github.com/cockroachdb/cockroach@v20.2.0-alpha.1+incompatible/cloud/kubernetes/performance/cockroachdb-daemonset-secure.yaml (about)

     1  # This configuration file sets up a secure DaemonSet running CockroachDB.
     2  # For more information on why you might want to use a DaemonSet instead
     3  # of a StatefulSet, see our docs:
     4  # https://www.cockroachlabs.com/docs/stable/kubernetes-performance.html#running-in-a-daemonset
     5  #
     6  # To use this file, customize the parts labeled "TODO" before running:
     7  #   kubectl create -f cockroachdb-daemonset-secure.yaml
     8  #
     9  # You will then have to approve certificate signing requests and initialize the
    10  # cluster as described in the parent directory's README.md file. In order for
    11  # the initialization step to work, note that you will need to change the
    12  # address used by the cluster-init-secure.yaml file on the
    13  # "--host=cockroachdb-0.cockroach" line from "cockroachdb-0.cockroach" to the
    14  # address of one of your nodes.
    15  #
    16  # If you're interested in using a DaemonSet in insecure mode instead, please
    17  # see cockroachdb-daemonset-insecure.yaml.
    18  apiVersion: v1
    19  kind: ServiceAccount
    20  metadata:
    21    name: cockroachdb
    22    labels:
    23      app: cockroachdb
    24  ---
    25  apiVersion: rbac.authorization.k8s.io/v1beta1
    26  kind: Role
    27  metadata:
    28    name: cockroachdb
    29    labels:
    30      app: cockroachdb
    31  rules:
    32  - apiGroups:
    33    - ""
    34    resources:
    35    - secrets
    36    verbs:
    37    - create
    38    - get
    39  ---
    40  apiVersion: rbac.authorization.k8s.io/v1beta1
    41  kind: ClusterRole
    42  metadata:
    43    name: cockroachdb
    44    labels:
    45      app: cockroachdb
    46  rules:
    47  - apiGroups:
    48    - certificates.k8s.io
    49    resources:
    50    - certificatesigningrequests
    51    verbs:
    52    - create
    53    - get
    54    - watch
    55  ---
    56  apiVersion: rbac.authorization.k8s.io/v1beta1
    57  kind: RoleBinding
    58  metadata:
    59    name: cockroachdb
    60    labels:
    61      app: cockroachdb
    62  roleRef:
    63    apiGroup: rbac.authorization.k8s.io
    64    kind: Role
    65    name: cockroachdb
    66  subjects:
    67  - kind: ServiceAccount
    68    name: cockroachdb
    69    namespace: default
    70  ---
    71  apiVersion: rbac.authorization.k8s.io/v1beta1
    72  kind: ClusterRoleBinding
    73  metadata:
    74    name: cockroachdb
    75    labels:
    76      app: cockroachdb
    77  roleRef:
    78    apiGroup: rbac.authorization.k8s.io
    79    kind: ClusterRole
    80    name: cockroachdb
    81  subjects:
    82  - kind: ServiceAccount
    83    name: cockroachdb
    84    namespace: default
    85  ---
    86  apiVersion: v1
    87  kind: Service
    88  metadata:
    89    # This service is meant to be used by clients of the database. It exposes a ClusterIP that will
    90    # automatically load balance connections to the different database pods.
    91    name: cockroachdb-public
    92    labels:
    93      app: cockroachdb
    94  spec:
    95    ports:
    96    # The main port, served by gRPC, serves Postgres-flavor SQL, internode
    97    # traffic and the cli.
    98    - port: 26257
    99      targetPort: 26257
   100      name: grpc
   101    # The secondary port serves the UI as well as health and debug endpoints.
   102    - port: 8080
   103      targetPort: 8080
   104      name: http
   105    selector:
   106      app: cockroachdb
   107  ---
   108  apiVersion: policy/v1beta1
   109  kind: PodDisruptionBudget
   110  metadata:
   111    name: cockroachdb-budget
   112    labels:
   113      app: cockroachdb
   114  spec:
   115    selector:
   116      matchLabels:
   117        app: cockroachdb
   118    maxUnavailable: 1
   119  ---
   120  apiVersion: apps/v1
   121  kind: DaemonSet
   122  metadata:
   123    name: cockroachdb
   124    labels:
   125      app: cockroachdb
   126  spec:
   127    selector:
   128      matchLabels:
   129        app: cockroachdb
   130    template:
   131      metadata:
   132        labels:
   133          app: cockroachdb
   134      spec:
   135        serviceAccountName: cockroachdb
   136        # TODO: Remove the nodeSelector section if you want CockroachDB to run on all nodes in your cluster.
   137        # To give nodes this label, run:
   138        #   kubectl label node <node-name> app=cockroachdb
   139        nodeSelector:
   140          app: cockroachdb
   141        # Tolerations allow CockroachDB to run on Kubernetes nodes that other pods won't be allowed on.
   142        # To set up nodes to be dedicated to CockroachDB, you must "taint" them by running:
   143        #   kubectl taint node <node-name> app=cockroachdb:NoSchedule
   144        # If you don't set up any such taints, these tolerations will have no effect.
   145        tolerations:
   146        - key: "app"
   147          operator: "Equal"
   148          value: "cockroachdb"
   149          effect: "NoSchedule"
   150        # NOTE: Running with `hostNetwork: true` means that CockroachDB will use
   151        # the host machines' IP address and hostname, and that nothing else on
   152        # the machines will be able to use the same ports.
   153        hostNetwork: true
   154        # Init containers are run only once in the lifetime of a pod, before
   155        # it's started up for the first time. It has to exit successfully
   156        # before the pod's main containers are allowed to start.
   157        initContainers:
   158        # The init-certs container sends a certificate signing request to the
   159        # kubernetes cluster.
   160        # You can see pending requests using: kubectl get csr
   161        # CSRs can be approved using:         kubectl certificate approve <csr name>
   162        #
   163        # All addresses used to contact a node must be specified in the --addresses arg.
   164        #
   165        # In addition to the node certificate and key, the init-certs entrypoint will symlink
   166        # the cluster CA to the certs directory.
   167        - name: init-certs
   168          image: cockroachdb/cockroach-k8s-request-cert:0.4
   169          imagePullPolicy: IfNotPresent
   170          command:
   171          - "/bin/ash"
   172          - "-ecx"
   173          - "/request-cert -namespace=${POD_NAMESPACE} -certs-dir=/cockroach-certs -type=node -addresses=localhost,127.0.0.1,$(hostname),$(hostname -f),$(hostname -i),cockroachdb-public,cockroachdb-public.${POD_NAMESPACE}.svc.cluster.local,cockroachdb-public.${POD_NAMESPACE}.svc,cockroachdb-public.${POD_NAMESPACE} -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
   174          env:
   175          - name: POD_NAMESPACE
   176            valueFrom:
   177              fieldRef:
   178                fieldPath: metadata.namespace
   179          volumeMounts:
   180          - name: certs
   181            mountPath: /cockroach-certs
   182        # NOTE: If you are running clients that generate heavy load, you may find
   183        # it useful to copy this anti-affinity policy into the client pods'
   184        # configurations as well to avoid running them on the same machines as
   185        # CockroachDB and interfering with each other's performance.
   186        affinity:
   187          podAntiAffinity:
   188            preferredDuringSchedulingIgnoredDuringExecution:
   189            - weight: 100
   190              podAffinityTerm:
   191                labelSelector:
   192                  matchExpressions:
   193                  - key: app
   194                    operator: In
   195                    values:
   196                    - cockroachdb
   197                topologyKey: kubernetes.io/hostname
   198        containers:
   199        - name: cockroachdb
   200          image: cockroachdb/cockroach:v20.1.1
   201          imagePullPolicy: IfNotPresent
   202          # TODO: If you configured taints to give CockroachDB exclusive access to nodes, feel free
   203          # to remove the requests and limits sections. If you didn't, you'll need to change these to
   204          # appropriate values for the hardware that you're running. You can see the amount of
   205          # allocatable resources on each of your Kubernetes nodes by running:
   206          #   kubectl describe nodes
   207          resources:
   208            requests:
   209              cpu: "16"
   210              memory: "8Gi"
   211            limits:
   212              # NOTE: Unless you have enabled the non-default Static CPU Management Policy
   213              # and are using an integer number of CPUs, we don't recommend setting a CPU limit.
   214              # See:
   215              #   https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy
   216              #   https://github.com/kubernetes/kubernetes/issues/51135
   217              #cpu: "16"
   218              memory: "8Gi"
   219          ports:
   220          - containerPort: 26257
   221            hostPort: 26257
   222            name: grpc
   223          - containerPort: 8080
   224            hostPort: 8080
   225            name: http
   226          livenessProbe:
   227            httpGet:
   228              path: "/health"
   229              port: http
   230              scheme: HTTPS
   231            initialDelaySeconds: 30
   232            periodSeconds: 5
   233          readinessProbe:
   234            httpGet:
   235              path: "/health?ready=1"
   236              port: http
   237              scheme: HTTPS
   238            initialDelaySeconds: 10
   239            periodSeconds: 5
   240            failureThreshold: 2
   241          volumeMounts:
   242          - name: datadir
   243            mountPath: /cockroach/cockroach-data
   244          - name: certs
   245            mountPath: /cockroach/cockroach-certs
   246          env:
   247          - name: COCKROACH_CHANNEL
   248            value: kubernetes-secure
   249          command:
   250            - "/bin/bash"
   251            - "-ecx"
   252            # TODO: Replace "YOUR_IP_ADDR1_HERE,YOUR_IP_ADDR2_HERE,YOUR_IP_ADDR3_HERE" with a list of a few of the IP addresses or hostnames of the machines on which CockroachDB will be running.
   253            - "exec /cockroach/cockroach start --logtostderr --certs-dir /cockroach/cockroach-certs --http-addr 0.0.0.0 --cache 25% --max-sql-memory 25% --join=YOUR_IP_ADDR1_HERE,YOUR_IP_ADDR2_HERE,YOUR_IP_ADDR3_HERE"
   254        terminationGracePeriodSeconds: 60
   255        volumes:
   256        - name: datadir
   257          hostPath:
   258            # TODO: Replace "YOUR_FILESYSTEM_PATH_HERE" with the path where you want CockroachDB's data stored on your Kubernetes nodes.
   259            path: YOUR_FILESYSTEM_PATH_HERE
   260        - name: certs
   261          emptyDir: {}