Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added operator files #253

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions operator/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
FROM quay.io/opstree/redis:v7.0.15 AS redis
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Use official Redis image instead of personal repository.

Using a personal Docker repository poses security and reliability risks. Consider using the official Redis image.

-FROM quay.io/opstree/redis:v7.0.15 AS redis
+FROM redis:7.2-alpine AS redis
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
FROM quay.io/opstree/redis:v7.0.15 AS redis
FROM redis:7.2-alpine AS redis


FROM falkordb/falkordb:latest AS falkordb

RUN apt update && apt install -y libstdc++6 libgomp1
COPY --from=redis /usr/bin/entrypoint.sh /usr/bin/entrypoint.sh
COPY --from=redis /node-conf /node-conf/
COPY --from=redis /etc/redis/ /etc/redis/
ENTRYPOINT [ "/usr/bin/entrypoint.sh" ]
41 changes: 41 additions & 0 deletions operator/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
### REDIS OPERATOR

## Why ?
- The number of maintainers of the project.
- taking control of several deployment aspects that today only omnistrate has control of.
- we dont have to create a separate sharding script.
- we don't to create a rebalancer instance.
- less manual configuration.

## Features that are added/to be added:
- [x] Now the operator supports the use of wild card with TLS certificates (*.namespace).
- [ ] Working on adding host port for the pods (kubernetes) to allow direct communication using the port of the pod (kubernetes) and the public ip of the VM (node).
- [ ] Fix the FLUSHALL command that causes the data loss when doing a helm uninstall and reinstall.

## Important points/aspects of the operator to take into consideration:
- [ ] TLS creation is going to be our responsibility.
- [ ] We have to take care of the kubernetes services (operator only creates one that forwards to all pods).
- [ ] The helm charts are not up to date, meaning adding some options to the values yaml are not reflected in the created CRD, we have to create the CRD and edit.
- [ ] We have to override the Liveness and Readiness probes to fit our needs.
- [ ] We have to take care of POD distribution in multizone and zone enforcement in singlezone.
- [ ] Data loss when doing a helm uninstall due to the FLUSHALL command (temp fix: rename the command)
- [ ] We still need a CRON job to issue a BGRWRITEAOF
Comment on lines +15 to +22
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add security considerations to the important aspects list.

The list of important aspects should include security considerations such as network policies, RBAC, and secrets management.

 ## Important points/aspects of the operator to take into consideration:
 - [ ] TLS creation is going to be our responsibility.
 - [ ] We have to take care of the kubernetes services (operator only creates one that forwards to all pods).
+- [ ] Implement network policies to restrict pod-to-pod communication
+- [ ] Configure RBAC permissions for the operator
+- [ ] Set up proper secrets rotation mechanism
+- [ ] Enable audit logging for sensitive operations
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## Important points/aspects of the operator to take into consideration:
- [ ] TLS creation is going to be our responsibility.
- [ ] We have to take care of the kubernetes services (operator only creates one that forwards to all pods).
- [ ] The helm charts are not up to date, meaning adding some options to the values yaml are not reflected in the created CRD, we have to create the CRD and edit.
- [ ] We have to override the Liveness and Readiness probes to fit our needs.
- [ ] We have to take care of POD distribution in multizone and zone enforcement in singlezone.
- [ ] Data loss when doing a helm uninstall due to the FLUSHALL command (temp fix: rename the command)
- [ ] We still need a CRON job to issue a BGRWRITEAOF
## Important points/aspects of the operator to take into consideration:
- [ ] TLS creation is going to be our responsibility.
- [ ] We have to take care of the kubernetes services (operator only creates one that forwards to all pods).
- [ ] Implement network policies to restrict pod-to-pod communication
- [ ] Configure RBAC permissions for the operator
- [ ] Set up proper secrets rotation mechanism
- [ ] Enable audit logging for sensitive operations
- [ ] The helm charts are not up to date, meaning adding some options to the values yaml are not reflected in the created CRD, we have to create the CRD and edit.
- [ ] We have to override the Liveness and Readiness probes to fit our needs.
- [ ] We have to take care of POD distribution in multizone and zone enforcement in singlezone.
- [ ] Data loss when doing a helm uninstall due to the FLUSHALL command (temp fix: rename the command)
- [ ] We still need a CRON job to issue a BGRWRITEAOF
🧰 Tools
🪛 LanguageTool

[style] ~15-~15: The phrase “take into consideration” may be wordy. To make your writing clearer, consider replacing it.
Context: ...rtant points/aspects of the operator to take into consideration: - [ ] TLS creation is going to be our ...

(TAKE_INTO_CONSIDERATION)


[style] ~16-~16: Use ‘will’ instead of ‘going to’ if the following action is certain.
Context: ... into consideration: - [ ] TLS creation is going to be our responsibility. - [ ] We have to...

(GOING_TO_WILL)


[uncategorized] ~18-~18: It appears that hyphens are missing in the adjective “up-to-date”.
Context: ...ll pods). - [ ] The helm charts are not up to date, meaning adding some options to the val...

(UP_TO_DATE_HYPHEN)

🪛 markdownlint-cli2 (0.17.2)

15-15: Trailing punctuation in heading
Punctuation: ':'

(MD026, no-trailing-punctuation)


## How to deploy:
RUN the follwing commands:
1) - `helm repo add ot-helm https://ot-container-kit.github.io/helm-charts/`
2) - `helm repo update`
3) - `helm show values ot-helm/redis > standaloneValues.yaml` (This can be skipped if we want to edit the standaloneCRD.yaml directly)
4) - override the values you want
5) - `helm template standalone ot-helm -f standaloneValues.yaml > standaloneCRD.yaml`
6) - add `hostPort: 6379`,affinity and other setting to the spec in standaloneCRD.ymal
7) - take the standaloneCRD.yaml and replace the relevant components in operator-example-standalone.yaml
8) - add the secret to the supplementalFiles section in operator-example-standalone.yaml
9) - make sure to use the right syntax for variables in the operator-example-standalone.yaml
10) - login to omnistrate-cli
11) - build the release


## relevant repos:
1) - falkordb/helm-charts
2) - falkordb/redis-operator
160 changes: 160 additions & 0 deletions operator/operator-example-standalone.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,160 @@
# yaml-language-server: $schema=https://api.omnistrate.cloud/2022-09-01-00/schema/service-spec-schema.json
name: Redis Operator # Service Plan Name
deployment:
hostedDeployment:
GcpProjectId: ""
GcpProjectNumber: ""
GcpServiceAccountEmail: ""

services:
- name: Standalone
network:
ports:
- 6379
endpointConfiguration:
cluster:
host: "$sys.network.externalClusterEndpoint"
ports:
- 6379
primary: true
networkingType: PUBLIC
operatorCRDConfiguration:
template: |
# Source: redis/templates/redis-standalone.yaml
apiVersion: redis.redis.opstreelabs.in/v1beta2
kind: Redis
metadata:
name: standalone
labels:
app.kubernetes.io/name: standalone
helm.sh/chart: redis-0.16.5
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: standalone
app.kubernetes.io/version: 0.16.5
app.kubernetes.io/component: middleware
annotations:

spec:
hostPort: 6379
kubernetesConfig:
image: "falkordb/redis:latest"
imagePullPolicy: "IfNotPresent"
resources:
limits:
cpu: 400m
memory: 2Gi
requests:
cpu: 400m
memory: 400Mi
redisSecret:
name: "redis-password"
key: "password"

redisExporter:
enabled: false
image: "quay.io/opstree/redis-exporter:v1.44.0"
imagePullPolicy: "IfNotPresent"
redisConfig:
additionalRedisConfig: "standalone-ext-config"
storage:
keepAfterDelete: false
volumeClaimTemplate:
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
podSecurityContext:
fsGroup: 1000
runAsUser: 1000
env:
- name: NODE_EXTERNAL_ENDPOINT
value: {{$sys.network.node.externalEndpoint}}
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: omnistrate.com/managed-by
operator: In
values:
- omnistrate
- key: topology.kubernetes.io/region
operator: In
values:
- {{$sys.deploymentCell.region}}
- key: node.kubernetes.io/instance-type
operator: In
values:
- {{$sys.compute.node.instanceType}}
- key: omnistrate.com/resource
operator: In
values:
- {{$sys.deployment.resourceID}}




supplementalFiles:
- |
apiVersion: v1
data:
password: ZmFsa29yZGI=
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How can we have this generate a random value and not be hardcoded?

kind: Secret
metadata:
name: redis-password
namespace: {{$sys.id}}
type: Opaque
Comment on lines +100 to +108
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Enhance password security.

The Redis password is only base64 encoded (ZmFsa29yZGI=), which is easily reversible.

Recommendations:

  1. Use a secure password generator
  2. Consider using a secrets management system
  3. Rotate passwords regularly
  4. Don't commit passwords, even if encoded


- |
# Source: redis/templates/extra-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: standalone-ext-config
namespace: {{$sys.id}}
labels:
app.kubernetes.io/name: standalone
helm.sh/chart: redis-0.16.5
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: standalone
app.kubernetes.io/version: 0.16.5
app.kubernetes.io/component: middleware
data:
redis-additional.conf: |
loadmodule /FalkorDB/bin/src/falkordb.so
- |
# Source: redis/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: standalone-external-service
namespace: {{$sys.id}}
annotations:
external-dns.alpha.kubernetes.io/hostname: {{$sys.network.externalClusterEndpoint}}
external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
labels:
app.kubernetes.io/name: standalone
helm.sh/chart: redis-0.16.5
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: standalone
app.kubernetes.io/version: 0.16.5
app.kubernetes.io/component: middleware
spec:
clusterIP: None
selector:
app: standalone
redis_setup_type: standalone
role: standalone
ports:
- protocol: TCP
port: 6379
targetPort: 6379
name: clients

helmChartDependencies:
- chartName: redis-operator
chartVersion: 0.19.2
chartRepoName: falkordb
chartRepoURL: "https://falkordb.github.io/helm-charts/"
Loading
Loading