-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added operator files #253
base: main
Are you sure you want to change the base?
Added operator files #253
Changes from all commits
15c16c3
245fc9d
8f18cbb
63ce6c8
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
FROM quay.io/opstree/redis:v7.0.15 AS redis | ||
|
||
FROM falkordb/falkordb:latest AS falkordb | ||
|
||
RUN apt update && apt install -y libstdc++6 libgomp1 | ||
COPY --from=redis /usr/bin/entrypoint.sh /usr/bin/entrypoint.sh | ||
COPY --from=redis /node-conf /node-conf/ | ||
COPY --from=redis /etc/redis/ /etc/redis/ | ||
ENTRYPOINT [ "/usr/bin/entrypoint.sh" ] |
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,41 @@ | ||||||||||||||||||||||||||||||||||||||||||
### REDIS OPERATOR | ||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
## Why ? | ||||||||||||||||||||||||||||||||||||||||||
- The number of maintainers of the project. | ||||||||||||||||||||||||||||||||||||||||||
- taking control of several deployment aspects that today only omnistrate has control of. | ||||||||||||||||||||||||||||||||||||||||||
- we dont have to create a separate sharding script. | ||||||||||||||||||||||||||||||||||||||||||
- we don't to create a rebalancer instance. | ||||||||||||||||||||||||||||||||||||||||||
- less manual configuration. | ||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
## Features that are added/to be added: | ||||||||||||||||||||||||||||||||||||||||||
- [x] Now the operator supports the use of wild card with TLS certificates (*.namespace). | ||||||||||||||||||||||||||||||||||||||||||
- [ ] Working on adding host port for the pods (kubernetes) to allow direct communication using the port of the pod (kubernetes) and the public ip of the VM (node). | ||||||||||||||||||||||||||||||||||||||||||
- [ ] Fix the FLUSHALL command that causes the data loss when doing a helm uninstall and reinstall. | ||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
## Important points/aspects of the operator to take into consideration: | ||||||||||||||||||||||||||||||||||||||||||
- [ ] TLS creation is going to be our responsibility. | ||||||||||||||||||||||||||||||||||||||||||
- [ ] We have to take care of the kubernetes services (operator only creates one that forwards to all pods). | ||||||||||||||||||||||||||||||||||||||||||
- [ ] The helm charts are not up to date, meaning adding some options to the values yaml are not reflected in the created CRD, we have to create the CRD and edit. | ||||||||||||||||||||||||||||||||||||||||||
- [ ] We have to override the Liveness and Readiness probes to fit our needs. | ||||||||||||||||||||||||||||||||||||||||||
- [ ] We have to take care of POD distribution in multizone and zone enforcement in singlezone. | ||||||||||||||||||||||||||||||||||||||||||
- [ ] Data loss when doing a helm uninstall due to the FLUSHALL command (temp fix: rename the command) | ||||||||||||||||||||||||||||||||||||||||||
- [ ] We still need a CRON job to issue a BGRWRITEAOF | ||||||||||||||||||||||||||||||||||||||||||
Comment on lines
+15
to
+22
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Add security considerations to the important aspects list. The list of important aspects should include security considerations such as network policies, RBAC, and secrets management. ## Important points/aspects of the operator to take into consideration:
- [ ] TLS creation is going to be our responsibility.
- [ ] We have to take care of the kubernetes services (operator only creates one that forwards to all pods).
+- [ ] Implement network policies to restrict pod-to-pod communication
+- [ ] Configure RBAC permissions for the operator
+- [ ] Set up proper secrets rotation mechanism
+- [ ] Enable audit logging for sensitive operations 📝 Committable suggestion
Suggested change
🧰 Tools🪛 LanguageTool[style] ~15-~15: The phrase “take into consideration” may be wordy. To make your writing clearer, consider replacing it. (TAKE_INTO_CONSIDERATION) [style] ~16-~16: Use ‘will’ instead of ‘going to’ if the following action is certain. (GOING_TO_WILL) [uncategorized] ~18-~18: It appears that hyphens are missing in the adjective “up-to-date”. (UP_TO_DATE_HYPHEN) 🪛 markdownlint-cli2 (0.17.2)15-15: Trailing punctuation in heading (MD026, no-trailing-punctuation) |
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
## How to deploy: | ||||||||||||||||||||||||||||||||||||||||||
RUN the follwing commands: | ||||||||||||||||||||||||||||||||||||||||||
1) - `helm repo add ot-helm https://ot-container-kit.github.io/helm-charts/` | ||||||||||||||||||||||||||||||||||||||||||
2) - `helm repo update` | ||||||||||||||||||||||||||||||||||||||||||
3) - `helm show values ot-helm/redis > standaloneValues.yaml` (This can be skipped if we want to edit the standaloneCRD.yaml directly) | ||||||||||||||||||||||||||||||||||||||||||
4) - override the values you want | ||||||||||||||||||||||||||||||||||||||||||
5) - `helm template standalone ot-helm -f standaloneValues.yaml > standaloneCRD.yaml` | ||||||||||||||||||||||||||||||||||||||||||
6) - add `hostPort: 6379`,affinity and other setting to the spec in standaloneCRD.ymal | ||||||||||||||||||||||||||||||||||||||||||
7) - take the standaloneCRD.yaml and replace the relevant components in operator-example-standalone.yaml | ||||||||||||||||||||||||||||||||||||||||||
8) - add the secret to the supplementalFiles section in operator-example-standalone.yaml | ||||||||||||||||||||||||||||||||||||||||||
9) - make sure to use the right syntax for variables in the operator-example-standalone.yaml | ||||||||||||||||||||||||||||||||||||||||||
10) - login to omnistrate-cli | ||||||||||||||||||||||||||||||||||||||||||
11) - build the release | ||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
## relevant repos: | ||||||||||||||||||||||||||||||||||||||||||
1) - falkordb/helm-charts | ||||||||||||||||||||||||||||||||||||||||||
2) - falkordb/redis-operator |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,160 @@ | ||
# yaml-language-server: $schema=https://api.omnistrate.cloud/2022-09-01-00/schema/service-spec-schema.json | ||
name: Redis Operator # Service Plan Name | ||
deployment: | ||
hostedDeployment: | ||
GcpProjectId: "" | ||
GcpProjectNumber: "" | ||
GcpServiceAccountEmail: "" | ||
|
||
services: | ||
- name: Standalone | ||
network: | ||
ports: | ||
- 6379 | ||
endpointConfiguration: | ||
cluster: | ||
host: "$sys.network.externalClusterEndpoint" | ||
ports: | ||
- 6379 | ||
primary: true | ||
networkingType: PUBLIC | ||
operatorCRDConfiguration: | ||
template: | | ||
# Source: redis/templates/redis-standalone.yaml | ||
apiVersion: redis.redis.opstreelabs.in/v1beta2 | ||
kind: Redis | ||
metadata: | ||
name: standalone | ||
labels: | ||
app.kubernetes.io/name: standalone | ||
helm.sh/chart: redis-0.16.5 | ||
app.kubernetes.io/managed-by: Helm | ||
app.kubernetes.io/instance: standalone | ||
app.kubernetes.io/version: 0.16.5 | ||
app.kubernetes.io/component: middleware | ||
annotations: | ||
|
||
spec: | ||
hostPort: 6379 | ||
kubernetesConfig: | ||
image: "falkordb/redis:latest" | ||
imagePullPolicy: "IfNotPresent" | ||
resources: | ||
limits: | ||
cpu: 400m | ||
memory: 2Gi | ||
requests: | ||
cpu: 400m | ||
memory: 400Mi | ||
redisSecret: | ||
name: "redis-password" | ||
key: "password" | ||
|
||
redisExporter: | ||
enabled: false | ||
image: "quay.io/opstree/redis-exporter:v1.44.0" | ||
imagePullPolicy: "IfNotPresent" | ||
redisConfig: | ||
additionalRedisConfig: "standalone-ext-config" | ||
storage: | ||
keepAfterDelete: false | ||
volumeClaimTemplate: | ||
spec: | ||
accessModes: | ||
- ReadWriteOnce | ||
resources: | ||
requests: | ||
storage: 1Gi | ||
podSecurityContext: | ||
fsGroup: 1000 | ||
runAsUser: 1000 | ||
env: | ||
- name: NODE_EXTERNAL_ENDPOINT | ||
value: {{$sys.network.node.externalEndpoint}} | ||
affinity: | ||
nodeAffinity: | ||
requiredDuringSchedulingIgnoredDuringExecution: | ||
nodeSelectorTerms: | ||
- matchExpressions: | ||
- key: omnistrate.com/managed-by | ||
operator: In | ||
values: | ||
- omnistrate | ||
- key: topology.kubernetes.io/region | ||
operator: In | ||
values: | ||
- {{$sys.deploymentCell.region}} | ||
- key: node.kubernetes.io/instance-type | ||
operator: In | ||
values: | ||
- {{$sys.compute.node.instanceType}} | ||
- key: omnistrate.com/resource | ||
operator: In | ||
values: | ||
- {{$sys.deployment.resourceID}} | ||
|
||
|
||
|
||
|
||
supplementalFiles: | ||
- | | ||
apiVersion: v1 | ||
data: | ||
password: ZmFsa29yZGI= | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. How can we have this generate a random value and not be hardcoded? |
||
kind: Secret | ||
metadata: | ||
name: redis-password | ||
namespace: {{$sys.id}} | ||
type: Opaque | ||
Comment on lines
+100
to
+108
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Enhance password security. The Redis password is only base64 encoded ( Recommendations:
|
||
|
||
- | | ||
# Source: redis/templates/extra-config.yaml | ||
apiVersion: v1 | ||
kind: ConfigMap | ||
metadata: | ||
name: standalone-ext-config | ||
namespace: {{$sys.id}} | ||
labels: | ||
app.kubernetes.io/name: standalone | ||
helm.sh/chart: redis-0.16.5 | ||
app.kubernetes.io/managed-by: Helm | ||
app.kubernetes.io/instance: standalone | ||
app.kubernetes.io/version: 0.16.5 | ||
app.kubernetes.io/component: middleware | ||
data: | ||
redis-additional.conf: | | ||
loadmodule /FalkorDB/bin/src/falkordb.so | ||
- | | ||
# Source: redis/templates/service.yaml | ||
apiVersion: v1 | ||
kind: Service | ||
metadata: | ||
name: standalone-external-service | ||
namespace: {{$sys.id}} | ||
annotations: | ||
external-dns.alpha.kubernetes.io/hostname: {{$sys.network.externalClusterEndpoint}} | ||
external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP | ||
labels: | ||
app.kubernetes.io/name: standalone | ||
helm.sh/chart: redis-0.16.5 | ||
app.kubernetes.io/managed-by: Helm | ||
app.kubernetes.io/instance: standalone | ||
app.kubernetes.io/version: 0.16.5 | ||
app.kubernetes.io/component: middleware | ||
spec: | ||
clusterIP: None | ||
selector: | ||
app: standalone | ||
redis_setup_type: standalone | ||
role: standalone | ||
ports: | ||
- protocol: TCP | ||
port: 6379 | ||
targetPort: 6379 | ||
name: clients | ||
|
||
helmChartDependencies: | ||
- chartName: redis-operator | ||
chartVersion: 0.19.2 | ||
chartRepoName: falkordb | ||
chartRepoURL: "https://falkordb.github.io/helm-charts/" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Use official Redis image instead of personal repository.
Using a personal Docker repository poses security and reliability risks. Consider using the official Redis image.
📝 Committable suggestion