@@ -5,6 +5,114 @@ local inv = kap.inventory();
55// The hiera parameters for the component
66local params = inv.parameters.cockroach_operator;
77
8+ local database(name) = [
9+ // namespace
10+ kube.Namespace(params.databases[name].namespace),
11+ // database
12+ kube._Object('crdb.cockroachlabs.com/v1alpha1' , 'CrdbCluster' , name + '-database' ) {
13+ assert params.databases[name].nodes >= 3 : 'Parameter nodes should be >= 3.' ,
14+ metadata+: {
15+ labels+: {
16+ 'app.kubernetes.io/component' : 'database' ,
17+ 'app.kubernetes.io/managed-by' : 'commodore' ,
18+ 'app.kubernetes.io/name' : name + '-database' ,
19+ },
20+ namespace: params.databases[name].namespace,
21+ },
22+ spec+: {
23+ nodes: params.databases[name].nodes,
24+ image: {
25+ name: '%(registry)s/%(repository)s:%(tag)s' % params.images.cockroach,
26+ pullPolicy: 'IfNotPresent' ,
27+ },
28+ tlsEnabled: true ,
29+ dataStore: {
30+ pvc: {
31+ spec: {
32+ accessModes: [ params.databases[name].storage.accessMode ],
33+ storageClassName: params.databases[name].storage.storageClass,
34+ resources: {
35+ requests: { storage: params.databases[name].storage.size },
36+ },
37+ volumeMode: 'Filesystem' ,
38+ },
39+ },
40+ },
41+ affinity: {
42+ podAntiAffinity: {
43+ requiredDuringSchedulingIgnoredDuringExecution: [
44+ {
45+ labelSelector: {
46+ matchExpressions: [
47+ {
48+ key: 'app.kubernetes.io/name' ,
49+ operator: 'In' ,
50+ values: [ name + '-database' ],
51+ },
52+ ],
53+ },
54+ topologyKey: 'kubernetes.io/hostname' ,
55+ },
56+ ],
57+ },
58+ },
59+ },
60+ },
61+ // client
62+ kube.Deployment(name + '-database-client' ) {
63+ metadata+: {
64+ labels+: {
65+ 'app.kubernetes.io/component' : 'client' ,
66+ 'app.kubernetes.io/managed-by' : 'commodore' ,
67+ 'app.kubernetes.io/name' : name + '-database-client' ,
68+ },
69+ namespace: params.databases[name].namespace,
70+ },
71+ spec+: {
72+ replicas: 1 ,
73+ template+: {
74+ spec+: {
75+ serviceAccountName: 'default' ,
76+ securityContext: {
77+ seccompProfile: { type: 'RuntimeDefault' },
78+ },
79+ containers_:: {
80+ default: kube.Container('client' ) {
81+ image: '%(registry)s/%(repository)s:%(tag)s' % params.images.cockroach,
82+ env_:: {
83+ COCKROACH_CERTS_DIR: '/cockroach/certs-dir' ,
84+ COCKROACH_HOST: name + '-database-public' ,
85+ },
86+ command: [ 'sleep' , 'infinity' ],
87+ securityContext: {
88+ allowPrivilegeEscalation: false ,
89+ capabilities: { drop: [ 'ALL' ] },
90+ },
91+ volumeMounts_:: {
92+ certs: { mountPath: '/cockroach/certs-dir' },
93+ },
94+ },
95+ },
96+ volumes_:: {
97+ certs: {
98+ secret: {
99+ secretName: name + '-database-root' ,
100+ items: [
101+ { key: 'ca.crt' , path: 'ca.crt' },
102+ { key: 'tls.crt' , path: 'client.root.crt' },
103+ { key: 'tls.key' , path: 'client.root.key' },
104+ ],
105+ },
106+ },
107+ },
108+ },
109+ },
110+ },
111+ },
112+ ];
113+
8114// Define outputs below
9115{
116+ ['20_db_' + name]: database(name)
117+ for name in std.objectFields (params.databases)
10118}
0 commit comments