run mr containers as non root user
[oom.git] / kubernetes / dmaap / components / message-router / charts / message-router-kafka / templates / statefulset.yaml
1 # Copyright © 2017 Amdocs, Bell Canada
2 # Modifications Copyright © 2018 AT&T
3 #
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
7 #
8 #       http://www.apache.org/licenses/LICENSE-2.0
9 #
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
15
16 apiVersion: apps/v1beta1
17 kind: StatefulSet
18 metadata:
19   name: {{ include "common.fullname" . }}
20   namespace: {{ include "common.namespace" . }}
21   labels:
22     app: {{ include "common.name" . }}
23     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
24     release: {{ .Release.Name }}
25     heritage: {{ .Release.Service }}
26 spec:
27   serviceName: {{ .Values.service.name }}
28   replicas: {{ .Values.replicaCount }}
29   podManagementPolicy: Parallel
30   template:
31     metadata:
32       labels:
33         app:  {{ include "common.name" . }}
34         release: {{ .Release.Name }}
35     spec:
36       podAntiAffinity:
37          {{if eq .Values.podAntiAffinityType "hard" -}}
38          requiredDuringSchedulingIgnoredDuringExecution:
39          {{- else -}}
40          preferredDuringSchedulingIgnoredDuringExecution:
41          {{- end}}
42          - weight: 1
43            podAffinityTerm:
44              labelSelector:
45                 matchExpressions:
46                   - key: "app"
47                     operator: In
48                     values:
49                     - {{ include "common.name" . }}
50              topologyKey: "kubernetes.io/hostname"
51       {{- if .Values.nodeAffinity }}
52       nodeAffinity:
53         {{ toYaml .Values.nodeAffinity | indent 10 }}
54       {{- end }}
55       initContainers:
56       - name: {{ include "common.name" . }}-initcontainer
57         image: "{{ .Values.global.ubuntuInitRepository }}/{{ .Values.ubuntuInitImage }}"
58         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
59       - command:
60         - /root/ready.py
61         args:
62         - --container-name
63         - {{ .Values.zookeeper.name }}
64         env:
65         - name: NAMESPACE
66           valueFrom:
67             fieldRef:
68               apiVersion: v1
69               fieldPath: metadata.namespace
70         image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
71         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
72         name: {{ include "common.name" . }}-readiness
73       - command:
74         -  sh
75         - -exec
76         - |
77           chown -R 1000:1000 /opt/kafka/data;
78         image: "{{ .Values.busyBoxRepository }}/{{ .Values.busyBoxImage }}"
79         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
80         volumeMounts:
81         - mountPath: /opt/kafka/data
82           name: kafka-data
83         name: {{ include "common.name" . }}-permission-fixer
84       containers:
85       - name: {{ include "common.name" .  }}
86         image: "{{ include "common.repository" . }}/{{ .Values.image }}"
87         imagePullPolicy:  {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
88         command:
89         - sh
90         - -exc
91         - |
92           export KAFKA_BROKER_ID=${HOSTNAME##*-} && \
93           export ENDPOINT_PORT=$(( $KAFKA_BROKER_ID + {{ .Values.service.baseNodePort }} )) && \
94           export KAFKA_ADVERTISED_LISTENERS=EXTERNAL_SASL_PLAINTEXT://$(HOST_IP):$(( $KAFKA_BROKER_ID + {{ .Values.service.baseNodePort }} )),INTERNAL_SASL_PLAINTEXT://:{{ .Values.service.internalPort }} && \
95           exec start-kafka.sh
96         resources:
97 {{ include "common.resources" . | indent 12 }}
98         ports:
99         - containerPort: {{ .Values.service.internalPort }}
100         - containerPort: {{ .Values.service.externalPort }}
101        {{ if eq .Values.liveness.enabled true }}
102         livenessProbe:
103           tcpSocket:
104             port: {{ .Values.service.internalPort }}
105           initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
106           periodSeconds: {{ .Values.liveness.periodSeconds }}
107         {{ end }}
108         readinessProbe:
109           tcpSocket:
110             port: {{ .Values.service.internalPort }}
111           initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
112           periodSeconds: {{ .Values.readiness.periodSeconds }}
113         env:
114         - name: HOST_IP
115           valueFrom:
116             fieldRef:
117               apiVersion: v1
118               fieldPath: status.hostIP
119         - name: KAFKA_ZOOKEEPER_CONNECT
120           value: "{{.Values.zookeeper.name}}:{{.Values.zookeeper.port}}"
121         - name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP
122           value: "INTERNAL_SASL_PLAINTEXT:SASL_PLAINTEXT,EXTERNAL_SASL_PLAINTEXT:SASL_PLAINTEXT"
123         - name: KAFKA_LISTENERS
124           value: "EXTERNAL_SASL_PLAINTEXT://0.0.0.0:{{ .Values.service.externalPort }},INTERNAL_SASL_PLAINTEXT://0.0.0.0:{{ .Values.service.internalPort }}"
125         - name: KAFKA_INTER_BROKER_LISTENER_NAME
126           value: "INTERNAL_SASL_PLAINTEXT"
127         - name: KAFKA_SASL_ENABLED_MECHANISMS
128           value: "PLAIN"
129         - name: KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL
130           value: "PLAIN"
131         - name: KAFKA_AUTHORIZER_CLASS_NAME
132           value: "{{ .Values.kafkaCustomAuthorizer }}"
133         - name: KAFKA_DELETE_TOPIC_ENABLE
134           value: "{{ .Values.deleteTopicEnable }}"
135         - name: aaf_locate_url
136           value: "https://aaf-locate:8095"
137         - name: KAFKA_LOG_DIRS
138           value: "/opt/kafka/data"
139         - name: KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR
140           value: "{{ .Values.replicaCount }}"
141         - name: KAFKA_DEFAULT_REPLICATION_FACTOR
142           value: "{{ .Values.replicaCount }}"
143         - name: KAFKA_NUM_PARTITIONS
144           value: "{{ .Values.defaultpartitions }}"
145         volumeMounts:
146         - mountPath: /etc/localtime
147           name: localtime
148           readOnly: true
149         - mountPath: /var/run/docker.sock
150           name: docker-socket
151         - mountPath: /opt/kafka/data
152           name: kafka-data
153       {{- if .Values.tolerations }}
154       tolerations:
155         {{ toYaml .Values.tolerations | indent 10 }}
156       {{- end }}
157       volumes:
158       - name: localtime
159         hostPath:
160           path: /etc/localtime
161       - name: docker-socket
162         hostPath:
163           path: /var/run/docker.sock
164 {{ if not .Values.persistence.enabled }}
165       - name: kafka-data
166         emptyDir: {}
167 {{ else }}
168   volumeClaimTemplates:
169     - metadata:
170         name: kafka-data
171         labels:
172           app: {{ include "common.fullname" . }}
173           chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
174           release: "{{ .Release.Name }}"
175           heritage: "{{ .Release.Service }}"
176       spec:
177         accessModes:
178           - {{ .Values.persistence.accessMode | quote }}
179         resources:
180           requests:
181             storage: {{ .Values.persistence.size | quote }}
182         selector:
183           matchLabels:
184             release: "{{ .Release.Name }}"
185             app: {{ .Values.service.name }}
186             chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
187             heritage: "{{ .Release.Service }}"
188 {{ end }}
189       imagePullSecrets:
190       - name: "{{ include "common.namespace" . }}-docker-registry-key"