-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: [DENA-580] fix cockroachdb manifests #48
Conversation
- secret: | ||
name: cockroachdb.client.root | ||
items: | ||
- key: ca.crt |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wondering if we can move these patches(including the ones for the stateful set) inside the base.
@@ -87,3 +72,27 @@ spec: | |||
- key: tls.key | |||
path: client.root.key | |||
defaultMode: 256 | |||
--- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't want to be a pain but how about getting rid of certificates-patch.yaml
and do these path overrides directly on the resource(Job, StatefulSet)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's really good idea, I don't know why I didn't thought about that :)
Applied
Post diff --git a/root-manifests/cockroachdb/example/cert-manager/manifests.yaml b/built-manifests/cockroachdb/example/cert-manager/manifests.yaml
index b5e249b..4577d55 100644
--- a/root-manifests/cockroachdb/example/cert-manager/manifests.yaml
+++ b/built-manifests/cockroachdb/example/cert-manager/manifests.yaml
@@ -181,18 +181,9 @@ spec:
terminationGracePeriodSeconds: 60
volumes:
- name: client-certs
- projected:
+ secret:
defaultMode: 256
- sources:
- - secret:
- items:
- - key: ca.crt
- path: ca.crt
- - key: tls.crt
- path: client.root.crt
- - key: tls.key
- path: client.root.key
- name: cockroachdb.client.root
+ secretName: cockroachdb.client.root
---
apiVersion: apps/v1
kind: StatefulSet
@@ -292,22 +283,13 @@ spec:
shareProcessNamespace: true
terminationGracePeriodSeconds: 60
volumes:
- - name: certs
- projected:
- defaultMode: 256
- sources:
- - secret:
- items:
- - key: ca.crt
- path: ca.crt
- - key: tls.crt
- path: node.crt
- - key: tls.key
- path: node.key
- name: cockroachdb.node
- name: datadir
persistentVolumeClaim:
claimName: datadir
+ - name: certs
+ secret:
+ defaultMode: 256
+ secretName: cockroachdb.node
updateStrategy:
type: RollingUpdate
volumeClaimTemplates:
@@ -426,18 +408,9 @@ spec:
restartPolicy: OnFailure
volumes:
- name: client-certs
- projected:
+ secret:
defaultMode: 256
- sources:
- - secret:
- items:
- - key: ca.crt
- path: ca.crt
- - key: tls.crt
- path: client.root.crt
- - key: tls.key
- path: client.root.key
- name: cockroachdb.client.root
+ secretName: cockroachdb.client.root
ttlSecondsAfterFinished: 600
---
apiVersion: cert-manager.io/v1
@@ -483,7 +456,7 @@ spec:
- cockroachdb-2.cockroachdb.<your namespace here>.svc.cluster.local
issuerRef:
kind: Issuer
- name: ca-issuer
+ name: cockroachdb-ca-issuer
secretName: cockroachdb.node
usages:
- server auth
diff --git a/root-manifests/cockroachdb/manifests-cert-manager/manifests.yaml b/built-manifests/cockroachdb/manifests-cert-manager/manifests.yaml
index 9d9031b..4d1ba3e 100644
--- a/root-manifests/cockroachdb/manifests-cert-manager/manifests.yaml
+++ b/built-manifests/cockroachdb/manifests-cert-manager/manifests.yaml
@@ -14,6 +14,7 @@ data:
exit 1
fi
+ # todo: wait for the cockroachdb cluster to be ready
SQL_CMD="/cockroach/cockroach sql" > /dev/null
$SQL_CMD << EOF
@@ -157,9 +158,18 @@ spec:
terminationGracePeriodSeconds: 60
volumes:
- name: client-certs
- secret:
+ projected:
defaultMode: 256
- secretName: cockroachdb.client.root
+ sources:
+ - secret:
+ items:
+ - key: ca.crt
+ path: ca.crt
+ - key: tls.crt
+ path: client.root.crt
+ - key: tls.key
+ path: client.root.key
+ name: cockroachdb.client.root
---
apiVersion: apps/v1
kind: StatefulSet
@@ -260,9 +270,18 @@ spec:
persistentVolumeClaim:
claimName: datadir
- name: certs
- secret:
+ projected:
defaultMode: 256
- secretName: cockroachdb.node
+ sources:
+ - secret:
+ items:
+ - key: ca.crt
+ path: ca.crt
+ - key: tls.crt
+ path: node.crt
+ - key: tls.key
+ path: node.key
+ name: cockroachdb.node
updateStrategy:
type: RollingUpdate
volumeClaimTemplates:
@@ -340,8 +359,19 @@ spec:
readOnly: true
restartPolicy: OnFailure
volumes:
- - emptyDir: {}
- name: client-certs
+ - name: client-certs
+ projected:
+ defaultMode: 256
+ sources:
+ - secret:
+ items:
+ - key: ca.crt
+ path: ca.crt
+ - key: tls.crt
+ path: client.root.crt
+ - key: tls.key
+ path: client.root.key
+ name: cockroachdb.client.root
- configMap:
name: cockroachdb-scripts
name: cockroachdb-scripts
@@ -360,11 +390,14 @@ spec:
- command:
- /bin/bash
- -c
- - /cockroach/cockroach init --certs-dir=/cockroach/cockroach-certs --host=$(COCKROACH_INIT_HOST)
- --port=26357 2>&1 | grep 'initialized'
+ - /cockroach/cockroach init --certs-dir=/cockroach/cockroach-certs --port=26357
+ 2>&1 | grep 'initialized'
env:
- - name: COCKROACH_INIT_HOST
- value: cockroachdb-0.cockroachdb
+ - name: COCKROACH_HOST
+ valueFrom:
+ configMapKeyRef:
+ key: cockroach.host
+ name: cockroach
image: cockroachdb/cockroach:v23.2.2
imagePullPolicy: IfNotPresent
name: cluster-init
@@ -381,9 +414,18 @@ spec:
restartPolicy: OnFailure
volumes:
- name: client-certs
- secret:
+ projected:
defaultMode: 256
- secretName: cockroachdb.client.root
+ sources:
+ - secret:
+ items:
+ - key: ca.crt
+ path: ca.crt
+ - key: tls.crt
+ path: client.root.crt
+ - key: tls.key
+ path: client.root.key
+ name: cockroachdb.client.root
ttlSecondsAfterFinished: 600
---
apiVersion: cert-manager.io/v1
@@ -394,7 +436,7 @@ spec:
commonName: root
issuerRef:
kind: Issuer
- name: ca-issuer
+ name: cockroachdb-ca-issuer
secretName: cockroachdb.client.root
usages:
- client auth
@@ -426,6 +468,7 @@ spec:
- cockroachdb-0.cockroachdb
- cockroachdb-1.cockroachdb
- cockroachdb-2.cockroachdb
+ - cockroachdb-proxy
issuerRef:
kind: Issuer
name: cockroachdb-ca-issuer
=============================================
k8s objects: 0 to add, 0 to destroy
12 changed hunks |
Original manifests:
cockroachdb-ca-issuer
andca-issuer
(cockroachdb-ca-issuer
is correct name of issuer)