pulsar-helm-chart/charts/pulsar/templates/toolset-statefulset.yaml
Bruno Domenici a9f2ba76ae
OpenID: introducing support for OpenID configuration (#509)
* feat!(openid): introducing support for openid configuration

BREAKING CHANGE: provider configuration changed from auth.authentication.provider to auth.authentication.jwt.enabled

* add upgrading to 4.1.0

* add validation for deprecated values

* add openid CI with keycloak

* fix chart-testing lint new-line-at-end-of-file

* fix keycloak dependency repository

* fix keycloak repository

* fix yaml to json convert error

* disable keycloak to validate github actions before re-enable it

* disable openid test scenario

* disable keycloak in values

* enable keycloak without authentication and authorization

* add openid test scenario

* disable test scenario other than openid

* enable all test scenario

* disable functions component

* create openid resources

* test truncate command

* test truncate command

* change client_secret generator

* change client_secret generator

* test python

* fix script

* fix script

* print python result

* test python

* test python

* fix client_secret generation

* fix create openid resources

* fix secret name

* fix mount keycloak config

* fix keycloak service

* exclude keycloak from chart

* add license

* add license

* wait keycloak is alive

* fix keycloak chart install namespace

* add test pulsar real openid config

* fix keycloak issuer url

* fix pod name

* remove check keycloak alive

* check realm pulsar openid configuration

* change keycloak service

* remove test keyclock service

* remove selector to get all pod log

* wait keycloak is alive

* check keycloak realm pulsar urls

* wait until keycloak is ready

* add wait timeout

* fix realm pulsar name

* add log to debug

* add openid for toolset

* set authorization

* set authorization

* fix client template filename

* fix install keycloak

* disable authorization

* debug sub claim value

* fix sub claim value

* cleanup

* enable all build

---------

Co-authored-by: glecroc <guillaume.lecroc@cnp.fr>
2025-05-20 14:09:12 +03:00

144 lines
5.7 KiB
YAML

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
#
{{- if .Values.components.toolset }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.toolset.component }}"
namespace: {{ template "pulsar.namespace" . }}
annotations: {{ .Values.toolset.appAnnotations | toYaml | nindent 4 }}
labels:
{{- include "pulsar.standardLabels" . | nindent 4 }}
component: {{ .Values.toolset.component }}
spec:
serviceName: "{{ template "pulsar.fullname" . }}-{{ .Values.toolset.component }}"
replicas: {{ .Values.toolset.replicaCount }}
updateStrategy:
type: RollingUpdate
podManagementPolicy: Parallel
selector:
matchLabels:
{{- include "pulsar.matchLabels" . | nindent 6 }}
component: {{ .Values.toolset.component }}
template:
metadata:
labels:
{{- include "pulsar.template.labels" . | nindent 8 }}
component: {{ .Values.toolset.component }}
annotations:
{{- if .Values.toolset.restartPodsOnConfigMapChange }}
checksum/config: {{ include (print $.Template.BasePath "/toolset-configmap.yaml") . | sha256sum }}
{{- end }}
{{- with .Values.toolset.annotations }}
{{ toYaml . | indent 8 }}
{{- end }}
spec:
{{- if .Values.toolset.nodeSelector }}
nodeSelector:
{{ toYaml .Values.toolset.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.toolset.tolerations }}
tolerations:
{{ toYaml .Values.toolset.tolerations | indent 8 }}
{{- end }}
{{- if .Values.toolset.topologySpreadConstraints }}
topologySpreadConstraints:
{{- toYaml .Values.toolset.topologySpreadConstraints | nindent 8 }}
{{- end }}
terminationGracePeriodSeconds: {{ .Values.toolset.gracePeriod }}
serviceAccountName: "{{ template "pulsar.fullname" . }}-{{ .Values.toolset.component }}"
{{- if .Values.toolset.initContainers }}
initContainers:
{{- toYaml .Values.toolset.initContainers | nindent 6 }}
{{- end }}
containers:
- name: "{{ template "pulsar.fullname" . }}-{{ .Values.toolset.component }}"
{{- if (and .Values.images.toolset .Values.images.toolset.repository) }}
image: "{{ template "pulsar.imageFullName" (dict "image" .Values.images.toolset "root" .) }}"
imagePullPolicy: "{{ template "pulsar.imagePullPolicy" (dict "image" .Values.images.toolset "root" .) }}"
{{- else }}
image: "{{ template "pulsar.imageFullName" (dict "image" .Values.images.broker "root" .) }}"
imagePullPolicy: "{{ template "pulsar.imagePullPolicy" (dict "image" .Values.images.broker "root" .) }}"
{{- end }}
{{- if .Values.toolset.resources }}
resources:
{{ toYaml .Values.toolset.resources | indent 10 }}
{{- end }}
command: ["sh", "-c"]
args:
- |
{{- if .Values.toolset.additionalCommand }}
{{ .Values.toolset.additionalCommand }}
{{- end }}
bin/apply-config-from-env.py conf/client.conf;
bin/apply-config-from-env.py conf/bookkeeper.conf;
{{- include "pulsar.toolset.zookeeper.tls.settings" . | nindent 10 }}
sleep 10000000000
envFrom:
- configMapRef:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.toolset.component }}"
volumeMounts:
{{- if .Values.auth.authentication.enabled }}
{{- if .Values.auth.authentication.jwt.enabled }}
- mountPath: "/pulsar/tokens"
name: client-token
readOnly: true
{{- end }}
{{- end }}
{{- if and .Values.tls.enabled (or .Values.tls.broker.enabled .Values.tls.proxy.enabled) }}
- mountPath: "/pulsar/certs/proxy-ca"
name: proxy-ca
readOnly: true
{{- end}}
{{- if .Values.toolset.extraVolumeMounts }}
{{ toYaml .Values.toolset.extraVolumeMounts | indent 8 }}
{{- end }}
{{- include "pulsar.toolset.certs.volumeMounts" . | nindent 8 }}
volumes:
{{- if .Values.auth.authentication.enabled }}
{{- if .Values.auth.authentication.jwt.enabled }}
- name: client-token
secret:
secretName: "{{ .Release.Name }}-token-{{ .Values.auth.superUsers.client }}"
items:
- key: TOKEN
path: client/token
{{- end}}
{{- end}}
{{- if and .Values.tls.enabled (or .Values.tls.broker.enabled .Values.tls.proxy.enabled) }}
- name: proxy-ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
{{- end }}
items:
- key: ca.crt
path: ca.crt
{{- end}}
{{- if .Values.toolset.extraVolumes }}
{{ toYaml .Values.toolset.extraVolumes | indent 6 }}
{{- end }}
{{- include "pulsar.toolset.certs.volumes" . | nindent 6 }}
{{- include "pulsar.imagePullSecrets" . | nindent 6}}
{{- end }}