Merge "Implement PodDisruptionBudget and RollingUpdate for HA"

Author: Microzuul CI

controllers/libs/base/base.go

@@ -13,6 +13,7 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	apiv1 "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -27,6 +28,23 @@ var DefaultPodSecurityContext = apiv1.PodSecurityContext{
 	},
 }
 
+// MkPodDisruptionBudget produces a PodDisruptionBudget.
+func MkPodDisruptionBudget(name, ns string, maxUnavailable int32, selector, annotations map[string]string) policyv1.PodDisruptionBudget {
+	return policyv1.PodDisruptionBudget{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        name,
+			Namespace:   ns,
+			Annotations: annotations,
+		},
+		Spec: policyv1.PodDisruptionBudgetSpec{
+			MaxUnavailable: utils.IntOrStringPtr(maxUnavailable),
+			Selector: &metav1.LabelSelector{
+				MatchLabels: selector,
+			},
+		},
+	}
+}
+
 // MkSecurityContext produces a SecurityContext
 func MkSecurityContext(privileged bool, openshiftUser bool) *apiv1.SecurityContext {
 	scc := &apiv1.SecurityContext{

controllers/libs/utils/utils.go

@@ -22,6 +22,7 @@ import (
 	"golang.org/x/crypto/ssh"
 	"gopkg.in/ini.v1"
 	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/util/intstr"
 )
 
 // GetEnvVarValue returns the value of the named env var. Return an empty string when not found.
@@ -35,6 +36,9 @@ func GetEnvVarValue(varName string) (string, error) {
 
 func Int32Ptr(i int32) *int32 { return &i }
 func BoolPtr(b bool) *bool    { return &b }
+func IntOrStringPtr(i int32) *intstr.IntOrString {
+	return &intstr.IntOrString{Type: intstr.Int, IntVal: i}
+}
 
 var Execmod int32 = 493 // decimal for 0755 octal
 var Readmod int32 = 292 // decimal for 0444 octal

controllers/utils.go

@@ -33,6 +33,7 @@ import (
 
 	appsv1 "k8s.io/api/apps/v1"
 	apiv1 "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
 	storagev1 "k8s.io/api/storage/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
@@ -1060,3 +1061,28 @@ func WaitFor(ensureFun func() bool, linear bool) bool {
 		time.Sleep(duration)
 	}
 }
+
+// EnsurePodDisruptionBudget ensures a PodDisruptionBudget exists
+// The PodDisruptionBudget is updated if needed
+func (r *SFKubeContext) EnsurePodDisruptionBudget(pdb *policyv1.PodDisruptionBudget) {
+	var current policyv1.PodDisruptionBudget
+	name := pdb.GetName()
+
+	if !r.GetOrDie(name, &current) {
+		if !r.DryRun {
+			logging.LogI("Creating PodDisruptionBudget, name: " + name)
+		}
+		r.CreateR(pdb)
+	} else {
+		if !reflect.DeepEqual(current.Spec, pdb.Spec) || !utils.MapEquals(&current.ObjectMeta.Annotations, &pdb.ObjectMeta.Annotations) {
+			if r.DryRun {
+				logging.LogI("[Dry Run] Would update PodDisruptionBudget, name: " + name + ". Reason: Spec or Annotations have changed")
+			} else {
+				logging.LogI("Updating PodDisruptionBudget, name: " + name)
+			}
+			current.Spec = pdb.Spec
+			current.ObjectMeta.Annotations = pdb.ObjectMeta.Annotations
+			r.UpdateR(&current)
+		}
+	}
+}

controllers/zookeeper.go

@@ -41,6 +41,7 @@ const zkServerPort = 2888
 
 const ZookeeperIdent = "zookeeper"
 const ZookeeperReplicas = 3
+const ZookeeperMaxUnavailable = 1
 
 const zkPIMountPath = "/config-scripts"
 
@@ -175,8 +176,14 @@ func (r *SFController) DeployZookeeper() bool {
 		StorageClassName: storageConfig.StorageClassName,
 		ExtraAnnotations: storageConfig.ExtraAnnotations,
 	}
+	pdb := base.MkPodDisruptionBudget(ZookeeperIdent, r.Ns, ZookeeperMaxUnavailable, map[string]string{"app": "sf", "run": ZookeeperIdent}, nil)
+	r.EnsurePodDisruptionBudget(&pdb)
 	zk := r.mkHeadlessStatefulSet(
 		ZookeeperIdent, base.ZookeeperImage(), storageConfig, apiv1.ReadWriteOnce, r.cr.Spec.ExtraLabels, r.IsOpenShift)
+	zk.Spec.UpdateStrategy = appsv1.StatefulSetUpdateStrategy{
+		Type: appsv1.RollingUpdateStatefulSetStrategyType,
+	}
+	zk.Spec.PodManagementPolicy = appsv1.OrderedReadyPodManagement
 	// We overwrite the VolumeClaimTemplates set by MkHeadlessStatefulSet to keep the previous volume name
 	// Previously the default PVC created by MkHeadlessStatefulSet was not used by Zookeeper (not mounted). So to avoid having two Volumes
 	// and to ensure data persistence during the upgrade we keep the previous naming 'ZookeeperIdent + "-data"' and we discard the one

docs/reference/CHANGELOG.md

@@ -11,6 +11,8 @@ All notable changes to this project will be documented in this file.
   While the process handles snapshotting Zookeeper's data and restoring it to all pods after the extra replicas rollout, you are **strongly** advised
   to perform a backup with the sf-operator CLI before upgrading to avoid accidental data loss.
   PKI certificates will be recreated to reflect the new ensemble setup.
+- Added `PodDisruptionBudget` and `RollingUpdate` strategy to the Zookeeper controller, in accordance with zookeeper
+  being now deployed as a 3-replica ensemble (see below).
 
 ### Deprecated
 ### Removed