71 lines
2.2 KiB
YAML
71 lines
2.2 KiB
YAML
{{- if .Values.etcd.deploy }}
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
labels:
|
|
{{- include "etcd.labels" . | nindent 4 }}
|
|
annotations:
|
|
"helm.sh/hook": post-install
|
|
"helm.sh/hook-weight": "-5"
|
|
"helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
|
|
name: "{{ .Release.Name }}-etcd-setup"
|
|
namespace: {{ .Release.Namespace }}
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: "{{ .Release.Name }}"
|
|
spec:
|
|
serviceAccountName: {{ include "etcd.serviceAccountName" . }}
|
|
restartPolicy: Never
|
|
initContainers:
|
|
- name: kubectl
|
|
image: {{ printf "clastix/kubectl:%s" (include "etcd.jobsTagKubeVersion" .) }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |-
|
|
kubectl --namespace={{ .Release.Namespace }} rollout status sts/etcd --timeout=300s
|
|
containers:
|
|
- command:
|
|
- bash
|
|
- -c
|
|
- |-
|
|
etcdctl member list -w table &&
|
|
etcdctl user add --no-password=true root &&
|
|
etcdctl role add root &&
|
|
etcdctl user grant-role root root &&
|
|
etcdctl auth enable
|
|
env:
|
|
- name: ETCDCTL_ENDPOINTS
|
|
value: https://etcd-0.{{ include "etcd.serviceName" . }}.{{ .Release.Namespace }}.svc.cluster.local:2379
|
|
- name: ETCDCTL_CACERT
|
|
value: /opt/certs/ca/ca.crt
|
|
- name: ETCDCTL_CERT
|
|
value: /opt/certs/root-certs/tls.crt
|
|
- name: ETCDCTL_KEY
|
|
value: /opt/certs/root-certs/tls.key
|
|
image: quay.io/coreos/etcd:v3.5.1
|
|
imagePullPolicy: Always
|
|
name: etcd-client
|
|
volumeMounts:
|
|
- name: root-certs
|
|
mountPath: /opt/certs/root-certs
|
|
- name: certs
|
|
mountPath: /opt/certs/ca
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
volumes:
|
|
- name: root-certs
|
|
secret:
|
|
secretName: {{ include "etcd.clientSecretName" . }}
|
|
- name: certs
|
|
secret:
|
|
secretName: {{ include "etcd.caSecretName" . }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|