Skip to content

Commit ac689a9

Browse files
jacobecoxjacobecox
committed
working version
1 parent 81f0d4f commit ac689a9

10 files changed

Lines changed: 81 additions & 67 deletions

‎redpanda/versions/1.0.0/templates/domain.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,31 @@ spec:
2727
minProtocolVersion: TLSV1_2
2828
workloadLink: //gvc/{{ .Values.global.cpln.gvc }}/workload/{{ include "redpanda.clusterName" . }}
2929
{{- end }}
30+
{{- if .Values.redpanda_console.domain }}
31+
32+
---
33+
kind: domain
34+
name: {{ .Values.redpanda_console.domain }}
35+
description: {{ .Values.redpanda_console.domain }}
36+
spec:
37+
acceptAllHosts: false
38+
dnsMode: cname
39+
ports:
40+
- number: 443
41+
protocol: http2
42+
routes:
43+
- port: 8080
44+
prefix: /
45+
workloadLink: //gvc/{{ .Values.global.cpln.gvc }}/workload/{{ include "redpanda.consoleName" . }}
46+
tls:
47+
cipherSuites:
48+
- ECDHE-ECDSA-AES256-GCM-SHA384
49+
- ECDHE-ECDSA-CHACHA20-POLY1305
50+
- ECDHE-ECDSA-AES128-GCM-SHA256
51+
- ECDHE-RSA-AES256-GCM-SHA384
52+
- ECDHE-RSA-CHACHA20-POLY1305
53+
- ECDHE-RSA-AES128-GCM-SHA256
54+
- AES256-GCM-SHA384
55+
- AES128-GCM-SHA256
56+
minProtocolVersion: TLSV1_2
57+
{{- end }}

‎redpanda/versions/1.0.0/templates/identity.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
kind: identity
22
name: {{ include "redpanda.name" . }}
3-
description: {{ include "redpanda.clusterName" . }} identity
3+
description: Redpanda identity
44
gvc: {{ .Values.global.cpln.gvc }}

‎redpanda/versions/1.0.0/templates/policy.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
kind: policy
22
name: {{ include "redpanda.name" . }}
3-
description: {{ include "redpanda.name" . }}
3+
description: Redpanda secrets access policy
44
origin: default
55
bindings:
66
- permissions:
@@ -11,3 +11,6 @@ targetKind: secret
1111
targetLinks:
1212
- //secret/{{ include "redpanda.name" . }}-init
1313
- //secret/{{ include "redpanda.name" . }}-secrets
14+
{{- if .Values.redpanda_console.enabled }}
15+
- //secret/{{ include "redpanda.name" . }}-console-config
16+
{{- end }}

‎redpanda/versions/1.0.0/templates/secret-console-config.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{{- $adminUser := index .Values.redpanda.auth.users 0 }}
33
kind: secret
44
name: {{ include "redpanda.name" . }}-console-config
5-
description: {{ include "redpanda.name" . }}-console-config
5+
description: Redpanda console configuration
66
type: opaque
77
data:
88
encoding: plain
@@ -14,7 +14,7 @@ data:
1414
enabled: true
1515
mechanism: {{ .Values.redpanda.auth.saslMechanism }}
1616
username: {{ $adminUser.username }}
17-
password: $(REDPANDA_CONSOLE_PASSWORD)
17+
password: {{ $adminUser.password }}
1818
redpanda:
1919
adminApi:
2020
enabled: true
@@ -25,7 +25,7 @@ data:
2525
urls:
2626
- http://{{ include "redpanda.clusterName" . }}:{{ .Values.redpanda.listeners.schemaRegistry.port }}
2727
authentication:
28-
method: http_basic
29-
username: {{ $adminUser.username }}
30-
password: $(REDPANDA_CONSOLE_PASSWORD)
28+
basic:
29+
username: {{ $adminUser.username }}
30+
password: {{ $adminUser.password }}
3131
{{- end }}

‎redpanda/versions/1.0.0/templates/secret-init.yaml‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
kind: secret
22
name: {{ include "redpanda.name" . }}-init
3-
description: {{ include "redpanda.name" . }}-init
3+
description: Redpanda broker startup script
44
type: opaque
55
data:
66
encoding: plain
@@ -34,7 +34,7 @@ data:
3434
{{- end }}
3535
seed_servers:
3636
${SEED_SERVERS}
37-
rpc_api:
37+
rpc_server:
3838
address: 0.0.0.0
3939
port: 33145
4040
advertised_rpc_api:
@@ -60,7 +60,7 @@ data:
6060
port: {{ .Values.redpanda.listeners.kafka.external.directReplicaRouting.containerPort }}
6161
name: external
6262
{{- end }}
63-
admin_api:
63+
admin:
6464
- address: 0.0.0.0
6565
port: {{ .Values.redpanda.listeners.adminApi.port }}
6666
default_topic_replications: {{ include "redpanda.defaultReplicationFactor" . }}
@@ -79,14 +79,30 @@ data:
7979
- address: 0.0.0.0
8080
port: {{ .Values.redpanda.listeners.schemaRegistry.port }}
8181
authentication_method: http_basic
82+
83+
# Redpanda v25.2+ removed ephemeral credentials for internal clients.
84+
# The schema registry client needs explicit SASL credentials to reach the Kafka API.
85+
schema_registry_client:
86+
scram_username: {{ (index .Values.redpanda.auth.users 0).username }}
87+
scram_password: ${REDPANDA_{{ (index .Values.redpanda.auth.users 0).username | upper | replace "-" "_" }}_PASSWORD}
88+
sasl_mechanism: {{ .Values.redpanda.auth.saslMechanism }}
8289
{{- if .Values.redpanda.listeners.pandaproxy.enabled }}
8390
8491
pandaproxy:
8592
pandaproxy_api:
8693
- address: 0.0.0.0
8794
port: {{ .Values.redpanda.listeners.pandaproxy.port }}
8895
authentication_method: http_basic
96+
97+
pandaproxy_client:
98+
scram_username: {{ (index .Values.redpanda.auth.users 0).username }}
99+
scram_password: ${REDPANDA_{{ (index .Values.redpanda.auth.users 0).username | upper | replace "-" "_" }}_PASSWORD}
100+
sasl_mechanism: {{ .Values.redpanda.auth.saslMechanism }}
89101
{{- end }}
90102
REDPANDA_CFG
91103
92-
exec redpanda start --config /etc/redpanda/redpanda.yaml
104+
# Remove stale pid lock from previous container; safe because our new container process
105+
# tree is separate — once the old container exits, the kernel releases the flock.
106+
rm -f /var/lib/redpanda/data/pid.lock
107+
108+
exec redpanda --redpanda-cfg /etc/redpanda/redpanda.yaml --smp {{ .Values.redpanda.smp }} --reserve-memory {{ .Values.redpanda.reserveMemory }}

‎redpanda/versions/1.0.0/templates/secret-secrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
kind: secret
22
name: {{ include "redpanda.name" . }}-secrets
3-
description: {{ include "redpanda.name" . }}-secrets
3+
description: Redpanda user credentials
44
type: dictionary
55
data:
66
{{- range .Values.redpanda.auth.users }}

‎redpanda/versions/1.0.0/templates/volumesets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
kind: volumeset
22
name: {{ include "redpanda.name" . }}-data
3-
description: {{ include "redpanda.clusterName" . }} data
3+
description: Redpanda volume set
44
gvc: {{ .Values.global.cpln.gvc }}
55
spec:
66
initialCapacity: {{ .Values.redpanda.volume.initialCapacity }}

‎redpanda/versions/1.0.0/templates/workload-redpanda-cluster.yaml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{{- include "redpanda.validateReplicas" . }}
22
kind: workload
33
name: {{ include "redpanda.clusterName" . }}
4-
description: {{ include "redpanda.clusterName" . }}
4+
description: Redpanda broker cluster
55
gvc: {{ .Values.global.cpln.gvc }}
66
tags:
77
# Brokers must resolve peer FQDNs for Raft consensus before they are Ready.
@@ -25,11 +25,16 @@ spec:
2525
- '-c'
2626
- |
2727
ORDINAL=$(echo "$HOSTNAME" | awk -F'-' '{print $NF}')
28+
CLUSTER_NAME=$(echo "$HOSTNAME" | sed 's/-[0-9]*$//')
2829
ADMIN="localhost:{{ .Values.redpanda.listeners.adminApi.port }}"
29-
until curl -sf "http://${ADMIN}/v1/health" | grep -q '"is_healthy":true'; do sleep 2; done
30+
ADMIN_HOSTS=""
31+
for i in $(seq 0 $(( {{ .Values.redpanda.replicas }} - 1 ))); do
32+
ADMIN_HOSTS="${ADMIN_HOSTS:+${ADMIN_HOSTS},}${CLUSTER_NAME}-${i}.${CLUSTER_NAME}:{{ .Values.redpanda.listeners.adminApi.port }}"
33+
done
34+
until curl -sf "http://${ADMIN}/v1/cluster/health_overview" 2>/dev/null | grep -qE '"is_healthy"\s*:\s*true'; do sleep 2; done
3035
[ "$ORDINAL" != "0" ] && exit 0
3136
{{- range .Values.redpanda.auth.users }}
32-
rpk security user create {{ .username }} --password "$REDPANDA_{{ .username | upper | replace "-" "_" }}_PASSWORD" --mechanism {{ $.Values.redpanda.auth.saslMechanism }} --api-addr "$ADMIN" || true
37+
rpk security user create {{ .username }} --password "$REDPANDA_{{ .username | upper | replace "-" "_" }}_PASSWORD" --mechanism {{ $.Values.redpanda.auth.saslMechanism }} -X admin.hosts="${ADMIN_HOSTS}" || true
3338
{{- end }}
3439
# Transfer all partition leadership off this broker before Kubernetes sends
3540
# SIGTERM. By the time SIGTERM arrives the broker holds no leadership, so
@@ -39,7 +44,7 @@ spec:
3944
command:
4045
- /bin/bash
4146
- '-c'
42-
- rpk cluster maintenance enable --wait --api-addr localhost:{{ .Values.redpanda.listeners.adminApi.port }} || true
47+
- rpk cluster maintenance enable --wait -X admin.hosts=localhost:{{ .Values.redpanda.listeners.adminApi.port }} || true
4348
cpu: '{{ .Values.redpanda.cpu }}'
4449
{{- if .Values.redpanda.minCpu }}
4550
minCpu: '{{ .Values.redpanda.minCpu }}'
@@ -91,9 +96,11 @@ spec:
9196
initialDelaySeconds: 20
9297
periodSeconds: 10
9398
successThreshold: 1
94-
httpGet:
95-
path: /v1/health
96-
port: {{ .Values.redpanda.listeners.adminApi.port }}
99+
exec:
100+
command:
101+
- /bin/bash
102+
- '-c'
103+
- curl -sf http://localhost:{{ .Values.redpanda.listeners.adminApi.port }}/v1/cluster/health_overview | grep -qE '"is_healthy"\s*:\s*true'
97104
timeoutSeconds: 5
98105
volumes:
99106
- path: /var/lib/redpanda/data

‎redpanda/versions/1.0.0/templates/workload-redpanda-console.yaml‎

Lines changed: 2 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,8 @@
11
{{- if .Values.redpanda_console.enabled }}
22
{{- $adminUser := index .Values.redpanda.auth.users 0 }}
3-
{{- if .Values.redpanda_console.domain }}
4-
kind: domain
5-
name: {{ .Values.redpanda_console.domain }}
6-
description: {{ .Values.redpanda_console.domain }}
7-
spec:
8-
acceptAllHosts: false
9-
dnsMode: cname
10-
ports:
11-
- number: 443
12-
protocol: http2
13-
routes:
14-
- port: 8080
15-
prefix: /
16-
workloadLink: //gvc/{{ .Values.global.cpln.gvc }}/workload/{{ include "redpanda.consoleName" . }}
17-
tls:
18-
cipherSuites:
19-
- ECDHE-ECDSA-AES256-GCM-SHA384
20-
- ECDHE-ECDSA-CHACHA20-POLY1305
21-
- ECDHE-ECDSA-AES128-GCM-SHA256
22-
- ECDHE-RSA-AES256-GCM-SHA384
23-
- ECDHE-RSA-CHACHA20-POLY1305
24-
- ECDHE-RSA-AES128-GCM-SHA256
25-
- AES256-GCM-SHA384
26-
- AES128-GCM-SHA256
27-
minProtocolVersion: TLSV1_2
28-
---
29-
{{- end }}
30-
kind: policy
31-
name: {{ include "redpanda.consoleName" . }}
32-
origin: default
33-
bindings:
34-
- permissions:
35-
- reveal
36-
principalLinks:
37-
- //gvc/{{ .Values.global.cpln.gvc }}/identity/{{ include "redpanda.consoleName" . }}
38-
targetKind: secret
39-
targetLinks:
40-
- //secret/{{ include "redpanda.name" . }}-secrets
41-
- //secret/{{ include "redpanda.name" . }}-console-config
42-
---
43-
kind: identity
44-
name: {{ include "redpanda.consoleName" . }}
45-
description: {{ include "redpanda.consoleName" . }} identity
46-
gvc: {{ .Values.global.cpln.gvc }}
47-
---
483
kind: workload
494
name: {{ include "redpanda.consoleName" . }}
50-
description: {{ include "redpanda.consoleName" . }}
5+
description: Redpanda Console
516
gvc: {{ .Values.global.cpln.gvc }}
527
tags:
538
{{- include "redpanda.tags" . | nindent 2 }}
@@ -105,7 +60,7 @@ spec:
10560
inboundAllowType: {{ default "[]" .Values.redpanda_console.firewall.internal_inboundAllowType }}
10661
{{- end }}
10762
{{- end }}
108-
identityLink: //gvc/{{ .Values.global.cpln.gvc }}/identity/{{ include "redpanda.consoleName" . }}
63+
identityLink: //gvc/{{ .Values.global.cpln.gvc }}/identity/{{ include "redpanda.name" . }}
10964
loadBalancer:
11065
direct:
11166
enabled: false

‎redpanda/versions/1.0.0/values.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@ redpanda:
99
memory: 4Gi
1010
minCpu: 500m
1111
minMemory: 2Gi
12+
# smp: number of Seastar reactor threads — must match the container's vCPU count (floor of cpu limit).
13+
# Without this, Seastar uses all node CPUs and divides memory across them, starving each shard.
14+
smp: 1
15+
# reserveMemory: memory set aside for the OS; Redpanda uses (memory - reserveMemory).
16+
reserveMemory: 1G
1217

1318
volume:
1419
initialCapacity: 10 # In GB

0 commit comments

Comments
 (0)