apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} kind: StatefulSet metadata: name: {{ printf "%s-worker" (include "common.names.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: worker {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} replicas: {{ .Values.worker.replicaCount }} podManagementPolicy: {{ .Values.worker.podManagementPolicy }} {{- if .Values.worker.updateStrategy }} updateStrategy: {{- toYaml .Values.worker.updateStrategy | nindent 4 }} {{- end }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: worker template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} app.kubernetes.io/component: worker {{- if .Values.worker.podLabels }} {{- include "common.tplvalues.render" (dict "value" .Values.worker.podLabels "context" $) | nindent 8 }} {{- end }} {{- if or .Values.worker.podAnnotations .Values.metrics.enabled }} annotations: {{- if .Values.worker.podAnnotations }} {{- include "common.tplvalues.render" (dict "value" .Values.worker.podAnnotations "context" $) | nindent 8 }} {{- end }} {{- if and .Values.metrics.enabled }} {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.workerAnnotations "context" $) | nindent 8 }} {{- end }} {{- end }} spec: {{- include "spark.imagePullSecrets" . | nindent 6 }} serviceAccountName: {{ template "spark.serviceAccountName" . }} {{- if .Values.worker.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.worker.affinity "context" $) | nindent 8 }} {{- else }} affinity: podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.worker.podAffinityPreset "component" "worker" "context" $) | nindent 10 }} podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.worker.podAntiAffinityPreset "component" "worker" "context" $) | nindent 10 }} nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.worker.nodeAffinityPreset.type "key" .Values.worker.nodeAffinityPreset.key "values" .Values.worker.nodeAffinityPreset.values) | nindent 10 }} {{- end }} {{- if .Values.worker.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.worker.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.worker.nodeSelector }} nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.worker.nodeSelector "context" $) | nindent 8 }} {{- end }} {{- if .Values.worker.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.worker.tolerations "context" $) | nindent 8 }} {{- end }} {{- if .Values.worker.priorityClassName }} priorityClassName: {{ .Values.worker.priorityClassName | quote }} {{- end }} {{- if .Values.worker.schedulerName }} schedulerName: {{ .Values.worker.schedulerName | quote }} {{- end }} {{- if .Values.worker.topologySpreadConstraints }} topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.worker.topologySpreadConstraints "context" .) | nindent 8 }} {{- end }} {{- if .Values.worker.podSecurityContext.enabled }} securityContext: {{- omit .Values.worker.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.worker.terminationGracePeriodSeconds }} terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }} {{- end }} {{- if .Values.hostNetwork }} hostNetwork: true dnsPolicy: ClusterFirstWithHostNet {{- end }} {{- if or .Values.worker.initContainers .Values.security.ssl.enabled }} initContainers: {{- if .Values.worker.initContainers }} {{ include "common.tplvalues.render" (dict "value" .Values.worker.initContainers "context" $) | trim | nindent 8 }} {{- end }} {{- if .Values.security.ssl.enabled }} - name: init-certs image: {{ include "spark.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} command: - /bin/bash - -ec - |- {{- if .Values.security.ssl.autoGenerated }} if [[ -f "/certs/tls.key" ]] && [[ -f "/certs/tls.crt" ]] && [[ -f "/certs/ca.crt" ]]; then openssl rsa -aes256 -in /certs/tls.key -out /tmp/tls.key --passout pass:"$SPARK_SSL_KEY_PASSWORD" openssl pkcs12 -export -in "/certs/tls.crt" \ -passout pass:"$SPARK_SSL_KEYSTORE_PASSWORD" \ -inkey "/certs/tls.key" \ -out "/tmp/keystore.p12" keytool -importkeystore -srckeystore "/tmp/keystore.p12" \ -srcstoretype PKCS12 \ -srcstorepass "$SPARK_SSL_KEYSTORE_PASSWORD" \ -deststorepass "$SPARK_SSL_KEYSTORE_PASSWORD" \ -destkeystore "/opt/bitnami/spark/conf/certs/spark-keystore.jks" rm "/tmp/keystore.p12" keytool -import -file "/certs/ca.crt" \ -keystore "/opt/bitnami/spark/conf/certs/spark-truststore.jks" \ -storepass "$SPARK_SSL_TRUSTSTORE_PASSWORD" \ -noprompt else echo "Couldn't find the expected PEM certificates! They are mandatory when encryption via TLS is enabled." exit 1 fi {{- else }} if [[ -f "/certs/spark-truststore.jks" ]] && [[ -f "/certs/spark-keystore.jks" ]]; then cp "/certs/spark-truststore.jks" "/opt/bitnami/spark/conf/certs/spark-truststore.jks" cp "/certs/spark-keystore.jks" "/opt/bitnami/spark/conf/certs/spark-keystore.jks" else echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled." exit 1 fi {{- end }} env: - name: SPARK_SSL_KEY_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_KEYSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_TRUSTSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-truststore-password {{- if .Values.security.ssl.resources }} resources: {{- toYaml .Values.security.ssl.resources | nindent 12 }} {{- end }} volumeMounts: - name: certs mountPath: /certs - name: shared-certs mountPath: /opt/bitnami/spark/conf/certs {{- end }} {{- end }} containers: - name: spark-worker image: {{ include "spark.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} {{- if .Values.worker.containerSecurityContext.enabled }} securityContext: {{- omit .Values.worker.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} {{- if .Values.diagnosticMode.enabled }} command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} {{- else if .Values.worker.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.worker.command "context" $) | nindent 12 }} {{- end }} {{- if .Values.diagnosticMode.enabled }} args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} {{- else if .Values.worker.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.worker.args "context" $) | nindent 12 }} {{- end }} ports: {{- if .Values.security.ssl.enabled }} - name: https containerPort: {{ .Values.worker.containerPorts.https }} protocol: TCP {{- else }} - name: http containerPort: {{ .Values.worker.containerPorts.http }} protocol: TCP {{- end }} {{- if .Values.worker.containerPorts.cluster }} - name: cluster containerPort: {{ .Values.worker.containerPorts.cluster }} {{- end }} {{- if .Values.worker.extraContainerPorts }} {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraContainerPorts "context" $) | nindent 12 }} {{- end }} volumeMounts: {{- if .Values.worker.existingConfigmap }} - name: config mountPath: '/bitnami/spark/conf/' {{- end }} {{- if .Values.security.ssl.enabled }} - name: shared-certs mountPath: '/opt/bitnami/spark/conf/certs' readOnly: true - name: certs mountPath: /certs {{- end }} {{- if .Values.worker.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} {{- if .Values.initScripts }} - name: custom-init-scripts mountPath: /docker-entrypoint-initdb.d/init-scripts {{- end }} {{- if .Values.initScriptsCM }} - name: custom-init-scripts-cm mountPath: /docker-entrypoint-initdb.d/init-scripts-cm {{- end }} {{- if .Values.initScriptsSecret }} - name: custom-init-scripts-secret mountPath: /docker-entrypoint-initdb.d/init-scripts-secret {{- end }} env: - name: SPARK_MODE value: "worker" - name: BITNAMI_DEBUG value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - name: SPARK_DAEMON_MEMORY value: {{ .Values.worker.daemonMemoryLimit | quote }} {{- if .Values.metrics.enabled }} - name: SPARK_METRICS_ENABLED value: "true" {{- end }} ## There are some environment variables whose existence needs ## to be checked because Spark checks if they are null instead of an ## empty string {{- if .Values.worker.memoryLimit }} - name: SPARK_WORKER_MEMORY value: {{ .Values.worker.memoryLimit | quote }} {{- end }} {{- if .Values.worker.coreLimit }} - name: SPARK_WORKER_CORES value: {{ .Values.worker.coreLimit | quote }} {{- end }} {{- if .Values.worker.containerPorts.cluster }} - name: SPARK_WORKER_PORT value: {{ .Values.worker.containerPorts.cluster | quote }} {{- end }} {{- if .Values.worker.containerPorts.http }} - name: SPARK_WORKER_WEBUI_PORT value: {{ .Values.worker.containerPorts.http | quote }} {{- end }} {{- if .Values.worker.dir }} - name: SPARK_WORKER_DIR value: {{ .Values.worker.dir | quote }} {{- end }} - name: SPARK_DAEMON_JAVA_OPTS value: {{ .Values.worker.javaOptions | quote }} - name: SPARK_MASTER_URL value: {{ printf "spark://%s-master-svc:%d" (include "common.names.fullname" .) (int .Values.service.ports.cluster) }} # If you use a custom properties file, it must be loaded using a ConfigMap - name: SPARK_WORKER_OPTS value: {{ .Values.worker.configOptions }} {{- if .Values.security.rpc.authenticationEnabled }} - name: SPARK_RPC_AUTHENTICATION_ENABLED value: {{ .Values.security.rpc.authenticationEnabled | quote }} - name: SPARK_RPC_AUTHENTICATION_SECRET valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: rpc-authentication-secret {{- end }} {{- if .Values.security.rpc.encryptionEnabled }} - name: SPARK_RPC_ENCRYPTION_ENABLED value: {{ .Values.security.rpc.encryptionEnabled | quote }} {{- end }} {{- if .Values.security.storageEncryptionEnabled }} - name: SPARK_LOCAL_STORAGE_ENCRYPTION_ENABLED value: {{ .Values.security.storageEncryptionEnabled | quote }} {{- end }} {{- if .Values.security.ssl.enabled }} - name: SPARK_SSL_ENABLED value: {{ .Values.security.ssl.enabled | quote }} - name: SPARK_SSL_KEY_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_KEYSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_TRUSTSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-truststore-password - name: SPARK_SSL_NEED_CLIENT_AUTH value: {{ .Values.security.ssl.needClientAuth | quote }} - name: SPARK_SSL_PROTOCOL value: {{ .Values.security.ssl.protocol | quote }} - name: SPARK_WEBUI_SSL_PORT value: {{ .Values.worker.containerPorts.https | quote }} {{- end }} {{- if .Values.worker.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVars "context" $) | nindent 12 }} {{- end }} envFrom: {{- if .Values.worker.extraEnvVarsCM }} - configMapRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsCM "context" $) }} {{- end }} {{- if .Values.worker.extraEnvVarsSecret }} - secretRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.worker.extraEnvVarsSecret "context" $) }} {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.worker.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customLivenessProbe "context" $) | nindent 12 }} {{- else if .Values.worker.livenessProbe.enabled }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / port: {{ .Values.worker.containerPorts.http }} {{- end }} {{- if .Values.worker.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customReadinessProbe "context" $) | nindent 12 }} {{- else if .Values.worker.readinessProbe.enabled }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / port: {{ .Values.worker.containerPorts.http }} {{- end }} {{- if .Values.worker.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.worker.customStartupProbe "context" $) | nindent 12 }} {{- else if .Values.worker.startupProbe.enabled }} startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.worker.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / port: {{ .Values.worker.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.worker.lifecycleHooks }} lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.worker.lifecycleHooks "context" $) | nindent 12 }} {{- end }} {{- if .Values.worker.resources }} resources: {{- toYaml .Values.worker.resources | nindent 12 }} {{- end }} {{- if .Values.worker.sidecars }} {{- include "common.tplvalues.render" ( dict "value" .Values.worker.sidecars "context" $) | nindent 8 }} {{- end }} volumes: {{- if .Values.worker.existingConfigmap }} - name: config configMap: name: {{ .Values.worker.existingConfigmap }} {{- end }} {{- if .Values.security.ssl.enabled }} - name: certs secret: secretName: {{ include "spark.tlsSecretName" . }} - name: shared-certs emptyDir: {} {{- end }} {{- if .Values.worker.extraVolumes }} {{- include "common.tplvalues.render" (dict "value" .Values.worker.extraVolumes "context" $) | nindent 8 }} {{- end }} {{- if .Values.initScripts }} - name: custom-init-scripts configMap: name: {{ template "spark.initScripts" . }} {{- end }} {{- if .Values.initScriptsCM }} - name: custom-init-scripts-cm configMap: name: {{ template ".Values.initScriptsCM" . }} {{- end }} {{- if .Values.initScriptsSecret }} - name: custom-init-scripts-secret secret: secretName: {{ template ".Values.initScriptsSecret" . }} defaultMode: 0755 {{- end }}