cockroachdb-k8s.yaml

cockroachdb-k8s.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cockroachdb
  labels:
    app: cockroachdb
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: cockroachdb
  labels:
    app: cockroachdb
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - get
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: cockroachdb
  labels:
    app: cockroachdb
rules:
  - apiGroups:
      - certificates.k8s.io
    resources:
      - certificatesigningrequests
    verbs:
      - create
      - get
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: cockroachdb
  labels:
    app: cockroachdb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cockroachdb
subjects:
  - kind: ServiceAccount
    name: cockroachdb
    namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: cockroachdb
  labels:
    app: cockroachdb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cockroachdb
subjects:
  - kind: ServiceAccount
    name: cockroachdb
    namespace: default
---
# apiVersion: v1
# kind: LimitRange
# metadata:
#   name: res-limit-range
# spec:
#   limits:
#   - default:
#       cpu: "2"
#       memory: "4Gi"
#     defaultRequest:
#       cpu: "2"
#       memory: "4Gi"
#     type: Container
# ---
apiVersion: v1
kind: StorageClass
metadata:
  name: ssd
  labels:
    app: cockroachdb
  annotations:
    storageclass.beta.kubernetes.io/is-default-class: "true"
allowVolumeExpansion: true
parameters:
  type: pd-ssd
---
# apiVersion: v1
# kind: PersistentVolumeClaim
# metadata:
#   name: cockroachdb-pvc
#   labels:
#     app: cockroachdb  
# spec:
#   accessModes:
#     - ReadWriteOnce
#   storageClassName: ssd
#   resources:
#     requests:
#       storage: 50Gi
# ---
apiVersion: v1
kind: Service
metadata:
  # This service is meant to be used by clients of the database. It exposes a ClusterIP that will
  # automatically load balance connections to the different database pods.
  name: cockroachdb-public
  labels:
    app: cockroachdb
spec:
  ports:
    # The main port, served by gRPC, serves Postgres-flavor SQL, internode
    # traffic and the cli.
    - port: 26257
      targetPort: 26257
      name: grpc
    # The secondary port serves the UI as well as health and debug endpoints.
    - port: 8080
      targetPort: 8080
      name: http
  selector:
    app: cockroachdb
---
apiVersion: v1
kind: Service
metadata:
  # This service only exists to create DNS entries for each pod in the stateful
  # set such that they can resolve each other's IP addresses. It does not
  # create a load-balanced ClusterIP and should not be used directly by clients
  # in most circumstances.
  name: cockroachdb
  labels:
    app: cockroachdb
  annotations:
    # Use this annotation in addition to the actual publishNotReadyAddresses
    # field below because the annotation will stop being respected soon but the
    # field is broken in some versions of Kubernetes:
    # https://github.com/kubernetes/kubernetes/issues/58662
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
    # Enable automatic monitoring of all instances when Prometheus is running in the cluster.
    prometheus.io/scrape: "true"
    prometheus.io/path: "_status/vars"
    prometheus.io/port: "8080"
spec:
  ports:
    - port: 26257
      targetPort: 26257
      name: grpc
    - port: 8080
      targetPort: 8080
      name: http
  # We want all pods in the StatefulSet to have their addresses published for
  # the sake of the other CockroachDB pods even before they're ready, since they
  # have to be able to talk to each other in order to become ready.
  publishNotReadyAddresses: true
  clusterIP: None
  selector:
    app: cockroachdb
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: cockroachdb-budget
  labels:
    app: cockroachdb
spec:
  selector:
    matchLabels:
      app: cockroachdb
  maxUnavailable: 1
---
apiVersion: apps/v1beta1
kind: StatefulSet
metadata:
  name: cockroachdb
spec:
  serviceName: "cockroachdb"
  # PORTAL: This valus is set to 1
  # still can add nodes according to environment and needs
  # https://www.cockroachlabs.com/docs/stable/orchestrate-cockroachdb-with-kubernetes.html#add-nodes
  # kubectl scale statefulset cockroachdb --replicas=X
  replicas: 3
  template:
    metadata:
      labels:
        app: cockroachdb
    spec:
      serviceAccountName: cockroachdb
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      # Init containers are run only once in the lifetime of a pod, before
      # it's started up for the first time. It has to exit successfully
      # before the pod's main containers are allowed to start.
      initContainers:
        # The init-certs container sends a certificate signing request to the
        # kubernetes cluster.
        # You can see pending requests using: kubectl get csr
        # CSRs can be approved using:         kubectl certificate approve <csr name>
        #
        # All addresses used to contact a node must be specified in the --addresses arg.
        #
        # In addition to the node certificate and key, the init-certs entrypoint will symlink
        # the cluster CA to the certs directory.
        - name: init-certs
          image: cockroachdb/cockroach-k8s-request-cert:0.4
          imagePullPolicy: IfNotPresent
          command:
            - "/bin/ash"
            - "-ecx"
            - "/request-cert -namespace=${POD_NAMESPACE} -certs-dir=/cockroach-certs -type=node -addresses=localhost,127.0.0.1,$(hostname -f),$(hostname -f|cut -f 1-2 -d '.'),cockroachdb-public,cockroachdb-public.$(hostname -f|cut -f 3- -d '.') -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: certs
              mountPath: /cockroach-certs
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - cockroachdb
                topologyKey: kubernetes.io/hostname
      containers:
        - name: cockroachdb
          image: cockroachdb/cockroach:v2.1.6
          imagePullPolicy: IfNotPresent
          # TODO: Change these to appropriate values for the hardware that you're running. You can see
          # the amount of allocatable resources on each of your Kubernetes nodes by running:
          #   kubectl describe nodes
          # PORTAL: cpu=2, memory=8Gi
          resources:
            requests:
              cpu: "2"
              memory: "3450Mi"
            limits:
              # NOTE: Unless you have enabled the non-default Static CPU Management Policy
              # and are using an integer number of CPUs, we don't recommend setting a CPU limit.
              # See:
              #   https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy
              #   https://github.com/kubernetes/kubernetes/issues/51135
              #cpu: "16"
              cpu: "2500m"
              memory: "4Gi"
          ports:
            - containerPort: 26257
              name: grpc
            - containerPort: 8080
              name: http
          livenessProbe:
            httpGet:
              path: "/health"
              port: http
              scheme: HTTPS
            initialDelaySeconds: 30
            periodSeconds: 5
          readinessProbe:
            httpGet:
              path: "/health?ready=1"
              port: http
              scheme: HTTPS
            initialDelaySeconds: 10
            periodSeconds: 5
            failureThreshold: 2
          volumeMounts:
            - name: datadir
              mountPath: /cockroach/cockroach-data
            - name: certs
              mountPath: /cockroach/cockroach-certs
          env:
            - name: COCKROACH_CHANNEL
              value: kubernetes-secure
          command:
            - "/bin/bash"
            - "-ecx"
            # The use of qualified `hostname -f` is crucial:
            # Other nodes aren't able to look up the unqualified hostname.
            - "exec /cockroach/cockroach start --logtostderr --certs-dir /cockroach/cockroach-certs --advertise-host $(hostname -f) --http-addr 0.0.0.0 --join cockroachdb-0.cockroachdb,cockroachdb-1.cockroachdb,cockroachdb-2.cockroachdb --cache 25% --max-sql-memory 25%"
      # No pre-stop hook is required, a SIGTERM plus some time is all that's
      # needed for graceful shutdown of a node.
      terminationGracePeriodSeconds: 60
      volumes:
        - name: datadir
          persistentVolumeClaim:
            claimName: datadir
        - name: certs
          emptyDir: {}
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  volumeClaimTemplates:
    - metadata:
        name: datadir
      spec:
        accessModes:
          - "ReadWriteOnce"
        # TODO: This specifically asks for a storage class with the name "ssd". A
        # storage class of this name doesn't exist by default. See our docs for
        # more information on how to create an optimized storage class for use here:
        # https://www.cockroachlabs.com/docs/stable/orchestrate-cockroachdb-with-kubernetes-performance.html#disk-type
        storageClassName: ssd
        resources:
          requests:
            storage: 50Gi