For enhanced
** Please be patient while the chart is being deployed **
{{- if .Values.diagnosticMode.enabled }}
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
@@ -16,14 +17,6 @@ Get the list of pods by executing:
kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
Access the pod you want to debug by executing
kubectl exec --namespace {{ .Release.Namespace }} -ti <NAME OF THE POD> -- bash
In order to replicate the container startup scripts execute this command:
/opt/bitnami/scripts/nats/entrypoint.sh
{{- else }}
{{- if or (contains .Values.service.type "LoadBalancer") (contains .Values.service.type "nodePort") }}
@@ -54,9 +47,13 @@ NATS can be accessed via port {{ .Values.service.ports.client }} on the followin
To get the authentication credentials, run:
export NATS_USER=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | grep -m 1 user | awk '{print $2}' | tr -d '"')
export NATS_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | grep -m 1 password | awk '{print $2}' | tr -d '"')
{{- if .Values.auth.token }}
export NATS_TOKEN=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*token: "\([^"]*\)".*/\1/p' | head -n 1)
{{- else }}
export NATS_USER=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*user: "\([^"]*\)".*/\1/p' | head -n 1)
export NATS_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*password: "\([^"]*\)".*/\1/p' | head -n 1)
echo -e "Client credentials:\n\tUser: $NATS_USER\n\tPassword: $NATS_PASS"
{{- end }}
{{- end }}
@@ -64,20 +61,62 @@ NATS monitoring service can be accessed via port {{ .Values.service.ports.monito
{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
You can create a Golang pod to be used as a NATS client:
You can create a pod to be used as a NATS client:
kubectl run {{ include "common.names.fullname" . }}-client --restart='Never' --env="NATS_USER=$NATS_USER" --env="NATS_PASS=$NATS_PASS" --image docker.io/bitnami/golang --namespace {{ .Release.Namespace }} --command -- sleep infinity
kubectl exec --tty -i {{ include "common.names.fullname" . }}-client --namespace {{ .Release.Namespace }} -- bash
GO111MODULE=off go get github.com/nats-io/nats.go
cd $GOPATH/src/github.com/nats-io/nats.go/examples/nats-pub && go install && cd
cd $GOPATH/src/github.com/nats-io/nats.go/examples/nats-echo && go install && cd
{{- if .Values.auth.enabled }}
nats-echo -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} SomeSubject
nats-pub -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} -reply Hi SomeSubject "Hi everyone"
{{- else }}
nats-echo -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} SomeSubject
nats-pub -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} -reply Hi SomeSubject "Hi everyone"
{{- end }}
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: {{ include "common.names.fullname" . }}-client
namespace: {{ .Release.Namespace }}
spec:
containers:
- name: cli
image: docker.io/bitnami/natscli
command: ["sleep", "infinity"]
env:
{{- if .Values.auth.token }}
- name: NATS_TOKEN
value: "$NATS_TOKEN"
{{- else }}
- name: NATS_USER
value: "$NATS_USER"
- name: NATS_PASS
value: "$NATS_PASS"
{{- end }}
{{- if .Values.tls.enabled }}
volumeMounts:
- mountPath: /etc/certs/ca
name: ca-cert
readOnly: true
- mountPath: /etc/certs/client
name: client-cert
readOnly: true
volumes:
- name: ca-cert
secret:
secretName: {{ template "nats.tls.ca.secretName" . }}
- name: client-cert
secret:
secretName: {{ template "nats.tls.client.secretName" . }}
{{- end }}
EOF
Then, access the pod and connect to NATS:
kubectl exec --tty -i {{ include "common.names.fullname" . }}-client --namespace {{ .Release.Namespace }} -- bash
{{- if .Values.auth.enabled }}
{{- if .Values.auth.token }}
nats -s nats://$NATS_TOKEN@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} subscribe SomeSubject &
nats -s nats://$NATS_TOKEN@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} publish SomeSubject "Some message"
{{- else }}
nats -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} subscribe SomeSubject
nats -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} publish SomeSubject "Some message"
{{- end }}
{{- else }}
nats -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} subscribe SomeSubject
nats -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} publish SomeSubject "Some message"
{{- end }}
To access the Monitoring svc from outside the cluster, follow the steps below:
@@ -129,7 +168,7 @@ To access the Monitoring svc from outside the cluster, follow the steps below:
{{- include "common.warnings.rollingTag" .Values.image }}
{{- include "common.warnings.rollingTag" .Values.metrics.image }}
{{- include "nats.validateValues" . -}}
{{- include "common.warnings.resources" (dict "sections" (list "metrics" "") "context" $) }}
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.metrics.image) "context" $) }}
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.metrics.image) "context" $) }}
{{- include "nats.validateValues" . }}
bitnami/nats/templates/_helpers.tpl
+38 -18
View File
@@ -6,7 +6,7 @@ SPDX-License-Identifier: APACHE-2.0
{{/* vim: set filetype=mustache: */}}
{{/*
Return the proper Nats image name
Return the proper NATS image name
*/}}
{{- define "nats.image" -}}
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
@@ -35,17 +35,8 @@ We prepend a random letter to the string to avoid password validation errors
{{- end -}}
{{/*
Return true if a NATS configuration secret object should be created
Create the name of the service account to use
*/}}
{{- define "nats.createSecret" -}}
{{- if and .Values.configuration (not .Values.existingSecret) }}
{{- true -}}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "nats.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
@@ -58,10 +49,39 @@ Return true if a NATS configuration secret object should be created
Return the NATS configuration secret name
*/}}
{{- define "nats.secretName" -}}
{{- if .Values.existingSecret }}
{{- printf "%s" (tpl .Values.existingSecret .) -}}
{{ default (include "common.names.fullname" .) (tpl .Values.existingSecret .) -}}
{{- end -}}
{{/*
Return the name of the secret containing the CA TLS certificate
*/}}
{{- define "nats.tls.ca.secretName" -}}
{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.ca))) -}}
{{- printf "%s-ca-crt" (include "common.names.fullname" .) -}}
{{- else -}}
{{- printf "%s" (include "common.names.fullname" .) -}}
{{- required "An existing secret name must be provided with a CA cert for NATS if cert is not provided!" (tpl .Values.tls.existingCASecret .) -}}
{{- end -}}
{{- end -}}
{{/*
Return the name of the secret containing the TLS certificates for NATS servers
*/}}
{{- define "nats.tls.server.secretName" -}}
{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.server.cert)) (not (empty .Values.tls.server.key))) -}}
{{- printf "%s-crt" (include "common.names.fullname" .) -}}
{{- else -}}
{{- required "An existing secret name must be provided with TLS certs for NATS servers if cert and key are not provided!" (tpl .Values.tls.server.existingSecret .) -}}
{{- end -}}
{{- end -}}
{{/*
Return the name of the secret containing the TLS certificates for NATS clients
*/}}
{{- define "nats.tls.client.secretName" -}}
{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.client.cert)) (not (empty .Values.tls.client.key))) -}}
{{- printf "%s-client-crt" (include "common.names.fullname" .) -}}
{{- else -}}
{{- required "An existing secret name must be provided with TLS certs for NATS clients if cert and key are not provided!" (tpl .Values.tls.client.existingSecret .) -}}
{{- end -}}
{{- end -}}
@@ -82,18 +102,18 @@ Compile all warnings into a single message, and call fail.
{{/* Validate values of NATS - must provide a valid resourceType ("deployment" or "statefulset") */}}
{{- define "nats.validateValues.resourceType" -}}
{{- if and (ne .Values.resourceType "deployment") (ne .Values.resourceType "statefulset") -}}
{{- if and (ne (lower .Values.resourceType) "deployment") (ne (lower .Values.resourceType) "statefulset") -}}
nats: resourceType
Invalid resourceType selected. Valid values are "deployment" and
"statefulset". Please set a valid mode (--set resourceType="xxxx")
{{- end -}}
{{- end -}}
{{/* Validate values of NATS - enabling JetStream requires persistence & statefulsets */}}
{{/* Validate values of NATS - enabling JetStream requires persistence & StatefulSet */}}
{{- define "nats.validateValues.jetstream" -}}
{{- if and .Values.jetstream.enabled (or (ne .Values.resourceType "statefulset") (not .Values.persistence.enabled)) -}}
nats: jetstream
Invalid configuration selected. Enabling jetstream requires enabling persistence
and using a "statefulset" (--set persistence.enabled=true,resourceType="statefulset")
Invalid configuration selected. Enabling JetStream requires enabling persistence
and using a StatefulSet (--set persistence.enabled=true,resourceType="statefulset")
{{- end -}}
{{- end -}}
bitnami/nats/templates/statefulset.yaml → bitnami/nats/templates/application.yaml
+48 -32
View File
@@ -3,31 +3,33 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if or (eq .Values.resourceType "statefulset") (not (contains .Values.resourceType "deployment")) }}
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
kind: StatefulSet
{{- $resourceType := lower .Values.resourceType }}
apiVersion: {{ ternary (include "common.capabilities.deployment.apiVersion" .) (include "common.capabilities.statefulset.apiVersion" .) (eq $resourceType "deployment") }}
kind: {{ ternary "Deployment" "StatefulSet" (eq $resourceType "deployment") }}
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
podManagementPolicy: {{ .Values.podManagementPolicy }}
replicas: {{ .Values.replicaCount }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- if eq $resourceType "statefulset" }}
podManagementPolicy: {{ .Values.podManagementPolicy }}
serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- if .Values.updateStrategy }}
updateStrategy: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
{{ ternary "strategy" "updateStrategy" (eq $resourceType "deployment") }}: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
annotations:
{{- if (include "nats.createSecret" .) }}
{{- if not .Values.existingSecret }}
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.podAnnotations }}
@@ -76,25 +78,30 @@ spec:
{{- if .Values.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
command:
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
{{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
{{- else }}
- /nats-server
{{- end }}
args:
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
{{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
{{- else }}
- -c
- /etc/{{ .Values.natsFilename }}.conf
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
- name: NATS_FILENAME
value: {{ .Values.natsFilename | quote }}
{{- if eq $resourceType "statefulset" }}
- name: NATS_SERVER_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
{{- end }}
{{- if .Values.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
@@ -153,19 +160,18 @@ spec:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/logs
subPath: app-logs-dir
- name: config
mountPath: /bitnami/nats/conf/{{ .Values.natsFilename }}.conf
mountPath: /etc/{{ .Values.natsFilename }}.conf
subPath: {{ .Values.natsFilename }}.conf
{{- if .Values.persistence.enabled }}
{{- if .Values.tls.enabled }}
- name: ca-cert
mountPath: /etc/certs/ca
readOnly: true
- name: server-cert
mountPath: /etc/certs/server
readOnly: true
{{- end }}
{{- if and .Values.persistence.enabled (eq $resourceType "statefulset") }}
- name: data
mountPath: /data
{{- end }}
@@ -176,6 +182,9 @@ spec:
- name: metrics
image: {{ template "nats.metrics.image" . }}
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
{{- if .Values.metrics.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
@@ -183,11 +192,10 @@ spec:
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.flags "context" $) | nindent 12 }}
- "http://localhost:{{ .Values.containerPorts.monitoring }}"
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
ports:
- name: metrics
containerPort: {{ coalesce .Values.metrics.containerPorts.http .Values.metrics.containerPort }}
containerPort: {{ .Values.metrics.containerPorts.http }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.metrics.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.metrics.livenessProbe.enabled }}
@@ -204,7 +212,6 @@ spec:
path: /metrics
port: metrics
{{- end }}
{{- end }}
{{- if .Values.metrics.resources }}
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
@@ -221,10 +228,20 @@ spec:
- name: config
secret:
secretName: {{ include "nats.secretName" . }}
{{- if .Values.tls.enabled }}
- name: ca-cert
secret:
secretName: {{ template "nats.tls.ca.secretName" . }}
defaultMode: 256
- name: server-cert
secret:
secretName: {{ template "nats.tls.server.secretName" . }}
defaultMode: 256
{{- end }}
{{- if .Values.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.persistence.enabled }}
{{- if and .Values.persistence.enabled (eq $resourceType "statefulset") }}
{{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }}
persistentVolumeClaimRetentionPolicy:
whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
@@ -253,4 +270,3 @@ spec:
{{- end }}
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
{{- end }}
{{- end }}
bitnami/nats/templates/certs.yaml
+116
View File
@@ -0,0 +1,116 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") }}
{{- if empty .Values.tls.autoGenerated.certManager.existingIssuer }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ printf "%s-clusterissuer" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
selfSigned: {}
---
{{- end }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
secretName: {{ template "nats.tls.ca.secretName" . }}
commonName: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
isCA: true
issuerRef:
name: {{ default (printf "%s-clusterissuer" (include "common.names.fullname" .)) .Values.tls.autoGenerated.certManager.existingIssuer }}
kind: {{ default "Issuer" .Values.tls.autoGenerated.certManager.existingIssuerKind }}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
ca:
secretName: {{ template "nats.tls.ca.secretName" . }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ printf "%s-crt" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
secretName: {{ template "nats.tls.server.secretName" . }}
commonName: {{ printf "%s.%s.svc.%s" (include "common.names.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain }}
issuerRef:
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
kind: Issuer
subject:
organizations:
- "NATS"
dnsNames:
- '*.{{ include "common.names.namespace" . }}'
- '*.{{ include "common.names.namespace" . }}.svc'
- '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
- '*.{{ include "common.names.fullname" . }}'
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}'
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc'
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
{{- if eq (lower .Values.resourceType) "statefulset" }}
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}'
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}.{{ include "common.names.namespace" . }}'
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}.{{ include "common.names.namespace" . }}.svc'
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
{{- end }}
privateKey:
algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }}
size: {{ int .Values.tls.autoGenerated.certManager.keySize }}
duration: {{ .Values.tls.autoGenerated.certManager.duration }}
renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ printf "%s-client-crt" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
secretName: {{ template "nats.tls.client.secretName" . }}
commonName: {{ printf "%s-client" (include "common.names.fullname" .) }}
issuerRef:
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
kind: Issuer
subject:
organizations:
- "NATS"
dnsNames:
- '*.{{ include "common.names.namespace" . }}'
- '*.{{ include "common.names.namespace" . }}.svc'
- '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
privateKey:
algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }}
size: {{ int .Values.tls.autoGenerated.certManager.keySize }}
duration: {{ .Values.tls.autoGenerated.certManager.duration }}
renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }}
{{- end }}
bitnami/nats/templates/deployment.yaml
-217
View File
@@ -1,217 +0,0 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if eq .Values.resourceType "deployment" }}
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.replicaCount }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- if .Values.updateStrategy }}
strategy: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
annotations:
{{- if (include "nats.createSecret" .) }}
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.podAnnotations }}
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
{{- end }}
spec:
{{- include "nats.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ include "nats.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
{{- if .Values.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName | quote }}
{{- end }}
{{- if .Values.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.schedulerName }}
schedulerName: {{ .Values.schedulerName | quote }}
{{- end }}
{{- if .Values.podSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: nats
image: {{ template "nats.image" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- if .Values.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
- name: NATS_FILENAME
value: {{ .Values.natsFilename | quote }}
{{- if .Values.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
{{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
envFrom:
{{- if .Values.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- end }}
ports:
- name: client
containerPort: {{ .Values.containerPorts.client }}
- name: cluster
containerPort: {{ .Values.containerPorts.cluster }}
- name: monitoring
containerPort: {{ .Values.containerPorts.monitoring }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: monitoring
{{- end }}
{{- if .Values.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /healthz
port: monitoring
{{- end }}
{{- if .Values.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: monitoring
{{- end }}
{{- end }}
{{- if .Values.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.resources }}
resources: {{- toYaml .Values.resources | nindent 12 }}
{{- else if ne .Values.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/logs
subPath: app-logs-dir
- name: config
mountPath: /bitnami/nats/conf/{{ .Values.natsFilename }}.conf
subPath: {{ .Values.natsFilename }}.conf
{{- if .Values.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.metrics.enabled }}
- name: metrics
image: {{ template "nats.metrics.image" . }}
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.flags "context" $) | nindent 12 }}
- "http://localhost:{{ .Values.containerPorts.monitoring }}"
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
ports:
- name: metrics
containerPort: {{ coalesce .Values.metrics.containerPorts.http .Values.metrics.containerPort }}
{{- if .Values.metrics.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.metrics.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /metrics
port: metrics
{{- end }}
{{- if .Values.metrics.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.metrics.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /metrics
port: metrics
{{- end }}
{{- end }}
{{- if .Values.metrics.resources }}
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
{{- else if ne .Values.metrics.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: config
secret:
secretName: {{ include "nats.secretName" . }}
{{- if .Values.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
{{- end }}
{{- end }}
bitnami/nats/templates/headless-svc.yaml
+6 -4
View File
@@ -3,11 +3,12 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if eq (lower .Values.resourceType) "statefulset" }}
apiVersion: v1
kind: Service
metadata:
name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ .Release.Namespace | quote }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
@@ -18,14 +19,15 @@ spec:
clusterIP: None
ports:
- name: tcp-client
port: {{ .Values.service.ports.client }}
port: {{ .Values.containerPorts.client }}
targetPort: client
- name: tcp-cluster
port: {{ .Values.service.ports.cluster }}
port: {{ .Values.containerPorts.cluster }}
targetPort: cluster
- name: tcp-monitoring
port: {{ .Values.service.ports.monitoring }}
port: {{ .Values.containerPorts.monitoring }}
targetPort: monitoring
publishNotReadyAddresses: {{ .Values.service.headless.publishNotReadyAddresses }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
{{- end }}
bitnami/nats/templates/ingress-tls-secret.yaml
+44
View File
@@ -0,0 +1,44 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.ingress.enabled }}
{{- if .Values.ingress.secrets }}
{{- range .Values.ingress.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .name }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
---
{{- end }}
{{- end }}
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
{{- $secretName := printf "%s-tls" .Values.ingress.hostname | trunc 63 | trimSuffix "-" }}
{{- $ca := genCA "nats-ca" 365 }}
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $secretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
{{- end }}
{{- end }}
bitnami/nats/templates/ingress.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ printf "%s-monitoring" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ .Release.Namespace | quote }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
bitnami/nats/templates/metrics-svc.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ printf "%s-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ .Release.Namespace | quote }}
namespace: {{ include "common.names.namespace" . | quote }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: metrics
bitnami/nats/templates/networkpolicy.yaml
+3 -3
View File
@@ -8,7 +8,7 @@ kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
@@ -40,7 +40,7 @@ spec:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
{{- if .Values.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.rts.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
@@ -49,7 +49,7 @@ spec:
- port: {{ .Values.containerPorts.cluster }}
- port: {{ .Values.containerPorts.monitoring }}
{{- if .Values.metrics.enabled }}
- port: {{ coalesce .Values.metrics.containerPorts.http .Values.metrics.containerPort }}
- port: {{ .Values.metrics.containerPorts.http }}
{{- end }}
{{- if not .Values.networkPolicy.allowExternal }}
from:
bitnami/nats/templates/poddisruptionbudget.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
kind: PodDisruptionBudget
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
bitnami/nats/templates/secrets.yaml
+108 -5
View File
@@ -3,17 +3,120 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if (include "nats.createSecret" .) }}
{{/*
Return the NATS configuration.
ref: https://docs.nats.io/running-a-nats-service/configuration
*/}}
{{- define "nats.configuration" -}}
{{- if .Values.configuration }}
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" .) }}
{{- else }}
{{- if eq .Values.resourceType "statefulset" }}
server_name: $NATS_SERVER_NAME
{{- end }}
listen: 0.0.0.0:{{ .Values.containerPorts.client }}
http: 0.0.0.0:{{ .Values.containerPorts.monitoring }}
# Authorization for client connections
{{- if .Values.auth.enabled }}
authorization {
{{- if .Values.auth.token }}
token: {{ .Values.auth.token | quote }}
{{- else if .Values.auth.credentials }}
users: [
{{- range $cred := .Values.auth.credentials }}
{ user: {{ $cred.user | quote }}, password: {{ default (include "nats.randomPassword" $) $cred.password | quote }} },
{{- end }}
],
{{- end }}
timeout: {{ int .Values.auth.timeout }}
}
{{- if .Values.auth.noAuthUser }}
no_auth_user: {{ .Values.auth.noAuthUser | quote }}
{{- end }}
{{- end }}
# Logging options
debug: {{ ternary "true" "false" (or .Values.debug.enabled .Values.diagnosticMode.enabled) }}
trace: {{ ternary "true" "false" (or .Values.debug.trace .Values.diagnosticMode.enabled) }}
logtime: {{ ternary "true" "false" (or .Values.debug.logtime .Values.diagnosticMode.enabled) }}
# Pid file
pid_file: "/tmp/{{ .Values.natsFilename }}.pid"
# System overrides
{{- if .Values.maxConnections }}
max_connections: {{ int .Values.maxConnections }}
{{- end }}
{{- if .Values.maxControlLine }}
max_control_line: {{ int .Values.maxControlLine }}
{{- end }}
{{- if .Values.maxPayload }}
max_payload: {{ int .Values.maxPayload }}
{{- end }}
{{- if .Values.writeDeadline }}
write_deadline: {{ .Values.writeDeadline | quote }}
{{- end }}
{{- if .Values.tls.enabled }}
# TLS configuration
tls {
ca_file: /etc/certs/ca/tls.crt
cert_file: /etc/certs/server/tls.crt
key_file: /etc/certs/server/tls.key
timeout: 2
}
{{- end }}
{{- if gt (int .Values.replicaCount) 1 }}
{{- $clusterAuthPwd := default (include "nats.randomPassword" .) .Values.cluster.auth.password }}
# Clustering definition
cluster {
name: {{ .Values.cluster.name | quote }}
listen: 0.0.0.0:{{ .Values.containerPorts.cluster }}
{{- if .Values.cluster.auth.enabled }}
# Authorization for cluster connections
authorization {
user: {{ .Values.cluster.auth.user | quote }}
password: {{ $clusterAuthPwd | quote }}
timeout: 1
}
{{- end }}
# Routes are actively solicited and connected to from this server.
# Other servers can connect to us if they supply the correct credentials
# in their routes definitions from above
{{- $auth := ternary (printf "%s:%s@" .Values.cluster.auth.user $clusterAuthPwd) "" .Values.cluster.auth.enabled }}
{{- $domain := (printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" ) }}
{{- $stsPrefix := include "common.names.fullname" . }}
{{- $clusterPort := .Values.service.ports.cluster }}
routes = [
{{- range $podIndex := until (.Values.replicaCount | int) }}
nats://{{ $auth }}{{ $stsPrefix }}-{{ $podIndex }}.{{ $domain }}:{{ $clusterPort }}
{{- end }}
]
{{- if .Values.cluster.connectRetries }}
# Configure number of connect retries for implicit routes
connect_retries: {{ .Values.cluster.connectRetries }}
{{- end }}
}
{{- end }}
{{- if .Values.jetstream.enabled }}
# JetStream configuration
jetstream: enabled
jetstream {
store_dir: /data
max_memory_store: {{ .Values.jetstream.maxMemory }}
max_file_store: {{ .Values.persistence.size }}
}
{{- end }}
{{- end }}
{{- end }}
{{- if not .Values.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" . ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" . ) | nindent 4 }}
{{- end }}
data:
{{ .Values.natsFilename }}.conf: |-
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | b64enc | nindent 4 }}
{{- include "common.tplvalues.render" (dict "value" (include "nats.configuration" .) "context" .) | b64enc | nindent 4 }}
{{- end }}
bitnami/nats/templates/service.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.commonAnnotations .Values.service.annotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
bitnami/nats/templates/servicemonitor.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ printf "%s-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ default .Release.Namespace .Values.metrics.serviceMonitor.namespace | quote }}
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace | quote }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
bitnami/nats/templates/tls-secret.yaml
+86 -27
View File
@@ -3,42 +3,101 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.ingress.enabled }}
{{- if .Values.ingress.secrets }}
{{- range .Values.ingress.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .name }}
namespace: {{ $.Release.Namespace | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
---
{{- end }}
{{- end }}
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
{{- $secretName := printf "%s-tls" .Values.ingress.hostname | trunc 63 | trimSuffix "-" }}
{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "helm") -}}
{{- $ca := genCA "nats-ca" 365 }}
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
{{- $releaseNamespace := include "common.names.namespace" . }}
{{- $clusterDomain := .Values.clusterDomain }}
{{- $caSecretName := include "nats.tls.ca.secretName" . }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $secretName }}
namespace: {{ .Release.Namespace | quote }}
name: {{ $caSecretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $caSecretName "key" "tls.crt" "defaultValue" $ca.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $caSecretName "key" "tls.key" "defaultValue" $ca.Key "context" $) }}
---
{{- $serverFullname := include "common.names.fullname" . }}
{{- $serverAltNames := list (printf "%s.%s.svc.%s" $serverFullname $releaseNamespace $clusterDomain) $serverFullname "127.0.0.1" "localhost" }}
{{- if eq (lower .Values.resourceType) "statefulset" }}
{{- $serverHeadlessSvcName := printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
{{- $serverAltNames = list (printf "*.%s.%s.svc.%s" $serverHeadlessSvcName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serverHeadlessSvcName $releaseNamespace $clusterDomain) $serverHeadlessSvcName (printf "%s.%s.svc.%s" $serverFullname $releaseNamespace $clusterDomain) $serverFullname "127.0.0.1" "localhost" }}
{{- end }}
{{- $serverCert := genSignedCert $serverFullname nil $serverAltNames 365 $ca }}
{{- $serverSecretName := include "nats.tls.server.secretName" . }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $serverSecretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $serverSecretName "key" "tls.crt" "defaultValue" $serverCert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $serverSecretName "key" "tls.key" "defaultValue" $serverCert.Key "context" $) }}
---
{{- $clientCert := genSignedCert "client" nil nil 365 $ca }}
{{- $clientSecretName := include "nats.tls.client.secretName" . }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $clientSecretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $clientSecretName "key" "tls.crt" "defaultValue" $clientCert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $clientSecretName "key" "tls.key" "defaultValue" $clientCert.Key "context" $) }}
{{- else if and .Values.tls.enabled (not .Values.tls.autoGenerated.enabled) (empty .Values.tls.existingCASecret) (empty .Values.tls.server.existingSecret) (empty .Values.tls.client.existingSecret) -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "nats.tls.ca.secretName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ required "A valid .Values.tls.ca entry required!" .Values.tls.ca | b64enc | quote }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "nats.tls.server.secretName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ required "A valid .Values.tls.server.cert entry required!" .Values.tls.server.cert | b64enc | quote }}
tls.key: {{ required "A valid .Values.tls.server.key entry required!" .Values.tls.server.key | b64enc | quote }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "nats.tls.client.secretName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ required "A valid .Values.tls.client.cert entry required!" .Values.tls.client.cert | b64enc | quote }}
tls.key: {{ required "A valid .Values.tls.client.key entry required!" .Values.tls.client.key | b64enc | quote }}
{{- end }}
bitnami/nats/values.yaml
+133 -146
View File
@@ -32,17 +32,21 @@ global:
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
##
adaptSecurityContext: auto
## @section Common parameters
## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)
## @param kubeVersion Override Kubernetes version
##
kubeVersion: ""
## @param nameOverride String to partially override common.names.fullname template (will maintain the release name)
## @param nameOverride String to partially override common.names.name
##
nameOverride: ""
## @param fullnameOverride String to fully override common.names.fullname template
## @param fullnameOverride String to fully override common.names.fullname
##
fullnameOverride: ""
## @param namespaceOverride String to fully override common.names.namespace
##
namespaceOverride: ""
## @param commonLabels Add labels to all the deployed resources
##
commonLabels: {}
@@ -66,6 +70,7 @@ diagnosticMode:
- sleep
args:
- infinity
## @section NATS parameters
## Bitnami NATS image version
@@ -76,12 +81,11 @@ diagnosticMode:
## @param image.digest NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
## @param image.pullPolicy NATS image pull policy
## @param image.pullSecrets NATS image pull secrets
## @param image.debug Enable NATS image debug mode
##
image:
registry: docker.io
repository: bitnami/nats
tag: 2.10.24-debian-12-r2
tag: 2.10.24-debian-12-r3
digest: ""
## Specify a imagePullPolicy
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
@@ -94,36 +98,67 @@ image:
## - myRegistryKeySecretName
##
pullSecrets: []
## Enable debug mode
##
debug: false
## Client Authentication
## ref: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro
## @param auth.enabled Switch to enable/disable client authentication
## @param auth.user Client authentication user
## @param auth.password Client authentication password
## @param auth.token Client authentication token
## @param auth.credentials [array] Client authentication users credentials collection. Ignored if `auth.token` is set
## @param auth.noAuthUser No authenticated access will be associated with this user. It must be one of the available under `auth.credentials` map array. No authenticated access will be denied if unset.
## @param auth.timeout Client authentication timeout (seconds)
## @param auth.usersCredentials Client authentication users credentials collection
## Example:
## auth.usersCredentials:
## - username: "a"
## password: "b"
## @param auth.noAuthUser Client authentication username from auth.usersCredentials map to be used when no credentials provided
##
auth:
enabled: true
user: nats_client
password: ""
token: ""
timeout: 1
usersCredentials: []
credentials:
- user: nats_client
password: ""
noAuthUser: ""
timeout: 1
## @param tls.enabled Enable TLS configuration for NATS
## @param tls.autoGenerated.enabled Enable automatic generation of TLS certificates
## @param tls.autoGenerated.engine Mechanism to generate the certificates (allowed values: helm, cert-manager)
## @param tls.autoGenerated.certManager.existingIssuer The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.existingIssuerKind Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.keyAlgorithm Key algorithm for the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.keySize Key size for the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.duration Duration for the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.renewBefore Renewal period for the certificates (only for `cert-manager` engine)
## @param tls.ca CA certificate for TLS. Ignored if `tls.existingCASecret` is set
## @param tls.existingCASecret The name of an existing Secret containing the CA certificate for TLS
## @param tls.server.cert TLS certificate for NATS servers. Ignored if `tls.server.existingSecret` is set
## @param tls.server.key TLS key for NATS servers. Ignored if `tls.server.existingSecret` is set
## @param tls.server.existingSecret The name of an existing Secret containing the TLS certificates for NATS servers
## @param tls.client.cert TLS certificate for NATS clients. Ignored if `tls.client.existingSecret` is set
## @param tls.client.key TLS key for NATS clients. Ignored if `tls.client.existingSecret` is set
## @param tls.client.existingSecret The name of an existing Secret containing the TLS certificates for NATS clients
##
tls:
enabled: false
autoGenerated:
enabled: true
engine: helm
certManager:
existingIssuer: ""
existingIssuerKind: ""
keySize: 2048
keyAlgorithm: RSA
duration: 2160h
renewBefore: 360h
ca: ""
existingCASecret: ""
server:
cert: ""
key: ""
existingSecret: ""
client:
cert: ""
key: ""
existingSecret: ""
## Cluster Configuration
## ref: https://docs.nats.io/running-a-nats-service/configuration/clustering/cluster_config
##
cluster:
## @param cluster.name Cluster name
##
name: nats
## @param cluster.connectRetries Configure number of connect retries for implicit routes, otherwise leave blank
##
@@ -180,107 +215,16 @@ writeDeadline: ""
## to specify the proper filename according to the image version.
##
natsFilename: nats-server
## @param configuration [string] Specify content for NATS configuration file (generated based on other parameters otherwise)
## @param configuration Specify content for NATS configuration file (generated based on other parameters otherwise)
## e.g:
## configuration: |-
## listen: 0.0.0.0:6222
## http: 0.0.0.0:8222
## ...
##
configuration: |-
{{- $authPwd := default (include "nats.randomPassword" .) .Values.auth.password -}}
{{- $clusterAuthPwd := default (include "nats.randomPassword" .) .Values.cluster.auth.password -}}
{{- if eq .Values.resourceType "statefulset" }}
server_name: $NATS_SERVER_NAME
{{- end }}
listen: 0.0.0.0:{{ .Values.containerPorts.client }}
http: 0.0.0.0:{{ .Values.containerPorts.monitoring }}
# Authorization for client connections
{{- if .Values.auth.enabled }}
authorization {
{{- if .Values.auth.user }}
user: {{ .Values.auth.user | quote }}
password: {{ $authPwd | quote }}
{{- else if .Values.auth.token }}
token: {{ .Values.auth.token | quote }}
{{- else if .Values.auth.usersCredentials }}
users: [
{{- range $user := .Values.auth.usersCredentials }}
{ user: {{ $user.username | quote }}, password: {{ $user.password | quote }} },
{{- end }}
],
{{- end }}
timeout: {{ int .Values.auth.timeout }}
}
{{- if .Values.auth.noAuthUser }}
no_auth_user: {{ .Values.auth.noAuthUser | quote }}
{{- end }}
{{- end }}
# Logging options
debug: {{ ternary "true" "false" (or .Values.debug.enabled .Values.diagnosticMode.enabled) }}
trace: {{ ternary "true" "false" (or .Values.debug.trace .Values.diagnosticMode.enabled) }}
logtime: {{ ternary "true" "false" (or .Values.debug.logtime .Values.diagnosticMode.enabled) }}
# Pid file
pid_file: "/opt/bitnami/nats/tmp/{{ .Values.natsFilename }}.pid"
# Some system overrides
{{- if .Values.maxConnections }}
max_connections: {{ int .Values.maxConnections }}
{{- end }}
{{- if .Values.maxControlLine }}
max_control_line: {{ int .Values.maxControlLine }}
{{- end }}
{{- if .Values.maxPayload }}
max_payload: {{ int .Values.maxPayload }}
{{- end }}
{{- if .Values.writeDeadline }}
write_deadline: {{ .Values.writeDeadline | quote }}
{{- end }}
{{- if gt (int .Values.replicaCount) 1 }}
# Clustering definition
cluster {
name: {{ .Values.cluster.name | quote }}
listen: 0.0.0.0:{{ .Values.containerPorts.cluster }}
{{- if .Values.cluster.auth.enabled }}
# Authorization for cluster connections
authorization {
user: {{ .Values.cluster.auth.user | quote }}
password: {{ $clusterAuthPwd | quote }}
timeout: 1
}
{{- end }}
# Routes are actively solicited and connected to from this server.
# Other servers can connect to us if they supply the correct credentials
# in their routes definitions from above
{{- $auth := ternary ( printf "%s:%s@" .Values.cluster.auth.user $clusterAuthPwd) "" .Values.cluster.auth.enabled }}
{{- $domain := (printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" ) }}
{{- $stsPrefix := include "common.names.fullname" . }}
routes = [
{{- range $podIndex := until (.Values.replicaCount|int) }}
nats://{{ $auth }}{{ $stsPrefix }}-{{ $podIndex }}.{{ $domain }}:{{ $.Values.service.ports.cluster }}
{{- end }}
]
{{- if .Values.cluster.connectRetries }}
# Configure number of connect retries for implicit routes
connect_retries: {{ .Values.cluster.connectRetries }}
{{- end }}
}
{{- end }}
{{- if .Values.jetstream.enabled }}
# JetStream configuration
jetstream: enabled
jetstream {
store_dir: /data/jetstream
max_memory_store: {{ .Values.jetstream.maxMemory }}
max_file_store: {{ .Values.persistence.size }}
}
{{- end }}
## @param existingSecret The name of an existing Secret with your custom configuration for NATS
## NOTE: When it's set the configuration parameter is ignored
configuration: ""
## @param existingSecret Name of an existing secret with your custom configuration for NATS
## NOTE: When it's set the `configuration` parameter is ignored
##
existingSecret: ""
## @param command Override default container command (useful when using custom images)
@@ -302,6 +246,7 @@ extraEnvVarsCM: ""
## @param extraEnvVarsSecret Secret with extra environment variables
##
extraEnvVarsSecret: ""
## @section NATS deployment/statefulset parameters
## @param resourceType NATS cluster resource type under Kubernetes. Allowed values: `statefulset` (default) or `deployment`
@@ -321,13 +266,15 @@ schedulerName: ""
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
##
priorityClassName: ""
## Strategy to use to update Pods
## @param updateStrategy.type NATS deployment/statefulset update strategy type
## Can be set to RollingUpdate or Recreate (deployment) | RollingUpdate or OnDelete (statefulset)
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
##
updateStrategy:
## @param updateStrategy.type StrategyType. Can be set to RollingUpdate or OnDelete
##
type: RollingUpdate
## @param podManagementPolicy StatefulSet pod management policy
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
##
podManagementPolicy: OrderedReady
## @param containerPorts.client NATS client container port
@@ -558,6 +505,7 @@ serviceAccount:
## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount
##
annotations: {}
## @section Traffic Exposure parameters
## NATS service parameters
@@ -781,6 +729,7 @@ networkPolicy:
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Metrics parameters
## Metrics / Prometheus NATS Exporter
@@ -790,32 +739,6 @@ metrics:
## @param metrics.enabled Enable Prometheus metrics via exporter side-car
##
enabled: false
## metrics exporter containers' liveness probe.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.livenessProbe.enabled Enable livenessProbe
## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
##
livenessProbe:
enabled: true
initialDelaySeconds: 15
timeoutSeconds: 5
## metrics exporter containers' readiness probe
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.readinessProbe.enabled Enable readinessProbe
## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
##
readinessProbe:
enabled: true
initialDelaySeconds: 5
timeoutSeconds: 1
## @param metrics.customLivenessProbe Override default liveness probe
##
customLivenessProbe: { }
## @param metrics.customReadinessProbe Override default readiness probe
##
customReadinessProbe: { }
## @param metrics.image.registry [default: REGISTRY_NAME] Prometheus metrics exporter image registry
## @param metrics.image.repository [default: REPOSITORY_NAME/nats-exporter] Prometheus metrics exporter image repository
## @skip metrics.image.tag Prometheus metrics exporter image tag (immutable tags are recommended)
@@ -837,6 +760,70 @@ metrics:
## - myRegistryKeySecretName
##
pullSecrets: []
## metrics exporter containers' liveness probe.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.livenessProbe.enabled Enable livenessProbe
## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe
## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe
## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe
##
livenessProbe:
enabled: true
initialDelaySeconds: 15
timeoutSeconds: 5
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
## metrics exporter containers' readiness probe
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.readinessProbe.enabled Enable readinessProbe
## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe
## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe
## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe
##
readinessProbe:
enabled: true
initialDelaySeconds: 5
timeoutSeconds: 1
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
## @param metrics.customLivenessProbe Override default liveness probe
##
customLivenessProbe: { }
## @param metrics.customReadinessProbe Override default readiness probe
##
customReadinessProbe: { }
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param metrics.containerSecurityContext.enabled Enabled containers' Security Context
## @param metrics.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param metrics.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param metrics.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param metrics.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param metrics.containerSecurityContext.privileged Set container's Security Context privileged
## @param metrics.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param metrics.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param metrics.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param metrics.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production).
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
##
@@ -925,7 +912,7 @@ metrics:
## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
##
persistence:
## @param persistence.enabled Enable NATS data persistence using PVC(s)
## @param persistence.enabled Enable NATS data persistence using PVCs (only for statefulset resourceType)
##
enabled: false
## @param persistence.storageClass PVC Storage Class for NATS data volume