helm: Buddy merge for #11368 (Enable persistence in custom mode) (#11993)

* feat: Standardize persistence

* helm: Use deprecated standalone.existingClaimName when specified over newer persistence.existingClaimName

* chore: Change pvc comment

* feat: Update chart reference

* Update docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx

Co-authored-by: Pierre Lebrun <pierreyves.lebrun@rakuten.com>
This commit is contained in:
Gus Luxton 2022-04-15 21:31:14 -03:00 committed by GitHub
parent 48f1434046
commit a2ece60402
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
14 changed files with 550 additions and 99 deletions

View file

@ -407,39 +407,61 @@ Teleport's RBAC policies to define access rules for the cluster.
| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../guides/gcp.mdx) |
| `custom` | [Running a Teleport cluster with a custom config](../guides/custom.mdx) |
## `standalone`
## `persistence`
### `standalone.existingClaimName`
### `persistence.enabled`
| Type | Default value | Can be used in `custom` mode? |
| - | - | - |
| `bool` | `true` | ✅ |
`persistence.enabled` can be used to enable data persistence using either a new or pre-existing `PersistentVolumeClaim`.
<Tabs>
<TabItem label="values.yaml">
```yaml
persistence:
enabled: true
```
</TabItem>
<TabItem label="--set">
```code
$ --set persistence.enabled=true
```
</TabItem>
</Tabs>
### `persistence.existingClaimName`
| Type | Default value | Can be used in `custom` mode? |
| - | - | - |
| `string` | `nil` | ✅ |
`standalone.existingClaimName` can be used to provide the name of a pre-existing `PersistentVolumeClaim` to use if desired.
`persistence.existingClaimName` can be used to provide the name of a pre-existing `PersistentVolumeClaim` to use if desired.
The default is left blank, which will automatically create a `PersistentVolumeClaim` to use for Teleport storage in `standalone` mode.
The default is left blank, which will automatically create a `PersistentVolumeClaim` to use for Teleport storage in `standalone` or `custom` mode.
<Tabs>
<TabItem label="values.yaml">
```yaml
standalone:
persistence:
existingClaimName: my-existing-pvc-name
```
</TabItem>
<TabItem label="--set">
```code
$ --set standalone.existingClaimName=my-existing-pvc-name
$ --set persistence.existingClaimName=my-existing-pvc-name
```
</TabItem>
</Tabs>
### `standalone.volumeSize`
### `persistence.volumeSize`
| Type | Default value | Can be used in `custom` mode? |
| - | - | - |
| `string` | `10Gi` | ✅ |
You can set `volumeSize` to request a different size of persistent volume when installing the Teleport chart in `standalone` mode.
You can set `volumeSize` to request a different size of persistent volume when installing the Teleport chart in `standalone` or `custom` mode.
<Admonition type="note">
`volumeSize` will be ignored if `existingClaimName` is set.
@ -448,13 +470,13 @@ You can set `volumeSize` to request a different size of persistent volume when i
<Tabs>
<TabItem label="values.yaml">
```yaml
standalone:
persistence:
volumeSize: 50Gi
```
</TabItem>
<TabItem label="--set">
```code
--set standalone.volumeSize=50Gi
--set persistence.volumeSize=50Gi
```
</TabItem>
</Tabs>

View file

@ -0,0 +1,9 @@
clusterName: test-custom-cluster
chartMode: custom
persistence:
enabled: true
volumeSize: 50Gi
acme: true
acmeEmail: test@email.com
labels:
env: custom

View file

@ -0,0 +1,9 @@
clusterName: test-custom-cluster
chartMode: custom
persistence:
enabled: true
existingClaimName: teleport-storage
acme: true
acmeEmail: test@email.com
labels:
env: custom

View file

@ -0,0 +1,4 @@
clusterName: test-persistence-cluster
standalone:
existingClaimName: ""
volumeSize: 10Gi

View file

@ -1,6 +1,7 @@
clusterName: test-standalone-cluster
chartMode: standalone
standalone:
persistence:
enabled: true
volumeSize: 50Gi
acme: true
acmeEmail: test@email.com

View file

@ -1,6 +1,7 @@
clusterName: test-standalone-cluster
chartMode: standalone
standalone:
persistence:
enabled: true
existingClaimName: teleport-storage
acme: true
acmeEmail: test@email.com

View file

@ -10,6 +10,7 @@
{{- if and .Values.acme .Values.tls.existingSecretName }}
{{- fail "Cannot set both acme.enabled and tls.existingSecretName, choose one or the other" }}
{{- end }}
{{- $persistence := (coalesce .Values.standalone .Values.persistence) -}}
apiVersion: apps/v1
kind: Deployment
metadata:
@ -230,9 +231,9 @@ spec:
configMap:
name: {{ .Release.Name }}
- name: "data"
{{- if eq .Values.chartMode "standalone" }}
{{- if and (.Values.persistence.enabled) (or (eq .Values.chartMode "standalone") (eq .Values.chartMode "custom")) }}
persistentVolumeClaim:
claimName: {{ if .Values.standalone.existingClaimName }}{{ .Values.standalone.existingClaimName }}{{ else }}{{ .Release.Name }}{{ end }}
claimName: {{ if $persistence.existingClaimName }}{{ $persistence.existingClaimName }}{{ else }}{{ .Release.Name }}{{ end }}
{{- else }}
emptyDir: {}
{{- end }}

View file

@ -1,4 +1,5 @@
{{- if and (eq .Values.chartMode "standalone") (not .Values.standalone.existingClaimName) }}
{{- $persistence := (coalesce .Values.standalone .Values.persistence) -}}
{{- if and (and (or (eq .Values.chartMode "standalone") (eq .Values.chartMode "custom")) (.Values.persistence.enabled)) (not $persistence.existingClaimName) }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
@ -11,5 +12,5 @@ spec:
- ReadWriteOnce
resources:
requests:
storage: {{ required "standalone.volumeSize is required in chart values" .Values.standalone.volumeSize }}
storage: {{ required "persistence.volumeSize is required in chart values" $persistence.volumeSize }}
{{- end }}

View file

@ -88,7 +88,52 @@ sets Pod annotations when specified:
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should add PersistentVolumeClaim as volume when in standalone mode:
should add PersistentVolumeClaim as volume when in custom mode and persistence.enabled is true:
1: |
containers:
- args:
- --diag-addr=0.0.0.0:3000
image: quay.io/gravitational/teleport:10.0.0-dev
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 6
httpGet:
path: /healthz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
name: teleport
ports:
- containerPort: 3000
name: diag
protocol: TCP
readinessProbe:
failureThreshold: 12
httpGet:
path: /readyz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumeMounts:
- mountPath: /etc/teleport
name: config
readOnly: true
- mountPath: /var/lib/teleport
name: data
serviceAccountName: RELEASE-NAME
volumes:
- name: gcp-credentials
secret:
secretName: teleport-gcp-credentials
- configMap:
name: RELEASE-NAME
name: config
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should add PersistentVolumeClaim as volume when in standalone mode and persistence.enabled is true:
1: |
containers:
- args:
@ -248,50 +293,6 @@ should add emptyDir for data in GCP mode:
name: config
- emptyDir: {}
name: data
should add emptyDir for data in custom mode:
1: |
containers:
- args:
- --diag-addr=0.0.0.0:3000
image: quay.io/gravitational/teleport:10.0.0-dev
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 6
httpGet:
path: /healthz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
name: teleport
ports:
- containerPort: 3000
name: diag
protocol: TCP
readinessProbe:
failureThreshold: 12
httpGet:
path: /readyz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumeMounts:
- mountPath: /etc/teleport
name: config
readOnly: true
- mountPath: /var/lib/teleport
name: data
serviceAccountName: RELEASE-NAME
volumes:
- name: gcp-credentials
secret:
secretName: teleport-gcp-credentials
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
should add insecureSkipProxyTLSVerify to args when set in values:
1: |
containers:
@ -338,7 +339,7 @@ should add insecureSkipProxyTLSVerify to args when set in values:
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should add named PersistentVolumeClaim as volume when in standalone mode and standalone.existingClaimName is set:
should add named PersistentVolumeClaim as volume when in custom mode and persistence.existingClaimName is set:
1: |
containers:
- args:
@ -383,6 +384,52 @@ should add named PersistentVolumeClaim as volume when in standalone mode and sta
- name: data
persistentVolumeClaim:
claimName: teleport-storage
? should add named PersistentVolumeClaim as volume when in standalone mode, persistence.existingClaimName
is set and persistence.enabled is true
: 1: |
containers:
- args:
- --diag-addr=0.0.0.0:3000
image: quay.io/gravitational/teleport:10.0.0-dev
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 6
httpGet:
path: /healthz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
name: teleport
ports:
- containerPort: 3000
name: diag
protocol: TCP
readinessProbe:
failureThreshold: 12
httpGet:
path: /readyz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumeMounts:
- mountPath: /etc/teleport
name: config
readOnly: true
- mountPath: /var/lib/teleport
name: data
serviceAccountName: RELEASE-NAME
volumes:
- name: gcp-credentials
secret:
secretName: teleport-gcp-credentials
- configMap:
name: RELEASE-NAME
name: config
- name: data
persistentVolumeClaim:
claimName: teleport-storage
should do enterprise things when when enterprise is set in values:
1: |
containers:
@ -578,8 +625,9 @@ should have multiple replicas when replicaCount is set:
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should mount ConfigMap for config in AWS mode:
1: |
affinity:
@ -737,8 +785,9 @@ should mount ConfigMap for config in custom mode:
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should mount ConfigMap for config in standalone mode:
1: |
containers:
@ -1123,8 +1172,9 @@ should mount cert-manager TLS secret when highAvailability.certManager.enabled i
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should mount extraVolumes and extraVolumeMounts:
1: |
containers:
@ -1348,6 +1398,184 @@ should mount tls.existingSecretName when set in values:
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should not add PersistentVolumeClaim as volume when in custom mode and persistence.enabled is false:
1: |
containers:
- args:
- --diag-addr=0.0.0.0:3000
image: quay.io/gravitational/teleport:10.0.0-dev
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 6
httpGet:
path: /healthz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
name: teleport
ports:
- containerPort: 3000
name: diag
protocol: TCP
readinessProbe:
failureThreshold: 12
httpGet:
path: /readyz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumeMounts:
- mountPath: /etc/teleport
name: config
readOnly: true
- mountPath: /var/lib/teleport
name: data
serviceAccountName: RELEASE-NAME
volumes:
- name: gcp-credentials
secret:
secretName: teleport-gcp-credentials
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
should not add PersistentVolumeClaim as volume when in standalone mode and persistence.enabled is false:
1: |
containers:
- args:
- --diag-addr=0.0.0.0:3000
image: quay.io/gravitational/teleport:10.0.0-dev
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 6
httpGet:
path: /healthz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
name: teleport
ports:
- containerPort: 3000
name: diag
protocol: TCP
readinessProbe:
failureThreshold: 12
httpGet:
path: /readyz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumeMounts:
- mountPath: /etc/teleport
name: config
readOnly: true
- mountPath: /var/lib/teleport
name: data
serviceAccountName: RELEASE-NAME
volumes:
- name: gcp-credentials
secret:
secretName: teleport-gcp-credentials
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
? should not add named PersistentVolumeClaim as volume when in custom mode, persistence.existingClaimName
is set and persistence.enabled is false
: 1: |
containers:
- args:
- --diag-addr=0.0.0.0:3000
image: quay.io/gravitational/teleport:10.0.0-dev
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 6
httpGet:
path: /healthz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
name: teleport
ports:
- containerPort: 3000
name: diag
protocol: TCP
readinessProbe:
failureThreshold: 12
httpGet:
path: /readyz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumeMounts:
- mountPath: /etc/teleport
name: config
readOnly: true
- mountPath: /var/lib/teleport
name: data
serviceAccountName: RELEASE-NAME
volumes:
- name: gcp-credentials
secret:
secretName: teleport-gcp-credentials
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
? should not add named PersistentVolumeClaim as volume when in standalone mode, persistence.existingClaimName
is set but persistence.enabled is false
: 1: |
containers:
- args:
- --diag-addr=0.0.0.0:3000
image: quay.io/gravitational/teleport:10.0.0-dev
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 6
httpGet:
path: /healthz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
name: teleport
ports:
- containerPort: 3000
name: diag
protocol: TCP
readinessProbe:
failureThreshold: 12
httpGet:
path: /readyz
port: diag
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 1
volumeMounts:
- mountPath: /etc/teleport
name: config
readOnly: true
- mountPath: /var/lib/teleport
name: data
serviceAccountName: RELEASE-NAME
volumes:
- name: gcp-credentials
secret:
secretName: teleport-gcp-credentials
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
should not do enterprise things when when enterprise is not set in values:
1: |
containers:
@ -1595,8 +1823,9 @@ should not have strategy in custom mode:
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should not mount TLS secrets when when highAvailability.certManager.enabled is false and tls.existingSecretName is not set:
1: |
containers:
@ -1766,8 +1995,9 @@ should set affinity when set in values:
- configMap:
name: RELEASE-NAME
name: config
- emptyDir: {}
name: data
- name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
should set environment when extraEnv set in values:
1: |
containers:

View file

@ -1,3 +1,18 @@
creates a PersistentVolumeClaim when chartMode=custom:
1: |
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: RELEASE-NAME
name: RELEASE-NAME
namespace: NAMESPACE
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
creates a PersistentVolumeClaim when chartMode=standalone:
1: |
apiVersion: v1
@ -13,6 +28,21 @@ creates a PersistentVolumeClaim when chartMode=standalone:
resources:
requests:
storage: 10Gi
creates a PersistentVolumeClaim with values from custom-customsize.yaml:
1: |
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: RELEASE-NAME
name: RELEASE-NAME
namespace: NAMESPACE
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 50Gi
creates a PersistentVolumeClaim with values from standalone-customsize.yaml:
1: |
apiVersion: v1

View file

@ -491,10 +491,12 @@ tests:
- matchSnapshot:
path: spec.template.spec
- it: should add PersistentVolumeClaim as volume when in standalone mode
- it: should add PersistentVolumeClaim as volume when in standalone mode and persistence.enabled is true
set:
chartMode: standalone
clusterName: helm-lint.example.com
persistence:
enabled: true
asserts:
- contains:
path: spec.template.spec.volumes
@ -505,7 +507,55 @@ tests:
- matchSnapshot:
path: spec.template.spec
- it: should add named PersistentVolumeClaim as volume when in standalone mode and standalone.existingClaimName is set
- it: should not add PersistentVolumeClaim as volume when in standalone mode and persistence.enabled is false
set:
chartMode: standalone
clusterName: helm-lint.example.com
persistence:
enabled: false
asserts:
- notContains:
path: spec.template.spec.volumes
content:
name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
- matchSnapshot:
path: spec.template.spec
- it: should add PersistentVolumeClaim as volume when in custom mode and persistence.enabled is true
set:
chartMode: custom
clusterName: helm-lint.example.com
persistence:
enabled: true
asserts:
- contains:
path: spec.template.spec.volumes
content:
name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
- matchSnapshot:
path: spec.template.spec
- it: should not add PersistentVolumeClaim as volume when in custom mode and persistence.enabled is false
set:
chartMode: custom
clusterName: helm-lint.example.com
persistence:
enabled: false
asserts:
- notContains:
path: spec.template.spec.volumes
content:
name: data
persistentVolumeClaim:
claimName: RELEASE-NAME
- matchSnapshot:
path: spec.template.spec
- it: should add named PersistentVolumeClaim as volume when in standalone mode, persistence.existingClaimName is set and persistence.enabled is true
values:
- ../.lint/standalone-existingpvc.yaml
asserts:
@ -518,6 +568,51 @@ tests:
- matchSnapshot:
path: spec.template.spec
- it: should not add named PersistentVolumeClaim as volume when in standalone mode, persistence.existingClaimName is set but persistence.enabled is false
values:
- ../.lint/standalone-existingpvc.yaml
set:
persistence:
enabled: false
asserts:
- notContains:
path: spec.template.spec.volumes
content:
name: data
persistentVolumeClaim:
claimName: teleport-storage
- matchSnapshot:
path: spec.template.spec
- it: should add named PersistentVolumeClaim as volume when in custom mode and persistence.existingClaimName is set
values:
- ../.lint/standalone-existingpvc.yaml
asserts:
- contains:
path: spec.template.spec.volumes
content:
name: data
persistentVolumeClaim:
claimName: teleport-storage
- matchSnapshot:
path: spec.template.spec
- it: should not add named PersistentVolumeClaim as volume when in custom mode, persistence.existingClaimName is set and persistence.enabled is false
values:
- ../.lint/standalone-existingpvc.yaml
set:
persistence:
enabled: false
asserts:
- notContains:
path: spec.template.spec.volumes
content:
name: data
persistentVolumeClaim:
claimName: teleport-storage
- matchSnapshot:
path: spec.template.spec
- it: should add emptyDir for data in AWS mode
values:
- ../.lint/aws-ha.yaml
@ -542,19 +637,6 @@ tests:
- matchSnapshot:
path: spec.template.spec
- it: should add emptyDir for data in custom mode
set:
chartMode: custom
clusterName: helm-lint.example.com
asserts:
- contains:
path: spec.template.spec.volumes
content:
name: data
emptyDir: {}
- matchSnapshot:
path: spec.template.spec
- it: should set priorityClassName when set in values
values:
- ../.lint/priority-class-name.yaml

View file

@ -14,6 +14,18 @@ tests:
of: PersistentVolumeClaim
- matchSnapshot: {}
- it: creates a PersistentVolumeClaim when chartMode=custom
set:
chartMode: custom
asserts:
- template: pvc.yaml
hasDocuments:
count: 1
- template: pvc.yaml
isKind:
of: PersistentVolumeClaim
- matchSnapshot: {}
- it: creates a PersistentVolumeClaim with values from standalone-customsize.yaml
values:
- ../.lint/standalone-customsize.yaml
@ -27,10 +39,32 @@ tests:
value: 50Gi
- matchSnapshot: {}
- it: creates a PersistentVolumeClaim with values from custom-customsize.yaml
values:
- ../.lint/custom-customsize.yaml
asserts:
- hasDocuments:
count: 1
- isKind:
of: PersistentVolumeClaim
- equal:
path: spec.resources.requests.storage
value: 50Gi
- matchSnapshot: {}
- it: does not create a PersistentVolumeClaim when chartMode=standalone and existingClaimName is not blank
set:
chartMode: standalone
standalone:
persistence:
existingClaimName: test-claim
asserts:
- hasDocuments:
count: 0
- it: does not create a PersistentVolumeClaim when chartMode=custom and existingClaimName is not blank
set:
chartMode: custom
persistence:
existingClaimName: test-claim
asserts:
- hasDocuments:
@ -43,6 +77,13 @@ tests:
- hasDocuments:
count: 0
- it: does not create a PersistentVolumeClaim with values from custom-existingpvc.yaml
values:
- ../.lint/custom-existingpvc.yaml
asserts:
- hasDocuments:
count: 0
- it: does not create a PersistentVolumeClaim when chartMode=aws
set:
chartMode: aws
@ -56,10 +97,3 @@ tests:
asserts:
- hasDocuments:
count: 0
- it: does not create a PersistentVolumeClaim when chartMode=custom
set:
chartMode: custom
asserts:
- hasDocuments:
count: 0

View file

@ -153,6 +153,31 @@
}
}
},
"persistence": {
"$id": "#/properties/persistence",
"type": "object",
"required": [
"enabled",
"volumeSize"
],
"properties": {
"enabled": {
"$id": "#/properties/persistence/properties/enabled",
"type": "boolean",
"default": "true"
},
"existingClaimName": {
"$id": "#/properties/persistence/properties/existingClaimName",
"type": "string",
"default": ""
},
"volumeSize": {
"$id": "#/properties/persistence/properties/volumeSize",
"type": "string",
"default": ""
}
}
},
"aws": {
"$id": "#/properties/aws",
"type": "object",

View file

@ -74,10 +74,12 @@ labels: {}
# kubectl -n ${TELEPORT_NAMESPACE?} create configmap ${HELM_RELEASE_NAME?} --from-file=teleport.yaml
chartMode: standalone
################################################################
# Standalone-specific settings (only used in "standalone" mode)
################################################################
standalone:
######################################################################
# Persistence settings (only used in "standalone" and "custom" modes)
######################################################################
persistence:
# Enable persistence using a PersistentVolumeClaim
enabled: true
# Leave blank to automatically create a PersistentVolumeClaim for Teleport storage.
# If you would like to use a pre-existing PersistentVolumeClaim, put its name here.
existingClaimName: ""