From 494405ff3482eb49d7d306699555d91113550801 Mon Sep 17 00:00:00 2001 From: tompizmor Date: Mon, 22 Jul 2019 13:50:05 +0200 Subject: [PATCH] Change kafka --- bitnami/kafka/Chart.yaml | 2 +- bitnami/kafka/README.md | 245 ++++++++++++----------- bitnami/kafka/templates/_helpers.tpl | 33 ++- bitnami/kafka/templates/statefulset.yaml | 13 ++ bitnami/kafka/values-production.yaml | 18 ++ bitnami/kafka/values.yaml | 18 ++ 6 files changed, 211 insertions(+), 118 deletions(-) diff --git a/bitnami/kafka/Chart.yaml b/bitnami/kafka/Chart.yaml index 46fb99a332..4119cf57e5 100644 --- a/bitnami/kafka/Chart.yaml +++ b/bitnami/kafka/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: kafka -version: 4.0.2 +version: 4.1.0 appVersion: 2.3.0 description: Apache Kafka is a distributed streaming platform. keywords: diff --git a/bitnami/kafka/README.md b/bitnami/kafka/README.md index 93009b6d33..032b5b1f2b 100644 --- a/bitnami/kafka/README.md +++ b/bitnami/kafka/README.md @@ -45,121 +45,127 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Kafka chart and their default values. -| Parameter | Description | Default | -| --------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Kafka image registry | `docker.io` | -| `image.repository` | Kafka Image name | `bitnami/kafka` | -| `image.tag` | Kafka Image tag | `{VERSION}` | -| `image.pullPolicy` | Kafka image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug values should be set | `false` | -| `nameOverride` | String to partially override kafka.fullname template with a string (will append the release name) | `nil` | -| `fullnameOverride` | String to fully override kafka.fullname template with a string | `nil` | -| `updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | -| `rollingUpdatePartition` | Partition update strategy | `nil` | -| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | -| `replicaCount` | Number of Kafka nodes | `1` | -| `config` | Configuration file for Kafka | `nil` | -| `allowPlaintextListener` | Allow to use the PLAINTEXT listener | `true` | -| `listeners` | The address the socket server listens on. | `nil` | -| `advertisedListeners` | Hostname and port the broker will advertise to producers and consumers. | `nil` | -| `listenerSecurityProtocolMap` | The protocol->listener mapping. | `nil` | -| `interBrokerListenerName` | The listener that the brokers should communicate on. | `nil` | -| `brokerId` | ID of the Kafka node | `-1` | -| `deleteTopicEnable` | Switch to enable topic deletion or not. | `false` | -| `heapOpts` | Kafka's Java Heap size. | `-Xmx1024m -Xms1024m` | -| `logFlushIntervalMessages` | The number of messages to accept before forcing a flush of data to disk. | `10000` | -| `logFlushIntervalMs` | The maximum amount of time a message can sit in a log before we force a flush. | `1000` | -| `logRetentionBytes` | A size-based retention policy for logs. | `_1073741824` | -| `logRetentionCheckIntervalMs` | The interval at which log segments are checked to see if they can be deleted. | `300000` | -| `logRetentionHours` | The minimum age of a log file to be eligible for deletion due to age. | `168` | -| `logSegmentBytes` | The maximum size of a log segment file. When this size is reached a new log segment will be created. | `_1073741824` | -| `logMessageFormatVersion` | Logging message format version. | `` | -| `logsDirs` | A comma separated list of directories under which to store log files. | `/opt/bitnami/kafka/data` | -| `maxMessageBytes` | The largest record batch size allowed by Kafka. | `1000012` | -| `defaultReplicationFactor` | Default replication factors for automatically created topics | `1` | -| `offsetsTopicReplicationFactor` | The replication factor for the offsets topic | `1` | -| `transactionStateLogReplicationFactor ` | The replication factor for the transaction topic | `1` | -| `transactionStateLogMinIsr ` | Overridden min.insync.replicas config for the transaction topic | `1` | -| `numIoThreads` | The number of threads doing disk I/O. | `8` | -| `numNetworkThreads` | The number of threads handling network requests. | `3` | -| `numPartitions` | The default number of log partitions per topic. | `1` | -| `numRecoveryThreadsPerDataDir` | The number of threads per data directory to be used for log recovery at startup and flushing at shutdown. | `1` | -| `socketReceiveBufferBytes` | The receive buffer (SO_RCVBUF) used by the socket server. | `102400` | -| `socketRequestMaxBytes` | The maximum size of a request that the socket server will accept (protection against OOM). | `_104857600` | -| `socketSendBufferBytes` | The send buffer (SO_SNDBUF) used by the socket server. | `102400` | -| `zookeeperConnectionTimeoutMs` | Timeout in ms for connecting to Zookeeper. | `6000` | -| `extraEnvVars` | Extra environment variables to add to kafka pods | `nil` | -| `sslEndpointIdentificationAlgorithm` | The endpoint identification algorithm to validate server hostname using server certificate. | `https` | -| `auth.enabled` | Switch to enable the kafka authentication. | `false` | -| `auth.existingSecret` | Name of the existing secret containing credentials for brokerUser, interBrokerUser and zookeeperUser. | `nil` | -| `auth.certificatesSecret` | Name of the existing secret containing the certificate files that will be used by Kafka. | `nil` | -| `auth.certificatesPassword` | Password for the above certificates if they are password protected. | `nil` | -| `auth.brokerUser` | Kafka client user. | `user` | -| `auth.brokerPassword` | Kafka client password. | `nil` | -| `auth.interBrokerUser` | Kafka inter broker communication user | `admin` | -| `auth.interBrokerPassword` | Kafka inter broker communication password. | `nil` | -| `auth.zookeeperUser` | Kafka Zookeeper user. | `nil` | -| `auth.zookeeperPassword` | Kafka Zookeeper password. | `nil` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.port` | Kafka port | `9092` | -| `service.nodePort` | Kubernetes Service nodePort | `nil` | -| `service.loadBalancerIP` | loadBalancerIP for Kafka Service | `nil` | -| `service.annotations` | Service annotations | `` | -| `persistence.enabled` | Enable Kafka persistence using PVC, note that Zookeeper perisstency is unaffected | `true` | -| `persistence.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | -| `persistence.storageClass` | PVC Storage Class for Kafka volume | `nil` | -| `persistence.accessMode` | PVC Access Mode for Kafka volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Kafka volume | `8Gi` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `affinity` | Map of node/pod affinities | `{}` | -| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | -| `livenessProbe.enabled` | would you like a livessProbed to be enabled | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | -| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | -| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | -| `readinessProbe.enabled` | would you like a readinessProbe to be enabled | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 5 | -| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | -| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | -| `metrics.kafka.enabled` | Whether or not to create a separate Kafka exporter | `false` | -| `metrics.kafka.image.registry` | Kafka exporter image registry | `docker.io` | -| `metrics.kafka.image.repository` | Kafka exporter image name | `danielqsj/kafka-exporter` | -| `metrics.kafka.image.tag` | Kafka exporter image tag | `v1.0.1` | -| `metrics.kafka.image.pullPolicy` | Kafka exporter image pull policy | `IfNotPresent` | -| `metrics.kafka.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.kafka.interval` | Interval that Prometheus scrapes Kafka metrics when using Prometheus Operator | `10s` | -| `metrics.kafka.port` | Kafka Exporter Port which exposes metrics in Prometheus format for scraping | `9308` | -| `metrics.kafka.resources` | Allows setting resource limits for kafka-exporter pod | `{}` | -| `metrics.jmx.resources` | Allows setting resource limits for jmx sidecar container | `{}` | -| `metrics.jmx.enabled` | Whether or not to expose JMX metrics to Prometheus | `false` | -| `metrics.jmx.image.registry` | JMX exporter image registry | `docker.io` | -| `metrics.jmx.image.repository` | JMX exporter image name | `solsson/kafka-prometheus-jmx-exporter@sha256` | -| `metrics.jmx.image.tag` | JMX exporter image tag | `a23062396cd5af1acdf76512632c20ea6be76885dfc20cd9ff40fb23846557e8` | -| `metrics.jmx.image.pullPolicy` | JMX exporter image pull policy | `IfNotPresent` | -| `metrics.jmx.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.jmx.interval` | Interval that Prometheus scrapes JMX metrics when using Prometheus Operator | `10s` | -| `metrics.jmx.exporterPort` | JMX Exporter Port which exposes metrics in Prometheus format for scraping | `5556` | -| `metrics.jmx.configMap.enabled` | Enable the default ConfigMap for JMX | `true` | -| `metrics.jmx.configMap.overrideConfig` | Allows config file to be generated by passing values to ConfigMap | `{}` | -| `metrics.jmx.configMap.overrideName` | Allows setting the name of the ConfigMap to be used | `""` | -| `metrics.jmx.jmxPort` | The jmx port which JMX style metrics are exposed (note: these are not scrapeable by Prometheus) | `5555` | -| `metrics.jmx.whitelistObjectNames` | Allows setting which JMX objects you want to expose to via JMX stats to JMX Exporter | (see `values.yaml`) | -| `zookeeper.enabled` | Switch to enable or disable the Zookeeper helm chart | `true` | -| `zookeeper.persistence.enabled` | Enable Zookeeper persistence using PVC | `true` | -| `externalZookeeper.servers` | Server or list of external Zookeeper servers to use. | `nil` | +| Parameter | Description | Default | +| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Kafka image registry | `docker.io` | +| `image.repository` | Kafka Image name | `bitnami/kafka` | +| `image.tag` | Kafka Image tag | `{VERSION}` | +| `image.pullPolicy` | Kafka image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override kafka.fullname template with a string (will append the release name) | `nil` | +| `fullnameOverride` | String to fully override kafka.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | +| `rollingUpdatePartition` | Partition update strategy | `nil` | +| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | +| `replicaCount` | Number of Kafka nodes | `1` | +| `config` | Configuration file for Kafka | `nil` | +| `allowPlaintextListener` | Allow to use the PLAINTEXT listener | `true` | +| `listeners` | The address the socket server listens on. | `nil` | +| `advertisedListeners` | Hostname and port the broker will advertise to producers and consumers. | `nil` | +| `listenerSecurityProtocolMap` | The protocol->listener mapping. | `nil` | +| `interBrokerListenerName` | The listener that the brokers should communicate on. | `nil` | +| `brokerId` | ID of the Kafka node | `-1` | +| `deleteTopicEnable` | Switch to enable topic deletion or not. | `false` | +| `heapOpts` | Kafka's Java Heap size. | `-Xmx1024m -Xms1024m` | +| `logFlushIntervalMessages` | The number of messages to accept before forcing a flush of data to disk. | `10000` | +| `logFlushIntervalMs` | The maximum amount of time a message can sit in a log before we force a flush. | `1000` | +| `logRetentionBytes` | A size-based retention policy for logs. | `_1073741824` | +| `logRetentionCheckIntervalMs` | The interval at which log segments are checked to see if they can be deleted. | `300000` | +| `logRetentionHours` | The minimum age of a log file to be eligible for deletion due to age. | `168` | +| `logSegmentBytes` | The maximum size of a log segment file. When this size is reached a new log segment will be created. | `_1073741824` | +| `logMessageFormatVersion` | Logging message format version. | `` | +| `logsDirs` | A comma separated list of directories under which to store log files. | `/opt/bitnami/kafka/data` | +| `maxMessageBytes` | The largest record batch size allowed by Kafka. | `1000012` | +| `defaultReplicationFactor` | Default replication factors for automatically created topics | `1` | +| `offsetsTopicReplicationFactor` | The replication factor for the offsets topic | `1` | +| `transactionStateLogReplicationFactor ` | The replication factor for the transaction topic | `1` | +| `transactionStateLogMinIsr ` | Overridden min.insync.replicas config for the transaction topic | `1` | +| `numIoThreads` | The number of threads doing disk I/O. | `8` | +| `numNetworkThreads` | The number of threads handling network requests. | `3` | +| `numPartitions` | The default number of log partitions per topic. | `1` | +| `numRecoveryThreadsPerDataDir` | The number of threads per data directory to be used for log recovery at startup and flushing at shutdown. | `1` | +| `socketReceiveBufferBytes` | The receive buffer (SO_RCVBUF) used by the socket server. | `102400` | +| `socketRequestMaxBytes` | The maximum size of a request that the socket server will accept (protection against OOM). | `_104857600` | +| `socketSendBufferBytes` | The send buffer (SO_SNDBUF) used by the socket server. | `102400` | +| `zookeeperConnectionTimeoutMs` | Timeout in ms for connecting to Zookeeper. | `6000` | +| `extraEnvVars` | Extra environment variables to add to kafka pods | `nil` | +| `sslEndpointIdentificationAlgorithm` | The endpoint identification algorithm to validate server hostname using server certificate. | `https` | +| `auth.enabled` | Switch to enable the kafka authentication. | `false` | +| `auth.existingSecret` | Name of the existing secret containing credentials for brokerUser, interBrokerUser and zookeeperUser. | `nil` | +| `auth.certificatesSecret` | Name of the existing secret containing the certificate files that will be used by Kafka. | `nil` | +| `auth.certificatesPassword` | Password for the above certificates if they are password protected. | `nil` | +| `auth.brokerUser` | Kafka client user. | `user` | +| `auth.brokerPassword` | Kafka client password. | `nil` | +| `auth.interBrokerUser` | Kafka inter broker communication user | `admin` | +| `auth.interBrokerPassword` | Kafka inter broker communication password. | `nil` | +| `auth.zookeeperUser` | Kafka Zookeeper user. | `nil` | +| `auth.zookeeperPassword` | Kafka Zookeeper password. | `nil` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.port` | Kafka port | `9092` | +| `service.nodePort` | Kubernetes Service nodePort | `nil` | +| `service.loadBalancerIP` | loadBalancerIP for Kafka Service | `nil` | +| `service.annotations` | Service annotations | `` | +| `persistence.enabled` | Enable Kafka persistence using PVC, note that Zookeeper perisstency is unaffected | `true` | +| `persistence.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | +| `persistence.storageClass` | PVC Storage Class for Kafka volume | `nil` | +| `persistence.accessMode` | PVC Access Mode for Kafka volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for Kafka volume | `8Gi` | +| `persistence.annotations` | Annotations for the PVC | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `affinity` | Map of node/pod affinities | `{}` | +| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | +| `livenessProbe.enabled` | would you like a livessProbed to be enabled | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | +| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | +| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | +| `readinessProbe.enabled` | would you like a readinessProbe to be enabled | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 5 | +| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | +| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | +| `metrics.kafka.enabled` | Whether or not to create a separate Kafka exporter | `false` | +| `metrics.kafka.image.registry` | Kafka exporter image registry | `docker.io` | +| `metrics.kafka.image.repository` | Kafka exporter image name | `danielqsj/kafka-exporter` | +| `metrics.kafka.image.tag` | Kafka exporter image tag | `v1.0.1` | +| `metrics.kafka.image.pullPolicy` | Kafka exporter image pull policy | `IfNotPresent` | +| `metrics.kafka.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.kafka.interval` | Interval that Prometheus scrapes Kafka metrics when using Prometheus Operator | `10s` | +| `metrics.kafka.port` | Kafka Exporter Port which exposes metrics in Prometheus format for scraping | `9308` | +| `metrics.kafka.resources` | Allows setting resource limits for kafka-exporter pod | `{}` | +| `metrics.jmx.resources` | Allows setting resource limits for jmx sidecar container | `{}` | +| `metrics.jmx.enabled` | Whether or not to expose JMX metrics to Prometheus | `false` | +| `metrics.jmx.image.registry` | JMX exporter image registry | `docker.io` | +| `metrics.jmx.image.repository` | JMX exporter image name | `solsson/kafka-prometheus-jmx-exporter@sha256` | +| `metrics.jmx.image.tag` | JMX exporter image tag | `a23062396cd5af1acdf76512632c20ea6be76885dfc20cd9ff40fb23846557e8` | +| `metrics.jmx.image.pullPolicy` | JMX exporter image pull policy | `IfNotPresent` | +| `metrics.jmx.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.jmx.interval` | Interval that Prometheus scrapes JMX metrics when using Prometheus Operator | `10s` | +| `metrics.jmx.exporterPort` | JMX Exporter Port which exposes metrics in Prometheus format for scraping | `5556` | +| `metrics.jmx.configMap.enabled` | Enable the default ConfigMap for JMX | `true` | +| `metrics.jmx.configMap.overrideConfig` | Allows config file to be generated by passing values to ConfigMap | `{}` | +| `metrics.jmx.configMap.overrideName` | Allows setting the name of the ConfigMap to be used | `""` | +| `metrics.jmx.jmxPort` | The jmx port which JMX style metrics are exposed (note: these are not scrapeable by Prometheus) | `5555` | +| `metrics.jmx.whitelistObjectNames` | Allows setting which JMX objects you want to expose to via JMX stats to JMX Exporter | (see `values.yaml`) | +| `zookeeper.enabled` | Switch to enable or disable the Zookeeper helm chart | `true` | +| `zookeeper.persistence.enabled` | Enable Zookeeper persistence using PVC | `true` | +| `externalZookeeper.servers` | Server or list of external Zookeeper servers to use. | `nil` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -301,6 +307,15 @@ The [Bitnami Kafka](https://github.com/bitnami/bitnami-docker-kafka) image store Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading ### To 2.0.0 diff --git a/bitnami/kafka/templates/_helpers.tpl b/bitnami/kafka/templates/_helpers.tpl index 667f05051f..767dac05a4 100644 --- a/bitnami/kafka/templates/_helpers.tpl +++ b/bitnami/kafka/templates/_helpers.tpl @@ -128,7 +128,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -139,8 +139,11 @@ imagePullSecrets: {{- range .Values.metrics.jmx.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -151,5 +154,31 @@ imagePullSecrets: {{- range .Values.metrics.jmx.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "kafka.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/kafka/templates/statefulset.yaml b/bitnami/kafka/templates/statefulset.yaml index b17d620d6a..b3cd81d5d5 100644 --- a/bitnami/kafka/templates/statefulset.yaml +++ b/bitnami/kafka/templates/statefulset.yaml @@ -58,6 +58,19 @@ spec: affinity: {{ toYaml .Values.affinity | indent 8 }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "kafka.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/kafka"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 -}} + volumeMounts: + - name: data + mountPath: "/bitnami/kafka" + {{- end }} containers: - name: kafka image: "{{ template "kafka.image" . }}" diff --git a/bitnami/kafka/values-production.yaml b/bitnami/kafka/values-production.yaml index e3e270cefa..9615ea7f69 100644 --- a/bitnami/kafka/values-production.yaml +++ b/bitnami/kafka/values-production.yaml @@ -37,6 +37,24 @@ image: ## String to fully override kafka.fullname template # fullnameOverride: +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## diff --git a/bitnami/kafka/values.yaml b/bitnami/kafka/values.yaml index 560700006f..ac5d348a36 100644 --- a/bitnami/kafka/values.yaml +++ b/bitnami/kafka/values.yaml @@ -37,6 +37,24 @@ image: ## String to fully override kafka.fullname template # fullnameOverride: +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ##