apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} kind: StatefulSet metadata: name: {{ printf "%s-master" (include "common.names.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: master {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} replicas: 1 {{- if .Values.master.updateStrategy }} updateStrategy: {{- toYaml .Values.master.updateStrategy | nindent 4 }} {{- end }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: master template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} app.kubernetes.io/component: master {{- if .Values.master.podLabels }} {{- include "common.tplvalues.render" (dict "value" .Values.master.podLabels "context" $) | nindent 8 }} {{- end }} {{- if or .Values.master.podAnnotations .Values.metrics.enabled }} annotations: {{- if .Values.master.podAnnotations }} {{- include "common.tplvalues.render" (dict "value" .Values.master.podAnnotations "context" $) | nindent 8 }} {{- end }} {{- if and .Values.metrics.enabled }} {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.masterAnnotations "context" $) | nindent 8 }} {{- end }} {{- end }} spec: {{- include "spark.imagePullSecrets" . | nindent 6 }} serviceAccountName: {{ template "spark.serviceAccountName" . }} {{- if .Values.master.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.master.affinity "context" $) | nindent 8 }} {{- else }} affinity: podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAffinityPreset "component" "master" "context" $) | nindent 10 }} podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAntiAffinityPreset "component" "master" "context" $) | nindent 10 }} nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.master.nodeAffinityPreset.type "key" .Values.master.nodeAffinityPreset.key "values" .Values.master.nodeAffinityPreset.values) | nindent 10 }} {{- end }} {{- if .Values.master.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }} {{- end }} {{- if .Values.master.nodeSelector }} nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.master.nodeSelector "context" $) | nindent 8 }} {{- end }} {{- if .Values.master.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.master.tolerations "context" $) | nindent 8 }} {{- end }} {{- if .Values.master.priorityClassName }} priorityClassName: {{ .Values.master.priorityClassName | quote }} {{- end }} {{- if .Values.master.schedulerName }} schedulerName: {{ .Values.master.schedulerName | quote }} {{- end }} {{- if .Values.master.topologySpreadConstraints }} topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.master.topologySpreadConstraints "context" .) | nindent 8 }} {{- end }} {{- if .Values.master.podSecurityContext.enabled }} securityContext: {{- omit .Values.master.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if .Values.master.terminationGracePeriodSeconds }} terminationGracePeriodSeconds: {{ .Values.master.terminationGracePeriodSeconds }} {{- end }} {{- if .Values.hostNetwork }} hostNetwork: true dnsPolicy: ClusterFirstWithHostNet {{- end }} {{- if or .Values.master.initContainers .Values.security.ssl.enabled }} initContainers: {{- if .Values.master.initContainers }} {{ include "common.tplvalues.render" (dict "value" .Values.master.initContainers "context" $) | trim | nindent 8 }} {{- end }} {{- if .Values.security.ssl.enabled }} - name: init-certs image: {{ include "spark.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} command: - /bin/bash - -ec - |- {{- if .Values.security.ssl.autoGenerated }} if [[ -f "/certs/tls.key" ]] && [[ -f "/certs/tls.crt" ]] && [[ -f "/certs/ca.crt" ]]; then openssl pkcs12 -export -in "/certs/tls.crt" \ -passout pass:"${SPARK_SSL_KEYSTORE_PASSWORD}" \ -inkey "/certs/tls.key" \ -out "/tmp/keystore.p12" keytool -importkeystore -srckeystore "/tmp/keystore.p12" \ -srcstoretype PKCS12 \ -srcstorepass "${SPARK_SSL_KEYSTORE_PASSWORD}" \ -deststorepass "${SPARK_SSL_KEYSTORE_PASSWORD}" \ -destkeystore "/opt/bitnami/spark/conf/certs/spark-keystore.jks" rm "/tmp/keystore.p12" keytool -import -file "/certs/ca.crt" \ -keystore "/opt/bitnami/spark/conf/certs/spark-truststore.jks" \ -storepass "${SPARK_SSL_TRUSTSTORE_PASSWORD}" \ -noprompt else echo "Couldn't find the expected PEM certificates! They are mandatory when encryption via TLS is enabled." exit 1 fi {{- else }} if [[ -f "/certs/spark-truststore.jks" ]] && [[ -f "/certs/spark-keystore.jks" ]]; then cp "/certs/spark-truststore.jks" "/opt/bitnami/spark/conf/certs/spark-truststore.jks" cp "/certs/spark-keystore.jks" "/opt/bitnami/spark/conf/certs/spark-keystore.jks" else echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled." exit 1 fi {{- end }} env: - name: SPARK_SSL_KEY_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_KEYSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_TRUSTSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-truststore-password {{- if .Values.security.ssl.resources }} resources: {{- toYaml .Values.security.ssl.resources | nindent 12 }} {{- end }} volumeMounts: - name: certs mountPath: /certs - name: shared-certs mountPath: /opt/bitnami/spark/conf/certs {{- end }} {{- end }} containers: - name: spark-master image: {{ include "spark.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} {{- if .Values.master.containerSecurityContext.enabled }} securityContext: {{- omit .Values.master.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} {{- if .Values.diagnosticMode.enabled }} command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} {{- else if .Values.master.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.master.command "context" $) | nindent 12 }} {{- end }} {{- if .Values.diagnosticMode.enabled }} args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} {{- else if .Values.master.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.master.args "context" $) | nindent 12 }} {{- end }} ports: {{- if .Values.security.ssl.enabled }} - name: https containerPort: {{ .Values.master.containerPorts.https }} protocol: TCP {{- else }} - name: http containerPort: {{ .Values.master.containerPorts.http }} protocol: TCP {{- end }} - name: cluster containerPort: {{ .Values.master.containerPorts.cluster }} {{- if .Values.master.extraContainerPorts }} {{- include "common.tplvalues.render" (dict "value" .Values.master.extraContainerPorts "context" $) | nindent 12 }} {{- end }} volumeMounts: {{- if .Values.master.existingConfigmap }} - name: config mountPath: /bitnami/spark/conf/ {{- end }} {{- if .Values.security.ssl.enabled }} - name: shared-certs mountPath: /opt/bitnami/spark/conf/certs readOnly: true {{- end }} {{- if .Values.master.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} {{- if .Values.initScripts }} - name: custom-init-scripts mountPath: /docker-entrypoint-initdb.d/init-scripts {{- end }} {{- if .Values.initScriptsCM }} - name: custom-init-scripts-cm mountPath: /docker-entrypoint-initdb.d/init-scripts-cm {{- end }} {{- if .Values.initScriptsSecret }} - name: custom-init-scripts-secret mountPath: /docker-entrypoint-initdb.d/init-scripts-secret {{- end }} env: - name: BITNAMI_DEBUG value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - name: SPARK_MODE value: "master" {{- if .Values.metrics.enabled }} - name: SPARK_METRICS_ENABLED value: "true" {{- end }} - name: SPARK_DAEMON_MEMORY value: {{ .Values.master.daemonMemoryLimit | quote }} {{- if .Values.master.containerPorts.cluster }} - name: SPARK_MASTER_PORT value: {{ .Values.master.containerPorts.cluster | quote }} {{- end }} {{- if .Values.master.containerPorts.http }} - name: SPARK_MASTER_WEBUI_PORT value: {{ .Values.master.containerPorts.http | quote }} {{- end }} {{- if .Values.master.configOptions }} - name: SPARK_MASTER_OPTS value: {{ .Values.master.configOptions | quote }} {{- end }} {{- if .Values.security.rpc.authenticationEnabled }} - name: SPARK_RPC_AUTHENTICATION_ENABLED value: {{ .Values.security.rpc.authenticationEnabled | quote }} - name: SPARK_RPC_AUTHENTICATION_SECRET valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: rpc-authentication-secret {{- end }} {{- if .Values.security.rpc.encryptionEnabled }} - name: SPARK_RPC_ENCRYPTION_ENABLED value: {{ .Values.security.rpc.encryptionEnabled | quote }} {{- end }} {{- if .Values.security.storageEncryptionEnabled }} - name: SPARK_LOCAL_STORAGE_ENCRYPTION_ENABLED value: {{ .Values.security.storageEncryptionEnabled | quote }} {{- end }} {{- if .Values.security.ssl.enabled }} - name: SPARK_SSL_ENABLED value: {{ .Values.security.ssl.enabled | quote }} - name: SPARK_SSL_KEY_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_KEYSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-keystore-password - name: SPARK_SSL_TRUSTSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ include "spark.passwordsSecretName" . }} key: ssl-truststore-password - name: SPARK_SSL_NEED_CLIENT_AUTH value: {{ .Values.security.ssl.needClientAuth | quote }} - name: SPARK_SSL_PROTOCOL value: {{ .Values.security.ssl.protocol | quote }} - name: SPARK_WEBUI_SSL_PORT value: {{ .Values.master.containerPorts.https | quote }} {{- end }} {{- if .Values.master.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVars "context" $) | nindent 12 }} {{- end }} envFrom: {{- if .Values.master.extraEnvVarsCM }} - configMapRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVarsCM "context" $) }} {{- end }} {{- if .Values.master.extraEnvVarsSecret }} - secretRef: name: {{ include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVarsSecret "context" $) }} {{- end }} {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.master.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customLivenessProbe "context" $) | nindent 12 }} {{- else if .Values.master.livenessProbe.enabled }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / port: {{ .Values.master.containerPorts.http }} {{- end }} {{- if .Values.master.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customReadinessProbe "context" $) | nindent 12 }} {{- else if .Values.master.readinessProbe.enabled }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / port: {{ .Values.master.containerPorts.http }} {{- end }} {{- if .Values.master.customStartupProbe }} startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customStartupProbe "context" $) | nindent 12 }} {{- else if .Values.master.startupProbe.enabled }} startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.startupProbe "enabled") "context" $) | nindent 12 }} httpGet: path: / port: {{ .Values.master.containerPorts.http }} {{- end }} {{- end }} {{- if .Values.master.lifecycleHooks }} lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.master.lifecycleHooks "context" $) | nindent 12 }} {{- end }} {{- if .Values.master.resources }} resources: {{- toYaml .Values.master.resources | nindent 12 }} {{- end }} {{- if .Values.master.sidecars }} {{- include "common.tplvalues.render" ( dict "value" .Values.master.sidecars "context" $) | nindent 8 }} {{- end }} volumes: {{- if .Values.master.existingConfigmap }} - name: config configMap: name: {{ .Values.master.existingConfigmap }} {{- end }} {{- if .Values.security.ssl.enabled }} - name: certs secret: secretName: {{ include "spark.tlsSecretName" . }} - name: shared-certs emptyDir: {} {{- end }} {{- if .Values.master.extraVolumes }} {{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumes "context" $) | nindent 8 }} {{- end }} {{- if .Values.initScripts }} - name: custom-init-scripts configMap: name: {{ template "spark.initScripts" . }} {{- end }} {{- if .Values.initScriptsCM }} - name: custom-init-scripts-cm configMap: name: {{ template ".Values.initScriptsCM" . }} {{- end }} {{- if .Values.initScriptsSecret }} - name: custom-init-scripts-secret secret: secretName: {{ template ".Values.initScriptsSecret" . }} defaultMode: 0755 {{- end }}