Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/nats] NATS chart based on scratch image (#31516)

Browse Source
This commit is contained in:
Juan Ariza Toledano
2025-01-23 13:51:51 +01:00
committed by GitHub
parent d6e96ac15f
commit 37c61ed57f
24 changed files with 878 additions and 642 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.vib/nats/ginkgo/nats_suite_test.go
+45 -5
View File
@@ -17,7 +17,7 @@ import (
var ( var (
kubeconfig string kubeconfig string
stsName string releaseName string
namespace string namespace string
username string username string
password string password string
@@ -27,10 +27,10 @@ var (
func init() { func init() {
flag.StringVar(&kubeconfig, "kubeconfig", "", "absolute path to the kubeconfig file") flag.StringVar(&kubeconfig, "kubeconfig", "", "absolute path to the kubeconfig file")
flag.StringVar(&stsName, "name", "", "name of the primary statefulset") flag.StringVar(&releaseName, "name", "", "name of the chart release")
flag.StringVar(&namespace, "namespace", "", "namespace where the application is running") flag.StringVar(&namespace, "namespace", "", "namespace where the application is running")
flag.StringVar(&username, "username", "", "database user") flag.StringVar(&username, "username", "", "nats user")
flag.StringVar(&password, "password", "", "database password for username") flag.StringVar(&password, "password", "", "password for nats user")
flag.IntVar(&timeoutSeconds, "timeout", 300, "timeout in seconds") flag.IntVar(&timeoutSeconds, "timeout", 300, "timeout in seconds")
timeout = time.Duration(timeoutSeconds) * time.Second timeout = time.Duration(timeoutSeconds) * time.Second
} }
@@ -74,7 +74,7 @@ func createJob(ctx context.Context, c kubernetes.Interface, name string, port st
Env: []v1.EnvVar{ Env: []v1.EnvVar{
{ {
Name: "NATS_URL", Name: "NATS_URL",
Value: fmt.Sprintf("nats://%s:%s", stsName, port), Value: fmt.Sprintf("nats://%s:%s", releaseName, port),
}, },
{ {
Name: "NATS_USER", Name: "NATS_USER",
@@ -84,8 +84,48 @@ func createJob(ctx context.Context, c kubernetes.Interface, name string, port st
Name: "NATS_PASSWORD", Name: "NATS_PASSWORD",
Value: password, Value: password,
}, },
{
Name: "NATS_CERT",
Value: "/certs/client/tls.crt",
},
{
Name: "NATS_KEY",
Value: "/certs/client/tls.key",
},
{
Name: "NATS_CA",
Value: "/certs/ca/tls.crt",
},
}, },
SecurityContext: securityContext, SecurityContext: securityContext,
VolumeMounts: []v1.VolumeMount{
{
Name: "ca-cert",
MountPath: "/certs/ca",
},
{
Name: "client-cert",
MountPath: "/certs/client",
},
},
},
},
Volumes: []v1.Volume{
{
Name: "ca-cert",
VolumeSource: v1.VolumeSource{
Secret: &v1.SecretVolumeSource{
SecretName: fmt.Sprintf("%s-ca-crt", releaseName),
},
},
},
{
Name: "client-cert",
VolumeSource: v1.VolumeSource{
Secret: &v1.SecretVolumeSource{
SecretName: fmt.Sprintf("%s-client-crt", releaseName),
},
},
}, },
}, },
}, },
.vib/nats/ginkgo/nats_test.go
+30 -30
View File
@@ -32,23 +32,23 @@ var _ = Describe("NATS", Ordered, func() {
}) })
When("a bucket is created and is scaled down to 0 replicas and back up", func() { When("a bucket is created and is scaled down to 0 replicas and back up", func() {
It("should have access to the created database", func() { It("should have access to NATS", func() {
getAvailableReplicas := func(ss *appsv1.StatefulSet) int32 { return ss.Status.AvailableReplicas } getAvailableReplicas := func(ss *appsv1.StatefulSet) int32 { return ss.Status.AvailableReplicas }
getRestartedAtAnnotation := func(pod *v1.Pod) string { return pod.Annotations["kubectl.kubernetes.io/restartedAt"] } getRestartedAtAnnotation := func(pod *v1.Pod) string { return pod.Annotations["kubectl.kubernetes.io/restartedAt"] }
getSucceededJobs := func(j *batchv1.Job) int32 { return j.Status.Succeeded } getSucceededJobs := func(j *batchv1.Job) int32 { return j.Status.Succeeded }
getOpts := metav1.GetOptions{} getOpts := metav1.GetOptions{}
By("checking all the replicas are available") By("checking all the replicas are available")
ss, err := c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) ss, err := c.AppsV1().StatefulSets(namespace).Get(ctx, releaseName, getOpts)
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Expect(ss.Status.Replicas).NotTo(BeZero()) Expect(ss.Status.Replicas).NotTo(BeZero())
origReplicas := *ss.Spec.Replicas origReplicas := *ss.Spec.Replicas
Eventually(func() (*appsv1.StatefulSet, error) { Eventually(func() (*appsv1.StatefulSet, error) {
return c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) return c.AppsV1().StatefulSets(namespace).Get(ctx, releaseName, getOpts)
}, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas))) }, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas)))
svc, err := c.CoreV1().Services(namespace).Get(ctx, stsName, getOpts) svc, err := c.CoreV1().Services(namespace).Get(ctx, releaseName, getOpts)
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
port, err := utils.SvcGetPortByName(svc, "tcp-client") port, err := utils.SvcGetPortByName(svc, "tcp-client")
@@ -57,34 +57,34 @@ var _ = Describe("NATS", Ordered, func() {
// Use current time for allowing the test suite to repeat // Use current time for allowing the test suite to repeat
jobSuffix := time.Now().Format("20060102150405") jobSuffix := time.Now().Format("20060102150405")
By("creating a job to create a new test bucket") By("creating a job to create a new KV Store Bucket")
createDBJobName := fmt.Sprintf("%s-createbc-%s", addKVBucketJobName := fmt.Sprintf("%s-add-kv-bucket-%s",
stsName, jobSuffix) releaseName, jobSuffix)
bucketName := fmt.Sprintf("test%s", jobSuffix) storeBucketName := fmt.Sprintf("test%s", jobSuffix)
err = createJob(ctx, c, createDBJobName, port, "add", bucketName) err = createJob(ctx, c, addKVBucketJobName, port, "add", storeBucketName)
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Eventually(func() (*batchv1.Job, error) { Eventually(func() (*batchv1.Job, error) {
return c.BatchV1().Jobs(namespace).Get(ctx, createDBJobName, getOpts) return c.BatchV1().Jobs(namespace).Get(ctx, addKVBucketJobName, getOpts)
}, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1))))
By("deleting the job once it has succeeded") By("deleting the job once it has succeeded")
err = c.BatchV1().Jobs(namespace).Delete(ctx, createDBJobName, metav1.DeleteOptions{}) err = c.BatchV1().Jobs(namespace).Delete(ctx, addKVBucketJobName, metav1.DeleteOptions{})
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
By("puting a value into a key") By("creating a job to put some key-value pair")
putJobName := fmt.Sprintf("%s-putbc-%s", putKVJobName := fmt.Sprintf("%s-put-kv-%s",
stsName, jobSuffix) releaseName, jobSuffix)
err = createJob(ctx, c, putJobName, port, "put", bucketName, "testKey", "testValue") err = createJob(ctx, c, putKVJobName, port, "put", storeBucketName, "testKey", "testValue")
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Eventually(func() (*batchv1.Job, error) { Eventually(func() (*batchv1.Job, error) {
return c.BatchV1().Jobs(namespace).Get(ctx, putJobName, getOpts) return c.BatchV1().Jobs(namespace).Get(ctx, putKVJobName, getOpts)
}, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1))))
By("deleting the job once it has succeeded") By("deleting the job once it has succeeded")
err = c.BatchV1().Jobs(namespace).Delete(ctx, putJobName, metav1.DeleteOptions{}) err = c.BatchV1().Jobs(namespace).Delete(ctx, putKVJobName, metav1.DeleteOptions{})
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
// Give the application some time to sync the data // Give the application some time to sync the data
@@ -96,40 +96,40 @@ var _ = Describe("NATS", Ordered, func() {
for i := int(origReplicas) - 1; i >= 0; i-- { for i := int(origReplicas) - 1; i >= 0; i-- {
Eventually(func() (*v1.Pod, error) { Eventually(func() (*v1.Pod, error) {
return c.CoreV1().Pods(namespace).Get(ctx, fmt.Sprintf("%s-%d", stsName, i), getOpts) return c.CoreV1().Pods(namespace).Get(ctx, fmt.Sprintf("%s-%d", releaseName, i), getOpts)
}, timeout, PollingInterval).Should(WithTransform(getRestartedAtAnnotation, Not(BeEmpty()))) }, timeout, PollingInterval).Should(WithTransform(getRestartedAtAnnotation, Not(BeEmpty())))
} }
Eventually(func() (*appsv1.StatefulSet, error) { Eventually(func() (*appsv1.StatefulSet, error) {
return c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) return c.AppsV1().StatefulSets(namespace).Get(ctx, releaseName, getOpts)
}, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas))) }, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas)))
By("creating a job to get a value for a key") By("creating a job to get a value for a key")
getJobName := fmt.Sprintf("%s-getbc-%s", getKVJobName := fmt.Sprintf("%s-get-key-%s",
stsName, jobSuffix) releaseName, jobSuffix)
err = createJob(ctx, c, getJobName, port, "get", bucketName, "testKey") err = createJob(ctx, c, getKVJobName, port, "get", storeBucketName, "testKey")
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Eventually(func() (*batchv1.Job, error) { Eventually(func() (*batchv1.Job, error) {
return c.BatchV1().Jobs(namespace).Get(ctx, getJobName, getOpts) return c.BatchV1().Jobs(namespace).Get(ctx, getKVJobName, getOpts)
}, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1))))
By("deleting the job once it has succeeded") By("deleting the job once it has succeeded")
err = c.BatchV1().Jobs(namespace).Delete(ctx, getJobName, metav1.DeleteOptions{}) err = c.BatchV1().Jobs(namespace).Delete(ctx, getKVJobName, metav1.DeleteOptions{})
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
By("creating a job to get the test bucket") By("creating a job to get the delete the KV Store Bucket")
deleteDBJobName := fmt.Sprintf("%s-delbc-%s", deleteKVBucketJobName := fmt.Sprintf("%s-del-kv-bucket-%s",
stsName, jobSuffix) releaseName, jobSuffix)
err = createJob(ctx, c, deleteDBJobName, port, "del", bucketName, "-f") err = createJob(ctx, c, deleteKVBucketJobName, port, "del", storeBucketName, "-f")
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Eventually(func() (*batchv1.Job, error) { Eventually(func() (*batchv1.Job, error) {
return c.BatchV1().Jobs(namespace).Get(ctx, deleteDBJobName, getOpts) return c.BatchV1().Jobs(namespace).Get(ctx, deleteKVBucketJobName, getOpts)
}, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1))))
By("deleting the job once it has succeeded") By("deleting the job once it has succeeded")
err = c.BatchV1().Jobs(namespace).Delete(ctx, deleteDBJobName, metav1.DeleteOptions{}) err = c.BatchV1().Jobs(namespace).Delete(ctx, deleteKVBucketJobName, metav1.DeleteOptions{})
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
}) })
}) })
.vib/nats/goss/goss.yaml
-17
View File
@@ -1,17 +0,0 @@
# Copyright Broadcom, Inc. All Rights Reserved.
# SPDX-License-Identifier: APACHE-2.0
file:
/bitnami/nats/conf/{{ .Vars.natsFilename }}.conf:
mode: "0644"
filetype: file
exists: true
owner: root
command:
{{- $uid := .Vars.containerSecurityContext.runAsUser }}
{{- $gid := .Vars.podSecurityContext.fsGroup }}
check-user-info:
# The UID and GID should always be either the one specified as vars (always a bigger number that the default)
# or the one randomly defined by openshift (larger values). Otherwise, the chart is still using the default value.
exec: if [ $(id -u) -lt {{ $uid }} ] || [ $(id -G | awk '{print $2}') -lt {{ $gid }} ]; then exit 1; fi
exit-status: 0
.vib/nats/runtime-parameters.yaml
+15 -2
View File
@@ -1,13 +1,21 @@
natsFilename: nats-testing-server natsFilename: nats-testing-server
auth: auth:
enabled: true enabled: true
user: test_nats_client credentials:
password: ComplicatedPassword123!4 - user: test_nats_client
password: ComplicatedPassword123!4
cluster: cluster:
auth: auth:
enabled: true enabled: true
user: test_nats_cluster user: test_nats_cluster
password: ClusterPassword123!4 password: ClusterPassword123!4
tls:
enabled: true
autoGenerated:
enabled: true
engine: helm
debug:
enabled: true
jetstream: jetstream:
enabled: true enabled: true
persistence: persistence:
@@ -30,3 +38,8 @@ service:
type: LoadBalancer type: LoadBalancer
resourceType: statefulset resourceType: statefulset
replicaCount: 2 replicaCount: 2
metrics:
containerSecurityContext:
enabled: true
runAsUser: 1002
enabled: true
.vib/nats/vib-verify.json
-15
View File
@@ -39,21 +39,6 @@
} }
}, },
"actions": [ "actions": [
{
"action_id": "goss",
"params": {
"resources": {
"path": "/.vib"
},
"tests_file": "nats/goss/goss.yaml",
"vars_file": "nats/runtime-parameters.yaml",
"remote": {
"pod": {
"workload": "sts-nats"
}
}
}
},
{ {
"action_id": "cypress", "action_id": "cypress",
"params": { "params": {
bitnami/nats/CHANGELOG.md
+6 -2
View File
@@ -1,8 +1,12 @@
# Changelog # Changelog
## 8.5.4 (2025-01-23) ## 9.0.0 (2025-01-23)
* [bitnami/nats] Improve NATS routes configuration ([#31523](https://github.com/bitnami/charts/pull/31523)) * [bitnami/nats] NATS chart based on scratch image ([#31516](https://github.com/bitnami/charts/pull/31516))
## <small>8.5.4 (2025-01-23)</small>
* [bitnami/nats] Improve NATS routes configuration (#31523) ([293d9e2](https://github.com/bitnami/charts/commit/293d9e20aa93cf76f020561a38f5380f55e5567b)), closes [#31523](https://github.com/bitnami/charts/issues/31523) [#30124](https://github.com/bitnami/charts/issues/30124)
## <small>8.5.3 (2025-01-17)</small> ## <small>8.5.3 (2025-01-17)</small>
bitnami/nats/Chart.yaml
+2 -2
View File
@@ -6,7 +6,7 @@ annotations:
licenses: Apache-2.0 licenses: Apache-2.0
images: | images: |
- name: nats - name: nats
image: docker.io/bitnami/nats:2.10.24-debian-12-r2 image: docker.io/bitnami/nats:2.10.24-debian-12-r3
- name: nats-exporter - name: nats-exporter
image: docker.io/bitnami/nats-exporter:0.16.0-debian-12-r2 image: docker.io/bitnami/nats-exporter:0.16.0-debian-12-r2
apiVersion: v2 apiVersion: v2
@@ -31,4 +31,4 @@ maintainers:
name: nats name: nats
sources: sources:
- https://github.com/bitnami/charts/tree/main/bitnami/nats - https://github.com/bitnami/charts/tree/main/bitnami/nats
version: 8.5.4 version: 9.0.0
bitnami/nats/README.md
+130 -88
View File
@@ -53,7 +53,7 @@ To make this process easier, the chart contains the `resourcesPreset` values, wh
The Bitnami NATS chart, when upgrading, reuses the secret previously rendered by the chart or the one specified in `existingSecret`. To update credentials, use one of the following: The Bitnami NATS chart, when upgrading, reuses the secret previously rendered by the chart or the one specified in `existingSecret`. To update credentials, use one of the following:
- Run `helm upgrade` specifying a new password in `auth.password` - Run `helm upgrade` specifying new credentials via `auth.token` or `auth.credentials` parameters
- Run `helm upgrade` specifying a new secret in `existingSecret` - Run `helm upgrade` specifying a new secret in `existingSecret`
### Backup and restore ### Backup and restore
@@ -160,58 +160,73 @@ As an alternative, you can use of the preset configurations for pod affinity, po
### Common parameters ### Common parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- | | ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | | `kubeVersion` | Override Kubernetes version | `""` |
| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | | `nameOverride` | String to partially override common.names.name | `""` |
| `fullnameOverride` | String to fully override common.names.fullname template | `""` | | `fullnameOverride` | String to fully override common.names.fullname | `""` |
| `commonLabels` | Add labels to all the deployed resources | `{}` | | `namespaceOverride` | String to fully override common.names.namespace | `""` |
| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | | `commonLabels` | Add labels to all the deployed resources | `{}` |
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | | `commonAnnotations` | Add annotations to all the deployed resources | `{}` |
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | | `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | | `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | | `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | | `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
### NATS parameters ### NATS parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------ | ----------------------------------------------------------------------------------------------------- | ---------------------- | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- |
| `image.registry` | NATS image registry | `REGISTRY_NAME` | | `image.registry` | NATS image registry | `REGISTRY_NAME` |
| `image.repository` | NATS image repository | `REPOSITORY_NAME/nats` | | `image.repository` | NATS image repository | `REPOSITORY_NAME/nats` |
| `image.digest` | NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | | `image.digest` | NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `image.pullPolicy` | NATS image pull policy | `IfNotPresent` | | `image.pullPolicy` | NATS image pull policy | `IfNotPresent` |
| `image.pullSecrets` | NATS image pull secrets | `[]` | | `image.pullSecrets` | NATS image pull secrets | `[]` |
| `image.debug` | Enable NATS image debug mode | `false` | | `auth.enabled` | Switch to enable/disable client authentication | `true` |
| `auth.enabled` | Switch to enable/disable client authentication | `true` | | `auth.token` | Client authentication token | `""` |
| `auth.user` | Client authentication user | `nats_client` | | `auth.credentials` | Client authentication users credentials collection. Ignored if `auth.token` is set | `[]` |
| `auth.password` | Client authentication password | `""` | | `auth.noAuthUser` | No authenticated access will be associated with this user. It must be one of the available under `auth.credentials` map array. No authenticated access will be denied if unset. | `""` |
| `auth.token` | Client authentication token | `""` | | `auth.timeout` | Client authentication timeout (seconds) | `1` |
| `auth.timeout` | Client authentication timeout (seconds) | `1` | | `tls.enabled` | Enable TLS configuration for NATS | `false` |
| `auth.usersCredentials` | Client authentication users credentials collection | `[]` | | `tls.autoGenerated.enabled` | Enable automatic generation of TLS certificates | `true` |
| `auth.noAuthUser` | Client authentication username from auth.usersCredentials map to be used when no credentials provided | `""` | | `tls.autoGenerated.engine` | Mechanism to generate the certificates (allowed values: helm, cert-manager) | `helm` |
| `cluster.name` | Cluster name | `nats` | | `tls.autoGenerated.certManager.existingIssuer` | The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine) | `""` |
| `cluster.connectRetries` | Configure number of connect retries for implicit routes, otherwise leave blank | `""` | | `tls.autoGenerated.certManager.existingIssuerKind` | Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine) | `""` |
| `cluster.auth.enabled` | Switch to enable/disable cluster authentication | `true` | | `tls.autoGenerated.certManager.keyAlgorithm` | Key algorithm for the certificates (only for `cert-manager` engine) | `RSA` |
| `cluster.auth.user` | Cluster authentication user | `nats_cluster` | | `tls.autoGenerated.certManager.keySize` | Key size for the certificates (only for `cert-manager` engine) | `2048` |
| `cluster.auth.password` | Cluster authentication password | `""` | | `tls.autoGenerated.certManager.duration` | Duration for the certificates (only for `cert-manager` engine) | `2160h` |
| `jetstream.enabled` | Switch to enable/disable JetStream | `false` | | `tls.autoGenerated.certManager.renewBefore` | Renewal period for the certificates (only for `cert-manager` engine) | `360h` |
| `jetstream.maxMemory` | Max memory usage for JetStream | `1G` | | `tls.ca` | CA certificate for TLS. Ignored if `tls.existingCASecret` is set | `""` |
| `debug.enabled` | Switch to enable/disable debug on logging | `false` | | `tls.existingCASecret` | The name of an existing Secret containing the CA certificate for TLS | `""` |
| `debug.trace` | Switch to enable/disable trace debug level on logging | `false` | | `tls.server.cert` | TLS certificate for NATS servers. Ignored if `tls.server.existingSecret` is set | `""` |
| `debug.logtime` | Switch to enable/disable logtime on logging | `false` | | `tls.server.key` | TLS key for NATS servers. Ignored if `tls.server.existingSecret` is set | `""` |
| `maxConnections` | Max. number of client connections | `""` | | `tls.server.existingSecret` | The name of an existing Secret containing the TLS certificates for NATS servers | `""` |
| `maxControlLine` | Max. protocol control line | `""` | | `tls.client.cert` | TLS certificate for NATS clients. Ignored if `tls.client.existingSecret` is set | `""` |
| `maxPayload` | Max. payload | `""` | | `tls.client.key` | TLS key for NATS clients. Ignored if `tls.client.existingSecret` is set | `""` |
| `writeDeadline` | Duration the server can block on a socket write to a client | `""` | | `tls.client.existingSecret` | The name of an existing Secret containing the TLS certificates for NATS clients | `""` |
| `natsFilename` | Filename used by several NATS files (binary, configuration file, and pid file) | `nats-server` | | `cluster.name` | Cluster name | `nats` |
| `configuration` | Specify content for NATS configuration file (generated based on other parameters otherwise) | `""` | | `cluster.connectRetries` | Configure number of connect retries for implicit routes, otherwise leave blank | `""` |
| `existingSecret` | The name of an existing Secret with your custom configuration for NATS | `""` | | `cluster.auth.enabled` | Switch to enable/disable cluster authentication | `true` |
| `command` | Override default container command (useful when using custom images) | `[]` | | `cluster.auth.user` | Cluster authentication user | `nats_cluster` |
| `args` | Override default container args (useful when using custom images) | `[]` | | `cluster.auth.password` | Cluster authentication password | `""` |
| `extraEnvVars` | Extra environment variables to be set on NATS container | `[]` | | `jetstream.enabled` | Switch to enable/disable JetStream | `false` |
| `extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | | `jetstream.maxMemory` | Max memory usage for JetStream | `1G` |
| `extraEnvVarsSecret` | Secret with extra environment variables | `""` | | `debug.enabled` | Switch to enable/disable debug on logging | `false` |
| `debug.trace` | Switch to enable/disable trace debug level on logging | `false` |
| `debug.logtime` | Switch to enable/disable logtime on logging | `false` |
| `maxConnections` | Max. number of client connections | `""` |
| `maxControlLine` | Max. protocol control line | `""` |
| `maxPayload` | Max. payload | `""` |
| `writeDeadline` | Duration the server can block on a socket write to a client | `""` |
| `natsFilename` | Filename used by several NATS files (binary, configuration file, and pid file) | `nats-server` |
| `configuration` | Specify content for NATS configuration file (generated based on other parameters otherwise) | `""` |
| `existingSecret` | Name of an existing secret with your custom configuration for NATS | `""` |
| `command` | Override default container command (useful when using custom images) | `[]` |
| `args` | Override default container args (useful when using custom images) | `[]` |
| `extraEnvVars` | Extra environment variables to be set on NATS container | `[]` |
| `extraEnvVarsCM` | ConfigMap with extra environment variables | `""` |
| `extraEnvVarsSecret` | Secret with extra environment variables | `""` |
### NATS deployment/statefulset parameters ### NATS deployment/statefulset parameters
@@ -221,7 +236,7 @@ As an alternative, you can use of the preset configurations for pod affinity, po
| `replicaCount` | Number of NATS nodes | `1` | | `replicaCount` | Number of NATS nodes | `1` |
| `schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | | `schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` |
| `priorityClassName` | Name of pod priority class | `""` | | `priorityClassName` | Name of pod priority class | `""` |
| `updateStrategy.type` | StrategyType. Can be set to RollingUpdate or OnDelete | `RollingUpdate` | | `updateStrategy.type` | NATS deployment/statefulset update strategy type | `RollingUpdate` |
| `podManagementPolicy` | StatefulSet pod management policy | `OrderedReady` | | `podManagementPolicy` | StatefulSet pod management policy | `OrderedReady` |
| `containerPorts.client` | NATS client container port | `4222` | | `containerPorts.client` | NATS client container port | `4222` |
| `containerPorts.cluster` | NATS cluster container port | `6222` | | `containerPorts.cluster` | NATS cluster container port | `6222` |
@@ -332,46 +347,62 @@ As an alternative, you can use of the preset configurations for pod affinity, po
### Metrics parameters ### Metrics parameters
| Name | Description | Value | | Name | Description | Value |
| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | | ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
| `metrics.enabled` | Enable Prometheus metrics via exporter side-car | `false` | | `metrics.enabled` | Enable Prometheus metrics via exporter side-car | `false` |
| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` | | `metrics.image.registry` | Prometheus metrics exporter image registry | `REGISTRY_NAME` |
| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` | | `metrics.image.repository` | Prometheus metrics exporter image repository | `REPOSITORY_NAME/nats-exporter` |
| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | | `metrics.image.digest` | NATS Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` | | `metrics.image.pullPolicy` | Prometheus metrics image pull policy | `IfNotPresent` |
| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | | `metrics.image.pullSecrets` | Prometheus metrics image pull secrets | `[]` |
| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | | `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` |
| `metrics.customLivenessProbe` | Override default liveness probe | `{}` | | `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
| `metrics.customReadinessProbe` | Override default readiness probe | `{}` | | `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
| `metrics.image.registry` | Prometheus metrics exporter image registry | `REGISTRY_NAME` | | `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
| `metrics.image.repository` | Prometheus metrics exporter image repository | `REPOSITORY_NAME/nats-exporter` | | `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
| `metrics.image.digest` | NATS Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | | `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `metrics.image.pullPolicy` | Prometheus metrics image pull policy | `IfNotPresent` | | `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` |
| `metrics.image.pullSecrets` | Prometheus metrics image pull secrets | `[]` | | `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` | | `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | | `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
| `metrics.containerPorts.http` | Prometheus metrics exporter port | `7777` | | `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `metrics.flags` | Flags to be passed to Prometheus metrics | `[]` | | `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `metrics.service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` | | `metrics.customLivenessProbe` | Override default liveness probe | `{}` |
| `metrics.service.port` | Prometheus metrics service port | `7777` | | `metrics.customReadinessProbe` | Override default readiness probe | `{}` |
| `metrics.service.loadBalancerIP` | Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank | `""` | | `metrics.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `metrics.service.annotations` | Annotations for Prometheus metrics service | `{}` | | `metrics.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
| `metrics.service.labels` | Labels for Prometheus metrics service | `{}` | | `metrics.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `metrics.serviceMonitor.enabled` | Specify if a ServiceMonitor will be deployed for Prometheus Operator | `false` | | `metrics.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` |
| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `monitoring` | | `metrics.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | | `metrics.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` | | `metrics.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` |
| `metrics.serviceMonitor.interval` | How frequently to scrape metrics | `""` | | `metrics.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` |
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | | `metrics.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | | `metrics.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | | `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` |
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | | `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `metrics.containerPorts.http` | Prometheus metrics exporter port | `7777` |
| `metrics.flags` | Flags to be passed to Prometheus metrics | `[]` |
| `metrics.service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` |
| `metrics.service.port` | Prometheus metrics service port | `7777` |
| `metrics.service.loadBalancerIP` | Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank | `""` |
| `metrics.service.annotations` | Annotations for Prometheus metrics service | `{}` |
| `metrics.service.labels` | Labels for Prometheus metrics service | `{}` |
| `metrics.serviceMonitor.enabled` | Specify if a ServiceMonitor will be deployed for Prometheus Operator | `false` |
| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `monitoring` |
| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` |
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` |
| `metrics.serviceMonitor.interval` | How frequently to scrape metrics | `""` |
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` |
| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` |
| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` |
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
### Persistence parameters ### Persistence parameters
| Name | Description | Value | | Name | Description | Value |
| -------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------- | | -------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------- |
| `persistence.enabled` | Enable NATS data persistence using PVC(s) | `false` | | `persistence.enabled` | Enable NATS data persistence using PVCs (only for statefulset resourceType) | `false` |
| `persistence.storageClass` | PVC Storage Class for NATS data volume | `""` | | `persistence.storageClass` | PVC Storage Class for NATS data volume | `""` |
| `persistence.accessModes` | PVC Access modes | `["ReadWriteOnce"]` | | `persistence.accessModes` | PVC Access modes | `["ReadWriteOnce"]` |
| `persistence.size` | PVC Storage Request for NATS data volume | `8Gi` | | `persistence.size` | PVC Storage Request for NATS data volume | `8Gi` |
@@ -393,7 +424,7 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm
```console ```console
helm install my-release \ helm install my-release \
--set auth.enabled=true,auth.user=my-user,auth.password=T0pS3cr3t \ --set auth.enabled=true,auth.credentials[0].user=my-user,auth.credentials[0].password=T0pS3cr3t \
oci://REGISTRY_NAME/REPOSITORY_NAME/nats oci://REGISTRY_NAME/REPOSITORY_NAME/nats
``` ```
@@ -418,6 +449,17 @@ Find more information about how to deal with common errors related to Bitnami's
## Upgrading ## Upgrading
### To 9.0.0
This major versions ships by default a new NATS image version that dramatically reduces the image given there's no distro and it simply includes the NATS binary on top of a scratch base image. As a consequence, there's no shell available in the image and debugging actions must be performed using sidecars or equivalent mechanisms.
Also, the default path for storing JetStream data is `/data/jetstream` instead of `/data/jetstream/jetstream` to avoid stuttering. If you're upgrading from an existing installation with persisted data, you'll have to edit the JetStream's "store_dir" configuration property so it's compatible with your previous data.
Finally, the following changes are also introduced on chart parameters in this major version update:
- `auth.usersCredentials` is renamed to `auth.credentials`.
- `auth.user` and `auth.password` are deprecated in favor of `auth.credentials`.
### To 8.5.0 ### To 8.5.0
This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850). This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850).
@@ -500,4 +542,4 @@ Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS, distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
bitnami/nats/templates/NOTES.txt
+63 -24
View File
@@ -7,6 +7,7 @@ Did you know there are enterprise versions of the Bitnami catalog? For enhanced
** Please be patient while the chart is being deployed ** ** Please be patient while the chart is being deployed **
{{- if .Values.diagnosticMode.enabled }} {{- if .Values.diagnosticMode.enabled }}
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
@@ -16,14 +17,6 @@ Get the list of pods by executing:
kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
Access the pod you want to debug by executing
kubectl exec --namespace {{ .Release.Namespace }} -ti <NAME OF THE POD> -- bash
In order to replicate the container startup scripts execute this command:
/opt/bitnami/scripts/nats/entrypoint.sh
{{- else }} {{- else }}
{{- if or (contains .Values.service.type "LoadBalancer") (contains .Values.service.type "nodePort") }} {{- if or (contains .Values.service.type "LoadBalancer") (contains .Values.service.type "nodePort") }}
@@ -54,9 +47,13 @@ NATS can be accessed via port {{ .Values.service.ports.client }} on the followin
To get the authentication credentials, run: To get the authentication credentials, run:
export NATS_USER=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | grep -m 1 user | awk '{print $2}' | tr -d '"') {{- if .Values.auth.token }}
export NATS_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | grep -m 1 password | awk '{print $2}' | tr -d '"') export NATS_TOKEN=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*token: "\([^"]*\)".*/\1/p' | head -n 1)
{{- else }}
export NATS_USER=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*user: "\([^"]*\)".*/\1/p' | head -n 1)
export NATS_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*password: "\([^"]*\)".*/\1/p' | head -n 1)
echo -e "Client credentials:\n\tUser: $NATS_USER\n\tPassword: $NATS_PASS" echo -e "Client credentials:\n\tUser: $NATS_USER\n\tPassword: $NATS_PASS"
{{- end }}
{{- end }} {{- end }}
@@ -64,20 +61,62 @@ NATS monitoring service can be accessed via port {{ .Values.service.ports.monito
{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local {{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
You can create a Golang pod to be used as a NATS client: You can create a pod to be used as a NATS client:
kubectl run {{ include "common.names.fullname" . }}-client --restart='Never' --env="NATS_USER=$NATS_USER" --env="NATS_PASS=$NATS_PASS" --image docker.io/bitnami/golang --namespace {{ .Release.Namespace }} --command -- sleep infinity cat <<EOF | kubectl apply -f -
kubectl exec --tty -i {{ include "common.names.fullname" . }}-client --namespace {{ .Release.Namespace }} -- bash apiVersion: v1
GO111MODULE=off go get github.com/nats-io/nats.go kind: Pod
cd $GOPATH/src/github.com/nats-io/nats.go/examples/nats-pub && go install && cd metadata:
cd $GOPATH/src/github.com/nats-io/nats.go/examples/nats-echo && go install && cd name: {{ include "common.names.fullname" . }}-client
{{- if .Values.auth.enabled }} namespace: {{ .Release.Namespace }}
nats-echo -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} SomeSubject spec:
nats-pub -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} -reply Hi SomeSubject "Hi everyone" containers:
{{- else }} - name: cli
nats-echo -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} SomeSubject image: docker.io/bitnami/natscli
nats-pub -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} -reply Hi SomeSubject "Hi everyone" command: ["sleep", "infinity"]
{{- end }} env:
{{- if .Values.auth.token }}
- name: NATS_TOKEN
value: "$NATS_TOKEN"
{{- else }}
- name: NATS_USER
value: "$NATS_USER"
- name: NATS_PASS
value: "$NATS_PASS"
{{- end }}
{{- if .Values.tls.enabled }}
volumeMounts:
- mountPath: /etc/certs/ca
name: ca-cert
readOnly: true
- mountPath: /etc/certs/client
name: client-cert
readOnly: true
volumes:
- name: ca-cert
secret:
secretName: {{ template "nats.tls.ca.secretName" . }}
- name: client-cert
secret:
secretName: {{ template "nats.tls.client.secretName" . }}
{{- end }}
EOF
Then, access the pod and connect to NATS:
kubectl exec --tty -i {{ include "common.names.fullname" . }}-client --namespace {{ .Release.Namespace }} -- bash
{{- if .Values.auth.enabled }}
{{- if .Values.auth.token }}
nats -s nats://$NATS_TOKEN@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} subscribe SomeSubject &
nats -s nats://$NATS_TOKEN@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} publish SomeSubject "Some message"
{{- else }}
nats -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} subscribe SomeSubject
nats -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} publish SomeSubject "Some message"
{{- end }}
{{- else }}
nats -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} subscribe SomeSubject
nats -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} {{ if .Values.tls.enabled }}--tlscert /etc/certs/client/tls.crt --tlskey /etc/certs/client/tls.key --tlsca /etc/certs/ca/tls.crt{{ end }} publish SomeSubject "Some message"
{{- end }}
To access the Monitoring svc from outside the cluster, follow the steps below: To access the Monitoring svc from outside the cluster, follow the steps below:
@@ -129,7 +168,7 @@ To access the Monitoring svc from outside the cluster, follow the steps below:
{{- include "common.warnings.rollingTag" .Values.image }} {{- include "common.warnings.rollingTag" .Values.image }}
{{- include "common.warnings.rollingTag" .Values.metrics.image }} {{- include "common.warnings.rollingTag" .Values.metrics.image }}
{{- include "nats.validateValues" . -}}
{{- include "common.warnings.resources" (dict "sections" (list "metrics" "") "context" $) }} {{- include "common.warnings.resources" (dict "sections" (list "metrics" "") "context" $) }}
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.metrics.image) "context" $) }} {{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.metrics.image) "context" $) }}
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.metrics.image) "context" $) }} {{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.metrics.image) "context" $) }}
{{- include "nats.validateValues" . }}
bitnami/nats/templates/_helpers.tpl
+38 -18
View File
@@ -6,7 +6,7 @@ SPDX-License-Identifier: APACHE-2.0
{{/* vim: set filetype=mustache: */}} {{/* vim: set filetype=mustache: */}}
{{/* {{/*
Return the proper Nats image name Return the proper NATS image name
*/}} */}}
{{- define "nats.image" -}} {{- define "nats.image" -}}
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} {{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
@@ -35,17 +35,8 @@ We prepend a random letter to the string to avoid password validation errors
{{- end -}} {{- end -}}
{{/* {{/*
Return true if a NATS configuration secret object should be created Create the name of the service account to use
*/}} */}}
{{- define "nats.createSecret" -}}
{{- if and .Values.configuration (not .Values.existingSecret) }}
{{- true -}}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "nats.serviceAccountName" -}} {{- define "nats.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}} {{- if .Values.serviceAccount.create -}}
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
@@ -58,10 +49,39 @@ Return true if a NATS configuration secret object should be created
Return the NATS configuration secret name Return the NATS configuration secret name
*/}} */}}
{{- define "nats.secretName" -}} {{- define "nats.secretName" -}}
{{- if .Values.existingSecret }} {{ default (include "common.names.fullname" .) (tpl .Values.existingSecret .) -}}
{{- printf "%s" (tpl .Values.existingSecret .) -}} {{- end -}}
{{/*
Return the name of the secret containing the CA TLS certificate
*/}}
{{- define "nats.tls.ca.secretName" -}}
{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.ca))) -}}
{{- printf "%s-ca-crt" (include "common.names.fullname" .) -}}
{{- else -}} {{- else -}}
{{- printf "%s" (include "common.names.fullname" .) -}} {{- required "An existing secret name must be provided with a CA cert for NATS if cert is not provided!" (tpl .Values.tls.existingCASecret .) -}}
{{- end -}}
{{- end -}}
{{/*
Return the name of the secret containing the TLS certificates for NATS servers
*/}}
{{- define "nats.tls.server.secretName" -}}
{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.server.cert)) (not (empty .Values.tls.server.key))) -}}
{{- printf "%s-crt" (include "common.names.fullname" .) -}}
{{- else -}}
{{- required "An existing secret name must be provided with TLS certs for NATS servers if cert and key are not provided!" (tpl .Values.tls.server.existingSecret .) -}}
{{- end -}}
{{- end -}}
{{/*
Return the name of the secret containing the TLS certificates for NATS clients
*/}}
{{- define "nats.tls.client.secretName" -}}
{{- if or .Values.tls.autoGenerated.enabled (and (not (empty .Values.tls.client.cert)) (not (empty .Values.tls.client.key))) -}}
{{- printf "%s-client-crt" (include "common.names.fullname" .) -}}
{{- else -}}
{{- required "An existing secret name must be provided with TLS certs for NATS clients if cert and key are not provided!" (tpl .Values.tls.client.existingSecret .) -}}
{{- end -}} {{- end -}}
{{- end -}} {{- end -}}
@@ -82,18 +102,18 @@ Compile all warnings into a single message, and call fail.
{{/* Validate values of NATS - must provide a valid resourceType ("deployment" or "statefulset") */}} {{/* Validate values of NATS - must provide a valid resourceType ("deployment" or "statefulset") */}}
{{- define "nats.validateValues.resourceType" -}} {{- define "nats.validateValues.resourceType" -}}
{{- if and (ne .Values.resourceType "deployment") (ne .Values.resourceType "statefulset") -}} {{- if and (ne (lower .Values.resourceType) "deployment") (ne (lower .Values.resourceType) "statefulset") -}}
nats: resourceType nats: resourceType
Invalid resourceType selected. Valid values are "deployment" and Invalid resourceType selected. Valid values are "deployment" and
"statefulset". Please set a valid mode (--set resourceType="xxxx") "statefulset". Please set a valid mode (--set resourceType="xxxx")
{{- end -}} {{- end -}}
{{- end -}} {{- end -}}
{{/* Validate values of NATS - enabling JetStream requires persistence & statefulsets */}} {{/* Validate values of NATS - enabling JetStream requires persistence & StatefulSet */}}
{{- define "nats.validateValues.jetstream" -}} {{- define "nats.validateValues.jetstream" -}}
{{- if and .Values.jetstream.enabled (or (ne .Values.resourceType "statefulset") (not .Values.persistence.enabled)) -}} {{- if and .Values.jetstream.enabled (or (ne .Values.resourceType "statefulset") (not .Values.persistence.enabled)) -}}
nats: jetstream nats: jetstream
Invalid configuration selected. Enabling jetstream requires enabling persistence Invalid configuration selected. Enabling JetStream requires enabling persistence
and using a "statefulset" (--set persistence.enabled=true,resourceType="statefulset") and using a StatefulSet (--set persistence.enabled=true,resourceType="statefulset")
{{- end -}} {{- end -}}
{{- end -}} {{- end -}}
bitnami/nats/templates/statefulset.yaml → bitnami/nats/templates/application.yaml
+48 -32
View File
@@ -3,31 +3,33 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0 SPDX-License-Identifier: APACHE-2.0
*/}} */}}
{{- if or (eq .Values.resourceType "statefulset") (not (contains .Values.resourceType "deployment")) }} {{- $resourceType := lower .Values.resourceType }}
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} apiVersion: {{ ternary (include "common.capabilities.deployment.apiVersion" .) (include "common.capabilities.statefulset.apiVersion" .) (eq $resourceType "deployment") }}
kind: StatefulSet kind: {{ ternary "Deployment" "StatefulSet" (eq $resourceType "deployment") }}
metadata: metadata:
name: {{ template "common.names.fullname" . }} name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }} {{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
podManagementPolicy: {{ .Values.podManagementPolicy }}
replicas: {{ .Values.replicaCount }} replicas: {{ .Values.replicaCount }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }} {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector: selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- if eq $resourceType "statefulset" }}
podManagementPolicy: {{ .Values.podManagementPolicy }}
serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- if .Values.updateStrategy }} {{- if .Values.updateStrategy }}
updateStrategy: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }} {{ ternary "strategy" "updateStrategy" (eq $resourceType "deployment") }}: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
{{- end }} {{- end }}
template: template:
metadata: metadata:
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
annotations: annotations:
{{- if (include "nats.createSecret" .) }} {{- if not .Values.existingSecret }}
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
{{- end }} {{- end }}
{{- if .Values.podAnnotations }} {{- if .Values.podAnnotations }}
@@ -76,25 +78,30 @@ spec:
{{- if .Values.containerSecurityContext.enabled }} {{- if .Values.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }} securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }} {{- end }}
command:
{{- if .Values.diagnosticMode.enabled }} {{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.command }} {{- else if .Values.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }} {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
{{- else }}
- /nats-server
{{- end }} {{- end }}
args:
{{- if .Values.diagnosticMode.enabled }} {{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.args }} {{- else if .Values.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }} {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
{{- else }}
- -c
- /etc/{{ .Values.natsFilename }}.conf
{{- end }} {{- end }}
env: env:
- name: BITNAMI_DEBUG {{- if eq $resourceType "statefulset" }}
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
- name: NATS_FILENAME
value: {{ .Values.natsFilename | quote }}
- name: NATS_SERVER_NAME - name: NATS_SERVER_NAME
valueFrom: valueFrom:
fieldRef: fieldRef:
fieldPath: metadata.name fieldPath: metadata.name
{{- end }}
{{- if .Values.extraEnvVars }} {{- if .Values.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }} {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
{{- end }} {{- end }}
@@ -153,19 +160,18 @@ spec:
- name: empty-dir - name: empty-dir
mountPath: /tmp mountPath: /tmp
subPath: tmp-dir subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/logs
subPath: app-logs-dir
- name: config - name: config
mountPath: /bitnami/nats/conf/{{ .Values.natsFilename }}.conf mountPath: /etc/{{ .Values.natsFilename }}.conf
subPath: {{ .Values.natsFilename }}.conf subPath: {{ .Values.natsFilename }}.conf
{{- if .Values.persistence.enabled }} {{- if .Values.tls.enabled }}
- name: ca-cert
mountPath: /etc/certs/ca
readOnly: true
- name: server-cert
mountPath: /etc/certs/server
readOnly: true
{{- end }}
{{- if and .Values.persistence.enabled (eq $resourceType "statefulset") }}
- name: data - name: data
mountPath: /data mountPath: /data
{{- end }} {{- end }}
@@ -176,6 +182,9 @@ spec:
- name: metrics - name: metrics
image: {{ template "nats.metrics.image" . }} image: {{ template "nats.metrics.image" . }}
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
{{- if .Values.metrics.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }} {{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
@@ -183,11 +192,10 @@ spec:
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.flags "context" $) | nindent 12 }} args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.flags "context" $) | nindent 12 }}
- "http://localhost:{{ .Values.containerPorts.monitoring }}" - "http://localhost:{{ .Values.containerPorts.monitoring }}"
{{- end }} {{- end }}
{{- if not .Values.diagnosticMode.enabled }}
ports: ports:
- name: metrics - name: metrics
containerPort: {{ coalesce .Values.metrics.containerPorts.http .Values.metrics.containerPort }} containerPort: {{ .Values.metrics.containerPorts.http }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.metrics.customLivenessProbe }} {{- if .Values.metrics.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.metrics.livenessProbe.enabled }} {{- else if .Values.metrics.livenessProbe.enabled }}
@@ -204,7 +212,6 @@ spec:
path: /metrics path: /metrics
port: metrics port: metrics
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if .Values.metrics.resources }} {{- if .Values.metrics.resources }}
resources: {{- toYaml .Values.metrics.resources | nindent 12 }} resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
@@ -221,10 +228,20 @@ spec:
- name: config - name: config
secret: secret:
secretName: {{ include "nats.secretName" . }} secretName: {{ include "nats.secretName" . }}
{{- if .Values.tls.enabled }}
- name: ca-cert
secret:
secretName: {{ template "nats.tls.ca.secretName" . }}
defaultMode: 256
- name: server-cert
secret:
secretName: {{ template "nats.tls.server.secretName" . }}
defaultMode: 256
{{- end }}
{{- if .Values.extraVolumes }} {{- if .Values.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }} {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
{{- end }} {{- end }}
{{- if .Values.persistence.enabled }} {{- if and .Values.persistence.enabled (eq $resourceType "statefulset") }}
{{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }} {{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }}
persistentVolumeClaimRetentionPolicy: persistentVolumeClaimRetentionPolicy:
whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }} whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
@@ -253,4 +270,3 @@ spec:
{{- end }} {{- end }}
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }} {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
{{- end }} {{- end }}
{{- end }}
bitnami/nats/templates/certs.yaml
+116
View File
@@ -0,0 +1,116 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") }}
{{- if empty .Values.tls.autoGenerated.certManager.existingIssuer }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ printf "%s-clusterissuer" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
selfSigned: {}
---
{{- end }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
secretName: {{ template "nats.tls.ca.secretName" . }}
commonName: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
isCA: true
issuerRef:
name: {{ default (printf "%s-clusterissuer" (include "common.names.fullname" .)) .Values.tls.autoGenerated.certManager.existingIssuer }}
kind: {{ default "Issuer" .Values.tls.autoGenerated.certManager.existingIssuerKind }}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
ca:
secretName: {{ template "nats.tls.ca.secretName" . }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ printf "%s-crt" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
secretName: {{ template "nats.tls.server.secretName" . }}
commonName: {{ printf "%s.%s.svc.%s" (include "common.names.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain }}
issuerRef:
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
kind: Issuer
subject:
organizations:
- "NATS"
dnsNames:
- '*.{{ include "common.names.namespace" . }}'
- '*.{{ include "common.names.namespace" . }}.svc'
- '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
- '*.{{ include "common.names.fullname" . }}'
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}'
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc'
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
{{- if eq (lower .Values.resourceType) "statefulset" }}
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}'
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}.{{ include "common.names.namespace" . }}'
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}.{{ include "common.names.namespace" . }}.svc'
- '*.{{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
{{- end }}
privateKey:
algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }}
size: {{ int .Values.tls.autoGenerated.certManager.keySize }}
duration: {{ .Values.tls.autoGenerated.certManager.duration }}
renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ printf "%s-client-crt" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
secretName: {{ template "nats.tls.client.secretName" . }}
commonName: {{ printf "%s-client" (include "common.names.fullname" .) }}
issuerRef:
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
kind: Issuer
subject:
organizations:
- "NATS"
dnsNames:
- '*.{{ include "common.names.namespace" . }}'
- '*.{{ include "common.names.namespace" . }}.svc'
- '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
privateKey:
algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }}
size: {{ int .Values.tls.autoGenerated.certManager.keySize }}
duration: {{ .Values.tls.autoGenerated.certManager.duration }}
renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }}
{{- end }}
bitnami/nats/templates/deployment.yaml
-217
View File
@@ -1,217 +0,0 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if eq .Values.resourceType "deployment" }}
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
kind: Deployment
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.replicaCount }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
{{- if .Values.updateStrategy }}
strategy: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
{{- end }}
template:
metadata:
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
annotations:
{{- if (include "nats.createSecret" .) }}
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.podAnnotations }}
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
{{- end }}
spec:
{{- include "nats.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ include "nats.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
{{- if .Values.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName | quote }}
{{- end }}
{{- if .Values.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.schedulerName }}
schedulerName: {{ .Values.schedulerName | quote }}
{{- end }}
{{- if .Values.podSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.initContainers }}
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: nats
image: {{ template "nats.image" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- if .Values.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
- name: NATS_FILENAME
value: {{ .Values.natsFilename | quote }}
{{- if .Values.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
{{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
envFrom:
{{- if .Values.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- end }}
ports:
- name: client
containerPort: {{ .Values.containerPorts.client }}
- name: cluster
containerPort: {{ .Values.containerPorts.cluster }}
- name: monitoring
containerPort: {{ .Values.containerPorts.monitoring }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /
port: monitoring
{{- end }}
{{- if .Values.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /healthz
port: monitoring
{{- end }}
{{- if .Values.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: monitoring
{{- end }}
{{- end }}
{{- if .Values.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.resources }}
resources: {{- toYaml .Values.resources | nindent 12 }}
{{- else if ne .Values.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/nats/logs
subPath: app-logs-dir
- name: config
mountPath: /bitnami/nats/conf/{{ .Values.natsFilename }}.conf
subPath: {{ .Values.natsFilename }}.conf
{{- if .Values.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.metrics.enabled }}
- name: metrics
image: {{ template "nats.metrics.image" . }}
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.flags "context" $) | nindent 12 }}
- "http://localhost:{{ .Values.containerPorts.monitoring }}"
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
ports:
- name: metrics
containerPort: {{ coalesce .Values.metrics.containerPorts.http .Values.metrics.containerPort }}
{{- if .Values.metrics.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.metrics.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /metrics
port: metrics
{{- end }}
{{- if .Values.metrics.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.metrics.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
path: /metrics
port: metrics
{{- end }}
{{- end }}
{{- if .Values.metrics.resources }}
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
{{- else if ne .Values.metrics.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: config
secret:
secretName: {{ include "nats.secretName" . }}
{{- if .Values.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
{{- end }}
{{- end }}
bitnami/nats/templates/headless-svc.yaml
+6 -4
View File
@@ -3,11 +3,12 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0 SPDX-License-Identifier: APACHE-2.0
*/}} */}}
{{- if eq (lower .Values.resourceType) "statefulset" }}
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }} {{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
@@ -18,14 +19,15 @@ spec:
clusterIP: None clusterIP: None
ports: ports:
- name: tcp-client - name: tcp-client
port: {{ .Values.service.ports.client }} port: {{ .Values.containerPorts.client }}
targetPort: client targetPort: client
- name: tcp-cluster - name: tcp-cluster
port: {{ .Values.service.ports.cluster }} port: {{ .Values.containerPorts.cluster }}
targetPort: cluster targetPort: cluster
- name: tcp-monitoring - name: tcp-monitoring
port: {{ .Values.service.ports.monitoring }} port: {{ .Values.containerPorts.monitoring }}
targetPort: monitoring targetPort: monitoring
publishNotReadyAddresses: {{ .Values.service.headless.publishNotReadyAddresses }} publishNotReadyAddresses: {{ .Values.service.headless.publishNotReadyAddresses }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }} {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
{{- end }}
bitnami/nats/templates/ingress-tls-secret.yaml
+44
View File
@@ -0,0 +1,44 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.ingress.enabled }}
{{- if .Values.ingress.secrets }}
{{- range .Values.ingress.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .name }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
---
{{- end }}
{{- end }}
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
{{- $secretName := printf "%s-tls" .Values.ingress.hostname | trunc 63 | trimSuffix "-" }}
{{- $ca := genCA "nats-ca" 365 }}
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $secretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
{{- end }}
{{- end }}
bitnami/nats/templates/ingress.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
kind: Ingress kind: Ingress
metadata: metadata:
name: {{ printf "%s-monitoring" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} name: {{ printf "%s-monitoring" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.ingress.annotations .Values.commonAnnotations }} {{- if or .Values.ingress.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }} {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
bitnami/nats/templates/metrics-svc.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: {{ printf "%s-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} name: {{ printf "%s-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.labels .Values.commonLabels ) "context" . ) }} {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: metrics app.kubernetes.io/component: metrics
bitnami/nats/templates/networkpolicy.yaml
+3 -3
View File
@@ -8,7 +8,7 @@ kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata: metadata:
name: {{ template "common.names.fullname" . }} name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }} {{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
@@ -40,7 +40,7 @@ spec:
- podSelector: - podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
{{- if .Values.networkPolicy.extraEgress }} {{- if .Values.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.rts.networkPolicy.extraEgress "context" $ ) | nindent 4 }} {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }} {{- end }}
{{- end }} {{- end }}
ingress: ingress:
@@ -49,7 +49,7 @@ spec:
- port: {{ .Values.containerPorts.cluster }} - port: {{ .Values.containerPorts.cluster }}
- port: {{ .Values.containerPorts.monitoring }} - port: {{ .Values.containerPorts.monitoring }}
{{- if .Values.metrics.enabled }} {{- if .Values.metrics.enabled }}
- port: {{ coalesce .Values.metrics.containerPorts.http .Values.metrics.containerPort }} - port: {{ .Values.metrics.containerPorts.http }}
{{- end }} {{- end }}
{{- if not .Values.networkPolicy.allowExternal }} {{- if not .Values.networkPolicy.allowExternal }}
from: from:
bitnami/nats/templates/poddisruptionbudget.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
kind: PodDisruptionBudget kind: PodDisruptionBudget
metadata: metadata:
name: {{ template "common.names.fullname" . }} name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }} {{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
bitnami/nats/templates/secrets.yaml
+108 -5
View File
@@ -3,17 +3,120 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0 SPDX-License-Identifier: APACHE-2.0
*/}} */}}
{{- if (include "nats.createSecret" .) }} {{/*
Return the NATS configuration.
ref: https://docs.nats.io/running-a-nats-service/configuration
*/}}
{{- define "nats.configuration" -}}
{{- if .Values.configuration }}
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" .) }}
{{- else }}
{{- if eq .Values.resourceType "statefulset" }}
server_name: $NATS_SERVER_NAME
{{- end }}
listen: 0.0.0.0:{{ .Values.containerPorts.client }}
http: 0.0.0.0:{{ .Values.containerPorts.monitoring }}
# Authorization for client connections
{{- if .Values.auth.enabled }}
authorization {
{{- if .Values.auth.token }}
token: {{ .Values.auth.token | quote }}
{{- else if .Values.auth.credentials }}
users: [
{{- range $cred := .Values.auth.credentials }}
{ user: {{ $cred.user | quote }}, password: {{ default (include "nats.randomPassword" $) $cred.password | quote }} },
{{- end }}
],
{{- end }}
timeout: {{ int .Values.auth.timeout }}
}
{{- if .Values.auth.noAuthUser }}
no_auth_user: {{ .Values.auth.noAuthUser | quote }}
{{- end }}
{{- end }}
# Logging options
debug: {{ ternary "true" "false" (or .Values.debug.enabled .Values.diagnosticMode.enabled) }}
trace: {{ ternary "true" "false" (or .Values.debug.trace .Values.diagnosticMode.enabled) }}
logtime: {{ ternary "true" "false" (or .Values.debug.logtime .Values.diagnosticMode.enabled) }}
# Pid file
pid_file: "/tmp/{{ .Values.natsFilename }}.pid"
# System overrides
{{- if .Values.maxConnections }}
max_connections: {{ int .Values.maxConnections }}
{{- end }}
{{- if .Values.maxControlLine }}
max_control_line: {{ int .Values.maxControlLine }}
{{- end }}
{{- if .Values.maxPayload }}
max_payload: {{ int .Values.maxPayload }}
{{- end }}
{{- if .Values.writeDeadline }}
write_deadline: {{ .Values.writeDeadline | quote }}
{{- end }}
{{- if .Values.tls.enabled }}
# TLS configuration
tls {
ca_file: /etc/certs/ca/tls.crt
cert_file: /etc/certs/server/tls.crt
key_file: /etc/certs/server/tls.key
timeout: 2
}
{{- end }}
{{- if gt (int .Values.replicaCount) 1 }}
{{- $clusterAuthPwd := default (include "nats.randomPassword" .) .Values.cluster.auth.password }}
# Clustering definition
cluster {
name: {{ .Values.cluster.name | quote }}
listen: 0.0.0.0:{{ .Values.containerPorts.cluster }}
{{- if .Values.cluster.auth.enabled }}
# Authorization for cluster connections
authorization {
user: {{ .Values.cluster.auth.user | quote }}
password: {{ $clusterAuthPwd | quote }}
timeout: 1
}
{{- end }}
# Routes are actively solicited and connected to from this server.
# Other servers can connect to us if they supply the correct credentials
# in their routes definitions from above
{{- $auth := ternary (printf "%s:%s@" .Values.cluster.auth.user $clusterAuthPwd) "" .Values.cluster.auth.enabled }}
{{- $domain := (printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" ) }}
{{- $stsPrefix := include "common.names.fullname" . }}
{{- $clusterPort := .Values.service.ports.cluster }}
routes = [
{{- range $podIndex := until (.Values.replicaCount | int) }}
nats://{{ $auth }}{{ $stsPrefix }}-{{ $podIndex }}.{{ $domain }}:{{ $clusterPort }}
{{- end }}
]
{{- if .Values.cluster.connectRetries }}
# Configure number of connect retries for implicit routes
connect_retries: {{ .Values.cluster.connectRetries }}
{{- end }}
}
{{- end }}
{{- if .Values.jetstream.enabled }}
# JetStream configuration
jetstream: enabled
jetstream {
store_dir: /data
max_memory_store: {{ .Values.jetstream.maxMemory }}
max_file_store: {{ .Values.persistence.size }}
}
{{- end }}
{{- end }}
{{- end }}
{{- if not .Values.existingSecret }}
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: {{ template "common.names.fullname" . }} name: {{ template "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" . ) | nindent 4 }}
{{- if .Values.commonAnnotations }} {{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" . ) | nindent 4 }}
{{- end }} {{- end }}
data: data:
{{ .Values.natsFilename }}.conf: |- {{ .Values.natsFilename }}.conf: |-
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | b64enc | nindent 4 }} {{- include "common.tplvalues.render" (dict "value" (include "nats.configuration" .) "context" .) | b64enc | nindent 4 }}
{{- end }} {{- end }}
bitnami/nats/templates/service.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: {{ include "common.names.fullname" . }} name: {{ include "common.names.fullname" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.commonAnnotations .Values.service.annotations }} {{- if or .Values.commonAnnotations .Values.service.annotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }} {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
bitnami/nats/templates/servicemonitor.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor kind: ServiceMonitor
metadata: metadata:
name: {{ printf "%s-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} name: {{ printf "%s-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ default .Release.Namespace .Values.metrics.serviceMonitor.namespace | quote }} namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace | quote }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }} {{- if .Values.commonAnnotations }}
bitnami/nats/templates/tls-secret.yaml
+86 -27
View File
@@ -3,42 +3,101 @@ Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0 SPDX-License-Identifier: APACHE-2.0
*/}} */}}
{{- if .Values.ingress.enabled }} {{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "helm") -}}
{{- if .Values.ingress.secrets }}
{{- range .Values.ingress.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ .name }}
namespace: {{ $.Release.Namespace | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
---
{{- end }}
{{- end }}
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
{{- $secretName := printf "%s-tls" .Values.ingress.hostname | trunc 63 | trimSuffix "-" }}
{{- $ca := genCA "nats-ca" 365 }} {{- $ca := genCA "nats-ca" 365 }}
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }} {{- $releaseNamespace := include "common.names.namespace" . }}
{{- $clusterDomain := .Values.clusterDomain }}
{{- $caSecretName := include "nats.tls.ca.secretName" . }}
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: {{ $secretName }} name: {{ $caSecretName }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }} {{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }} {{- end }}
type: kubernetes.io/tls type: kubernetes.io/tls
data: data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }} tls.crt: {{ include "common.secrets.lookup" (dict "secret" $caSecretName "key" "tls.crt" "defaultValue" $ca.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }} tls.key: {{ include "common.secrets.lookup" (dict "secret" $caSecretName "key" "tls.key" "defaultValue" $ca.Key "context" $) }}
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} ---
{{- $serverFullname := include "common.names.fullname" . }}
{{- $serverAltNames := list (printf "%s.%s.svc.%s" $serverFullname $releaseNamespace $clusterDomain) $serverFullname "127.0.0.1" "localhost" }}
{{- if eq (lower .Values.resourceType) "statefulset" }}
{{- $serverHeadlessSvcName := printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
{{- $serverAltNames = list (printf "*.%s.%s.svc.%s" $serverHeadlessSvcName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serverHeadlessSvcName $releaseNamespace $clusterDomain) $serverHeadlessSvcName (printf "%s.%s.svc.%s" $serverFullname $releaseNamespace $clusterDomain) $serverFullname "127.0.0.1" "localhost" }}
{{- end }} {{- end }}
{{- $serverCert := genSignedCert $serverFullname nil $serverAltNames 365 $ca }}
{{- $serverSecretName := include "nats.tls.server.secretName" . }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $serverSecretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $serverSecretName "key" "tls.crt" "defaultValue" $serverCert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $serverSecretName "key" "tls.key" "defaultValue" $serverCert.Key "context" $) }}
---
{{- $clientCert := genSignedCert "client" nil nil 365 $ca }}
{{- $clientSecretName := include "nats.tls.client.secretName" . }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $clientSecretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $clientSecretName "key" "tls.crt" "defaultValue" $clientCert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $clientSecretName "key" "tls.key" "defaultValue" $clientCert.Key "context" $) }}
{{- else if and .Values.tls.enabled (not .Values.tls.autoGenerated.enabled) (empty .Values.tls.existingCASecret) (empty .Values.tls.server.existingSecret) (empty .Values.tls.client.existingSecret) -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "nats.tls.ca.secretName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ required "A valid .Values.tls.ca entry required!" .Values.tls.ca | b64enc | quote }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "nats.tls.server.secretName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ required "A valid .Values.tls.server.cert entry required!" .Values.tls.server.cert | b64enc | quote }}
tls.key: {{ required "A valid .Values.tls.server.key entry required!" .Values.tls.server.key | b64enc | quote }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "nats.tls.client.secretName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ required "A valid .Values.tls.client.cert entry required!" .Values.tls.client.cert | b64enc | quote }}
tls.key: {{ required "A valid .Values.tls.client.key entry required!" .Values.tls.client.key | b64enc | quote }}
{{- end }} {{- end }}
bitnami/nats/values.yaml
+133 -146
View File
@@ -32,17 +32,21 @@ global:
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
## ##
adaptSecurityContext: auto adaptSecurityContext: auto
## @section Common parameters ## @section Common parameters
## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) ## @param kubeVersion Override Kubernetes version
## ##
kubeVersion: "" kubeVersion: ""
## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) ## @param nameOverride String to partially override common.names.name
## ##
nameOverride: "" nameOverride: ""
## @param fullnameOverride String to fully override common.names.fullname template ## @param fullnameOverride String to fully override common.names.fullname
## ##
fullnameOverride: "" fullnameOverride: ""
## @param namespaceOverride String to fully override common.names.namespace
##
namespaceOverride: ""
## @param commonLabels Add labels to all the deployed resources ## @param commonLabels Add labels to all the deployed resources
## ##
commonLabels: {} commonLabels: {}
@@ -66,6 +70,7 @@ diagnosticMode:
- sleep - sleep
args: args:
- infinity - infinity
## @section NATS parameters ## @section NATS parameters
## Bitnami NATS image version ## Bitnami NATS image version
@@ -76,12 +81,11 @@ diagnosticMode:
## @param image.digest NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag ## @param image.digest NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
## @param image.pullPolicy NATS image pull policy ## @param image.pullPolicy NATS image pull policy
## @param image.pullSecrets NATS image pull secrets ## @param image.pullSecrets NATS image pull secrets
## @param image.debug Enable NATS image debug mode
## ##
image: image:
registry: docker.io registry: docker.io
repository: bitnami/nats repository: bitnami/nats
tag: 2.10.24-debian-12-r2 tag: 2.10.24-debian-12-r3
digest: "" digest: ""
## Specify a imagePullPolicy ## Specify a imagePullPolicy
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
@@ -94,36 +98,67 @@ image:
## - myRegistryKeySecretName ## - myRegistryKeySecretName
## ##
pullSecrets: [] pullSecrets: []
## Enable debug mode
##
debug: false
## Client Authentication ## Client Authentication
## ref: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro ## ref: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro
## @param auth.enabled Switch to enable/disable client authentication ## @param auth.enabled Switch to enable/disable client authentication
## @param auth.user Client authentication user
## @param auth.password Client authentication password
## @param auth.token Client authentication token ## @param auth.token Client authentication token
## @param auth.credentials [array] Client authentication users credentials collection. Ignored if `auth.token` is set
## @param auth.noAuthUser No authenticated access will be associated with this user. It must be one of the available under `auth.credentials` map array. No authenticated access will be denied if unset.
## @param auth.timeout Client authentication timeout (seconds) ## @param auth.timeout Client authentication timeout (seconds)
## @param auth.usersCredentials Client authentication users credentials collection
## Example:
## auth.usersCredentials:
## - username: "a"
## password: "b"
## @param auth.noAuthUser Client authentication username from auth.usersCredentials map to be used when no credentials provided
##
auth: auth:
enabled: true enabled: true
user: nats_client
password: ""
token: "" token: ""
timeout: 1 credentials:
usersCredentials: [] - user: nats_client
password: ""
noAuthUser: "" noAuthUser: ""
timeout: 1
## @param tls.enabled Enable TLS configuration for NATS
## @param tls.autoGenerated.enabled Enable automatic generation of TLS certificates
## @param tls.autoGenerated.engine Mechanism to generate the certificates (allowed values: helm, cert-manager)
## @param tls.autoGenerated.certManager.existingIssuer The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.existingIssuerKind Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.keyAlgorithm Key algorithm for the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.keySize Key size for the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.duration Duration for the certificates (only for `cert-manager` engine)
## @param tls.autoGenerated.certManager.renewBefore Renewal period for the certificates (only for `cert-manager` engine)
## @param tls.ca CA certificate for TLS. Ignored if `tls.existingCASecret` is set
## @param tls.existingCASecret The name of an existing Secret containing the CA certificate for TLS
## @param tls.server.cert TLS certificate for NATS servers. Ignored if `tls.server.existingSecret` is set
## @param tls.server.key TLS key for NATS servers. Ignored if `tls.server.existingSecret` is set
## @param tls.server.existingSecret The name of an existing Secret containing the TLS certificates for NATS servers
## @param tls.client.cert TLS certificate for NATS clients. Ignored if `tls.client.existingSecret` is set
## @param tls.client.key TLS key for NATS clients. Ignored if `tls.client.existingSecret` is set
## @param tls.client.existingSecret The name of an existing Secret containing the TLS certificates for NATS clients
##
tls:
enabled: false
autoGenerated:
enabled: true
engine: helm
certManager:
existingIssuer: ""
existingIssuerKind: ""
keySize: 2048
keyAlgorithm: RSA
duration: 2160h
renewBefore: 360h
ca: ""
existingCASecret: ""
server:
cert: ""
key: ""
existingSecret: ""
client:
cert: ""
key: ""
existingSecret: ""
## Cluster Configuration ## Cluster Configuration
## ref: https://docs.nats.io/running-a-nats-service/configuration/clustering/cluster_config ## ref: https://docs.nats.io/running-a-nats-service/configuration/clustering/cluster_config
## ##
cluster: cluster:
## @param cluster.name Cluster name ## @param cluster.name Cluster name
##
name: nats name: nats
## @param cluster.connectRetries Configure number of connect retries for implicit routes, otherwise leave blank ## @param cluster.connectRetries Configure number of connect retries for implicit routes, otherwise leave blank
## ##
@@ -180,107 +215,16 @@ writeDeadline: ""
## to specify the proper filename according to the image version. ## to specify the proper filename according to the image version.
## ##
natsFilename: nats-server natsFilename: nats-server
## @param configuration [string] Specify content for NATS configuration file (generated based on other parameters otherwise) ## @param configuration Specify content for NATS configuration file (generated based on other parameters otherwise)
## e.g: ## e.g:
## configuration: |- ## configuration: |-
## listen: 0.0.0.0:6222 ## listen: 0.0.0.0:6222
## http: 0.0.0.0:8222 ## http: 0.0.0.0:8222
## ... ## ...
## ##
configuration: |- configuration: ""
{{- $authPwd := default (include "nats.randomPassword" .) .Values.auth.password -}} ## @param existingSecret Name of an existing secret with your custom configuration for NATS
{{- $clusterAuthPwd := default (include "nats.randomPassword" .) .Values.cluster.auth.password -}} ## NOTE: When it's set the `configuration` parameter is ignored
{{- if eq .Values.resourceType "statefulset" }}
server_name: $NATS_SERVER_NAME
{{- end }}
listen: 0.0.0.0:{{ .Values.containerPorts.client }}
http: 0.0.0.0:{{ .Values.containerPorts.monitoring }}
# Authorization for client connections
{{- if .Values.auth.enabled }}
authorization {
{{- if .Values.auth.user }}
user: {{ .Values.auth.user | quote }}
password: {{ $authPwd | quote }}
{{- else if .Values.auth.token }}
token: {{ .Values.auth.token | quote }}
{{- else if .Values.auth.usersCredentials }}
users: [
{{- range $user := .Values.auth.usersCredentials }}
{ user: {{ $user.username | quote }}, password: {{ $user.password | quote }} },
{{- end }}
],
{{- end }}
timeout: {{ int .Values.auth.timeout }}
}
{{- if .Values.auth.noAuthUser }}
no_auth_user: {{ .Values.auth.noAuthUser | quote }}
{{- end }}
{{- end }}
# Logging options
debug: {{ ternary "true" "false" (or .Values.debug.enabled .Values.diagnosticMode.enabled) }}
trace: {{ ternary "true" "false" (or .Values.debug.trace .Values.diagnosticMode.enabled) }}
logtime: {{ ternary "true" "false" (or .Values.debug.logtime .Values.diagnosticMode.enabled) }}
# Pid file
pid_file: "/opt/bitnami/nats/tmp/{{ .Values.natsFilename }}.pid"
# Some system overrides
{{- if .Values.maxConnections }}
max_connections: {{ int .Values.maxConnections }}
{{- end }}
{{- if .Values.maxControlLine }}
max_control_line: {{ int .Values.maxControlLine }}
{{- end }}
{{- if .Values.maxPayload }}
max_payload: {{ int .Values.maxPayload }}
{{- end }}
{{- if .Values.writeDeadline }}
write_deadline: {{ .Values.writeDeadline | quote }}
{{- end }}
{{- if gt (int .Values.replicaCount) 1 }}
# Clustering definition
cluster {
name: {{ .Values.cluster.name | quote }}
listen: 0.0.0.0:{{ .Values.containerPorts.cluster }}
{{- if .Values.cluster.auth.enabled }}
# Authorization for cluster connections
authorization {
user: {{ .Values.cluster.auth.user | quote }}
password: {{ $clusterAuthPwd | quote }}
timeout: 1
}
{{- end }}
# Routes are actively solicited and connected to from this server.
# Other servers can connect to us if they supply the correct credentials
# in their routes definitions from above
{{- $auth := ternary ( printf "%s:%s@" .Values.cluster.auth.user $clusterAuthPwd) "" .Values.cluster.auth.enabled }}
{{- $domain := (printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" ) }}
{{- $stsPrefix := include "common.names.fullname" . }}
routes = [
{{- range $podIndex := until (.Values.replicaCount|int) }}
nats://{{ $auth }}{{ $stsPrefix }}-{{ $podIndex }}.{{ $domain }}:{{ $.Values.service.ports.cluster }}
{{- end }}
]
{{- if .Values.cluster.connectRetries }}
# Configure number of connect retries for implicit routes
connect_retries: {{ .Values.cluster.connectRetries }}
{{- end }}
}
{{- end }}
{{- if .Values.jetstream.enabled }}
# JetStream configuration
jetstream: enabled
jetstream {
store_dir: /data/jetstream
max_memory_store: {{ .Values.jetstream.maxMemory }}
max_file_store: {{ .Values.persistence.size }}
}
{{- end }}
## @param existingSecret The name of an existing Secret with your custom configuration for NATS
## NOTE: When it's set the configuration parameter is ignored
## ##
existingSecret: "" existingSecret: ""
## @param command Override default container command (useful when using custom images) ## @param command Override default container command (useful when using custom images)
@@ -302,6 +246,7 @@ extraEnvVarsCM: ""
## @param extraEnvVarsSecret Secret with extra environment variables ## @param extraEnvVarsSecret Secret with extra environment variables
## ##
extraEnvVarsSecret: "" extraEnvVarsSecret: ""
## @section NATS deployment/statefulset parameters ## @section NATS deployment/statefulset parameters
## @param resourceType NATS cluster resource type under Kubernetes. Allowed values: `statefulset` (default) or `deployment` ## @param resourceType NATS cluster resource type under Kubernetes. Allowed values: `statefulset` (default) or `deployment`
@@ -321,13 +266,15 @@ schedulerName: ""
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
## ##
priorityClassName: "" priorityClassName: ""
## Strategy to use to update Pods ## @param updateStrategy.type NATS deployment/statefulset update strategy type
## Can be set to RollingUpdate or Recreate (deployment) | RollingUpdate or OnDelete (statefulset)
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
## ##
updateStrategy: updateStrategy:
## @param updateStrategy.type StrategyType. Can be set to RollingUpdate or OnDelete
##
type: RollingUpdate type: RollingUpdate
## @param podManagementPolicy StatefulSet pod management policy ## @param podManagementPolicy StatefulSet pod management policy
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
## ##
podManagementPolicy: OrderedReady podManagementPolicy: OrderedReady
## @param containerPorts.client NATS client container port ## @param containerPorts.client NATS client container port
@@ -558,6 +505,7 @@ serviceAccount:
## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount
## ##
annotations: {} annotations: {}
## @section Traffic Exposure parameters ## @section Traffic Exposure parameters
## NATS service parameters ## NATS service parameters
@@ -781,6 +729,7 @@ networkPolicy:
## ##
ingressNSMatchLabels: {} ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {} ingressNSPodMatchLabels: {}
## @section Metrics parameters ## @section Metrics parameters
## Metrics / Prometheus NATS Exporter ## Metrics / Prometheus NATS Exporter
@@ -790,32 +739,6 @@ metrics:
## @param metrics.enabled Enable Prometheus metrics via exporter side-car ## @param metrics.enabled Enable Prometheus metrics via exporter side-car
## ##
enabled: false enabled: false
## metrics exporter containers' liveness probe.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.livenessProbe.enabled Enable livenessProbe
## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
##
livenessProbe:
enabled: true
initialDelaySeconds: 15
timeoutSeconds: 5
## metrics exporter containers' readiness probe
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.readinessProbe.enabled Enable readinessProbe
## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
##
readinessProbe:
enabled: true
initialDelaySeconds: 5
timeoutSeconds: 1
## @param metrics.customLivenessProbe Override default liveness probe
##
customLivenessProbe: { }
## @param metrics.customReadinessProbe Override default readiness probe
##
customReadinessProbe: { }
## @param metrics.image.registry [default: REGISTRY_NAME] Prometheus metrics exporter image registry ## @param metrics.image.registry [default: REGISTRY_NAME] Prometheus metrics exporter image registry
## @param metrics.image.repository [default: REPOSITORY_NAME/nats-exporter] Prometheus metrics exporter image repository ## @param metrics.image.repository [default: REPOSITORY_NAME/nats-exporter] Prometheus metrics exporter image repository
## @skip metrics.image.tag Prometheus metrics exporter image tag (immutable tags are recommended) ## @skip metrics.image.tag Prometheus metrics exporter image tag (immutable tags are recommended)
@@ -837,6 +760,70 @@ metrics:
## - myRegistryKeySecretName ## - myRegistryKeySecretName
## ##
pullSecrets: [] pullSecrets: []
## metrics exporter containers' liveness probe.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.livenessProbe.enabled Enable livenessProbe
## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe
## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe
## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe
##
livenessProbe:
enabled: true
initialDelaySeconds: 15
timeoutSeconds: 5
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
## metrics exporter containers' readiness probe
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
## @param metrics.readinessProbe.enabled Enable readinessProbe
## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe
## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe
## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe
##
readinessProbe:
enabled: true
initialDelaySeconds: 5
timeoutSeconds: 1
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
## @param metrics.customLivenessProbe Override default liveness probe
##
customLivenessProbe: { }
## @param metrics.customReadinessProbe Override default readiness probe
##
customReadinessProbe: { }
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param metrics.containerSecurityContext.enabled Enabled containers' Security Context
## @param metrics.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param metrics.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param metrics.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param metrics.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param metrics.containerSecurityContext.privileged Set container's Security Context privileged
## @param metrics.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param metrics.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param metrics.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param metrics.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). ## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production).
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
## ##
@@ -925,7 +912,7 @@ metrics:
## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/ ## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
## ##
persistence: persistence:
## @param persistence.enabled Enable NATS data persistence using PVC(s) ## @param persistence.enabled Enable NATS data persistence using PVCs (only for statefulset resourceType)
## ##
enabled: false enabled: false
## @param persistence.storageClass PVC Storage Class for NATS data volume ## @param persistence.storageClass PVC Storage Class for NATS data volume